NixOS · Jun 14, 2019 · Jun 15, 2019 · Jun 15, 2019 · Jun 15, 2019 · Jun 15, 2019
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -258,6 +258,16 @@ sub usbCheck {
     }
 }
 
+# Add bcache module, if needed.
+my @bcacheDevices = glob("/dev/bcache*");
+if (scalar @bcacheDevices > 0) {
+    push @initrdAvailableKernelModules, "bcache";
+}
+
+# Prevent unbootable systems if LVM snapshots are present at boot time.
+if (`lsblk -o TYPE` =~ "lvm") {
+    push @initrdKernelModules, "dm-snapshot";
+}
 
 my $virt = `systemd-detect-virt`;
 chomp $virt;
@@ -319,10 +329,19 @@ sub findStableDevPath {
 if (@swaps) {
     shift @swaps;
     foreach my $swap (@swaps) {
-        $swap =~ /^(\S+)\s/;
-        next unless -e $1;
-        my $dev = findStableDevPath $1;
-        push @swapDevices, "{ device = \"$dev\"; }";
+        my @fields = split ' ', $swap;
+        my $swapFilename = $fields[0];
+        my $swapType = $fields[1];
+        next unless -e $swapFilename;
+        my $dev = findStableDevPath $swapFilename;
+        if ($swapType =~ "partition") {
+            push @swapDevices, "{ device = \"$dev\"; }";
+        } elsif ($swapType =~ "file") {
+            # swap *files* are more likely specified in configuration.nix, so
+            # ignore them here.
+        } else {
+            die "Unsupported swap type: $swapType\n";
+        }
     }
 }
 
@@ -422,6 +441,10 @@ sub in {
         }
     }
 
+    # Don't emit tmpfs entry for /tmp, because it most likely comes from the
+    # boot.tmpOnTmpfs option in configuration.nix (managed declaratively).
+    next if ($mountPoint eq "/tmp" && $fsType eq "tmpfs");
+
     # Emit the filesystem.
     $fileSystems .= <<EOF;
   fileSystems.\"$mountPoint\" =
@@ -497,6 +520,7 @@ sub multiLineList {
 }
 
 my $initrdAvailableKernelModules = toNixStringList(uniq @initrdAvailableKernelModules);
+my $initrdKernelModules = toNixStringList(uniq @initrdKernelModules);
 my $kernelModules = toNixStringList(uniq @kernelModules);
 my $modulePackages = toNixList(uniq @modulePackages);
 
@@ -516,6 +540,7 @@ sub multiLineList {
   imports =${\multiLineList("    ", @imports)};
 
   boot.initrd.availableKernelModules = [$initrdAvailableKernelModules ];
+  boot.initrd.kernelModules = [$initrdKernelModules ];
   boot.kernelModules = [$kernelModules ];
   boot.extraModulePackages = [$modulePackages ];
 $fsAndSwap

diff --git a/pkgs/applications/networking/mailreaders/afew/default.nix b/pkgs/applications/networking/mailreaders/afew/default.nix
@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "afew";
-  version = "1.3.0";
+  version = "2.0.0";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "0105glmlkpkjqbz350dxxasvlfx9dk0him9vwbl86andzi106ygz";
+    sha256 = "0j60501nm242idf2ig0h7p6wrg58n5v2p6zfym56v9pbvnbmns0s";
   };
 
   nativeBuildInputs = with pythonPackages; [ sphinx setuptools_scm ];
@@ -15,19 +15,22 @@ pythonPackages.buildPythonApplication rec {
     pythonPackages.notmuch chardet dkimpy
   ] ++ stdenv.lib.optional (!pythonPackages.isPy3k) subprocess32;
 
+  makeWrapperArgs = [
+    ''--prefix PATH ':' "${notmuch}/bin"''
+  ];
+
+  outputs = [ "out" "doc" ];
+
   postBuild =  ''
-    make -C docs man
+    python setup.py build_sphinx -b html,man
   '';
 
   postInstall = ''
-    mandir="$out/share/man/man1"
-    mkdir -p "$mandir"
-    cp docs/build/man/* "$mandir"
+    install -D -v -t $out/share/man/man1 build/sphinx/man/*
+    mkdir -p $out/share/doc/afew
+    cp -R build/sphinx/html/* $out/share/doc/afew
   '';
 
