jiebi/CodeConvo huggingface dataset:
Code change:
headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Related discussion:
text: golden-cheetah-bin: PR to mark insecure: Also reported upstream:
opencv seems like a relatively common package (with multiple versions). Maybe the maintainer could have a look?
High priority things that I think are still to be updated: Chat apps / browsers / mail clients: fluffychat (uses vendored flutter < v3.13.4, cc upstream has a commit in master which updates flutter to 3.13.4, but I don't think that's released yet. gitter (cc upstream seems unmaintained anyway, should be removed?) mautrix-whatsapp (vendored via some Go dep, cc signal-desktop-beta (cc who took care of Signal, can you maybe have a look?) threema-desktop (lib/threema/threema-web - is this even used? since we use nixpkgs electron, cc tutanota-desktop (opt/tutanota-desktop/tutanota-desktop - similar to threema-desktop, also cc
mattermost-desktop (share/mattermost-desktop/mattermost-desktop, cc
rocketchat-desktop (cc I think just needs a bump to 3.9.7 for
Yeah removing gutter seems fine
do you recommend moving FluffyChat from stable -a git commit temporarily? By the way, flutter itself seems to have a bad vendored version. Need to push out 3.13.4.
There's a mautrix-whatsapp bump here: , not sure how I can check whether this is fixed by that PR? Edit: looked into the upstream source, definitely not fixed by that PR. From what I can see mautrix-whatsapp uses libwebp in a vulnerable way. I'll try to work with upstream to get this resolved.
If cherry-picking the patch is an option it's probably less invasive, if upstream is planning a release in the next 2-3 days I think I wouldn't mind waiting too. If neither of these options apply (or if you don't mind bumping twice in rapid succession if upstream pushes a new release) going to an unstable version SGTM.
was updated and merged recently (). Would that count?
Looks like that new version contains which is a proper fix. Thanks for the pointer! Just needs backport to 23.05 now.
It was mentioned in the changelog, please read them when updating a package.
Code change:
headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Related discussion:
text: mattermost-desktop is out of date in nixpkgs. Their latest release is based on Electron 26.1.0, which is also insecure. Please get upstream to fix their security vulnerabilities. rocketchat-desktop also needs a bump in release-23.05. I've started the backport process via the master PR, please test it and let me know when it's ready to be merged. - Everything in this list that hasn't been updated by Friday 2023-09-29 00:00 UTC will be marked as insecure next weekend.
Also mentioned this on Matrix, but for posterity: SideQuest is also affected (and frequently loads untrusted content). It appears to use a bundled Electron 13, which has not received and will not receive a patch. I've e-mailed the upstream in the hopes that they can update to a newer Electron ASAP.
Using and then checking the output of by opening DevTools (Ctrl+Shift+I) : <- patched according to GH security advisory : <- patched according to GH security advisory : <- vulnerable? Tested on
Great, thanks for looking into it! Hopefully they'll roll out that update to the stable branch soon... I guess it's difficult for a small indie developer like them, it's only been 2 weeks since the fix was made available! :-)
just got updated in master so it's not in nixos-unstable yet. thanks for checking it out, I couldn't figure out a way to check the electron ver.
Thanks! I checked 0.0.30 (which is on master and 23.05 as of yesterday) and it seems to be on Electron 22.3.24. Marking as fixed
Thanks for pinning me. Just created an issue there: Because the source build failed the time I tried to package Caprine (some years ago). It's a pain to an build Electron app from source in Nixpkgs.
Regarding Mailspring there is , I will ask about their plans to move forwards
There should be a pre-release with electron 27 for armcord, will dig in tomorrow.
Currently we are not building koreader from source (see for some efforts).
Code change:
with python3Packages; buildPythonApplication rec { pname = "kitty"; <del> version = "0.34.0"; </del> <ins> version = "0.34.1"; </ins> format = "other"; src = fetchFromGitHub { owner = "kovidgoyal"; repo = "kitty"; rev = "refs/tags/v${version}"; <del> hash = "sha256-IP1CWMHiWnBSbt+78EQ6hfX2A9FDhlwt0KLthXtO4dA="; </del> <ins> hash = "sha256-r7KZcSqREILMp0F9ajeHS5sglq/o88h2t+4BgbABjOY="; </ins> }; goModules = (buildGo122Module {

