jiebi/CodeConvo huggingface dataset:
Change:
advantage-air = callPackage ../development/python-modules/advantage-air { }; <ins> advocate = callPackage ../development/python-modules/advocate { }; </ins> aemet-opendata = callPackage ../development/python-modules/aemet-opendata { }; aenum = callPackage ../development/python-modules/aenum { };

Discussion:
, CVSSv3=9.8 (nixos-21.11) CVSSv3=9.8 (nixos-21.11) CVSSv3=8.8 (nixos-21.11) CVSSv3=6.5 (nixos-21.11) CVSSv3=6.1 (nixos-21.11) CVSSv3=5.4 (nixos-21.11) calibre-web is vulnerable to Business Logic Errors Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) Improper Access Control in Pypi calibreweb prior to 0.6.16. Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Scanned versions: nixos-21.11: . Cc
Fixed in
Change:
<ins> diff --git a/rts/posix/OSMem.c b/rts/posix/OSMem.c index 99620ee..e052a84 100644 --- a/rts/posix/OSMem.c +++ b/rts/posix/OSMem.c @@ -523,13 +523,7 @@ void osDecommitMemory(void *at, W_ size) sysErrorBelch("unable to make released memory unaccessible"); #endif -#ifdef MADV_FREE -    // Try MADV_FREE first, FreeBSD has both and MADV_DONTNEED -    // just swaps memory out -    r = madvise(at, size, MADV_FREE); -#else r = madvise(at, size, MADV_DONTNEED); -#endif if(r < 0) sysErrorBelch("unable to decommit memory"); } </ins>

Discussion:
Post merge, lots of Haskell programs print the following errors: Incidentally, it seemed that some Haskell builds were running out of memory (None left on Hydra as I restarted all of the them). There's a GHC issue mentioning this problem along with a suggested patch: should we apply?
There is some information about this issue to grab from Apparently the problem is not related to Haskell but to the version of which is fairly recent for the default nixos kernel. So if you upgrade the kernel the error should disappear. I haven't tested or try to upgrade the kernel but instead was hoping the issue would disappear with some recent nix-channel updates (the unstable channel). But so far it hasn't. I still hope for a fix to come up in a near future.
Well sorry I probably misunderstood the messages from the IRC channel. Initially this happens to me on only but it has just started to show up in another linux distro after updating the nix channel:
Also see post on nix-dev: Worked for me. Still an issue given that hydra runs on 4.4.x…
the glibc, or binutils, or hardening flags could all be causing this but using kernel 4.7 does fix it.
Personally, I'd rather configure the build with than patch the script. IMHO that's a cleaner solution. Does anyone understand the implications of this setting, i.e. does it reduce performance in any significant way etc.?
The idea is to reduce the number of system calls. With , GHC s a 1TB region of virtual memory and does its own allocations there. Disabling this feature will incur a small performance penalty when allocating. GHC has a different implementation of if it doesn't detect MADV_FREE, so I think forcibly disabling that check in the configure script is the right way to go. That way there is no performance penalty (even if it is small).
OK. Does anyone have a patch ready that accomplishes this? The patch from goes a different route which doesn't feel ideal.
Change:
] ++ lib.optionals stdenv.isDarwin [ getconf ]); in '' <del> wrapProgram $out/bin/duplicity  </del> <ins> makeWrapperArgsBak=("''${makeWrapperArgs[@]}") makeWrapperArgs+=( "''${gappsWrapperArgs[@]}" </ins> --prefix PATH : "${binPath}" <ins> ) ''; postFixup = '' # Restore previous value for tests wrapping in preInstallCheck makeWrapperArgs=("''${makeWrapperArgsBak[@]}") </ins> ''; preCheck = ''

Discussion:
Upon attempting to start the backup process, the following error is shown, resulting in the backup failing to start: Steps to reproduce the behavior: deja-dup (Backups) to create a backup Backup run properly without issues ! Similar to , but with a different Python library (Gio) Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
I have located the derivation files for both the working and non-working version. working: non-working:
Thanks for reporting. probably needs I opened , could you please test it?
The fix works!
Change:
inherit (pkgs) zstd pkgconfig; }; <del> zxcvbn-python = callPackage ../development/python-modules/zxcvbn-python { }; </del> <ins> zxcvbn = callPackage ../development/python-modules/zxcvbn { }; </ins> incremental = callPackage ../development/python-modules/incremental { };

