diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix index 06949bda1cb2..e516d8ea6f8b 100644 --- a/nixos/modules/installer/cd-dvd/iso-image.nix +++ b/nixos/modules/installer/cd-dvd/iso-image.nix @@ -506,12 +506,7 @@ in }; isoImage.squashfsCompression = mkOption { - default = with pkgs.stdenv.hostPlatform; "xz -Xdict-size 100% " - + lib.optionalString isx86 "-Xbcj x86" - # Untested but should also reduce size for these platforms - + lib.optionalString isAarch "-Xbcj arm" - + lib.optionalString (isPower && is32bit && isBigEndian) "-Xbcj powerpc" - + lib.optionalString (isSparc) "-Xbcj sparc"; + default = "zstd -Xcompression-level 19"; type = lib.types.nullOr lib.types.str; description = '' Compression settings to use for the squashfs nix store. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 9f061bd78294..b2c9a117c9a6 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1457,6 +1457,7 @@ ./services/web-servers/caddy/default.nix ./services/web-servers/darkhttpd.nix ./services/web-servers/fcgiwrap.nix + ./services/web-servers/fcgiwrap-instances.nix ./services/web-servers/garage.nix ./services/web-servers/hitch/default.nix ./services/web-servers/hydron.nix diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix index d09cd87febff..469af04d106d 100644 --- a/nixos/modules/services/misc/zoneminder.nix +++ b/nixos/modules/services/misc/zoneminder.nix @@ -202,10 +202,11 @@ in { ]; services = { - fcgiwrap = lib.mkIf useNginx { - enable = true; - preforkProcesses = cfg.cameras; - inherit user group; + fcgiwrap.instances.zoneminder = lib.mkIf useNginx { + process.prefork = cfg.cameras; + process.user = user; + process.group = group; + socket = { inherit (config.services.nginx) user group; }; }; mysql = lib.mkIf cfg.database.createLocally { @@ -225,9 +226,7 @@ in { default = true; root = "${pkg}/share/zoneminder/www"; listen = [ { addr = "0.0.0.0"; inherit (cfg) port; } ]; - extraConfig = let - fcgi = config.services.fcgiwrap; - in '' + extraConfig = '' index index.php; location / { @@ -257,7 +256,7 @@ in { fastcgi_param HTTP_PROXY ""; fastcgi_intercept_errors on; - fastcgi_pass ${fcgi.socketType}:${fcgi.socketAddress}; + fastcgi_pass unix:${config.services.fcgiwrap.instances.zoneminder.socket.address}; } location /cache/ { diff --git a/nixos/modules/services/networking/cgit.nix b/nixos/modules/services/networking/cgit.nix index 0ccbef756812..c4ecc86c1235 100644 --- a/nixos/modules/services/networking/cgit.nix +++ b/nixos/modules/services/networking/cgit.nix @@ -25,14 +25,14 @@ let regexLocation = cfg: regexEscape (stripLocation cfg); - mkFastcgiPass = cfg: '' + mkFastcgiPass = name: cfg: '' ${if cfg.nginx.location == "/" then '' fastcgi_param PATH_INFO $uri; '' else '' fastcgi_split_path_info ^(${regexLocation cfg})(/.+)$; fastcgi_param PATH_INFO $fastcgi_path_info; '' - }fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + }fastcgi_pass unix:${config.services.fcgiwrap.instances."cgit-${name}".socket.address}; ''; cgitrcLine = name: value: "${name}=${ @@ -72,25 +72,11 @@ let ${cfg.extraConfig} ''; - mkCgitReposDir = cfg: - if cfg.scanPath != null then - cfg.scanPath - else - pkgs.runCommand "cgit-repos" { - preferLocalBuild = true; - allowSubstitutes = false; - } '' - mkdir -p "$out" - ${ - concatStrings ( - mapAttrsToList - (name: value: '' - ln -s ${escapeShellArg