php: fix the filter tests that break the 8.5.12 build

The 8.5.12 pin in 39ed0cc/be9afb2 builds the interpreter but the system build
stopped in php-filter's checkPhase:

  FAILED TEST SUMMARY
  filter.default=encoded doesn't reach hard limit  [tests/oom_filter_default_encoded.phpt]
  filter_input() doesn't reach hard limit          [tests/oom_filter_input.phpt]
  filter_input_array() doesn't reach hard limit    [tests/oom_filter_input_array.phpt]
  make: *** [Makefile:133: test] Error 1

Not a fault in the pin. nixpkgs configures PHP with `--disable-all` and builds
every extension as a shared module, while these three tests — added by the
upstream fix for CVE-2026-109618 — deliberately spawn `php-cgi -n` with no
php.ini.  With no ini there is no shared filter module, so filter_input() is
undefined, the request never reaches the code under test, and the expected
"Allowed memory size ... exhausted" never appears.

nixpkgs shipped the remedy with the version bump in a5fc1be5b6 ("php: fix
`filter` tests", 2026-10-21 14:27 UTC), which adds the module to the child's
command line.  The pinned nixpkgs revision (7694c4f6b853, 2026-10-16) predates
it, so apply the same substitution locally.

The override has to rewrite the filter derivation inside `extensions` rather
than go through buildEnv's `packageOverrides`: that argument is threaded into
the unwrapped PHP only, while the extension set is folded from mkPhp's own
packageOverrides, so passing it there is accepted and silently ignored.

Drop this block once flake.lock is past a5fc1be5b6 — otherwise both patch the
same files and the substitution is applied twice.

Verified by evaluating both derivations against the pinned revision: the
filter derivation now carries the substitution, php-with-extensions is
8.5.12, and the 45-extension set is unchanged.

CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.2.2] - 2026-10-21
+
+### Changed
+- **Nixpkgs Update (`nixpkgs-stable` / `nixos-26.05`):**
+  - Updated to commit [`cd4ea8d`](https://github.com/NixOS/nixpkgs/commit/cd4ea8d57de16f4810bc5f14207bac45fbf19f67)
+  - Upgraded **Matrix Synapse**: `1.162.0` → `1.163.0` (automatically picked up by The Hub)
+- **Sovran_Bitcoin Update (`1.1.2`):**
+  - Updated to commit [`63e1049`](https://github.com/naturallaw777/Sovran_Bitcoin/commit/63e104940ef4ff21eb2b43977ca6e110e9c5d524)
+  - Hotfix for Nostr Wallet Connect (NWC): fixes spending on LND 0.21, real internal preimages, and `pay_keysend` support
+
+### Fixed
+- Make Hub login verification loadable and diagnosable
+- Trusted Hub icon, truthful root hint, no Default-keyring prompt
+- Hub login must accept the password the desktop accepts
+- Don't let password verification crash the System Passwords tile
+[1.2.2]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.2.2
+
+
 ## [1.2.1] - 2026-10-18
 
 ### Added

README.md

@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.
 
 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso.sha256) ·
 [Build from Source](#build-from-source)
 
 <img src="assets/desktop-screenshot.webp" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -401,8 +401,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).
 
 ### 1. Download the ISO and checksum
 
-- [Download Sovran_SystemsOS-1.2.1.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso)
-- [Download Sovran_SystemsOS-1.2.1.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso.sha256)
+- [Download Sovran_SystemsOS-1.2.2.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso)
+- [Download Sovran_SystemsOS-1.2.2.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso.sha256)
 
 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -419,13 +419,13 @@ ISO must match the published one exactly.
 Open a terminal in the download folder and run:
 
 ```bash
-sha256sum --check Sovran_SystemsOS-1.2.1.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.2.2.iso.sha256
 ```
 
 A successful comparison reports:
 
 ```text
-Sovran_SystemsOS-1.2.1.iso: OK
+Sovran_SystemsOS-1.2.2.iso: OK
 ```
 
 </details>
@@ -436,11 +436,11 @@ Sovran_SystemsOS-1.2.1.iso: OK
 Open Terminal in the download folder and run:
 
 ```bash
-shasum -a 256 Sovran_SystemsOS-1.2.1.iso
+shasum -a 256 Sovran_SystemsOS-1.2.2.iso
 ```
 
 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS-1.2.1.iso.sha256`.
+`Sovran_SystemsOS-1.2.2.iso.sha256`.
 
