NixOS · Jun 9, 2020 · Jun 10, 2020 · Jun 10, 2020 · Jun 11, 2020 · Jun 11, 2020
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
@@ -50,13 +50,13 @@ let
   inherit (python2Packages) pygtk wrapPython python;
 in stdenv.mkDerivation rec {
   pname = "gimp";
-  version = "2.10.18";
+  version = "2.10.20";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "05np26g61fyr72s7qjfrcck8v57r0yswq5ihvqyzvgzfx08y3gv5";
+    sha256 = "4S+fh0saAHxCd7YKqB4LZzML5+YVPldJ6tg5uQL8ezw=";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/applications/misc/gitit/default.nix b/pkgs/applications/misc/gitit/default.nix
@@ -0,0 +1,61 @@
+{ lib, haskellPackages, haskell, removeReferencesTo
+# “Plugins” are a fancy way of saying gitit will invoke
+# GHC at *runtime*, which in turn makes it pull GHC
+# into its runtime closure. Only enable if you really need
+# that feature. But if you do you’ll want to use gitit
+# as a library anyway.
+, pluginSupport ? false
+}:
+
+# this is similar to what we do with the pandoc executable
+
+let
+  plain = haskellPackages.gitit;
+  plugins =
+    if pluginSupport
+    then plain
+    else haskell.lib.disableCabalFlag plain "plugins";
+  static = haskell.lib.justStaticExecutables plugins;
+
+in
+  (haskell.lib.overrideCabal static (drv: {
+    buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
+  })).overrideAttrs (drv: {
+
+    # These libraries are still referenced, because they generate
+    # a `Paths_*` module for figuring out their version.
+    # The `Paths_*` module is generated by Cabal, and contains the
+    # version, but also paths to e.g. the data directories, which
+    # lead to a transitive runtime dependency on the whole GHC distribution.
+    # This should ideally be fixed in haskellPackages (or even Cabal),
+    # but a minimal gitit is important enough to patch it manually.
+    disallowedReferences = [
+      haskellPackages.pandoc-types
+      haskellPackages.HTTP
+      haskellPackages.pandoc
+      haskellPackages.happstack-server
+      haskellPackages.filestore
+    ];
+    postInstall = ''
+      remove-references-to \
+        -t ${haskellPackages.pandoc-types} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.HTTP} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.pandoc} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.happstack-server} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.filestore} \
+        $out/bin/gitit
+    '';
+
+    meta = drv.meta // {
+      maintainers = drv.meta.maintainers or []
+        ++ [ lib.maintainers.Profpatsch ];
+    };
+  })
diff --git a/pkgs/applications/networking/mpop/default.nix b/pkgs/applications/networking/mpop/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mpop";
-  version = "1.4.9";
+  version = "1.4.10";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "0hinmyd4lipy9wi3grwm72vv6xrpf4m08i9g9nlxzxnwfanw885q";
+    sha256 = "1243hazpiwgvz2m3p48cdh0yw1019i6xjxgc7qyhmxcdy0inb6wy";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/desktops/gnome-3/apps/polari/default.nix b/pkgs/desktops/gnome-3/apps/polari/default.nix
@@ -5,13 +5,13 @@
 
 let
   pname = "polari";
-  version = "3.36.2";
+  version = "3.36.3";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "12i0gp2kwp0b7af135q32qygkhh2025f74dqbaylfbmzacbdpz5c";
+    sha256 = "0fpmrvhd40yay051bzn4x3gsrzdv42nav0pm5ps0np8wk1z689jg";
   };
 
   patches = [

diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -66,7 +66,8 @@ let
   #######################################################################
     # sha256 of released mathcomp versions
     sha256 = {
-      "1.11.0+beta1" = "12i3zznwajlihzpqsiqniv20rklj8d8401lhd241xy4s21fxkkjm";
+      "1.11.0"       = "06a71d196wd5k4wg7khwqb7j7ifr7garhwkd54s86i0j7d6nhl3c";
+      "1.11+beta1"   = "12i3zznwajlihzpqsiqniv20rklj8d8401lhd241xy4s21fxkkjm";
       "1.10.0"       = "1b9m6pwxxyivw7rgx82gn5kmgv2mfv3h3y0mmjcjfypi8ydkrlbv";
       "1.9.0"        = "0lid9zaazdi3d38l8042lczb02pw5m9wq0yysiilx891hgq2p81r";
       "1.8.0"        = "07l40is389ih8bi525gpqs3qp4yb2kl11r9c8ynk1ifpjzpnabwp";
@@ -75,7 +76,8 @@ let
     };
     # versions of coq compatible with released mathcomp versions
     coq-versions     = {
-      "1.11.0+beta1" = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
+      "1.11.0"       = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
+      "1.11+beta1"   = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
       "1.10.0"       = flip elem [ "8.7" "8.8" "8.9" "8.10" "8.11" ];
       "1.9.0"        = flip elem [ "8.7" "8.8" "8.9" "8.10" ];
       "1.8.0"        = flip elem [ "8.7" "8.8" "8.9" ];
@@ -94,7 +96,7 @@ let
     # mathcomp preferred versions by decreasing order
     # (the first version in the list will be tried first)
     version-preferences =
-      [ "1.10.0" "1.9.0" "1.11.0+beta1" "1.8.0" "1.7.0" "1.6.1" ];
+      [ "1.10.0" "1.11.0" "1.9.0" "1.8.0" "1.7.0" "1.6.1" ];
 
