Skip to content

Make staging-next from cherry-picked last staging-next-26.05#534248

Merged
vcunat merged 86 commits into
NixOS:staging-nextfrom
vcunat:p/staging-next
Jun 23, 2026
Merged

Make staging-next from cherry-picked last staging-next-26.05#534248
vcunat merged 86 commits into
NixOS:staging-nextfrom
vcunat:p/staging-next

Conversation

@vcunat

@vcunat vcunat commented Jun 22, 2026

Copy link
Copy Markdown
Member

Why? We can get those security fixes pretty fast, as the whole estimated rebuild work seems to be only a fraction of the usual staging-next iteration thanks to 26.05 not diverging from master too much yet.

How? Basically cherry-picked all non-merge commits introduced during the last staging-next-26.05, with minor manual adjustments. (some were already applied, some didn't make sense to pick; basically all were cherry-picked from staging not long ago, so it wasn't lot of work)

Details:

  • rough upper bound for rebuilds was estimated by diff against current release-26.05 saying

    linux 19640, darwin 12070

  • the usual rebuild amount (taken from the last staging-next):

    linux 80727, darwin 65513

whispersofthedawn and others added 30 commits June 22, 2026 07:59
@whispersofthedawn @vcunat
expat: 2.8.0 -> 2.8.1
e866333 
Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes
Diff: libexpat/libexpat@R_2_8_0...R_2_8_1

Fixes: CVE-2026-45186
(cherry picked from commit fe1ca2c)
(cherry picked from commit d7c0b19)
@vcunat
Revert "groff: only apply the latest patch on linux for now"
412b051 
This reverts commit 37a9427.

(cherry picked from commit b2e8b0c)
(cherry picked from commit e682a0e)
@LordGrimmauld @vcunat
audit: 4.1.2-unstable-2025-09-06 -> 4.1.4
2102ac3 
Upstream diff: linux-audit/audit-userspace@cb13fe7...v4.1.4

Adds support for io_uring and syscalls of Linux 7.0 kernels.

(cherry picked from commit 2b8ed1f)
(cherry picked from commit 5aece02)
@ruuda @vcunat
libressl_4_3: init at 4.3.1
85e3036 
I also added expiration date comments on all of them, because I always
spend some time chasing what the support dates are, and it would save
maintainer time to be able to see what to do with these branches.

(cherry picked from commit feb7c9f)
(cherry picked from commit c6eddcf)
@ruuda @vcunat
libressl_4_1: delete unsupported package
fdf4fbe 
LibreSSL branches are supported for one year after the OpenBSD release
in which they are included. LibreSSL 4.1 was part of OpenBSD 7.7, which
was released on April 28, 2025, so it's end of life now.

(cherry picked from commit 0bfe3de)
(cherry picked from commit 8953025)
@ruuda @vcunat
libressl: add ruuda as maintainer
d5937f2 
I've been keeping this package up to date over the past few years, since
I run a webserver that depends on it. I'd be happy to be co-maintainer
for it, and hopefully reduce the load on others.

(cherry picked from commit 1665623)
(cherry picked from commit 6fd22cc)
@ruuda @vcunat
libressl: enable strictDeps and __structuredAttrs
7c65181 
(cherry picked from commit c74cade)
(cherry picked from commit 6fbc1e2)
@ruuda @vcunat
libressl_4_3: backport executable stack fix
c0a53e6 
And also add an additional check to preCheck that will enable us to
catch executable stack issues earlier next time.

(cherry picked from commit 5198c49)
(cherry picked from commit 4248c5f)
@Hythera @vcunat
openexr: 3.4.10 -> 3.4.11
f479a5d 
changelog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11

diff: AcademySoftwareFoundation/openexr@v3.4.10...v3.4.11
(cherry picked from commit 32f67f0)
(cherry picked from commit 34b3da5)
@Hythera @vcunat
openapv: 0.2.1.2 -> 0.2.1.3
ab6adf5 
changelog: https://github.com/AcademySoftwareFoundation/openapv/releases/tag/v0.2.1.3-fix

