From 0eb3352e678932daf59cab3998a0192c36560588 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Mon, 23 Jun 2025 22:08:33 +0800 Subject: [PATCH 01/14] wechat: 4.0.5.24 -> 4.0.5.27-29258 for darwin --- pkgs/by-name/we/wechat/package.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix index f3e052d56fa8..c0f53906e2b4 100644 --- a/pkgs/by-name/we/wechat/package.nix +++ b/pkgs/by-name/we/wechat/package.nix @@ -27,11 +27,12 @@ let sources = let + # https://dldir1.qq.com/weixin/mac/mac-release.xml any-darwin = { - version = "4.0.5.24"; + version = "4.0.5.27-29258"; src = fetchurl { - url = "https://web.archive.org/web/20250608064358if_/https://dldir1v6.qq.com/weixin/Universal/Mac/WeChatMac.dmg"; - hash = "sha256-ieixBgYhZ5jU3TWCV7BXKFBidJ1bbabXBHTkrpNcGDI="; + url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_4.0.5.27_29258.dmg"; + hash = "sha256-Gje1F9rdykxTqYIJ4Pfq3zpUH3t3GKIK/QL5kt1qCVc="; }; }; in From ea13ae3056922422e18809c548e8d868f7a3b8a1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 05:51:48 +0000 Subject: [PATCH 02/14] poliedros: 1.0.1 -> 1.5.0 --- pkgs/by-name/po/poliedros/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/po/poliedros/package.nix b/pkgs/by-name/po/poliedros/package.nix index c1d36e41db39..48bb166275a2 100644 --- a/pkgs/by-name/po/poliedros/package.nix +++ b/pkgs/by-name/po/poliedros/package.nix @@ -14,7 +14,7 @@ nix-update-script, }: let - version = "1.0.1"; + version = "1.5.0"; in python3Packages.buildPythonApplication { pname = "poliedros"; @@ -25,7 +25,7 @@ python3Packages.buildPythonApplication { owner = "kriptolix"; repo = "Poliedros"; tag = "v${version}"; - hash = "sha256-1lYEsfyl6ckH1TmMLRP+flnm77INiA8ntnGVWnwpLvs="; + hash = "sha256-1itBovF5xGB8zMedtKKcQ2FJeOd5gT1COrJtwEOgdbk="; }; nativeBuildInputs = [ From d968aa8c9ed500847a17ecb2448348660da6e7ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 25 Jun 2025 12:25:28 +0200 Subject: [PATCH 03/14] nix: 2.26.3 -> 2.26.4 --- pkgs/tools/package-management/nix/default.nix | 5 +- .../patches/ghsa-g948-229j-48j3-2.26.patch | 463 ------------------ 2 files changed, 2 insertions(+), 466 deletions(-) delete mode 100644 pkgs/tools/package-management/nix/patches/ghsa-g948-229j-48j3-2.26.patch diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index b53e3f88cfd1..974532d99be4 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -175,9 +175,8 @@ lib.makeExtensible ( }; nix_2_26 = commonMeson { - version = "2.26.3"; - hash = "sha256-5ZV8YqU8mfFmoAMiUEuBqNwk0T3vUR//x1D12BiYCeY="; - patches = [ ./patches/ghsa-g948-229j-48j3-2.26.patch ]; + version = "2.26.4"; + hash = "sha256-WmGMiwwC9RLomNtpDeRoe5bqBAH84A6pLcqi1MbcQi4="; self_attribute_name = "nix_2_26"; }; diff --git a/pkgs/tools/package-management/nix/patches/ghsa-g948-229j-48j3-2.26.patch b/pkgs/tools/package-management/nix/patches/ghsa-g948-229j-48j3-2.26.patch deleted file mode 100644 index 985e7b29e53f..000000000000 --- a/pkgs/tools/package-management/nix/patches/ghsa-g948-229j-48j3-2.26.patch +++ /dev/null @@ -1,463 +0,0 @@ -From 787e012f26761e1455e711ab4ceedaa2c740621c Mon Sep 17 00:00:00 2001 -From: Eelco Dolstra -Date: Thu, 19 Jun 2025 16:20:34 +0200 -Subject: [PATCH] Fixes for GHSA-g948-229j-48j3 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Squashed commit of the following: - -commit 04fff3a637d455cbb1d75937a235950e43008db9 -Author: Eelco Dolstra -Date: Thu Jun 12 12:30:32 2025 +0200 - - Chown structured attr files safely - -commit 5417ad445e414c649d0cfc71a05661c7bf8f3ef5 -Author: Eelco Dolstra -Date: Thu Jun 12 12:14:04 2025 +0200 - - Replace 'bool sync' with an enum for clarity - - And drop writeFileAndSync(). - -commit 7ae0141f328d8e8e1094be24665789c05f974ba6 -Author: Eelco Dolstra -Date: Thu Jun 12 11:35:28 2025 +0200 - - Drop guessOrInventPathFromFD() - - No need to do hacky stuff like that when we already know the original path. - -commit 45b05098bd019da7c57cd4227a89bfd0fa65bb08 -Author: Eelco Dolstra -Date: Thu Jun 12 11:15:58 2025 +0200 - - Tweak comment - -commit 0af15b31209d1b7ec8addfae9a1a6b60d8f35848 -Author: Raito Bezarius -Date: Thu Mar 27 12:22:26 2025 +0100 - - libstore: ensure that temporary directory is always 0o000 before deletion - - In the case the deletion fails, we