     # list of core mathcomp packages sorted by dependency order
     packages = _version: # unused in current versions of mathcomp

diff --git a/pkgs/development/coq-modules/mathcomp/extra.nix b/pkgs/development/coq-modules/mathcomp/extra.nix
@@ -112,7 +112,7 @@ let
 
       mathcomp-analysis = {version, coqPackages}: {
         propagatedBuildInputs = with coqPackages;
-          [ mathcomp.field mathcomp-finmap mathcomp-bigenough ];
+          [ mathcomp.field mathcomp-finmap mathcomp-bigenough mathcomp-real-closed ];
         meta = {
           description = "Analysis library compatible with Mathematical Components";
           homepage = "https://github.com/math-comp/analysis";
@@ -168,12 +168,15 @@ let
         "1.0.0" = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
       };
       mathcomp-analysis = {
+        "0.3.1" = "1iad288yvrjv8ahl9v18vfblgqb1l5z6ax644w49w9hwxs93f2k8";
+        "0.3.0" = "03klwi4fja0cqb4myp3kgycfbmdv00bznmxf8yg3zzzzw997hjqc";
         "0.2.3" = "0p9mr8g1qma6h10qf7014dv98ln90dfkwn76ynagpww7qap8s966";
         "0.2.2" = "1d5dwg9di2ppdzfg21zr0a691zigb5kz0lcw263jpyli1nrq7cvk";
         "0.2.0" = "1186xjxgns4ns1szyi931964bjm0mp126qzlv10mkqqgfw07nhrd";
         "0.1.0" = "0hwkr2wzy710pcyh274fcarzdx8sv8myp16pv0vq5978nmih46al";
       };
       multinomials = {
+        "1.5.2" = "15aspf3jfykp1xgsxf8knqkxv8aav2p39c2fyirw7pwsfbsv2c4s";
         "1.5.1" = "13nlfm2wqripaq671gakz5mn4r0xwm0646araxv0nh455p9ndjs3";
         "1.5"   = "064rvc0x5g7y1a0nip6ic91vzmq52alf6in2bc2dmss6dmzv90hw";
         "1.4"   = "0vnkirs8iqsv8s59yx1fvg1nkwnzydl42z3scya1xp1b48qkgn0p";
@@ -183,13 +186,16 @@ let
         "1.0"   = "1qmbxp1h81cy3imh627pznmng0kvv37k4hrwi2faa101s6bcx55m";
       };
       mathcomp-real-closed = {
+        "1.1.1" = "0ksjscrgq1i79vys4zrmgvzy2y4ylxa8wdsf4kih63apw6v5ws6b";
+        "1.1.0" = "0zgfmrlximw77bw5w6w0xg2nampp02pmrwnrzx8m1n5pqljnv8fh";
         "1.0.5" = "0q8nkxr9fba4naylr5xk7hfxsqzq2pvwlg1j0xxlhlgr3fmlavg2";
         "1.0.4" = "058v9dj973h9kfhqmvcy9a6xhhxzljr90cf99hdfcdx68fi2ha1b";
         "1.0.3" = "1xbzkzqgw5p42dx1liy6wy8lzdk39zwd6j14fwvv5735k660z7yb";
         "1.0.2" = "0097pafwlmzd0gyfs31bxpi1ih04i72nxhn99r93aj20mn7mcsgl";
         "1.0.1" = "0j81gkjbza5vg89v4n9z598mfdbql416963rj4b8fzm7dp2r4rxg";
       };
       coqeal = {
+        "1.0.4" = "1g5m26lr2lwxh6ld2gykailhay4d0ayql4bfh0aiwqpmmczmxipk";
         "1.0.3" = "0hc63ny7phzbihy8l7wxjvn3haxx8jfnhi91iw8hkq8n29i23v24";
         "1.0.2" = "1brmf3gj03iky1bcl3g9vx8vknny7xfvs0y2rfr85am0296sxsfj";
         "1.0.1" = "19jhdrv2yp9ww0h8q73ihb2w1z3glz4waf2d2n45klafxckxi7bm";
@@ -201,13 +207,21 @@ let
     # CONSISTENT sets of packages. #
     ################################
     for-coq-and-mc = let
+      v6 = {
+        mathcomp-finmap       = "1.5.0";
+        mathcomp-bigenough    = "1.0.0";
+        mathcomp-analysis     = "0.3.1";
+        multinomials          = "1.5.2";
+        mathcomp-real-closed  = "1.1.1";
+        coqeal                = "1.0.4";
+      };
       v5 = {
         mathcomp-finmap       = "1.5.0";