-  makeWrapperArgs = [
-    ''--prefix PATH ':' "${notmuch}/bin"''
-  ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/afewmail/afew;

diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -24,11 +24,11 @@ let
   gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
 in stdenv.mkDerivation rec {
   name = "thunderbird-${version}";
-  version = "60.7.0";
+  version = "60.7.1";
 
   src = fetchurl {
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "0l773bl9kkrz905rm4ipsic5ykkrw2lmg3i9c5vxpc0j1qgmz3p3x5db1kbk2yy2i5hx9lkn5szhgjf71d7dgvf7935z67d5djqnhk0";
+    sha512 = "25dgbshgfmalxyah9rrgrxi4n0bmj0agcllz2hzv37w7makkl7qpf4wr859ykymmmvawcs8n747ppq9x73gn32bw88bjyxv2bn4l78q";
   };
 
   # from firefox, but without sound libraries

diff --git a/pkgs/applications/networking/znc/default.nix b/pkgs/applications/networking/znc/default.nix
@@ -13,11 +13,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "znc-${version}";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "https://znc.in/releases/archive/${name}.tar.gz";
-    sha256 = "1ac2csl5jr56vahnxdynlvrhwlvcc1gqxvyifckc6cn5aj7ygd30";
+    sha256 = "0g8i5hsl4kinpz1wp0a2zniidv3w2sd6awq8676fds516wcc6k0y";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
@@ -82,6 +82,11 @@ stdenv.mkDerivation rec {
       url = "https://git.qemu.org/?p=qemu.git;a=patch;h=b05b267840515730dbf6753495d5b7bd8b04ad1c";
       sha256 = "03a5vc5wvirbyi5r8kb2r4m2w6f1zmh9bqsr2psh4pblwar0nf55";
     })
+    (fetchpatch {
+      url = "https://git.qemu.org/?p=qemu.git;a=patch;h=d52680fc932efb8a2f334cc6993e705ed1e31e99";
+      name = "CVE-2019-12155.patch";
+      sha256 = "0h2q71mcz3gvlrbfkqcgla74jdg73hvzcrwr4max2ckpxx8x9207";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optional pulseSupport ./fix-hda-recording.patch
     ++ optionals stdenv.hostPlatform.isMusl [

diff --git a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, pantheon, substituteAll, meson, ninja, python3
 , pkgconfig, vala, granite, libgee, gettext, gtk3, appstream, gnome-menus
-, json-glib, plank, bamf, switchboard, libunity, libsoup, wingpanel, libwnck3
-, zeitgeist, bc }:
+, json-glib, plank, bamf, switchboard, libunity, libsoup, wingpanel, zeitgeist
+, bc }:
 
 stdenv.mkDerivation rec {
   pname = "applications-menu";
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
     libgee
     libsoup
     libunity
-    libwnck3
     plank
     switchboard
     wingpanel

diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
@@ -86,6 +86,11 @@ stdenv.mkDerivation rec {
         url = https://gitlab.gnome.org/GNOME/glib/commit/30ccbc386026cecac6ef3a77d8fa4f3c24ac68d7.patch;
         sha256 = "04y3pxgzlx92cppwibx4rlsyvwxb37aq52x2lr6ajfgykv2nzpr3";
       })
+      (fetchpatch {
+        url = "https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174.patch";
+        name = "CVE-2019-12450.patch";
+        sha256 = "03ris8lllbb7i18qvbpqaf7xdwfz1dkskx8mb533dmwlp2ll69hg";
+      })
     ];
 
   outputs = [ "bin" "out" "dev" "devdoc" ];

diff --git a/pkgs/development/libraries/grpc/default.nix b/pkgs/development/libraries/grpc/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags }:
 
 stdenv.mkDerivation rec {
-  version = "1.18.0";
+  version = "1.19.1";
   name = "grpc-${version}";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "0pf8q1z3qhlljlj6h7isvqvsxhh4612z780xcbv1h9lj7cdpr77m";
+    sha256 = "0c0jra4qnd86gyr4rlblic3igb5dpgrldac35myk5i5ia547fdhj";
   };
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [ zlib c-ares c-ares.cmake-config openssl protobuf gflags ];
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
       "-DgRPC_SSL_PROVIDER=package"
       "-DgRPC_PROTOBUF_PROVIDER=package"
       "-DgRPC_GFLAGS_PROVIDER=package"
+      "-DBUILD_SHARED_LIBS=ON"
     ];
 
   # CMake creates a build directory by default, this conflicts with the
@@ -26,6 +27,10 @@ stdenv.mkDerivation rec {
     rm -vf BUILD
   '';
 