should ensure that the temporary - directory cannot be used for nefarious purposes. - - Change-Id: I498a2dd0999a74195d13642f44a5de1e69d46120 - Signed-off-by: Raito Bezarius - -commit 2c20fa37b15cfa03ac6a1a6a47cdb2ed66c0827e -Author: Raito Bezarius -Date: Wed Mar 26 12:42:55 2025 +0100 - - libutil: ensure that `_deletePath` does NOT use absolute paths with dirfds - - When calling `_deletePath` with a parent file descriptor, `openat` is - made effective by using relative paths to the directory file descriptor. - - To avoid the problem, the signature is changed to resist misuse with an - assert in the prologue of the function. - - Change-Id: I6b3fc766bad2afe54dc27d47d1df3873e188de96 - Signed-off-by: Raito Bezarius - -commit d3c370bbcae48bb825ce19fd0f73bb4eefd2c9ea -Author: Raito Bezarius -Date: Wed Mar 26 01:07:47 2025 +0100 - - libstore: ensure that `passAsFile` is created in the original temp dir - - This ensures that `passAsFile` data is created inside the expected - temporary build directory by `openat()` from the parent directory file - descriptor. - - This avoids a TOCTOU which is part of the attack chain of CVE-????. - - Change-Id: Ie5273446c4a19403088d0389ae8e3f473af8879a - Signed-off-by: Raito Bezarius - -commit 45d3598724f932d024ef6bc2ffb00c1bb90e6018 -Author: Raito Bezarius -Date: Wed Mar 26 01:06:03 2025 +0100 - - libutil: writeFile variant for file descriptors - - `writeFile` lose its `sync` boolean flag to make things simpler. - - A new `writeFileAndSync` function is created and all call sites are - converted to it. - - Change-Id: Ib871a5283a9c047db1e4fe48a241506e4aab9192 - Signed-off-by: Raito Bezarius - -commit 732bd9b98cabf4aaf95a01fd318923de303f9996 -Author: Raito Bezarius -Date: Wed Mar 26 01:05:34 2025 +0100 - - libstore: chown to builder variant for file descriptors - - We use it immediately for the build temporary directory. - - Change-Id: I180193c63a2b98721f5fb8e542c4e39c099bb947 - Signed-off-by: Raito Bezarius - -commit 962c65f8dcd5570dd92c72370a862c7b38942e0d -Author: Raito Bezarius -Date: Wed Mar 26 01:04:59 2025 +0100 - - libstore: open build directory as a dirfd as well - - We now keep around a proper AutoCloseFD around the temporary directory - which we plan to use for openat operations and avoiding the build - directory being swapped out while we are doing something else. - - Change-Id: I18d387b0f123ebf2d20c6405cd47ebadc5505f2a - Signed-off-by: Raito Bezarius - -commit c9b42462b75b5a37ee6564c2b53cff186c8323da -Author: Raito Bezarius -Date: Wed Mar 26 01:04:12 2025 +0100 - - libutil: guess or invent a path from file descriptors - - This is useful for certain error recovery paths (no pun intended) that - does not thread through the original path name. - - Change-Id: I2d800740cb4f9912e64c923120d3f977c58ccb7e - Signed-off-by: Raito Bezarius - -Signed-off-by: Jörg Thalheim ---- - src/libstore/local-store.cc | 6 +-- - .../unix/build/local-derivation-goal.cc | 46 ++++++++++++++---- - .../unix/build/local-derivation-goal.hh | 20 ++++++++ - src/libutil/file-content-address.cc | 2 +- - src/libutil/file-system.cc | 47 +++++++++++-------- - src/libutil/file-system.hh | 14 ++++-- - 6 files changed, 99 insertions(+), 36 deletions(-) - -diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc -index 9a7a941b6..c0c808e0a 100644 ---- a/src/libstore/local-store.cc -+++ b/src/libstore/local-store.cc -@@ -116,7 +116,7 @@ LocalStore::LocalStore( - state->stmts = std::make_unique(); - - /* Create missing state directories if they don't already exist. */ -- createDirs(realStoreDir); -+ createDirs(realStoreDir.get()); - if (readOnly) { - experimentalFeatureSettings.require(Xp::ReadOnlyLocalStore); - } else { -@@ -248,7 +248,7 @@ LocalStore::LocalStore( - else if (curSchema == 0) { /* new store */ - curSchema = nixSchemaVersion; - openDB(*state, true); -- writeFile(schemaPath, fmt("%1%", nixSchemaVersion), 0666, true); -+ writeFile(schemaPath, fmt("%1%", curSchema), 0666, FsSync::Yes); - } - - else if (curSchema < nixSchemaVersion) { -@@ -299,7 +299,7 @@ LocalStore::LocalStore( - txn.commit(); - } - -- writeFile(schemaPath, fmt("%1%", nixSchemaVersion), 0666, true); -+ writeFile(schemaPath, fmt("%1%", nixSchemaVersion), 0666, FsSync::Yes); - - lockFile(globalLock.get(), ltRead, true); - } -diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc -index 5b9bc0bb0..80309e332 100644 ---- a/src/libstore/unix/build/local-derivation-goal.cc -+++ b/src/libstore/unix/build/local-derivation-goal.cc -@@ -559,7 +559,14 @@ void LocalDerivationGoal::startBuilder() - } else { - tmpDir = topTmpDir; - } -- chownToBuilder(tmpDir); -+ -+ /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to -+ POSIX semantics.