 </details>
 
@@ -450,7 +450,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:
 
 ```powershell
-Get-FileHash .\Sovran_SystemsOS-1.2.1.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.2.2.iso -Algorithm SHA256
 ```
 
 Compare the value under `Hash` with the published checksum.
@@ -465,7 +465,7 @@ match exactly.
 
 1. Download and install [Balena Etcher](https://etcher.balena.io), then
    connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS-1.2.1.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.2.2.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
    carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -883,7 +883,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.
 
 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso) ·
 [View the License](LICENSE)
 
 </div>

VERSION

@@ -1 +1 @@
-1.2.1
+1.2.2

app/sovran_systemsos_web/versions.json

@@ -9,7 +9,7 @@
   "btcpayserver.service": "2.4.5",
   "albyhub.service": "2.0.0",
   "mempool.service": "3.3.1",
-  "matrix-synapse.service": "1.162.0",
+  "matrix-synapse.service": "1.163.0",
   "livekit.service": "1.13.8",
   "vaultwarden.service": "1.37.4",
   "haven-relay.service": "1.2.2"

flake.lock

@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1792157233,
-        "narHash": "sha256-XQnyEc+Pj0Tg21ckbPMri0fiK/exCzhBw6wNgd1INqw=",
+        "lastModified": 1792500275,
+        "narHash": "sha256-Y86rSoq9EWo6538kYoWZCnH9+bl0jNS1vQrnNvm8znE=",
         "owner": "emmanuelrosa",
         "repo": "btc-clients-nix",
-        "rev": "990d29e23437f30b8573f640d3e323167de1dc7b",
+        "rev": "487c7e9ce3978601d37ac10b18610db672850f3b",
         "type": "github"
       },
       "original": {
@@ -56,11 +56,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1792030654,
-        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
+        "lastModified": 1792503283,
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -72,11 +72,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1792094642,
-        "narHash": "sha256-zp8ToDMnqZcu4o4IH9pdwXFXGp7yLm/M0dEnNWnyd7I=",
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fe13242281a67641c0102cdb1087f0ebe586c7df",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -104,11 +104,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1791956154,
-        "narHash": "sha256-jBYGPi4udQ9uo4KQp9m2J0546nJVQitG15gvZSaVVAs=",
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55bfb4d7437bd4e09ab7cba58a43bd68eb310044",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1792372617,
-        "narHash": "sha256-MLFWEcj6ZyFgFWubNPYK7IEI8NUtjbrhxhXQiI6JbPM=",
+        "lastModified": 1792602201,
+        "narHash": "sha256-5LkFX16SxgXyaUDvFPtHdFGp4w4deqQy9btRmPQSlwU=",
         "owner": "naturallaw777",
         "repo": "Sovran_Bitcoin",
-        "rev": "78e4430525069172a8d1a9c08a951f8b87a03bf3",
+        "rev": "63e104940ef4ff21eb2b43977ca6e110e9c5d524",
         "type": "github"
       },
       "original": {

modules/php.nix

@@ -18,9 +18,42 @@
 #
 # To fall back to PHP 8.4 (nixpkgs' current default `pkgs.php`) change only
 # the `phpBase` line below.
+#
+# Security floor (October 2026):
+#   CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via
+#   stale global state) are critical, unauthenticated flaws in PHP itself,
+#   CVSS v4.0 9.2 each, fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on
+#   2026-10-21.  PHP-FPM is named as susceptible in both advisories, so the
+#   pools below are in scope; updating is the only complete mitigation.
+#   nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 the same
+#   day, but the nixpkgs revision this flake pins predates it, so the floor is
+#   enforced here.  Once flake.lock is at or past that commit the `else`
+#   branch below stops being taken and can be deleted.
 