Related discussion:
text: Package name: kitty Latest released version: 0.34.1 <!-- Search your package here: --- Current version on the unstable channel: 0.34.0 Current version on the stable/release channel: 0.31.0 <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- Notify maintainers <!-- If the result shows no maintainers, tag the person that last updated the package. --Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Code change:
<ins> { lib , buildGoModule , fetchFromGitHub }: buildGoModule rec { pname = "virter"; version = "0.25.0"; src = fetchFromGitHub { owner = "LINBIT"; repo = "virter"; rev = "v${version}"; hash = "sha256-NIZBaPYFFH3MG2M7rF39TW8sLVR44SA37ZU3gOPwAFU="; }; vendorHash = "sha256-cVOxRrsDdtlDSJ3WRDNk8nqt7ztz4GSRIf6FDDBxvPc="; ldflags = [ "-s" "-w" "-X github.com/LINBIT/virter/cmd.version=${version}" "-X github.com/LINBIT/virter/cmd.builddate=builtByNix" "-X github.com/LINBIT/virter/cmd.githash=builtByNix" ]; # requires network access doCheck = false; meta = { description = "A command line tool for simple creation and cloning of virtual machines based on libvirt"; homepage = "https://github.com/LINBIT/virter"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ dit7ya ]; }; } </ins>

Related discussion:
text: Project description Virter is a command line tool for simple creation and cloning of virtual machines based on libvirt Metadata homepage URL: source URL: Blogs: , license: Apache v2 platforms: Linux only written in: go Thanks a ton!
Code change:
{ LOCATE_PATH = cfg.output; }; <del> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root" </del> <ins> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)" </ins> ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component" ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";

Related discussion:
text: prints The message seems misleading as everything works as expected, even as a regular user. = { enable = true; locate = pkgs.mlocate; }; System: (NixOS: ) Nix version: () Nixpkgs version: ()
This still happens, although its a correct warning
That's surprising since it works for me without root. I only experienced issues when the wrong binary is used. If I recall correctly has higher priority and causes this. Can you check the output of or paste whatever error you get?
Sorry hit the wrong button by accident.
The warning is correct, but the wording is misleading. What it’s trying to warn you is not that will only run as , but rather that will run as . You can prevent the warning from being shown (with no other effect) by explicitly requesting that run as with .
This is warning is still confusing to me. If I'm building an index of files, I'd expect that if I run it as a non privileged user many files will not be reachable and therefore these won't end up in the locate database/index. Given the way works, I'd also expect to have one database per system, not one per user. So from this my expectation is that can only successfully index everything if run as . In other words, I'm still not sure what is the purpose or goal of the message. Is it just that the command needs to run as ? is this bad in any way? why is this special given the purpose of the tool? Is it that the fact that it runs as is in some way a security concern? Is this to clarify that despite the existence of an group (and user?) these are not actually used for indexing, or is the point something else entirely. Do other tools work in such a different way that justifies the existence of this warning for ?
mlocate’s doesn’t have a option like findutils’ does. Therefore, the NixOS module ignores when using mlocate (). It prints a warning to indicate that your expectation has been violated. The group is there so that the mlocate binary can be setgid rather than setuid . Given that mlocate is designed with an that indexes everything and a that only shows you your own files, there doesn’t seem to be much point in running mlocate’s as another user.
Code change:
{ LOCATE_PATH = cfg.output; }; <del> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root" </del> <ins> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)" </ins> ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component" ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";

Related discussion:
text: If you want that, why not switch back to findutils?
I see, in this context, the above makes sense. I actually want the full system indexing. To me has always been a synonym of , except several times faster. Thanks for the clarification!
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Could you include your commit in a pull request? I think that's a good solution and we can close this issue.
It’s been in this whole time.
My bad, I read only the latest updates and the pull request was higher up. Did a bit of noise on the pull request. It's a harmless change so I was surprised to see it sitting there for this long.
To avoid , this is needed: it's needed because it creates the group. That error happens when using: with or without: and then doing something like . But if not using the (so only using the alone) then there's no error, because the service itself uses a different package's by default, it's from package. The source: EDIT: I made some mistakes initially, you can see post history for that.
Code change:
"--enable-gc" ] ++ lib.optionals (!enableDocumentation) [ "--disable-doc-gen" <del> ] ++ lib.optionals (!atLeast24) [ # option was removed in 2.4 "--disable-init-state" </del> ] ++ lib.optionals atLeast214 [ "CXXFLAGS=-I${lib.getDev rapidcheck}/extras/gtest/include" ] ++ lib.optionals stdenv.isLinux [