*/ -+ tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)}; -+ if (!tmpDirFd) -+ throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir); -+ -+ chownToBuilder(tmpDirFd.get(), tmpDir); - - for (auto & [outputName, status] : initialOutputs) { - /* Set scratch path we'll actually use during the build. -@@ -1157,9 +1164,7 @@ void LocalDerivationGoal::initTmpDir() - } else { - auto hash = hashString(HashAlgorithm::SHA256, i.first); - std::string fn = ".attr-" + hash.to_string(HashFormat::Nix32, false); -- Path p = tmpDir + "/" + fn; -- writeFile(p, rewriteStrings(i.second, inputRewrites)); -- chownToBuilder(p); -+ writeBuilderFile(fn, rewriteStrings(i.second, inputRewrites)); - env[i.first + "Path"] = tmpDirInSandbox + "/" + fn; - } - } -@@ -1264,11 +1269,9 @@ void LocalDerivationGoal::writeStructuredAttrs() - - auto jsonSh = writeStructuredAttrsShell(json); - -- writeFile(tmpDir + "/.attrs.sh", rewriteStrings(jsonSh, inputRewrites)); -- chownToBuilder(tmpDir + "/.attrs.sh"); -+ writeBuilderFile(".attrs.sh", rewriteStrings(jsonSh, inputRewrites)); - env["NIX_ATTRS_SH_FILE"] = tmpDirInSandbox + "/.attrs.sh"; -- writeFile(tmpDir + "/.attrs.json", rewriteStrings(json.dump(), inputRewrites)); -- chownToBuilder(tmpDir + "/.attrs.json"); -+ writeBuilderFile(".attrs.json", rewriteStrings(json.dump(), inputRewrites)); - env["NIX_ATTRS_JSON_FILE"] = tmpDirInSandbox + "/.attrs.json"; - } - } -@@ -1779,6 +1782,24 @@ void setupSeccomp() - #endif - } - -+void LocalDerivationGoal::chownToBuilder(int fd, const Path & path) -+{ -+ if (!buildUser) return; -+ if (fchown(fd, buildUser->getUID(), buildUser->getGID()) == -1) -+ throw SysError("cannot change ownership of file '%1%'", path); -+} -+ -+void LocalDerivationGoal::writeBuilderFile( -+ const std::string & name, -+ std::string_view contents) -+{ -+ auto path = std::filesystem::path(tmpDir) / name; -+ AutoCloseFD fd{openat(tmpDirFd.get(), name.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC | O_EXCL | O_NOFOLLOW, 0666)}; -+ if (!fd) -+ throw SysError("creating file %s", path); -+ writeFile(fd, path, contents); -+ chownToBuilder(fd.get(), path); -+} - - void LocalDerivationGoal::runChild() - { -@@ -3038,6 +3059,15 @@ void LocalDerivationGoal::checkOutputs(const std::mapisBuiltin()) { -diff --git a/src/libstore/unix/build/local-derivation-goal.hh b/src/libstore/unix/build/local-derivation-goal.hh -index 1ea247661..74a1e1c50 100644 ---- a/src/libstore/unix/build/local-derivation-goal.hh -+++ b/src/libstore/unix/build/local-derivation-goal.hh -@@ -37,6 +37,11 @@ struct LocalDerivationGoal : public DerivationGoal - */ - Path topTmpDir; - -+ /** -+ * The file descriptor of the temporary directory. -+ */ -+ AutoCloseFD tmpDirFd; -+ - /** - * The path of the temporary directory in the sandbox. - */ -@@ -244,9 +249,24 @@ struct LocalDerivationGoal : public DerivationGoal - - /** - * Make a file owned by the builder. -+ * -+ * SAFETY: this function is prone to TOCTOU as it receives a path and not a descriptor. -+ * It's only safe to call in a child of a directory only visible to the owner. - */ - void chownToBuilder(const Path & path); - -+ /** -+ * Make a file owned by the builder addressed by its file descriptor. -+ */ -+ void chownToBuilder(int fd, const Path & path); -+ -+ /** -+ * Create a file in `tmpDir` owned by the builder. -+ */ -+ void writeBuilderFile( -+ const std::string & name, -+ std::string_view contents); -+ - int getChildStatus() override; - - /** -diff --git a/src/libutil/file-content-address.cc b/src/libutil/file-content-address.cc -index 69301d9c8..2b6839346 100644 ---- a/src/libutil/file-content-address.cc -+++ b/src/libutil/file-content-address.cc -@@ -93,7 +93,7 @@ void restorePath( - { - switch (method) { - case