kurogeek
d13c64f314
Temporary overlay until the PR reaches nixpkgs-unstable. Fixes CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval time once the locked nixpkgs ships these versions; delete it then.
60 lines
2.2 KiB
Nix
60 lines
2.2 KiB
Nix
# TEMPORARY backport of NixOS/nixpkgs#576853
|
|
# (php 8.3.36 / 8.4.27 / 8.5.12; fixes CVE-2026-109618, CVE-2026-109619).
|
|
# Merged to master 2026-10-21, not yet on nixpkgs-unstable.
|
|
# Track: https://track.nix.ee/?pr=576853
|
|
#
|
|
# Remove once `nix flake update` pulls it in: delete this file and every
|
|
# reference to it (grep 576853). The overlay becomes a no-op and warns at eval
|
|
# time as soon as the locked nixpkgs ships these versions or newer.
|
|
final: prev:
|
|
let
|
|
inherit (prev) lib;
|
|
|
|
updates = {
|
|
php83 = {
|
|
version = "8.3.36";
|
|
hash = "sha256-RvS0XjaI7SsYGQFae1MsFbUcwFW907E/0A3f7r7tzV8=";
|
|
};
|
|
php84 = {
|
|
version = "8.4.27";
|
|
hash = "sha256-slMKh3xyL0sIyeF0owywi6wrfhkD7m6eMV8KqfX4LCQ=";
|
|
};
|
|
php85 = {
|
|
version = "8.5.12";
|
|
hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
|
|
};
|
|
};
|
|
|
|
# php-packages.nix hunk of the PR: the new releases' filter OOM tests only
|
|
# pass when the freshly built module is loaded explicitly.
|
|
packageOverrides = _: phpPrev: {
|
|
extensions = phpPrev.extensions // {
|
|
filter = phpPrev.extensions.filter.override {
|
|
postConfigure = ''
|
|
substituteInPlace \
|
|
tests/oom_filter_input.phpt \
|
|
tests/oom_filter_input_array.phpt \
|
|
tests/oom_filter_default_encoded.phpt \
|
|
--replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
bump =
|
|
name:
|
|
{ version, hash }:
|
|
if lib.versionAtLeast prev.${name}.version version then
|
|
lib.warn
|
|
"nixpkgs ships ${name} ${prev.${name}.version} (>= ${version}): NixOS/nixpkgs#576853 has landed, remove overlays/nixpkgs-pr-576853-php.nix"
|
|
prev.${name}
|
|
else
|
|
# `.override` on a php buildEnv rebuilds the interpreter with the new
|
|
# args, but the extension scope (php-packages) keeps the closure's
|
|
# original `packageOverrides`. Only `overrideAttrs` re-enters
|
|
# generic.nix with the overridden args and rebuilds that scope, so a
|
|
# no-op `overrideAttrs` is what makes `packageOverrides` take effect.
|
|
(prev.${name}.override { inherit version hash packageOverrides; }).overrideAttrs (_: { });
|
|
in
|
|
lib.mapAttrs bump updates
|