Related discussion:
text: Package name: nix23 Latest released version: 2.3.17 (see ) Current version on the unstable channel: 2.3.16 Current version on the stable/release channel: 2.3.16 Notify maintainers Note for maintainers: Please tag this issue in your PR. See for context. The release script apparently doesn't upload source tarballs anymore, so 2.3.17 sources look more like the other ones. There's a bunch of expressions in that might need to be revisited.
Code change:
description = "Enterprise-class Open Source LDAP server for Linux"; license = licenses.gpl3Plus; platforms = platforms.linux; <del> knownVulnerabilities = [ "CVE-2021-3514" # https://nvd.nist.gov/vuln/detail/CVE-2021-3514 ]; </del> }; }

Related discussion:
text: Project description Upgrade 389-ds-base Apparenty its new 1.4.4.4 release is a bit different. Metadata homepage URL: source URL:
I marked this as stale due to inactivity. &rarr;
Code change:
<del> { lib, stdenvNoCC, pijul }: </del> <ins> { lib, stdenvNoCC, pijul, cacert }: </ins> lib.makeOverridable ( { url

Related discussion:
text: The pijul fetcher throws a certificate error when used, for example with the following command: Related: Steps to reproduce the behavior: fetchpijul (for example like in the command above) fails with above error Repository gets fetched successfully Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Oh my, thanks for notifying, I'll make a PR to fix that ASAP!
Code change:
fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C"; }]; }; <ins> lilacious = { email = "yuchenhe126@gmail.com"; github = "Lilacious"; githubId = 101508537; name = "Yuchen He"; }; </ins> lillycham = { email = "lillycat332@gmail.com"; github = "lillycat332";

Related discussion:
text: Project description Railway lets you look up travel information for many different railways, all without needing to navigate through different websites. Metadata homepage URL: source URL: license: gpl3 platforms: linux Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Code change:
stdenv.mkDerivation rec { name = "tsocks-${version}"; version = "1.8beta5"; src = fetchurl { url = "mirror://sourceforge/tsocks/${name}.tar.gz"; sha256 = "0ixkymiph771dcdzvssi9dr2pk1bzaw9zv85riv3xl40mzspx7c4"; }; <ins> patches = [ ./poll.patch ]; </ins> preConfigure = '' <del> export configureFlags="$configureFlags --libdir=$out/lib" </del> <ins> sed -i -e "s,/usr,"$(echo $out|sed -e "s,/,/,g")",g" tsocks substituteInPlace tsocks --replace /usr $out export configureFlags="$configureFlags --libdir=$out/lib" </ins> ''; meta = with stdenv.lib; {

Related discussion:
text: The tsocks package creates a shell script () that can be used to run a command with set to the tsocks library. However, it is hard-coded to use . It should be changed to use .
Fixed by
Code change:
<del> { mkDerivation , lib , fetchFromGitHub , qtbase , cmake , qttools , qtsvg , nix-update-script , fetchpatch , kguiaddons }: mkDerivation rec { pname = "flameshot"; version = "12.1.0"; src = fetchFromGitHub { owner = "flameshot-org"; repo = "flameshot"; rev = "v${version}"; sha256 = "sha256-omyMN8d+g1uYsEw41KmpJCwOmVWLokEfbW19vIvG79w="; }; patches = [ # https://github.com/flameshot-org/flameshot/pull/3166 (fetchpatch { name = "10-fix-wayland.patch"; url = "https://github.com/flameshot-org/flameshot/commit/5fea9144501f7024344d6f29c480b000b2dcd5a6.patch"; sha256 = "sha256-SnjVbFMDKD070vR4vGYrwLw6scZAFaQA4b+MbI+0W9E="; }) ]; passthru = { updateScript = nix-update-script { }; }; cmakeFlags = [ (lib.cmakeBool "USE_WAYLAND_CLIPBOARD" true) ]; nativeBuildInputs = [ cmake qttools qtsvg ]; buildInputs = [ qtbase kguiaddons ]; meta = with lib; { description = "Powerful yet simple to use screenshot software"; homepage = "https://github.com/flameshot-org/flameshot"; mainProgram = "flameshot"; maintainers = with maintainers; [ scode oxalica ]; license = licenses.gpl3Plus; platforms = platforms.linux ++ platforms.darwin; }; } </del>

