hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175

ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0

As documented in the Nix expression, I unfortunately had to patch
`yarn.lock` manually (the `yarn.nix` result isn't affected by this). By
adding a `git+https`-prefix to
`midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file
I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache
from `yarn2nix` rather than trying to download a tarball from GitHub.

Also, this release contains a fix for CVE-2021-39175 which doesn't seem
to be backported to 1.8. To quote NVD[1]:

> In versions prior to 1.9.0, an unauthenticated attacker can inject
> arbitrary JavaScript into the speaker-notes of the slide-mode feature
> by embedding an iframe hosting the malicious code into the slides or by
> embedding the HedgeDoc instance into another page.

Even though it "only" has a medium rating by NVD (6.1), this seems
rather problematic to me (also, GitHub rates this as "High"), so it's
actually a candidate for a backport.

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175

(cherry picked from commit 0a10c17c8d01e5f9fefa3d6dbb7802a3cbce7e23)

pkgs/servers/web-apps/hedgedoc/default.nix

@@ -15,34 +15,42 @@ let
   # we need a different version than the one already available in nixpkgs
   esbuild-hedgedoc = buildGoModule rec {
     pname = "esbuild";
-    version = "0.11.20";
+    version = "0.12.27";
 
     src = fetchFromGitHub {
       owner = "evanw";
       repo = "esbuild";
       rev = "v${version}";
-      sha256 = "009f2mfgzkzgxjh3034mzdkcvm5vz17sgy1cs604f0425i22z8qm";
+      sha256 = "sha256-UclUTfm6fxoYEEdEEmO/j+WLZLe8SFzt7+Tej4bR0RU=";
     };
 
-    vendorSha256 = "1n5538yik72x94vzfq31qaqrkpxds5xys1wlibw2gn2am0z5c06q";
+    vendorSha256 = "sha256-QPkBR+FscUc3jOvH7olcGUhM6OW4vxawmNJuRQxPuGs=";
   };
 in
 
 mkYarnPackage rec {
-  name = "hedgedoc";
-  version = "1.8.2";
+  pname = "hedgedoc";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner  = "hedgedoc";
     repo   = "hedgedoc";
     rev    = version;
-    sha256 = "1h2wyhap264iqm2jh0i05w0hb2j86jsq1plyl7k3an90w7wngyg1";
+    sha256 = "sha256-hSKQGkI1+68Zf05RhgRKZo47buyobzjhURSZ30/h0PA=";
   };
 
   nativeBuildInputs = [ which makeWrapper ];
   extraBuildInputs = [ python2 esbuild-hedgedoc ];
 
   yarnNix = ./yarn.nix;
+
+  # FIXME(@Ma27) on the bump to 1.9.0 I had to patch this file manually:
+  # I replaced `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` with
+  # `midi "git+https://github.com/paulrosen/MIDI.js.git#abcjs"` on all occurrences.
+  #
+  # Without this change `yarn` attempted to download the code directly from GitHub, with
+  # the `git+`-prefix it actually uses the `midi.js` version from the offline cache
+  # created by `yarn2nix`. On future bumps this may be necessary as well!
   yarnLock = ./yarn.lock;
   packageJSON = ./package.json;