4 files changed, 15 insertions, 7 deletions
diff --git a/pkgs/servers/mail/dovecot/default.nix b/pkgs/servers/mail/dovecot/default.nix
index c639a9a26cb3..17286f8ec241 100644
--- a/pkgs/servers/mail/dovecot/default.nix
+++ b/pkgs/servers/mail/dovecot/default.nix
@@ -9,7 +9,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "dovecot-2.3.6";
+  name = "dovecot-2.3.7";
 
   nativeBuildInputs = [ perl pkgconfig ];
   buildInputs =
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dovecot.org/releases/2.3/${name}.tar.gz";
-    sha256 = "1irnalplb47nlc26dn7zzdi95zhrxxi3miza7p3wdsgapv0qs7gd";
+    sha256 = "1al382ykm94if5agasb9h2442a8s7wn43hlwh292ir1rhnp5dq8i";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index dde0a547693c..f1820d65ed04 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "metabase-${version}";
-  version = "0.32.2";
+  version = "0.32.9";
 
   src = fetchurl {
     url = "http://downloads.metabase.com/v${version}/metabase.jar";
-    sha256 = "1df2cvlqm0pz7w5094fv20308m0d2z4szlv46dzsfdw03hny50xn";
+    sha256 = "08iybb1m2pmimn0fs95kd948yf6c1xmg5kkzm9ykx4cpb9pn1yw0";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/squid/4.nix b/pkgs/servers/squid/4.nix
index f4abc1f3208e..69a46533ba5d 100644
--- a/pkgs/servers/squid/4.nix
+++ b/pkgs/servers/squid/4.nix
@@ -2,11 +2,11 @@
 , expat, libxml2, openssl }:
 
 stdenv.mkDerivation rec {
-  name = "squid-4.7";
+  name = "squid-4.8";
 
   src = fetchurl {
     url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
-    sha256 = "0kimbvp2mzask9k58va4s829vv3m54fzxrj7ryqshw5bfxgzd752";
+    sha256 = "0432m0ix046rkja7r7qpydgsm2kf1w393xym15nx6h9kv4jb7kbq";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
index 2fdbc29caedf..fde29dc7e80c 100644
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap
-, expat, libxml2, openssl }:
+, expat, libxml2, openssl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "squid-3.5.28";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1n4f55g56b11qz4fazrnvgzx5wp6b6637c4qkbd1lrjwwqibchgx";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "3.5-CVE-2019-13345.patch";
+      url = "https://github.com/squid-cache/squid/commit/5730c2b5cb56e7639dc423dd62651c8736a54e35.patch";
+      sha256 = "0955432g9a00vwxzcrwpjzx6vywspx1cxhr7bknr7jzbzam5sxi3";
+    })
+  ];
+
   buildInputs = [
     perl openldap db cyrus_sasl expat libxml2 openssl
   ] ++ stdenv.lib.optionals stdenv.isLinux [ libcap pam ];