diff: AcademySoftwareFoundation/openapv@v0.2.1.2...v0.2.1.3-fix
(cherry picked from commit 02d2fdd)
(cherry picked from commit ce58349)
@mweinelt @vcunat
python3Packages.aiodns: 4.0.0 -> 4.0.3
49d2ce0 
https://github.com/saghul/aiodns/releases/tag/v4.0.1
https://github.com/saghul/aiodns/releases/tag/v4.0.2
https://github.com/saghul/aiodns/releases/tag/v4.0.3
(cherry picked from commit 78f51bc)
(cherry picked from commit aea1edb)
@mweinelt @vcunat
python3Packages.xmltodict: 1.0.2 -> 1.0.4
ebd0392 
https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md
(cherry picked from commit 70d339f)
(cherry picked from commit 3a75354)
@K900 @vcunat
qt5: 5.15.18 -> 5.15.19
344a637 
(cherry picked from commit 52afc5f)
(cherry picked from commit 0b9b29e)
@ElXreno @vcunat
openldap: skip flaky syncreplication tests
e717fb6 
(cherry picked from commit 63147b1)
(cherry picked from commit ab31c6a)
@aduh95 @vcunat
nodejs_24: 24.15.0 -> 24.16.0
988d5e4 
(cherry picked from commit e9b7cf2)
(cherry picked from commit 2522258)
@Scrumplex @vcunat
unbound: 1.25.0 -> 1.25.1
8861a6b 
Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
(cherry picked from commit 0c98395)
(cherry picked from commit 7195978)
@dotlambda @vcunat
python3Packages.python-multipart: 0.0.22 -> 0.0.29
dcbc584 
Diff: Kludex/python-multipart@0.0.22...0.0.29

Changelog: https://github.com/Kludex/python-multipart/blob/0.0.29/CHANGELOG.md
(cherry picked from commit 83594b9)
(cherry picked from commit 5010b8e)
@dotlambda @vcunat
python3Packages.asgi-csrf: mark broken
44573c7 
(cherry picked from commit 1355d22)
(cherry picked from commit b928e51)
@dotlambda @vcunat
python3Packages.frictionless: exclude datasette from nativeCheckInputs
5c3ae22 
Datasette depends on asgi-csrf which was broken by updating
python-multipart past version 0.0.26.

(cherry picked from commit ba2df56)
(cherry picked from commit 4316ed9)
@vcunat
gtk4: make patch unconditional
8accd65 
The condition was just to avoid rebuilds at that moment.

(cherry picked from commit ace8498)
(cherry picked from commit 2549800)
@dotlambda @vcunat
python3Packages.aiodns: 4.0.3 -> 4.0.4
8e3eb65 
Diff: aio-libs/aiodns@v4.0.3...v4.0.4

Changelog: https://github.com/saghul/aiodns/releases/tag/v4.0.4
(cherry picked from commit a53c6a3)
(cherry picked from commit 10cf133)
@K900 @vcunat
kdePackages.plasma-workspace: backport patch for Qt 6.11.1 regression
c5cd03a 
(cherry picked from commit 66adfb9)
(cherry picked from commit 7a4e664)
@K900 @vcunat
qt6: 6.11.0 -> 6.11.1
6e26421 
(cherry picked from commit 1b3320b)
(cherry picked from commit abe60ca)
@zowoq @vcunat
glibc: 2.42-61 -> 2.42-67
bbacb13 
(cherry picked from commit 4a8e839)
(cherry picked from commit e0c4423)
@nim65s @vcunat
doctest: 2.5.0 -> 2.5.2
790c683 
Diff: doctest/doctest@v2.5.0...v2.5.2

Changelog: https://github.com/doctest/doctest/releases/tag/v2.5.2
(cherry picked from commit 7bd3d8d)
(cherry picked from commit be6ec59)
@znaniye @vcunat
python3Packages.paramiko: invoke is a required dependency
8806b11 
(cherry picked from commit 9088b3d)
(cherry picked from commit f5ae9c3)
@znaniye @vcunat
duplicity: remove invoke from dependencies
5eaef15 
invoke is not a required dependency of duplicity.
It does not appear in upstream's requirements.txt nor pyproject.toml:
- https://gitlab.com/duplicity/duplicity/-/blob/dev/requirements.txt
- https://gitlab.com/duplicity/duplicity/-/blob/dev/pyproject.toml

(cherry picked from commit b6254c4)
(cherry picked from commit 747ba2d)
@trofi @vcunat
simdjson: 4.6.0 -> 4.6.4
ba90fa7 
Changes:
- https://github.com/simdjson/simdjson/releases/tag/v4.6.1
- https://github.com/simdjson/simdjson/releases/tag/v4.6.2
- https://github.com/simdjson/simdjson/releases/tag/v4.6.3
- https://github.com/simdjson/simdjson/releases/tag/v4.6.4

(cherry picked from commit 3803be5)
(cherry picked from commit c0e4b6b)
@llakala @vcunat
libass: remove libiconv dependency on darwin
8b34d58 
This is already in stdenv.