value.path} "$out"/${escapeShellArg name} - '') - cfg.repos - ) - } - ''; + fcgiwrapUnitName = name: "fcgiwrap-cgit-${name}"; + fcgiwrapRuntimeDir = name: "/run/${fcgiwrapUnitName name}"; + gitProjectRoot = name: cfg: if cfg.scanPath != null + then cfg.scanPath + else "${fcgiwrapRuntimeDir name}/repos"; in { @@ -154,6 +140,30 @@ in type = types.lines; default = ""; }; + + user = mkOption { + description = '' + User to run the cgit service as. + + Defaults to "root" for compatibility with legacy setups. + Will default to the unprivileged user "cgit" in NixOS 24.11. + ''; + type = types.str; + default = "root"; + example = "cgit"; + }; + + group = mkOption { + description = '' + Group to run the cgit service as. + + Defaults to "root" for compatibility with legacy setups. + Will default to the unprivileged user "cgit" in NixOS 24.11. + ''; + type = types.str; + default = "root"; + example = "cgit"; + }; }; })); }; @@ -165,18 +175,55 @@ in message = "Exactly one of services.cgit.${vhost}.scanPath or services.cgit.${vhost}.repos must be set."; }) cfgs; - services.fcgiwrap.enable = true; + warnings = flatten (flip mapAttrsToList cfgs (inst: cfg: + optional (cfg.user == "root") '' + `services.cgit.${inst}` is configured to run as root. + This has security implications. See advisory: https://discourse.nixos.org/t/51419 + It is recommended to set an unprivileged user explicitly. + This default user will be set to "cgit" in NixOS 24.11. + '' + )); + + users = mkMerge (flip mapAttrsToList cfgs (_: cfg: { + users.${cfg.user} = { + isSystemUser = true; + inherit (cfg) group; + }; + groups.${cfg.group} = { }; + })); + + services.fcgiwrap.instances = flip mapAttrs' cfgs (name: cfg: + nameValuePair "cgit-${name}" { + process = { inherit (cfg) user group; }; + socket = { inherit (config.services.nginx) user group; }; + } + ); + + systemd.services = flip mapAttrs' cfgs (name: cfg: + nameValuePair (fcgiwrapUnitName name) + (mkIf (cfg.repos != { }) { + serviceConfig.RuntimeDirectory = fcgiwrapUnitName name; + preStart = '' + GIT_PROJECT_ROOT=${escapeShellArg (gitProjectRoot name cfg)} + mkdir -p "$GIT_PROJECT_ROOT" + cd "$GIT_PROJECT_ROOT" + ${concatLines (flip mapAttrsToList cfg.repos (name: repo: '' + ln -s ${escapeShellArg repo.path} ${escapeShellArg name} + ''))} + ''; + } + )); services.nginx.enable = true; - services.nginx.virtualHosts = mkMerge (mapAttrsToList (_: cfg: { + services.nginx.virtualHosts = mkMerge (mapAttrsToList (name: cfg: { ${cfg.nginx.virtualHost} = { locations = ( genAttrs' [ "cgit.css" "cgit.png" "favicon.ico" "robots.txt" ] - (name: nameValuePair "= ${stripLocation cfg}/${name}" { + (fileName: nameValuePair "= ${stripLocation cfg}/${fileName}" { extraConfig = '' - alias ${cfg.package}/cgit/${name}; + alias ${cfg.package}/cgit/${fileName}; ''; }) ) // { @@ -184,10 +231,10 @@ in fastcgiParams = rec { SCRIPT_FILENAME = "${pkgs.git}/libexec/git-core/git-http-backend"; GIT_HTTP_EXPORT_ALL = "1"; - GIT_PROJECT_ROOT = mkCgitReposDir cfg; + GIT_PROJECT_ROOT = gitProjectRoot name cfg; HOME = GIT_PROJECT_ROOT; }; - extraConfig = mkFastcgiPass cfg; + extraConfig = mkFastcgiPass name cfg; }; "${stripLocation cfg}/" = { fastcgiParams = { @@ -196,7 +243,7 @@ in HTTP_HOST = "$server_name"; CGIT_CONFIG = mkCgitrc cfg; }; - extraConfig = mkFastcgiPass cfg; + extraConfig = mkFastcgiPass name cfg; }; }; }; diff --git a/nixos/modules/services/networking/smokeping.nix b/nixos/modules/services/networking/smokeping.nix index 3fb3eac45cc8..9973c8cefbbc 100644 --- a/nixos/modules/services/networking/smokeping.nix +++ b/nixos/modules/services/networking/smokeping.nix @@ -328,6 +328,7 @@ in }; preStart = '' mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data + chown -R ${cfg.user}:${cfg.user} ${smokepingHome}/{cache,data} ln -snf ${cfg.package}/htdocs/css ${smokepingHome}/css ln -snf ${cfg.package}/htdocs/js ${smokepingHome}/js ln -snf ${cgiHome} ${smokepingHome}/smokeping.fcgi @@ -337,7 +338,11 @@ in }; # use nginx to serve the smokeping web service - services.fcgiwrap.enable = mkIf cfg.webService true; + services.fcgiwrap.instances.smokeping = mkIf cfg.webService { + process.user = cfg.user; + process.group = cfg.user; + socket = { inherit (config.services.nginx) user group; }; + }; services.nginx = mkIf cfg.webService { enable = true; virtualHosts."smokeping" = { @@ -349,7 +354,7 @@ in locations."/smokeping.fcgi" = { extraConfig = '' include ${config.services.nginx.package}/conf/fastcgi_params; - fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + fastcgi_pass unix:${config.services.fcgiwrap.instances.smokeping.socket.address}; fastcgi_param SCRIPT_FILENAME ${smokepingHome}/smokeping.fcgi; fastcgi_param DOCUMENT_ROOT ${smokepingHome}; ''; diff --git a/nixos/modules/services/web-servers/fcgiwrap-instances.nix b/nixos/modules/services/web-servers/fcgiwrap-instances.nix new file mode 100644 index 000000000000..4c02af7867d5 --- /dev/null +++ b/nixos/modules/services/web-servers/fcgiwrap-instances.nix @@ -0,0 +1,136 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + forEachInstance = f: flip mapAttrs' config.services.fcgiwrap.instances ( + name: cfg: nameValuePair "fcgiwrap-${name}" (f cfg) + ); + +in { + options.services.fcgiwrap.instances = mkOption { + description = "Configuration for fcgiwrap instances."; + default = { }; + type = types.attrsOf (types.submodule ({ config, ... }: { options = { + process.prefork = mkOption { + type = types.ints.positive; + default = 1; + description = "Number of processes to prefork."; + }; + + process.user = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + User as which this instance of fcgiwrap will be run. + Set to `null` (the default) to use a dynamically allocated user. + ''; + }; + + process.group = mkOption { + type = types.nullOr types.str; + default = null; + description = "Group as which this instance of fcgiwrap will be run."; + }; + + socket.type = mkOption { + type = types.enum [ "unix" "tcp" "tcp6" ]; + default = "unix"; + description = "Socket type: 'unix', 'tcp' or 'tcp6'."; + }; + + socket.address = mkOption { + type = types.str; + default = "/run/fcgiwrap-${config._module.args.name}.sock"; + example = "1.2.3.4:5678"; + description = '' + Socket address. + In case of a UNIX socket, this should be its filesystem path. + ''; + }; + + socket.user = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + User to be set as owner of the UNIX socket. + ''; + }; + + socket.group = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Group to be set as owner of the UNIX socket. + ''; + }; + + socket.mode = mkOption { + type = types.nullOr types.str; + default = if config.socket.type == "unix" then "0600" else null; + defaultText = literalExpression '' + if config.socket.type == "unix" then "0600" else null + ''; + description = '' + Mode to be set on the UNIX socket. + Defaults to private to the socket's owner. + ''; + }; + }; })); + }; + + config = { + assertions = concatLists (mapAttrsToList (name: cfg: [ + { + assertion = cfg.socket.type == "unix" -> cfg.socket.user != null; + message = "Socket owner is required for the UNIX socket type."; + } + { + assertion = cfg.socket.type == "unix" -> cfg.socket.group != null; + message = "Socket owner is required for the UNIX socket type."; + } + { + assertion = cfg.socket.user != null -> cfg.socket.type == "unix"; + message = "Socket owner can only be set for the UNIX socket type."; + } + { + assertion = cfg.socket.group != null -> cfg.socket.type == "unix"; + message = "Socket owner can only be set for the UNIX socket type."; + } + { + assertion = cfg.socket.mode != null -> cfg.socket.type == "unix"; + message = "Socket mode can only be set for the UNIX socket type."; + } + ]) config.services.fcgiwrap.instances); + + systemd.services = forEachInstance (cfg: { + after = [ "nss-user-lookup.target" ]; + wantedBy = optional (cfg.socket.type != "unix") "multi-user.target"; + + serviceConfig = { + ExecStart = '' + ${pkgs.fcgiwrap}/sbin/fcgiwrap ${cli.toGNUCommandLineShell {} ({ + c = cfg.process.prefork; + } // (optionalAttrs (cfg.socket.type != "unix") { + s = "${cfg.socket.type}:${cfg.socket.address}"; + }))} + ''; + } // (if cfg.process.user != null then { + User = cfg.process.user; + Group = cfg.process.group; + } else { + DynamicUser = true; + }); + }); + + systemd.sockets = forEachInstance (cfg: mkIf (cfg.socket.type == "unix") { + wantedBy = [ "sockets.target" ]; + socketConfig = { + ListenStream = cfg.socket.address; + SocketUser = cfg.socket.user; + SocketGroup = cfg.socket.group; + SocketMode = cfg.socket.mode; + }; + }); + }; +} diff --git a/nixos/modules/services/web-servers/fcgiwrap.nix b/nixos/modules/services/web-servers/fcgiwrap.nix index 3250e9c05ed6..1c89ae261bee 100644 --- a/nixos/modules/services/web-servers/fcgiwrap.nix +++ b/nixos/modules/services/web-servers/fcgiwrap.nix @@ -4,6 +4,18 @@ with lib; let cfg = config.services.fcgiwrap; + deprecationNote = '' + + This global instance option is deprecated in favour of per-instance + options configured through `services.fcgiwrap.instances.*`. + ''; + securityWarning = '' + The fcgiwrap module is configured with a global shared instance. + This has security implications. See advisory: https://discourse.nixos.org/t/51419 + Isolated instances should instead be configured through `services.fcgiwrap.instances.*'. + The global options at `services.fcgiwrap.*` will be removed in NixOS 24.11. + ''; + in { options = { @@ -11,43 +23,66 @@ in { enable = mkOption { type = types.bool; default = false; - description = "Whether to enable fcgiwrap, a server for running CGI applications over FastCGI."; + description = "Whether to enable fcgiwrap, a server for running CGI applications over FastCGI." + deprecationNote; + }; + + allowGlobalInstanceLocalPrivilegeEscalation = mkOption { + type = types.bool; + default = false; + description = '' + The global instance of fcgiwrap configured through this module + has a local privilege escalation vulnerability. + Set this option to true to accept the risk and bypass the evaluation + failure regardless. + ''; }; preforkProcesses = mkOption { type = types.int; default = 1; - description = "Number of processes to prefork."; + description = "Number of processes to prefork." + deprecationNote; }; socketType = mkOption { type = types.enum [ "unix" "tcp" "tcp6" ]; default = "unix"; - description = "Socket type: 'unix', 'tcp' or 'tcp6'."; + description = "Socket type: 'unix', 'tcp' or 'tcp6'." + deprecationNote; }; socketAddress = mkOption { type = types.str; default = "/run/fcgiwrap.sock"; example = "1.2.3.4:5678"; - description = "Socket address. In case of a UNIX socket, this should be its filesystem path."; + description = "Socket address. In case of a UNIX socket, this should be its filesystem path." + deprecationNote; }; user = mkOption { type = types.nullOr types.str; default = null; - description = "User permissions for the socket."; + description = "User permissions for the socket." + deprecationNote; }; group = mkOption { type = types.nullOr types.str; default = null; - description = "Group permissions for the socket."; + description = "Group permissions for the socket." + deprecationNote; }; }; }; config = mkIf cfg.enable { + assertions = [ + { + assertion = cfg.allowGlobalInstanceLocalPrivilegeEscalation; + message = securityWarning + '' + To temporarily accept the risk and continue using the global instance, + set `services.fcgiwrap.allowGlobalInstanceLocalPrivilegeEscalation` to true. + ''; + } + ]; + + warnings = [ securityWarning ]; + systemd.services.fcgiwrap = { after = [ "nss-user-lookup.target" ]; wantedBy = optional (cfg.socketType != "unix") "multi-user.target"; diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix index 0f596386ace9..6f899c924ff2 100644 --- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix +++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix @@ -1,20 +1,20 @@ { beta = import ./browser.nix { channel = "beta"; - version = "128.0.2739.5"; + version = "128.0.2739.42"; revision = "1"; - hash = "sha256-y+587iVWgPk2a1P/F2iwSW1NEnAJaigL6rlVmqaIDJk="; + hash = "sha256-VcBn2WL4rdAeEa62XT/dhC2OFLsV0Q/Sp6hqgmc/e0Y="; }; dev = import ./browser.nix { channel = "dev"; - version = "128.0.2739.5"; + version = "129.0.2779.0"; revision = "1"; - hash = "sha256-zY3iGbeYlOoArNNdF1qNwdtp25P0uWJmVMEK7kJIiqQ="; + hash = "sha256-hlamsHTpBMGwOICga0k874q8+xuaZFMofFLG/EvB0NU="; }; stable = import ./browser.nix { channel = "stable"; - version = "127.0.2651.86"; + version = "128.0.2739.42"; revision = "1"; - hash = "sha256-1Dh+OoTrghn9ArvEnBZCkLnUf0m0qnkEtCoWjA8QId4="; + hash = "sha256-AwdZX2Ens2+rhHLYV0efYsXYBTs2a57HyGz2k+IDMeQ="; }; } diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix index 6e860d2318c4..f52622591763 100644 --- a/pkgs/applications/networking/cluster/argocd/default.nix +++ b/pkgs/applications/networking/cluster/argocd/default.nix @@ -2,17 +2,17 @@ buildGoModule rec { pname = "argocd"; - version = "2.11.3"; + version = "2.11.7"; src = fetchFromGitHub { owner = "argoproj"; repo = "argo-cd"; rev = "v${version}"; - hash = "sha256-qSrMqByhOitRltYaVjIeubuoTR74x/pQ1Ad+uTPdpJU="; + hash = "sha256-/gbclPcYSDobwftFi0CECgBp6PNqxHW9svP3A5y8eEY="; }; proxyVendor = true; # darwin/linux hash mismatch - vendorHash = "sha256-atgNLlHoX+KBtJcYZNqNsYBK0cVGI/k2mXvmcr6wWN4="; + vendorHash = "sha256-y6B//zal2OyzZ1slC+x3vxHasFTM+xD+/6Sd2AFHFgY="; # Set