Discussion:
Tried to update my server but it refuses to build because of flexget. Nixos Unstable flexget as service Please run and paste the results. system: host os: multi-user?: sandbox: version: channels(hyper): channels(root): nixpkgs:
flexget works for you?
r-ryantm is my bot. Anyway, it looks like it successfully built it in It looks like it was merged on May 1st, and continued to build on Hydra after May 1st: Probably some dependency change messed it up. You could do some kind of binary bisection to figure out what commit broke it, or try to track down the error message, maybe zxcvbn-python is what broke it? cc because it's python related.
I don't know what a binary disection is.
No, this is simply flexget again that pins dependencies while it shouldn't. this has happened many times before so surely you know how to solve it by now.
I don't know what binary disection is.
this happened because , and landed in nixpkgs in the . I'm going to make a PR for this
Change:
homepage = "https://github.com/GPUOpen-Drivers/AMDVLK"; changelog = "https://github.com/GPUOpen-Drivers/AMDVLK/releases/tag/v-${version}"; license = licenses.mit; <del> platforms = [ "x86_64-linux" ]; </del> <ins> platforms = [ "x86_64-linux" "i686-linux" ]; </ins> maintainers = with maintainers; [ danieldk Flakebi ]; }; }

Discussion:
Project description introduced amdvlk to nixos already, but afaict this only works with 64bit application, but since a lot of especially games are still 32bit it really would be nice to also be able to run those with amdvlk. I currently have this: In my nixos configuration to make sure that if possible amdvlk is used but also to make sure 32bit applications can still run Metadata should be the same
What would be the right way to do this with nix? The possibilities I see are: with the nix i686 toolchain (working amdvlk here: , can be used as ) A disadvantage of 2. is that it does not support lto.
Change:
<del> NPM packages =========== </del> <ins> Node.js packages =============== To add a package from [NPM](https://www.npmjs.com/) to nixpkgs: </ins> 1. Install node2nix: `nix-env -f '<nixpkgs>' -iA node2nix`. 2. Modify `pkgs/development/node-packages/node-packages.json`, to add, update, or remove package entries.

Discussion:
Right now, we have sections covering Perl, Python, Ruby, Go, and more. is another popular language and we have an easy/automated way to add new packages to nixpkgs. We should make this easier for people who don't already know how! I plan on tackling this based on instructions I received over at
cc
Some of the entries in the document have a comment like Should I enhance the in and then generate the XML file? Can anyone clue me in to how they're generated?
They are generated in (using pandoc).
Once I've it to , how can I actually generate the XML?
The XML is generated during the build. To have it in the manual you need to include it with in . The confusing part is that refers some files that exists only at build-time (the files generated by ). It is also possible to keep the build directory with to inspect the generated files.
Change:
dontWrapGApps = true; preFixup = '' qtWrapperArgs+=("''${gappsWrapperArgs[@]}") <ins> '' + lib.optionalString stdenv.isDarwin '' wrapQtApp "$out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC" </ins> ''; buildInputs = [