(cherry picked from commit f6172a1)
(cherry picked from commit dd411ee)
@Hythera @vcunat
assimp: 6.0.4 -> 6.0.5
9756eaf 
changelog: https://github.com/assimp/assimp/blob/master/CHANGES.md

diff: assimp/assimp@v6.0.4...v6.0.5
(cherry picked from commit b0af552)
(cherry picked from commit cfdafe6)
leona-ya and others added 5 commits June 22, 2026 08:21
@leona-ya @vcunat
rsync: fix test failure on darwin
98d05b7 
Not-cherry-picked-because: Guarded to darwin, will remove guard on staging/staging-26.05
(cherry picked from commit c10ba49)
@mdaniels5757 @vcunat
libressl: fix Darwin build
df10d00 
https://hydra.nixos.org/build/331199232
(cherry picked from commit 3b6967c)
(cherry picked from commit ffc75d7)
@mweinelt @vcunat
python3Packages.valkey: fix valkey 9.1 compat
07f0989 
(cherry picked from commit 28e20e7)
(cherry picked from commit 653b43f)
@mweinelt @vcunat
python3Packages.cnf-lint: disable failing tests
4e59517 
Bisected to 2522258.

(cherry picked from commit eb643cb)
@vcunat
python3Packages.fasthtml: 0.12.48 -> 0.13.3
5ea9077 
.starlette upgrade in 83ece5c broke compatibility:
https://hydra.nixos.org/build/331250021/nixlog/6/tail

Upstream fixes that v0.13.0 and updating past 0.13.3 would need resolving
 - fastcore>=1.12.41 not satisfied by version 1.12.39
(which isn't great approach for stable 26.05 which motivates this commit)
https://github.com/AnswerDotAI/fasthtml/releases

(cherry picked from commit 6a56b38)
(from PR NixOS#533848 )
(cherry picked from commit 18a1ef9)
@nixpkgs-ci nixpkgs-ci Bot added 8.has: package (new) This PR adds a new package 8.has: package (update) This PR updates a package to a newer version 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-linux-stdenv This PR causes stdenv to rebuild on Linux and must target a staging branch. 10.rebuild-darwin-stdenv This PR causes stdenv to rebuild on Darwin and must target a staging branch. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. 9.needs: reviewer This PR currently has no reviewers requested and needs attention. 10.rebuild-nixos-tests This PR causes rebuilds for all NixOS tests and should normally target the staging branches. 6.topic: python Python is a high-level, general-purpose programming language. 6.topic: qt/kde Object-oriented framework for GUI creation 6.topic: rust General-purpose programming language emphasizing performance, type safety, and concurrency. 6.topic: golang Go is a high-level general purpose programming language that is statically typed and compiled. 6.topic: nodejs Node.js is a free, open-source, cross-platform JavaScript runtime environment 6.topic: systemd Software suite that provides an array of system components for Linux operating systems. labels Jun 22, 2026
@vcunat vcunat added this pull request to the merge queue Jun 23, 2026
Merged via the queue into NixOS:staging-next with commit ad1fe3e Jun 23, 2026
42 checks passed
@vcunat vcunat deleted the p/staging-next branch June 23, 2026 12:20
@vcunat vcunat mentioned this pull request Jun 23, 2026
Merged
@marcin-serwin

marcin-serwin commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Was including dcc6f5d (from #525241) here intentional?

This means that icu is pinned for nodejs on master, cc @aduh95.

@vcunat

vcunat commented Jun 26, 2026

Copy link
Copy Markdown
Member Author
  • It was useful to reduce the amount of rebuilds.
  • All this gets undone in the following staging-next iteration, i.e. staging state was unchanged by this.
  • I guess it would be best to finish PR icu: advance the default to icu78 #520553 soon, so that the icu in nodejs doesn't flap back and forth. (and having it newer on stable than on unstable over longer term would weird in itself)

@GeoffreyFrogeye GeoffreyFrogeye mentioned this pull request Jun 29, 2026
Closed
4 tasks
@cvengler cvengler mentioned this pull request Jul 9, 2026
Open
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

6.topic: golang Go is a high-level general purpose programming language that is statically typed and compiled. 6.topic: nodejs Node.js is a free, open-source, cross-platform JavaScript runtime environment 6.topic: python Python is a high-level, general-purpose programming language. 6.topic: qt/kde Object-oriented framework for GUI creation 6.topic: rust General-purpose programming language emphasizing performance, type safety, and concurrency. 6.topic: systemd Software suite that provides an array of system components for Linux operating systems. 8.has: package (new) This PR adds a new package 8.has: package (update) This PR updates a package to a newer version 9.needs: reviewer This PR currently has no reviewers requested and needs attention. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. 10.rebuild-darwin-stdenv This PR causes stdenv to rebuild on Darwin and must target a staging branch. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. 10.rebuild-linux-stdenv This PR causes stdenv to rebuild on Linux and must target a staging branch. 10.rebuild-nixos-tests This PR causes rebuilds for all NixOS tests and should normally target the staging branches.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.