         mathcomp-bigenough    = "1.0.0";
-        mathcomp-analysis     = "678d3cc37f5f3c71b1bd550836eb44e3ba2a5459";
-        multinomials           = "1.5.1";
+        mathcomp-analysis     = "0.3.0";
+        multinomials          = "1.5.1";
         mathcomp-real-closed  = "1.0.5";
-        coqeal                = "CohenCyril/bdfc96771644b082e41268edc43d61dc5fda2358";
+        coqeal                = "1.0.4";
       };
       v4 = v3 // { coqeal = "1.0.3"; };
       v3 = {
@@ -236,29 +250,34 @@ let
     in
       {
         "8.11" = {
-          "1.11.0+beta1" = v5;
+          "1.11.0"     = v6;
+          "1.11+beta1" = v5;
           "1.10.0"       = v4 // {mathcomp-finmap = "1.4.0+coq-8.11";};
         };
         "8.10" = {
-          "1.11.0+beta1" = removeAttrs v5 ["coqeal"];
+          "1.11.0"       = removeAttrs v6 ["coqeal"];
+          "1.11+beta1"   = removeAttrs v5 ["coqeal"];
           "1.10.0"       = v4;
           "1.9.0"        = removeAttrs v3 ["coqeal"];
         };
         "8.9" = {
-          "1.11.0+beta1" = removeAttrs v5 ["mathcomp-analysis"];
+          "1.11.0"       = removeAttrs v6 ["mathcomp-analysis"];
+          "1.11+beta1"   = removeAttrs v5 ["mathcomp-analysis"];
           "1.10.0"       = v4;
           "1.9.0"        = removeAttrs v3 ["coqeal"];
           "1.8.0"        = removeAttrs v2 ["coqeal"];
         };
         "8.8" = {
-          "1.11.0+beta1" = removeAttrs v5 ["mathcomp-analysis"];
+          "1.11.0"       = removeAttrs v6 ["mathcomp-analysis"];
+          "1.11+beta1"   = removeAttrs v5 ["mathcomp-analysis"];
           "1.10.0"       = removeAttrs v4 ["mathcomp-analysis"];
           "1.9.0"        = removeAttrs v3 ["coqeal"];
           "1.8.0"        = removeAttrs v2 ["coqeal"];
           "1.7.0"        = removeAttrs v1 ["coqeal" "multinomials"];
         };
         "8.7" = {
-          "1.11.0+beta1" = removeAttrs v5 ["mathcomp-analysis"];
+          "1.11.0"       = removeAttrs v6 ["mathcomp-analysis"];
+          "1.11+beta1"   = removeAttrs v5 ["mathcomp-analysis"];
           "1.10.0"       = removeAttrs v4 ["mathcomp-analysis"];
           "1.9.0"        = removeAttrs v3 ["coqeal" "mathcomp-analysis"];
           "1.8.0"        = removeAttrs v2 ["coqeal" "mathcomp-analysis"];

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
@@ -1405,6 +1405,9 @@ self: super: {
   # $HOME, which we don't have in our build sandbox.
   cabal-install-parsers = dontCheck super.cabal-install-parsers;
 
+  # gitit is unbroken in the latest release
+  gitit = markUnbroken super.gitit;
+
   # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
   haskell-ci = doJailbreak super.haskell-ci;
 

diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@@ -5137,7 +5137,6 @@ broken-packages:
   - github-webhooks
   - githud
   - gitignore
-  - gitit
   - gitlab-api
   - gitlib
   - gitlib-cmdline

diff --git a/pkgs/development/libraries/babl/default.nix b/pkgs/development/libraries/babl/default.nix
@@ -5,24 +5,26 @@
 , pkgconfig
 , gobject-introspection
 , lcms2
+, vala
 }:
 