Discussion:
See Hydra failure: I could not find anything directly keepassxc-related in the changes on hydra from last successful to first failing build. CC Also relevant: Version bump to 2.7: A fix for this issue might give a merge conflict there in the worst case, or alleviate the build problems there in the best case.
Does keepassxc depend on Qt? We're stuck on an older Qt because of the SDK version for x86_64-darwin. I think keepassxc may require a newer SDK.
mentions QT = 5.9.5.
Current version builds just fine. There's one test failure instead: I'll see if that's fixable...
Another issue though is that somehow became wrapped so can't be loaded anymore. Which may be related to the test failure... Either way, after trying to run the app, the gui just spins with 100% CPU. The cli part works just fine though.
I came across this issue because I was investigating something else, this is because of the wrap qt apps hook which wraps all the executable files, even if it's a dynamic library. This can be fixed by removing the executable flag from the library. You might be able to resolve it with something like: In the derivation. This should be fixed in the fixup script however
Change:
let pname = "osu-lazer-bin"; version = "2023.1114.1"; <del> name = "${pname}-${version}"; osu-lazer-bin-src = { aarch64-darwin = { </del> <ins> src = { aarch64-darwin = fetchzip { </ins> url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip"; <del> sha256 = "sha256-MQkHbodSkAQQpjaBP+Q35afcCrgcie6UoUldc+vjRA0="; </del> <ins> hash = "sha256-MQkHbodSkAQQpjaBP+Q35afcCrgcie6UoUldc+vjRA0="; stripRoot = false; </ins> }; <del> x86_64-darwin = { </del> <ins> x86_64-darwin = fetchzip { </ins> url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip"; <del> sha256 = "sha256-40ylXbn9jV9v+ve1hFwhT5/jhzNfWHjL2WIplVUD2qk="; </del> <ins> hash = "sha256-40ylXbn9jV9v+ve1hFwhT5/jhzNfWHjL2WIplVUD2qk="; stripRoot = false; </ins> }; <del> x86_64-linux = { </del> <ins> x86_64-linux = fetchurl { </ins> url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage"; <del> sha256 = "sha256-Q2z2Js0Zc9nvyQNxzLuuV7TcwiNIRo+RMRER6ZYgh74="; </del> <ins> hash = "sha256-Q2z2Js0Zc9nvyQNxzLuuV7TcwiNIRo+RMRER6ZYgh74="; </ins> }; }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported."); <del> linux = appimageTools.wrapType2 rec { inherit name pname version meta; src = fetchurl (osu-lazer-bin-src); extraPkgs = pkgs: with pkgs; [ icu ]; extraInstallCommands = let contents = appimageTools.extract { inherit pname version src; }; in '' mv -v $out/bin/${pname}-${version} $out/bin/osu! install -m 444 -D ${contents}/osu!.desktop -t $out/share/applications for i in 16 32 48 64 96 128 256 512 1024; do install -D ${contents}/osu!.png $out/share/icons/hicolor/''${i}x$i/apps/osu!.png done ''; }; darwin = stdenv.mkDerivation rec { inherit name pname version meta; src = fetchzip (osu-lazer-bin-src // { stripRoot = false; }); dontBuild = true; dontFixup = true; installPhase = '' runHook preInstall APP_DIR="$out/Applications" mkdir -p "$APP_DIR" cp -r . "$APP_DIR" runHook postInstall ''; }; meta = with lib; { </del> <ins> meta = { </ins> description = "Rhythm is just a *click* away (AppImage version for score submission and multiplayer, and binary distribution for Darwin systems)"; homepage = "https://osu.ppy.sh"; <del> license = with licenses; [ </del> <ins> license = with lib.licenses; [ </ins> mit cc-by-nc-40 unfreeRedistributable # osu-framework contains libbass.so in repository ]; <del> sourceProvenance = with sourceTypes; [ binaryNativeCode ]; maintainers = with maintainers; [ delan stepbrobd spacefault ]; </del> <ins> sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; maintainers = with lib.maintainers; [ delan spacefault stepbrobd ]; </ins> mainProgram = "osu!"; platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ]; };

Discussion:
The package includes the version in the name. This means users must change name predicates (i.e. allowUnfreePredicate) for each version change. This was confirmed to be undesirable here: I guess we just forgot to remove it. CC
Change:
) { inherit app; }; }; <ins> # Extract position from explicitly passed attrs so meta.position won't point to poetry2nix internals pos = builtins.unsafeGetAttrPos (lib.elemAt (lib.attrNames attrs) 0) attrs; </ins> meta = lib.optionalAttrs (lib.hasAttr "description" pyProject.tool.poetry) { inherit (pyProject.tool.poetry) description;

