| 2 Dec 2025 |
 hexa | if we cannot fix them we tend to mark as vulnerable, yes. better kept in #security-discuss:nixos.org | 22:42:28 |
| hexa | https://seclists.org/oss-sec/2025/q4/228 | 22:50:38 |
| hexa | * https://seclists.org/oss-sec/2025/q4/228 vim | 22:50:52 |
| hexa | cc Philip Taron (UTC-8) | 22:51:04 |
| hexa | blargh, windows only | 22:51:21 |
| hexa | 🪟 | 22:51:33 |
| 3 Dec 2025 |
| hexa | https://seclists.org/oss-sec/2025/q4/229 xorg.xkbcomp (1.4.7 -> 1.5.0) | 10:19:30 |
| hexa | https://www.openwall.com/lists/oss-security/2025/12/03/5 libpng 1.6.52 vcunat | 21:13:44 |
 vcunat | Doesn't seem critical and it will be a big rebuild, so I'm in no rush for today. | 23:10:53 |
| hexa | should be in the next staging cycle still | 23:28:39 |
| 4 Dec 2025 |
| vcunat | https://github.com/NixOS/nixpkgs/pull/467753 | 07:19:26 |
| vcunat | https://github.com/NixOS/nixpkgs/pull/467766 | 08:15:50 |
| hexa | https://www.openwall.com/lists/oss-security/2025/12/04/3 webkitgtk 2.50.3 | 15:22:27 |
 leona | https://github.com/NixOS/nixpkgs/pull/467875 apacheHttpd | 16:54:55 |
| 5 Dec 2025 |
 mdaniels5757 | Now realizing I let these pile up: | 03:42:37 |
| mdaniels5757 | Security update approved by maintainer, needs merge: https://github.com/NixOS/nixpkgs/pull/466669 and https://github.com/NixOS/nixpkgs/pull/466702 | 03:43:00 |
| mdaniels5757 | No approvals for these: https://github.com/NixOS/nixpkgs/pull/466677 https://github.com/NixOS/nixpkgs/pull/465816 https://github.com/NixOS/nixpkgs/pull/466341 https://github.com/NixOS/nixpkgs/pull/465846 | 03:46:09 |
| mdaniels5757 | Backports/release branch PRs: https://github.com/NixOS/nixpkgs/pull/466999 https://github.com/NixOS/nixpkgs/pull/466128 https://github.com/NixOS/nixpkgs/pull/466127 https://github.com/NixOS/nixpkgs/pull/465969 https://github.com/NixOS/nixpkgs/pull/467294 | 03:47:08 |
| mdaniels5757 | And finally, unreviewed (and unfortunately harder a bit harder to review, because the version bumps needed included an in-tree formatter bump, sorry): https://github.com/NixOS/nixpkgs/pull/465389 | 03:48:07 |
| mdaniels5757 | Jfc thats a lot | 03:48:15 |
| hexa | https://github.com/hedgedoc/hedgedoc/pull/6196 soon. Sandro 🐧 | 22:30:29 |
 qubitnano | Redacted or Malformed Event | 22:30:57 |
| hexa | Redacted or Malformed Event | 22:31:32 |
| hexa | * qubitnano: is this security relevant? | 22:31:53 |
| qubitnano | Redacted or Malformed Event | 22:32:21 |
| hexa | https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 golang | 23:31:25 |
| hexa | https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.4 | 23:31:38 |
| hexa | https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53 urllib3 (mine) | 23:31:57 |
| 6 Dec 2025 |
| mdaniels5757 | Already handled: https://github.com/NixOS/nixpkgs/pull/467201, https://github.com/NixOS/nixpkgs/pull/467287, and backports. | 02:06:34 |
| 7 Dec 2025 |
 dotlambda | https://github.com/NixOS/nixpkgs/pull/460222 doesn't have a backport to 25.05 yet | 05:23:54 |