 stdenv.mkDerivation rec {
   pname = "babl";
-  version = "0.1.74";
+  version = "0.1.78";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/babl/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "03nfcvy3453xkfvsfcnsfcjf2vg2pin09qnr9jlssdysa1lhnwcs";
+    sha256 = "F9VJNjO/9VhdnzdbxN9ZJRV80ccMzXwipjW+dcFyUjo=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
     pkgconfig
     gobject-introspection
+    vala
   ];
 
   buildInputs = [

diff --git a/pkgs/development/libraries/gegl/4.0.nix b/pkgs/development/libraries/gegl/4.0.nix
@@ -35,26 +35,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gegl";
-  version = "0.4.22";
+  version = "0.4.24";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/gegl/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0q9cckf90fb82qc5d496fjz459f1xw4j4p3rff1f57yivx0yr20q";
+    sha256 = "d2VJnyc0Gw0WAy5mUxnLwSh2SD/2qUT83ySpxY4+JUo=";
   };
 
-  patches = [
-    # Prevent deadlock making tests time-out
-    # https://gitlab.gnome.org/GNOME/gegl/issues/226
-    # https://gitlab.gnome.org/GNOME/glib/issues/1941
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gegl/commit/1d530816266b52c8788bbe1504c5b2d6eceba036.patch";
-      sha256 = "1d8nhrzvwq35c5ws00xy9y6bfd9wsj3dm0301hiwkfi4niq59ygh";
-    })
-  ];
-
   nativeBuildInputs = [
     pkgconfig
     gettext

diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
@@ -10,8 +10,8 @@ in
     buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
   })).overrideAttrs (drv: {
 
-    # These libraries are still referenced, because pandoc references
-    # their `Paths_*` module for figuring out their version.
+    # These libraries are still referenced, because they generate
+    # a `Paths_*` module for figuring out their version.
     # The `Paths_*` module is generated by Cabal, and contains the
     # version, but also paths to e.g. the data directories, which
     # lead to a transitive runtime dependency on the whole GHC distribution.

diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -16,9 +16,9 @@ let
   #       still works.
   srcParams = if (stdenv.lib.versionAtLeast kernel.version "4.8") then
     { # Use mainline branch
-      version = "unstable-2019-12-10";
-      rev = "ea832ac486afb6dac9ef59aa37e90f332ab7f05a";
-      sha256 = "1dg2i558hjnjnyk53xyg0ayykqaial9bm420v22s9a3khzzjnwq3";
+      version = "unstable-2020-04-16";
+      rev = "82626d4892eeb9eb704538bf0dc49a00725ff451";
+      sha256 = "118z6vjvhhcwvs4n3sgwwdagys9w718b8nkh6l9ic93732vv7cqx";
     }
   else
     { # Use master branch (broken on 4.8)

diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
@@ -19,11 +19,30 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/master/package/network/services/hostapd/patches/300-noscan.patch";
       sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";
     })
+    # AP mode PMF disconnection protection bypass (CVE.2019-16275), can be removed >= 2.10
+    # https://w1.fi/security/2019-7/
     (fetchurl {
       name = "CVE-2019-16275.patch";
       url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
       sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
     })
+    # Fixes for UPnP SUBSCRIBE misbehavior in hostapd WPS AP (CVE-2020-12695), can be removed >= 2.10
+    # https://w1.fi/security/2020-1/
+    (fetchurl {
+      name = "CVE-2020-12695_0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
+      url = "https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
+      sha256 = "1mrbhicqb34jlw1nid5hk2vnjbvfhvp7r5iblaj4l6vgc6fmp6id";
+    })
+    (fetchurl {
+      name = "CVE-2020-12695_0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
+      url = "https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
+      sha256 = "1pk08b06b24is50bis3rr56xjd3b5kxdcdk8bx39n9vna9db7zj9";
+    })
+    (fetchurl {
+      name = "CVE-2020-12695_0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
+      url = "https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
+      sha256 = "12npqp2skgrj934wwkqicgqksma0fxz09di29n1b5fm5i4njl8d8";
+    })
   ];
 
   outputs = [ "out" "man" ];
@@ -80,7 +99,7 @@ stdenv.mkDerivation rec {
     repositories.git = "git://w1.fi/hostap.git";
     description = "A user space daemon for access point and authentication servers";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ phreedom ninjatrappeur ];
+    maintainers = with maintainers; [ phreedom ninjatrappeur hexa ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
@@ -49,7 +49,7 @@ in {
   };
 
   unifiStable = generic {
-    version = "5.12.72";
-    sha256 = "00d7kxn3f1c0i4kg81hz2hf9bdbccb3d1zs7js414rpc5k3xg3kz";
+    version = "5.13.29";
+    sha256 = "0j1spid9q41l57gyphg8smn92iy52z4x4wy236a2a15p731gllh8";
   };
 }