From 74fe65b1796de1cafe104830580d859d76e52a6c Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Sun, 8 Feb 2026 09:06:11 +0100 Subject: [PATCH 1/2] micropython: 1.26.0 -> 1.27.0 --- pkgs/by-name/mi/micropython/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mi/micropython/package.nix b/pkgs/by-name/mi/micropython/package.nix index 19eb005ba52b..22bdf0d7d156 100644 --- a/pkgs/by-name/mi/micropython/package.nix +++ b/pkgs/by-name/mi/micropython/package.nix @@ -12,13 +12,13 @@ stdenv.mkDerivation rec { pname = "micropython"; - version = "1.26.0"; + version = "1.27.0"; src = fetchFromGitHub { owner = "micropython"; repo = "micropython"; tag = "v${version}"; - hash = "sha256-T0yaTXRQFEdx6lap+S68I2RRA2kQnjbKGz+YB6okJkY="; + hash = "sha256-q1lpWEZbguH9EbDKa121C1Rro2Rjn6duVKcwj8RZtdQ="; fetchSubmodules = true; # remove unused libraries from rp2 port's SDK. we leave this and the other From 3f880d9fc723cf65e62ce3c4f3fadbafcc976c92 Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Sun, 8 Feb 2026 09:07:01 +0100 Subject: [PATCH 2/2] micropython: fix CVE-2026-1998 closes https://github.com/NixOS/nixpkgs/issues/488034 --- pkgs/by-name/mi/micropython/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/mi/micropython/package.nix b/pkgs/by-name/mi/micropython/package.nix index 22bdf0d7d156..bb7745fd2849 100644 --- a/pkgs/by-name/mi/micropython/package.nix +++ b/pkgs/by-name/mi/micropython/package.nix @@ -46,6 +46,13 @@ stdenv.mkDerivation rec { }) ./fix-cross-compilation.patch ./fix-mpy-cross-path.patch + # fix CVE-2026-1998 + # https://github.com/micropython/micropython/issues/18639 + # https://github.com/micropython/micropython/pull/18671 + (fetchpatch { + url = "https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0abd396b6.patch"; + hash = "sha256-j8xr4oqmrsYumJvyA71bx+/dg2HiUxSxdjKUR/2sclI="; + }) ]; postPatch = ''