Related discussion:
text: -Krey, make a new issue?
Sure, but I don't know if upstream even supports mutter; doesn't seem like it based on , , etc.
For context it's currently broken, but it worked with the fix in until recently, so thought it was relevant to this.
Code change:
<ins> let tests = { wayland = { pkgs, ... }: { imports = [ ./common/wayland-cage.nix ]; services.cage.program = "${pkgs.freetube}/bin/freetube"; virtualisation.memorySize = 2047; environment.variables.NIXOS_OZONE_WL = "1"; environment.variables.DISPLAY = "do not use"; }; xorg = { pkgs, ... }: { imports = [ ./common/user-account.nix ./common/x11.nix ]; virtualisation.memorySize = 2047; services.xserver.enable = true; services.xserver.displayManager.sessionCommands = '' ${pkgs.freetube}/bin/freetube ''; test-support.displayManager.auto.user = "alice"; }; }; mkTest = name: machine: import ./make-test-python.nix ({ pkgs, ... }: { inherit name; nodes = { "${name}" = machine; }; meta.maintainers = with pkgs.lib.maintainers; [ kirillrdy ]; enableOCR = true; testScript = '' start_all() machine.wait_for_unit('graphical.target') machine.wait_for_text('Your Subscription list is currently empty') machine.send_key("ctrl-r") machine.wait_for_text('Your Subscription list is currently empty') machine.screenshot("main.png") machine.send_key("ctrl-comma") machine.wait_for_text('General Settings', timeout=30) machine.screenshot("preferences.png") ''; }); in builtins.mapAttrs (k: v: mkTest k v { }) tests </ins>

Related discussion:
text: Steps to reproduce the behavior: system configuration with Freetube in it. See and for the exact same issue with Morgen. Electron version lock seems to have been introduced with . Upstream seems to be at Electron 27: . and
Maybe we could add the patches from It looks like they were waiting for a nixos user to test it and eventually gave up on us.
are you able to test ?
Looks good as far as I can tell.
fails on this branch, for whatever reason.
Code change:
meta = with lib; { description = "Markdown notes editor and manager designed for elementary OS" <del> + lib.optionalString withPantheon " - built with Contractor support"; </del> <ins> + lib.optionalString withPantheon " - built with Contractor support"; </ins> homepage = "https://github.com/Philip-Scott/Notes-up"; <del> license = licenses.gpl2; </del> <ins> license = licenses.gpl2Only; </ins> maintainers = with maintainers; [ davidak ]; platforms = platforms.linux; };

Related discussion:
text: Describe the bug To Reproduce Steps to reproduce the behavior: Expected behavior no fail Additional context it seem to be fixed upstream, but no new release it made yet Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Code change:
{ stdenv, fetchurl, pkgconfig, bc, perl, perlPackages, pam, libXext, libXScrnSaver, libX11 , libXrandr, libXmu, libXxf86vm, libXrender, libXxf86misc, libjpeg, libGLU, libGL, gtk2 <del> , libxml2, libglade, intltool, xorg, makeWrapper, gle </del> <ins> , libxml2, libglade, intltool, xorg, makeWrapper, gle, gdk-pixbuf, gdk-pixbuf-xlib </ins> , forceInstallAllHacks ? false }:

Related discussion:
text: Describe the bug xscreensaver-demo is both a way to preview individual screensavers and the frontend for configuring xscreensaver. It should be installed alongside all the other xscreensaver binaries; however, it isn't, although its man page is. To Reproduce Steps to reproduce the behavior: Expected behavior is available in . Notify maintainers (raskin) Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Code change:
s = # Generated upstream information rec { baseName="firejail"; <del> version="0.9.44.10"; </del> <ins> version="0.9.48"; </ins> name="${baseName}-${version}"; <del> hash="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; url="https://netix.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.44.10.tar.xz"; sha256="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; </del> <ins> hash="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.48.tar.xz"; sha256="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; </ins> }; buildInputs = [ which

Related discussion:
text: firejail bash . Error: cannot establish communication with the parent, exiting. . [milan ~]$ firejail --debug bash ~ Autoselecting /nix/store/fibk8jc2iwswn1q1d7aw98pcw2l3lzjf-bash-4.4-p12/bin/bash as shell Command name #bash# Attempting to find default.profile. Found default profile in /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail directory Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/default.profile Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Note: you can use --noprofile to disable default.profile DISPLAY :0, 0 Using the local network stack Parent pid , child pid Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd, UIDMIN 1000 Sanitizing /etc/group,