FileSerialisationMethod::Flat: -- writeFile(path, source, 0666, startFsync); -+ writeFile(path, source, 0666, startFsync ? FsSync::Yes : FsSync::No); - break; - case FileSerialisationMethod::NixArchive: - restorePath(path, source, startFsync); -diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc -index 6fe93b63a..b3183f495 100644 ---- a/src/libutil/file-system.cc -+++ b/src/libutil/file-system.cc -@@ -258,7 +258,7 @@ void readFile(const Path & path, Sink & sink) - } - - --void writeFile(const Path & path, std::string_view s, mode_t mode, bool sync) -+void writeFile(const Path & path, std::string_view s, mode_t mode, FsSync sync) - { - AutoCloseFD fd = toDescriptor(open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT - // TODO -@@ -268,22 +268,29 @@ void writeFile(const Path & path, std::string_view s, mode_t mode, bool sync) - , mode)); - if (!fd) - throw SysError("opening file '%1%'", path); -+ -+ writeFile(fd, path, s, mode, sync); -+ -+ /* Close explicitly to propagate the exceptions. */ -+ fd.close(); -+} -+ -+void writeFile(AutoCloseFD & fd, const Path & origPath, std::string_view s, mode_t mode, FsSync sync) -+{ -+ assert(fd); - try { - writeFull(fd.get(), s); -+ -+ if (sync == FsSync::Yes) -+ fd.fsync(); -+ - } catch (Error & e) { -- e.addTrace({}, "writing file '%1%'", path); -+ e.addTrace({}, "writing file '%1%'", origPath); - throw; - } -- if (sync) -- fd.fsync(); -- // Explicitly close to make sure exceptions are propagated. -- fd.close(); -- if (sync) -- syncParent(path); - } - -- --void writeFile(const Path & path, Source & source, mode_t mode, bool sync) -+void writeFile(const Path & path, Source & source, mode_t mode, FsSync sync) - { - AutoCloseFD fd = toDescriptor(open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT - // TODO -@@ -307,11 +314,11 @@ void writeFile(const Path & path, Source & source, mode_t mode, bool sync) - e.addTrace({}, "writing file '%1%'", path); - throw; - } -- if (sync) -+ if (sync == FsSync::Yes) - fd.fsync(); - // Explicitly close to make sure exceptions are propagated. - fd.close(); -- if (sync) -+ if (sync == FsSync::Yes) - syncParent(path); - } - -@@ -374,7 +381,8 @@ static void _deletePath(Descriptor parentfd, const fs::path & path, uint64_t & b - #ifndef _WIN32 - checkInterrupt(); - -- std::string name(baseNameOf(path.native())); -+ std::string name(path.filename()); -+ assert(name != "." && name != ".." && !name.empty()); - - struct stat st; - if (fstatat(parentfd, name.c_str(), &st, -@@ -415,7 +423,7 @@ static void _deletePath(Descriptor parentfd, const fs::path & path, uint64_t & b - throw SysError("chmod %1%", path); - } - -- int fd = openat(parentfd, path.c_str(), O_RDONLY); -+ int fd = openat(parentfd, name.c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW); - if (fd == -1) - throw SysError("opening directory %1%", path); - AutoCloseDir dir(fdopendir(fd)); -@@ -427,7 +435,7 @@ static void _deletePath(Descriptor parentfd, const fs::path & path, uint64_t & b - checkInterrupt(); - std::string childName = dirent->d_name; - if (childName == "." || childName == "..") continue; -- _deletePath(dirfd(dir.get()), path + "/" + childName, bytesFreed); -+ _deletePath(dirfd(dir.get()), path / childName, bytesFreed); - } - if (errno) throw SysError("reading directory %1%", path); - } -@@ -445,14 +453,13 @@ static void _deletePath(Descriptor parentfd, const fs::path & path, uint64_t & b - - static void _deletePath(const fs::path & path, uint64_t & bytesFreed) - { -- Path dir = dirOf(path.string()); -- if (dir == "") -- dir = "/"; -+ assert(path.is_absolute()); -+ assert(path.parent_path() != path); - -- AutoCloseFD dirfd = toDescriptor(open(dir.c_str(), O_RDONLY)); -+ AutoCloseFD dirfd = toDescriptor(open(path.parent_path().string().c_str(), O_RDONLY)); - if (!dirfd) { - if (errno == ENOENT) return; -- throw SysError("opening directory '%1%'", path); -+ throw SysError("opening directory %s", path.parent_path()); - } - - _deletePath(dirfd.get(), path, bytesFreed); -diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh -index 204907339..b2db8869e 100644 ---- a/src/libutil/file-system.hh -+++ b/src/libutil/file-system.hh -@@ -194,21 +194,27 @@ std::string readFile(const Path & path); - std::string