Discussion:
"Source" link in search result on for Poetry package is pointing to poetry2nix source code instead of poetry. Steps to reproduce the behavior: on "Source" link in "poetry" package. This will point you to instead of When clicking on "Source" link in "poetry" package search results I want to get to "poetry" source code If applicable, add screenshots to help explain your problem. Add any other context about the problem here. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Please run and paste the result. Maintainer information:
This is really a bigger issue in how source code locations are extracted and it isn't unique to Poetry/Poetry2nix. The root cause is related to how is extracted: In this case is resolved to where Poetry2nix inherits descriptions from /. You can explicitly pass to which I just implemented in :
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Change:
<ins> { lib, rustPlatform, fetchFromGitHub, pkg-config, dbus, ffmpeg, oniguruma, openssl, sqlite, stdenv, darwin, alsa-lib, xorg, }: rustPlatform.buildRustPackage rec { pname = "screen-pipe"; version = "0.1.48"; src = fetchFromGitHub { owner = "louis030195"; repo = "screen-pipe"; rev = "v${version}"; hash = "sha256-rWKRCqWFuPO84C52mMrrS4euD6XdJU8kqZsAz28+vWE="; }; cargoLock = { lockFile = ./Cargo.lock; outputHashes = { "cpal-0.15.3" = "sha256-eKn3tS5QuqbMTwnRAEybvbPZOiKiid7ghGztAmrs9fw="; "rusty-tesseract-1.1.10" = "sha256-XT74zGn+DetEBUujHm4Soe2iorQcIoUeZbscTv+64hw="; }; }; postPatch = '' ln -s ${./Cargo.lock} Cargo.lock ''; nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ]; buildInputs = [ dbus ffmpeg oniguruma openssl sqlite ] ++ lib.optionals stdenv.isDarwin ( with darwin.apple_sdk_12_3.frameworks; [ CoreAudio AudioUnit CoreFoundation CoreGraphics CoreMedia IOKit Metal MetalPerformanceShaders Security ScreenCaptureKit SystemConfiguration ] ) ++ lib.optionals stdenv.isLinux [ alsa-lib xorg.libxcb ]; buildFeatures = lib.optional stdenv.isDarwin "metal"; env = { RUSTONIG_SYSTEM_LIBONIG = true; }; doCheck = false; # Tests fail to build meta = with lib; { description = "Personalized AI powered by what you've seen, said, or heard"; homepage = "https://github.com/louis030195/screen-pipe"; license = licenses.mit; maintainers = with maintainers; [ dit7ya ]; mainProgram = "screen-pipe"; }; } </ins>

Discussion:
Project description Library to build personalized AI powered by what you've seen, said, or heard. Works with Ollama. Alternative to Open. Secure. You own your data. Rust. Has both CLI and desktop app. Metadata homepage URL: source URL: license: mit platforms: unix, linux, darwin, windows
I am somewhat interested in this package and started a PR but I am super busy these days to thoroughly test the package. If anyone can do that, that would be awesome.
Change:
# gtk-launch --suffix PATH : "${lib.makeBinPath [ gtk3 ]}" <ins> '' + lib.optionalString (hasFeature "cairo") '' --prefix LUA_PATH : "./?.lua;${luajitPackages.lgi}/share/lua/5.1/?.lua;${luajitPackages.lgi}/share/lua/5.1/?/init.lua;${luajit}/share/lua/5.1/?.lua;${luajit}/share/lua/5.1/?/init.lua" --prefix LUA_CPATH : "./?.so;${luajitPackages.lgi}/lib/lua/5.1/?.so;${luajit}/lib/lua/5.1/?.so;${luajit}/lib/lua/5.1/loadall.so" ''; preFixup = '' gappsWrapperArgs+=( ${gappsWrapperArgs} </ins> ) '';

Discussion:
Package name: Ironbar Latest released version: 0.15.0Current version on the unstable channel: 0.14.1 Current version on the stable/release channel: 0.13.0 Notify maintainers Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Change:
paddlepaddle = callPackage ../development/python-modules/paddlepaddle { }; <ins> pcffont = callPackage ../development/python-modules/pcffont { }; </ins> pueblo = callPackage ../development/python-modules/pueblo { }; pulumi = callPackage ../development/python-modules/pulumi { inherit (pkgs) pulumi; };

Discussion:
looking over broken python packages for ZHF and pixel-font-builder is missing a python module and needs a dependency relaxed. Steps to reproduce the behavior: *pixel-font-builder" pcffont not part of nixpkgs would add it but no longer a maintainer <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Change:
configureFlags = [ "--enable-ILU" "--enable-ILUT" ]; <ins> CXXFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-register"; </ins> preConfigure = '' sed -i 's, -std=gnu99,,g' configure sed -i 's,malloc.h,stdlib.h,g' src-ILU/ilur/ilur.c

Discussion:
On MacOS Sonoma 14.4.1 on an M1 Macbook Pro, with nixpkgs pinned at , building fails when compiling : , but here's an excerpt of the failures from the command: I pin nixpkgs in the flake user registry, and reference it in my darwin configuration. Previously I had it pinned to , and on this same computer, building against that commit still works I didn't do a full bisect, but I also can verify that the following pinned commit also works: Maintainers from : Recent committers not already included: Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Technically not a build failure of ffmpeg but we should get libdevil out of the closure if it's broken.
The offending package should be a rather easy workaround via but I currently do not have access to a mac.
Apologies for mislabeling the report, and thank you for (a) correcting it, (b) the quick response. If you give me a command to run, I can help by running it and telling you if it works!
Setting in the mkDerivation call of the package should do it.
sorry, I'm not that experienced with Nix, can you share a snippet of code doing it? Do I need to do it for ffmpeg-full, or just for libdevil? Do I do this in my flake that says to install ffmpeg-full somehow? If it's easier to just fix it yourself without me, feel free to ignore. Thanks again for the quick response by merging
OK, seems to work with this overlay on :