 let
-	phpBase = pkgs.php85;
+	# The first 8.5.x release that carries the fixes above.  Bump only upward.
+	phpSecurityFloor = "8.5.12";
+
+	# php-8.5.12.tar.bz2, the same artifact and URL shape nixpkgs' own
+	# generic.nix fetches.  Verified against php.net on 2026-10-23.
+	phpSourceHash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
+
+	# `.override` (not `overrideAttrs`) on purpose: php85 is a `makeOverridable`
+	# buildEnv, so this threads `version`/`phpSrc` into generic.nix while
+	# keeping the default extension set.  `overrideAttrs` would keep the new
+	# source but drop the extension set, which would silently strip gd, intl,
+	# pdo_pgsql and friends out of the pools below.
+	phpBase =
+		if lib.versionAtLeast pkgs.php85.version phpSecurityFloor then
+			pkgs.php85
+		else
+			pkgs.php85.override {
+				version = phpSecurityFloor;
+				phpSrc = pkgs.fetchurl {
+					url = "https://www.php.net/distributions/php-${phpSecurityFloor}.tar.bz2";
+					hash = phpSourceHash;
+				};
+			};
 
 	custom-php = phpBase.buildEnv {
 		# `enabled` is nixpkgs' default extension set.  It already contains every
@@ -29,7 +62,41 @@ let
 		# xmlreader, xmlwriter, zip, zlib, pdo_pgsql, pdo_mysql, bcmath, gmp,
 		# exif, sodium, sysvsem, pcntl, ...).  OPcache is compiled into PHP >= 8.5
 		# and no longer appears as a separate extension.
-		extensions = { enabled, all }: enabled ++ (with all; [
+		extensions = { enabled, all }:
+			let
+				# nixpkgs builds PHP with `--disable-all` and every extension as a
+				# shared module.  Three of the OOM regression tests shipped with
+				# 8.5.12 spawn `php-cgi -n` on purpose — no php.ini, so no shared
+				# module, so filter_input() is never defined and the request never
+				# reaches the code under test.  php-filter's `make test` then fails
+				# with "doesn't reach hard limit" for oom_filter_input,
+				# oom_filter_input_array and oom_filter_default_encoded, and the
+				# whole system build stops there.
+				#
+				# Upstream nixpkgs fixes this in a5fc1be5b6 ("php: fix `filter`
+				# tests"), shipped alongside the 8.5.12 bump.  This lock predates
+				# it, so apply the same substitution here; drop this once flake.lock
+				# is past a5fc1be5b6, since the two would otherwise both patch.
+				#
+				# Done by rewriting the filter derivation in the extension list
+				# rather than through buildEnv's `packageOverrides`: that argument
+				# only reaches the unwrapped PHP, while the extension set is folded
+				# from mkPhp's own packageOverrides, so it is silently ignored here.
+				patchFilterTests = ext:
+					if (ext.extensionName or "") != "filter" then
+						ext
+					else
+						ext.overrideAttrs (prevAttrs: {
+						postConfigure = (prevAttrs.postConfigure or "") + ''
+							substituteInPlace \
+								tests/oom_filter_input.phpt \
+								tests/oom_filter_input_array.phpt \
+								tests/oom_filter_default_encoded.phpt \
+								--replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
+						'';
+					});
+			in
+			map patchFilterTests enabled ++ (with all; [
 				bz2        # Nextcloud: bz2 archive support
 				apcu       # Nextcloud: memcache.local  (apc.enable_cli=1 below is mandatory for occ + cron)
 				redis      # Nextcloud: memcache.distributed / file locking once a Redis server is configured