NixOS · Jan 18, 2020 · Jan 19, 2020 · Jan 19, 2020 · Feb 2, 2020 · Feb 2, 2020
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.30.0"; # Please backport all updates to the stable channel.
+  version = "1.30.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1gbvna40sc83s7mwip5281yn4bs0k19fj061y0xzwkvh0yk06x3i";
+    sha256 = "08l51f1fq9jlnqb4j38lxdfwfbqfzb85zrim57wlgcj8azp2ash6";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
@@ -18,11 +18,18 @@ in stdenv.mkDerivation rec {
     sha256 = "0wd881jzvqayx0ihzba29jl80k06xj9ywp16kxacdqs3064p1ywl";
   };
 
-  patches = [ (fetchpatch {
-    name = "CVE-2019-19956"; # Upstream patch
-    url = "https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549.patch";
-    sha256 = "05r36wb3jfiqqr595v8y1djb535pk99lvajvsi5rq7x90k8s6g61";
-  })];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-19956"; # Upstream patch
+      url = "https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549.patch";
+      sha256 = "05r36wb3jfiqqr595v8y1djb535pk99lvajvsi5rq7x90k8s6g61";
+    })
+    (fetchpatch {
+      name = "CVE-2020-7595.patch";
+      url = "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5.patch";
+      sha256 = "0klvaxkzakkpyq0m44l9xrpn5kwaii194sqsivfm6zhnb9hhl15l";
+    })
+  ];
 
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py"

diff --git a/pkgs/servers/openafs/1.8/cross-build.patch b/pkgs/servers/openafs/1.8/cross-build.patch
@@ -2,9 +2,9 @@ diff -Nur --unidirectional-new-file openafs-1.8.2/configure.ac openafs-1.8.2.new
 --- openafs-1.8.2/configure.ac	2018-09-11 17:52:48.000000000 +0200
 +++ openafs-1.8.2.new/configure.ac	2018-10-16 15:56:36.512277860 +0200
 @@ -23,6 +23,7 @@
+ AFS_LT_INIT
 
  AC_PROG_CC
- AC_PROG_LIBTOOL
 +AX_PROG_CC_FOR_BUILD
 
  AC_PATH_PROGS([PATH_CPP], [cpp], [${CC-cc} -E], [$PATH:/lib:/usr/ccs/lib])

diff --git a/pkgs/servers/openafs/1.8/default.nix b/pkgs/servers/openafs/1.8/default.nix
@@ -28,9 +28,6 @@ stdenv.mkDerivation {
   # Makefiles don't include install targets for all new shared libs, yet.
   dontDisableStatic = true;
 
-  # Fixes broken format string in 1.8.2
-  hardeningDisable=[ "format" ];
-
   preConfigure = ''
     patchShebangs .
     for i in `grep -l -R '/usr/\(include\|src\)' .`; do

diff --git a/pkgs/servers/openafs/1.8/srcs.nix b/pkgs/servers/openafs/1.8/srcs.nix
@@ -1,14 +1,14 @@
 { fetchurl }:
 rec {
-  version = "1.8.3";
+  version = "1.8.5";
   src = fetchurl {
     url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2";
-    sha256 = "19ffchxwgqg4wl98l456jdpgq2w8b5izn8hxdsq9hjs0a1nc3nga";
+    sha256 = "08w5n803xm75j7daa3mr2ncfmcg0wpm7yasj6zyddqlb4f7xdppf";
   };
 
   srcs = [ src
     (fetchurl {
       url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2";
-      sha256 = "14smdhn1f6f3cbvvwxgjjld0m4b17vqh3rzkxf5apmjsdda21njq";
+      sha256 = "08mg3n0q2igfas1khj18r9apyrkpbp1jick0ix5nfaal90jbifis";
     })];
 }
diff --git a/pkgs/tools/filesystems/e2fsprogs/default.nix b/pkgs/tools/filesystems/e2fsprogs/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.45.3";
+  version = "1.45.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0gcqfnp9h7wgz1vq402kxd2w398vqaim26aq9i722v3lrgh5cm9s";
+    sha256 = "0jsclghxfzj9qmdd3qqk0gdmkrgjv2gakf8qz9dba37qkj1nk776";
   };
 
   outputs = [ "bin" "dev" "out" "man" "info" ];