+  preBuild = ''
+    export LD_LIBRARY_PATH=$(pwd):$LD_LIBRARY_PATH
+  '';
+
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-Wno-error=unknown-warning-option";
 
   enableParallelBuilds = true;

diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
@@ -1,4 +1,4 @@
-{ docbook_xml_dtd_412, fetchurl, stdenv, perl, python2, zip, xmlto, zlib }:
+{ docbook_xml_dtd_412, fetchurl, stdenv, perl, python2, zip, xmlto, zlib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "zziplib-${version}";
@@ -9,6 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "0i052a7shww0fzsxrdp3rd7g4mbzx7324a8ysbc0br7frpblcql4";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-17828.patch";
+      url = "https://github.com/gdraheim/zziplib/commit/f609ae8971f3c0ce6.diff";
+      sha256 = "0jhiz4fgr93wzh6q03avn95b2nsf6402jaki6hxirxyhs5v9ahry";
+    })
+  ];
   postPatch = ''
     sed -i -e s,--export-dynamic,, configure
   '';

diff --git a/pkgs/development/python-modules/django/2_2.nix b/pkgs/development/python-modules/django/2_2.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.2.1";
+  version = "2.2.2";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1spa701phl8ha7qmfr89hwpa43kf52zbrs3xyc0rlvxianykrk3g";
+    sha256 = "1xbqsa016szsqx6pnggrlxs81169hd8adzmdvp969007xg9k0gbm";
   };
 
   patches = stdenv.lib.optional withGdal

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.125";
+  version = "4.14.127";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "065k5bg3qz0chzlfaxz63vpkipqrj26hnbbfyidkha2s44hbqg9y";
+    sha256 = "1cvmxh8habwgfczly0zl780d8sa63xkliy79i9a4dvndg4ilqinp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.50";
+  version = "4.19.52";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "07p0gkjf3xj9djsmzxvbb25cmsi5f95v3sfnd3p21gcaj4ip9659";
+    sha256 = "07iqlh5p68md4xa83bqcfqcwkzvzhbb706bnjjp8jdhcc9aycvi6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.181";
+  version = "4.4.182";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lw1qsql9dv8dllz6hglahxdfgzg34rpl9c9gwdrpm4j660nkaxj";
+    sha256 = "09w5v06c2ghai2pyz04kbhgfnqr22v4dkm9npb5kg6ndc67xh2f4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.181";
+  version = "4.9.182";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1vgwfjsn31fy0ikcnpaqbw8w0r0xb25xp3633f0258yb24z25kcg";
+    sha256 = "15cnk5bmd7kd4ggjzrbs9fpc21wliqdrnfnpg623cf0639l14vmi";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.1.nix b/pkgs/os-specific/linux/kernel/linux-5.1.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.1.9";
+  version = "5.1.11";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0y9a2bvls756f8hrpffhmbrg7hw5r6b2jc2rnpszzlixkjlyrjaq";
+    sha256 = "06fjjwbfky1vjf77km8fxvxqil214028njr8mn4j69whf8h97z8i";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
@@ -183,9 +183,9 @@ in {
 
     # this package should point to a version / git revision compatible with the latest kernel release
     # This is now "stable". Move to zfsStable after it's tested more.
-    version = "0.8.0";
+    version = "0.8.1";
 
-    sha256 = "1lqb9q2im5bbm4l8kfb31cb6rvy37h5ni6rnqlki127ynilymkj8";
+    sha256 = "0wlbziijx08a9bmbyq4gfz4by9l5jrx44g18i99qnfm78k2q8a84";
     isUnstable = true;
 
     extraPatches = [

diff --git a/pkgs/tools/admin/bubblewrap/default.nix b/pkgs/tools/admin/bubblewrap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libxslt, docbook_xsl, libcap }:
+{ stdenv, fetchurl, libxslt, docbook_xsl, libcap, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "bubblewrap-${version}";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1y2bdlxnlr84xcbf31lzirc292c5ak9bd2wvcvh4ppsliih6pjny";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b4bde42c10f065f6b7b02958ed50e.patch";
+      name = "CVE-2019-12439.patch";
+      sha256 = "1p2w0ixrr3aca6i26ckmlq8ini4a6kgq53r9f98f7ghvbdlp4dkg";
+    })
+  ];
+
   nativeBuildInputs = [ libcap libxslt docbook_xsl ];
 
   meta = with stdenv.lib; {

diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
@@ -34,6 +34,14 @@ stdenv.mkDerivation rec {
     sha256 = "1szj9ia1snbfqzfcsk6hx1j7jhbqsy0f9k5d7x9xiy8w5lfblwym";
   };
 
+  patches = [
+    (fetchurl {
+      url = "https://github.com/curl/curl/commit/5fc28510a4664f4.patch";
+      name = "CVE-2019-5435.patch";
+      sha256 = "00w12yhq8q260n91i1xrynz3vn4w3lypgl19cm893s35pbvg7y17";
+    })
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;