Steps to reproduce the behavior: full log - log excerpt: This is a dependency for -also fails for me atm. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --No maintainers listed for - Last users to edit this definition: Maintainers for , which is also affected by this: Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Looks like it's been broken for months: possibly related to ?
Here's what I believe ~is a~ might be part of a fix for this issue:
BTW I'm pretty sure this is not a dependency of : I just built the latter locally on Darwin and its dependency tree does not include .
Interesting. Tbh trying to build is the only reason I found this error and submitted this bug in the first place. Any idea what the discrepancy between your and my experiences might be? E.g.: maybe it's not a dependency for your darwin version but it is for mine? are we on the same version of ? Note: I'm neither a jellyfin nor darwin nor nix expert, any suggestions are very welcome.
I'm on linux but I do see libdevil in the buildtime closure of jellyfin:
I checked with nix-tree on Darwin, and used its search function. There's no dependency on from on Darwin due to this line:
Yeah, that was yesterday in . So seems like a duplicate of this issue then.
Ah, nice
Change:
<del> diff --git a/pathnames.h b/pathnames.h index cb44caa4..354fdf05 100644 --- a/pathnames.h +++ b/pathnames.h @@ -124,7 +124,7 @@ /* Location of ssh-keysign for hostbased authentication */ #ifndef _PATH_SSH_KEY_SIGN -#define _PATH_SSH_KEY_SIGN		"/usr/libexec/ssh-keysign" +#define _PATH_SSH_KEY_SIGN		"ssh-keysign" #endif /* Location of ssh-pkcs11-helper to support keys in tokens */ diff --git a/sshconnect2.c b/sshconnect2.c index dffee90b..e9a86e59 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1879,7 +1879,7 @@ ssh_keysign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp, closefrom(sock + 1); debug3("%s: [child] pid=%ld, exec %s", __func__, (long)getpid(), _PATH_SSH_KEY_SIGN); -		execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL); +		execlp(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *)NULL); fatal("%s: exec(%s): %s", __func__, _PATH_SSH_KEY_SIGN, strerror(errno)); } -- 2.22.0 </del>

Discussion:
, CVSSv3=7.0 (nixos-21.05) CVSSv3=5.3 (nixos-21.05) sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. Scanned versions: nixos-21.05: . Cc Cc
Change:
{ x86_64-linux = fetchurl { url = "${base}/v${version}/ArmCord_${version}_amd64.deb"; <del> sha256 = "1cfbypn9kh566s09c1bvxswpc0r11pmsvxlh4dixd5s622ia3h7r"; </del> <ins> hash = "sha256-d8Xv9ecXxkUAIqCS82VKlLNne56hESYvYtSDvNvGul0="; </ins> }; aarch64-linux = fetchurl { url = "${base}/v${version}/ArmCord_${version}_arm64.deb"; <del> sha256 = "0mb6az0mzjz2zal7igigjcigg3phn2ijfw04igpl7q2rg6ha3z00"; </del> <ins> hash = "sha256-yqZ4hl+E4IEEEuKhfyDYY1Lyz5/Nekrf8uxoJr1B8w8="; </ins> }; }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

Discussion:
Package name: ArmCord Latest released version: 3.2.3 <!-- Search your package here: --- Current version on the unstable channel: 3.2.1 Current version on the stable/release channel: 3.2.0 Repository: Website: <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- Notify maintainers <!-- If the result shows no maintainers, tag the person that last updated the package. --Note for maintainers: Please tag this issue in your PR.
Change:
Be aware that these will be written to the nix store in plaintext! <ins> Mutually exclusive with <varname>pskRaw</varname>. ''; }; pskRaw = mkOption { type = types.nullOr types.str; default = null; description = '' The network's pre-shared key in hex defaulting to being a network without any authentication. Mutually exclusive with <varname>psk</varname>. </ins> ''; }; };

Discussion:
has two forms of input for the field. and . I personally use the latter as it is the output of and better than having cleartext passphrases. (This also works with a random AES key - so long that it is shared) The current implementation lacks the distinction and only works with passphrases. I believe this should be .