readFile(const std::filesystem::path & path); - void readFile(const Path & path, Sink & sink); - -+enum struct FsSync { Yes, No }; -+ - /** - * Write a string to a file. - */ --void writeFile(const Path & path, std::string_view s, mode_t mode = 0666, bool sync = false); --static inline void writeFile(const std::filesystem::path & path, std::string_view s, mode_t mode = 0666, bool sync = false) -+void writeFile(const Path & path, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No); -+ -+static inline void writeFile(const std::filesystem::path & path, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No) - { - return writeFile(path.string(), s, mode, sync); - } - --void writeFile(const Path & path, Source & source, mode_t mode = 0666, bool sync = false); --static inline void writeFile(const std::filesystem::path & path, Source & source, mode_t mode = 0666, bool sync = false) -+void writeFile(const Path & path, Source & source, mode_t mode = 0666, FsSync sync = FsSync::No); -+ -+static inline void writeFile(const std::filesystem::path & path, Source & source, mode_t mode = 0666, FsSync sync = FsSync::No) - { - return writeFile(path.string(), source, mode, sync); - } - -+void writeFile(AutoCloseFD & fd, const Path & origPath, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No); -+ - /** - * Flush a path's parent directory to disk. - */ --- -2.49.0 - From 790b9d5b16b17c16d90e023b47ed3ca425fae159 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 13:43:12 +0000 Subject: [PATCH 04/14] kitex: 0.14.0 -> 0.14.1 --- pkgs/by-name/ki/kitex/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ki/kitex/package.nix b/pkgs/by-name/ki/kitex/package.nix index 7a4c7bd3c715..057a74a850eb 100644 --- a/pkgs/by-name/ki/kitex/package.nix +++ b/pkgs/by-name/ki/kitex/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "kitex"; - version = "0.14.0"; + version = "0.14.1"; src = fetchFromGitHub { owner = "cloudwego"; repo = "kitex"; tag = "v${finalAttrs.version}"; - hash = "sha256-I5jXSrhpEkTuBfKJCHlGk5nKeW4pVujEscB0Lb3MdbM="; + hash = "sha256-gjkEUiGt42ZXSriu7awZxSRl8fPnbLiqCjqbe1Yjcu8="; }; - vendorHash = "sha256-nTwS5QeTmWfMVEcvsgyx4XbGG5Nk0dzAjXBtvJdpR9c="; + vendorHash = "sha256-UlwaMPLo+gyDlncLvGnr0ec8sDfBa1xzVSSfXBAgngM="; subPackages = [ "tool/cmd/kitex" ]; From 57da44f579d6997d06c13b12b7ad8b79a6f4959e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 13:53:47 +0000 Subject: [PATCH 05/14] nhost-cli: 1.29.8 -> 1.29.9 --- pkgs/by-name/nh/nhost-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix index e8976bc0c872..25037454fcae 100644 --- a/pkgs/by-name/nh/nhost-cli/package.nix +++ b/pkgs/by-name/nh/nhost-cli/package.nix @@ -6,13 +6,13 @@ buildGoModule rec { pname = "nhost-cli"; - version = "1.29.8"; + version = "1.29.9"; src = fetchFromGitHub { owner = "nhost"; repo = "cli"; tag = "v${version}"; - hash = "sha256-y+I0BN41WsiUTg//7PMEi24esYsldpmk0/hGtjs8kdA="; + hash = "sha256-9UxB/tshTwMg4K7K0Fs1Ld96ET6Drg77GJgONj4cRmM="; }; vendorHash = null; From 2fb304914e7ad2f3ca4e384c1b4324ecfd752b1d Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 25 Jun 2025 17:07:06 +0200 Subject: [PATCH 06/14] vieb: drop Vieb is an electron browser which are unsafe be design due to lack of proper sandboxing. Also, it has no commiter among its maintainers, which [is required](https://github.com/NixOS/nixpkgs/tree/master/pkgs#quick-start-to-adding-a-package). --- pkgs/by-name/vi/vieb/package.nix | 79 -------------------------------- pkgs/top-level/aliases.nix | 1 + 2 files changed, 1 insertion(+), 79 deletions(-) delete mode 100644 pkgs/by-name/vi/vieb/package.nix diff --git a/pkgs/by-name/vi/vieb/package.nix b/pkgs/by-name/vi/vieb/package.nix deleted file mode 100644 index a68bd332c639..000000000000 --- a/pkgs/by-name/vi/vieb/package.nix +++ /dev/null @@ -1,79 +0,0 @@ -{ - stdenv, - buildNpmPackage, - fetchFromGitHub, - electron, - makeWrapper, - python3, - makeDesktopItem, - lib, -}: - -buildNpmPackage rec { - pname = "vieb"; - version = "12.3.0"; - - src = fetchFromGitHub { - owner = "Jelmerro"; - repo = "vieb"; - rev = version; - hash = "sha256-g3L+bzsDP3vfTaroqCWzRDymFTZE+6nLytRWzPMBoX8="; - }; - - postPatch = '' - sed -i '/"electron"/d' package.json - ''; - - npmDepsHash = "sha256-0V2fKdfqO64DLqLGz1OK9BZEbwGDqPFUdxu9F6v6Ms4="; - makeCacheWritable = true; - dontNpmBuild = true; - env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1; - - nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.hostPlatform.isAarch64 python3; - - desktopItem = makeDesktopItem { - name = "vieb"; - exec = "vieb %U"; - icon = "vieb"; - desktopName = "Web Browser"; - genericName = "Web Browser"; - categories = [ - "Network" - "WebBrowser" - ]; - mimeTypes = [ - "text/html" - "application/xhtml+xml" - "x-scheme-handler/http" - "x-scheme-handler/https" - ]; - }; - - postInstall = '' - install -Dm0644 {${desktopItem},$out}/share/applications/vieb.desktop - - pushd $out/lib/node_modules/vieb/app/img/icons - for file in *.png; do - install -Dm0644 $file $out/share/icons/hicolor/''${file//.png}/apps/vieb.png - done - popd - - makeWrapper ${electron}/bin/electron $out/bin/vieb \ - --add-flags $out/lib/node_modules/vieb/app \ - --set npm_package_version ${version} - ''; - - distPhase = ":"; # disable useless $out/tarballs directory - - meta = { - homepage = "https://vieb.dev/"; - changelog = "https://github.com/Jelmerro/Vieb/releases/tag/${version}"; - description = "Vim Inspired Electron Browser"; - mainProgram = "vieb"; - maintainers = with lib.maintainers; [ - tejing - ]; - platforms = lib.platforms.unix; - license = lib.licenses.gpl3Plus; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index cbd388f1cc92..0fa449add083 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2050,6 +2050,7 @@ mapAliases { ventoy-bin = ventoy; # Added 2023-04-12 ventoy-bin-full = ventoy-full; # Added 2023-04-12 verilog = iverilog; # Added 2024-07-12 + vieb = throw "'vieb' has been removed as it doesn't satisfy our security criteria for browsers."; # Added 2025-06-25 ViennaRNA = viennarna; # Added 2023-08-23 vimHugeX = vim-full; # Added 2022-12-04 vim_configurable = vim-full; # Added 2022-12-04 From 3bb1754d41436cab99d60c3ba887bb2f390c273d Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 25 Jun 2025 17:16:26 +0200 Subject: [PATCH 07/14] catalyst-browser: drop catalyst is electron browser which are unsafe be design due to lack of proper sandboxing. The package also seems unmaintained upstream. Updates were not backported too, which is not accaptable for a browser. Also, it has no commiter among its maintainers, which [is required](https://github.com/NixOS/nixpkgs/tree/master/pkgs#quick-start-to-adding-a-package). --- pkgs/by-name/ca/catalyst-browser/package.nix | 85 -------------------- pkgs/top-level/aliases.nix | 1 + 2 files changed, 1 insertion(+), 85 deletions(-) delete mode 100644 pkgs/by-name/ca/catalyst-browser/package.nix diff --git a/pkgs/by-name/ca/catalyst-browser/package.nix b/pkgs/by-name/ca/catalyst-browser/package.nix deleted file mode 100644 index 97c53a44a57c..000000000000 --- a/pkgs/by-name/ca/catalyst-browser/package.nix +++ /dev/null @@ -1,85 +0,0 @@ -{ - stdenv, - lib, - fetchurl, - appimageTools, - makeWrapper, - electron_33, - electronPackage ? electron_33, - asar, -}: - -let - electron = electronPackage; -in -stdenv.mkDerivation rec { - pname = "catalyst-browser"; - version = "3.9.6"; - - src = fetchurl { - url = "https://github.com/CatalystDevOrg/Catalyst/releases/download/v${version}/catalyst-${version}.AppImage"; - hash = "sha256-aqEwVykPt6p3HjDAsr7N/+uHnEK5yTUAgCsaT7OmI0w="; - name = "catalyst-${version}.AppImage"; - }; - - appimageContents = appimageTools.extractType2 { - inherit pname src version; - }; - - dontUnpack = true; - dontConfigure = true; - dontBuild = true; - - nativeBuildInputs = [ - makeWrapper - asar - ]; - - installPhase = '' - runHook preInstall - - mkdir -p $out/bin $out/share/catalyst $out/share/applications - mkdir -p $out/share/catalyst/resources/ - - cp -a ${appimageContents}/locales $out/share/catalyst - cp -a ${appimageContents}/catalyst.desktop $out/share/applications/catalyst.desktop - mkdir -p $out/share/pixmaps - cp -r ${appimageContents}/usr/share/icons/hicolor/1080x1080/apps/catalyst.png $out/share/pixmaps/ - asar extract ${appimageContents}/resources/app.asar resources/ - rm -rf resources/.github - rm -rf resources/.vscode - rm -rf resources/.eslintrc.json - rm -rf resources/.gitignore - rm -rf resources/.pnpm-debug.log - rm -rf resources/contributing.md - rm -rf resources/pnpm-lock.yaml - rm -rf resources/README.md - rm -rf resources/CODE_OF_CONDUCT.md - rm -rf *.nix - substituteInPlace resources/src/index.html \ - --replace-fail 'catalyst-default-distrib' 'catalyst-default-nixpkgs' - - substituteInPlace $out/share/applications/catalyst.desktop \ - --replace-fail 'Exec=AppRun' 'Exec=${meta.mainProgram}' - - asar pack resources/ $out/share/catalyst/resources/app.asar - - runHook postInstall - ''; - - postFixup = '' - makeWrapper ${electron}/bin/electron $out/bin/${meta.mainProgram} \ - --add-flags $out/share/catalyst/resources/app.asar \ - --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}" - ''; - - meta = { - description = "Minimal, functional, and customizable user-focused FOSS web browser based on Chromium"; - homepage = "https://getcatalyst.eu.org"; - license = lib.licenses.mit; - mainProgram = "catalyst"; - maintainers = with lib.maintainers; [ jdev082 ]; - platforms = [ "x86_64-linux" ]; - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index cbd388f1cc92..756dfcdcb567 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -412,6 +412,7 @@ mapAliases { cassandra_3_0 = throw "'cassandra_3_0' has been removed has it reached end-of-life"; # Added 2025-03-23 cassandra_3_11 = throw "'cassandra_3_11' has been removed has it reached end-of-life"; # Added 2025-03-23 cawbird = throw "cawbird has been abandoned upstream and is broken anyways due to Twitter closing its API"; + catalyst-browser = throw "'catalyst-browser' has been removed due to a lack of maintenance and not satisfying our security criteria for browsers."; # Added 2025-06-25 cde = throw "'cde' has been removed as it is unmaintained and broken"; # Added 2025-05-17 centerim = throw "centerim has been removed due to upstream disappearing"; # Added 2025-04-18 certmgr-selfsigned = certmgr; # Added 2023-11-30 From 1c57ff7b201d9bcb2e82f4b8ec8acc64298dce3a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 16:39:52 +0000 Subject: [PATCH 08/14] matrix-commander-rs: 0.10.1 -> 1.0.0 --- pkgs/by-name/ma/matrix-commander-rs/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ma/matrix-commander-rs/package.nix b/pkgs/by-name/ma/matrix-commander-rs/package.nix index 2f5cc53ee0aa..cc6b29b2e38c 100644 --- a/pkgs/by-name/ma/matrix-commander-rs/package.nix +++ b/pkgs/by-name/ma/matrix-commander-rs/package.nix @@ -9,17 +9,17 @@ rustPlatform.buildRustPackage rec { pname = "matrix-commander-rs"; - version = "0.10.1"; + version = "1.0.0"; src = fetchFromGitHub { owner = "8go"; repo = "matrix-commander-rs"; tag = "v${version}"; - hash = "sha256-ljRFZYfTSyiIVgABgQAVLlwhOmeMumAyZe9tASPtMZA="; + hash = "sha256-CvsMRxB5s891cVu03RroTQYOGA6rmhpif8VT0njXTnc="; }; useFetchCargoVendor = true; - cargoHash = "sha256-BMVxxCOAznAsqKUgGHJ9hPgdIksCyzMVUHeLa+om09U="; + cargoHash = "sha256-hzWq09qJTox8yZuMOQ1///hKxY4EsWn/mHKy3svxlF8="; nativeBuildInputs = [ pkg-config From ecd753598008dbc4997d89bea47d6142f654fc93 Mon Sep 17 00:00:00 2001 From: Amadej Kastelic Date: Wed, 25 Jun 2025 18:57:37 +0200 Subject: [PATCH 09/14] deepin-anything: 6.1.9 -> 6.2.10 --- pkgs/desktops/deepin/tools/deepin-anything/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/desktops/deepin/tools/deepin-anything/default.nix b/pkgs/desktops/deepin/tools/deepin-anything/default.nix index 80e719686f0c..0e0bdb7ffa4e 100644 --- a/pkgs/desktops/deepin/tools/deepin-anything/default.nix +++ b/pkgs/desktops/deepin/tools/deepin-anything/default.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation rec { pname = "deepin-anything"; - version = "6.1.9"; + version = "6.2.10"; src = fetchFromGitHub { owner = "linuxdeepin"; repo = "deepin-anything"; rev = version; - hash = "sha256-OYPsUXMjuU6gG+EzyYl640+2/59n8D5V906CVGwn6Bo="; + hash = "sha256-eGel+pLAYHYkPXQxzTz+lMPSlgNiDFAev2bzGjj4ZFw="; }; postPatch = '' @@ -41,6 +41,7 @@ stdenv.mkDerivation rec { udisks2-qt5 util-linux libnl + libsForQt5.polkit-qt glib pcre ]; From dd919920b98c973b904628c6c3bf57a9fcfca596 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 17:43:46 +0000 Subject: [PATCH 10/14] txtpbfmt: 0-unstable-2025-03-26 -> 0-unstable-2025-06-25 --- pkgs/by-name/tx/txtpbfmt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/tx/txtpbfmt/package.nix b/pkgs/by-name/tx/txtpbfmt/package.nix index 2ef1368bc4ed..95a5b3d7b048 100644 --- a/pkgs/by-name/tx/txtpbfmt/package.nix +++ b/pkgs/by-name/tx/txtpbfmt/package.nix @@ -7,13 +7,13 @@ buildGoModule { pname = "txtpbfmt"; - version = "0-unstable-2025-03-26"; + version = "0-unstable-2025-06-25"; src = fetchFromGitHub { owner = "protocolbuffers"; repo = "txtpbfmt"; - rev = "a5fe55684d52b017a494471a2a08264d778166ad"; - hash = "sha256-e8tDQOr6CtGjVhhiPjSG14adrqi5geBitD1SnqL6Tx8="; + rev = "c917e9664b93f5f7ba1890e9fe9db7390758f0e6"; + hash = "sha256-iyzKPGoKid6gz6eaINpAcV7gYkwiiRY9bjjFYIinGjw="; }; vendorHash = "sha256-iWY0b6PAw9BhA8WrTEECnVAKWTGXuIiGvOi9uhJO4PI="; From 41bf5b8bc52056f2aa7c2dbde2af668482000069 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 18:06:22 +0000 Subject: [PATCH 11/14] drupal: 11.1.7 -> 11.2.1 --- pkgs/by-name/dr/drupal/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix index 057c67f3afc3..5ee358e3148e 100644 --- a/pkgs/by-name/dr/drupal/package.nix +++ b/pkgs/by-name/dr/drupal/package.nix @@ -7,17 +7,17 @@ php.buildComposerProject2 (finalAttrs: { pname = "drupal"; - version = "11.1.7"; + version = "11.2.1"; src = fetchFromGitLab { domain = "git.drupalcode.org"; owner = "project"; repo = "drupal"; tag = finalAttrs.version; - hash = "sha256-jf28r44VDP9MzShoJMFD+6xSUcKBRGYJ1/ruQ3nGTRE="; + hash = "sha256-GlQvgI3dmRSHtNky0ZL4Y4VWIaUrO+EjPwnkkF9DJDQ="; }; - vendorHash = "sha256-LUZTf/Zn8p+V2K1LjhvrgaGBiTcSmGRsG1t9vXUcbeY="; + vendorHash = "sha256-2XqYxuIlnXzyvOYtY67H1hOuuFjApi0H5VV74j/RJzI="; composerNoPlugins = false; passthru = { From 89532e50950c39d07bc6aa6179d292a3361cb935 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 18:48:39 +0000 Subject: [PATCH 12/14] vault: 1.19.5 -> 1.20.0 --- pkgs/by-name/va/vault/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/va/vault/package.nix b/pkgs/by-name/va/vault/package.nix index 03e333ae062b..ad3f4ff81bd3 100644 --- a/pkgs/by-name/va/vault/package.nix +++ b/pkgs/by-name/va/vault/package.nix @@ -12,16 +12,16 @@ buildGoModule rec { pname = "vault"; - version = "1.19.5"; + version = "1.20.0"; src = fetchFromGitHub { owner = "hashicorp"; repo = "vault"; rev = "v${version}"; - hash = "sha256-pj9aaEpXEmBBjJOqdvD2bYip5gg3pUob7gmV8rbhnuo="; + hash = "sha256-2583vthe9x2WylLOMJFDBswqT3cF7euHyVc05V887B4="; }; - vendorHash = "sha256-tOGB9psxlgC+h/uJd93tkpDYzi/xIZ25rDMQ4LnX9Pg="; + vendorHash = "sha256-re1GZ+B1dKKLrKt8lj0fUuBkcUY/B38Y4o7yJIN7sts="; proxyVendor = true; From 06dbf3056d799d1fc5467dd8b6bd0489948ac67c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 26 Jun 2025 00:36:48 +0000 Subject: [PATCH 13/14] blis: 1.1 -> 2.0 --- pkgs/by-name/bl/blis/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bl/blis/package.nix b/pkgs/by-name/bl/blis/package.nix index 4e69653da83b..753ae5adf61a 100644 --- a/pkgs/by-name/bl/blis/package.nix +++ b/pkgs/by-name/bl/blis/package.nix @@ -20,13 +20,13 @@ let in stdenv.mkDerivation rec { pname = "blis"; - version = "1.1"; + version = "2.0"; src = fetchFromGitHub { owner = "flame"; repo = "blis"; rev = version; - sha256 = "sha256-joOTyHT87PelKNhL9+1lLqMz22WsENa+Rom41grBb0Y="; + sha256 = "sha256-+n8SbiiEJDN4j1IPmZfI5g1i2J+jWrUXh7S48JEDTAE="; }; inherit blas64; From 322d8a3c6940039f7cff179a8b09c5d7ca06359d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Jun 2025 23:25:49 +0000 Subject: [PATCH 14/14] telegraf: 1.35.0 -> 1.35.1 --- pkgs/by-name/te/telegraf/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix index dc609c2f012f..48af298648ea 100644 --- a/pkgs/by-name/te/telegraf/package.nix +++ b/pkgs/by-name/te/telegraf/package.nix @@ -10,7 +10,7 @@ buildGoModule rec { pname = "telegraf"; - version = "1.35.0"; + version = "1.35.1"; subPackages = [ "cmd/telegraf" ]; @@ -18,10 +18,10 @@ buildGoModule rec { owner = "influxdata"; repo = "telegraf"; rev = "v${version}"; - hash = "sha256-lBD+GzFlm1CRfOQORYCDndNvObzxkkCijsGu2YsagYI="; + hash = "sha256-vdn/c3EVtGnCh750IqjMjRxeW2Zimn8PazREL9KZX2Y="; }; - vendorHash = "sha256-RVpw94W8rrJSIsFmZRSo29h6ZN9xzYBqbGs46ZIwzKc="; + vendorHash = "sha256-W5Ng7IH4WKq1v1PfO1Wi3eBDonITcIuJzJTmtHPnCmg="; proxyVendor = true; ldflags = [