target as ./cmd per cli-local # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227 diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/by-name/bu/bup/package.nix similarity index 63% rename from pkgs/tools/backup/bup/default.nix rename to pkgs/by-name/bu/bup/package.nix index 07ae258a675f..91fb2b3c3f71 100644 --- a/pkgs/tools/backup/bup/default.nix +++ b/pkgs/by-name/bu/bup/package.nix @@ -1,15 +1,33 @@ -{ lib, stdenv, fetchFromGitHub, makeWrapper -, perl, pandoc, python3, git -, par2cmdline ? null, par2Support ? true +{ + lib, + stdenv, + fetchFromGitHub, + makeWrapper, + perl, + pandoc, + python3, + git, + + par2Support ? true, + par2cmdline ? null, }: assert par2Support -> par2cmdline != null; let - version = "0.33.3"; + version = "0.33.4"; - pythonDeps = with python3.pkgs; [ setuptools tornado ] - ++ lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ]; + pythonDeps = + with python3.pkgs; + [ + setuptools + tornado + ] + ++ lib.optionals (!stdenv.isDarwin) [ + pyxattr + pylibacl + fuse + ]; in stdenv.mkDerivation { @@ -20,11 +38,18 @@ stdenv.mkDerivation { repo = "bup"; owner = "bup"; rev = version; - hash = "sha256-w7yPs7hG4v0Kd9i2tYhWH7vW95MAMfI/8g61MB6bfps="; + hash = "sha256-9rWzHONcu4W/JcnDUGPbuGksroODbhdL6bNF+3Dd2ag="; }; - buildInputs = [ git python3 ]; - nativeBuildInputs = [ pandoc perl makeWrapper ]; + buildInputs = [ + git + python3 + ]; + nativeBuildInputs = [ + pandoc + perl + makeWrapper + ]; postPatch = "patchShebangs ."; @@ -37,7 +62,8 @@ stdenv.mkDerivation { "LIBDIR=$(out)/lib/bup" ]; - env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration -Wno-error=implicit-int"; + env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang + "-Wno-error=implicit-function-declaration -Wno-error=implicit-int"; postInstall = '' wrapProgram $out/bin/bup \ diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix index d3e051e96bb2..a119dec0ca4e 100644 --- a/pkgs/development/interpreters/php/8.2.nix +++ b/pkgs/development/interpreters/php/8.2.nix @@ -2,8 +2,8 @@ let base = callPackage ./generic.nix (_args // { - version = "8.2.21"; - hash = "sha256-+Ydv59TZbUGs7RmbWKH3rntmVd3JJnMTX+3tf2k5138="; + version = "8.2.23"; + hash = "sha256-98kM2no8HeAfO/t7Rp1S3snrovO4MyCDYAT5wu7K4ms="; }); in base.withExtensions ({ all, ... }: with all; ([ diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix index 53c720a01346..bb314d4e854d 100644 --- a/pkgs/development/interpreters/php/8.3.nix +++ b/pkgs/development/interpreters/php/8.3.nix @@ -2,8 +2,8 @@ let base = callPackage ./generic.nix (_args // { - version = "8.3.9"; - hash = "sha256-lu3G2Ct1A6ZlBUH8R3q9VFbfKN+qjJOI/54x2f4eMRI="; + version = "8.3.11"; + hash = "sha256-ZkDiRVCAqJrcQdTle7BPjCv7fuxif+GZr5c7/zTX8O4="; }); in base.withExtensions ({ all, ... }: with all; ([ diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix index 343574f251a8..42a180949be2 100644 --- a/pkgs/development/libraries/duckdb/default.nix +++ b/pkgs/development/libraries/duckdb/default.nix @@ -30,6 +30,14 @@ stdenv.mkDerivation (finalAttrs: { rev = "refs/tags/v${finalAttrs.version}"; }; + patches = [ + (fetchpatch { + name = "CVE-2024-41672.patch"; + url = "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a.patch"; + hash = "sha256-Zb962mWIgy2t/0csbwZ8BcLgpdIA9/JpJ0+EWr1Kg1g="; + }) + ]; + outputs = [ "out" "lib" "dev" ]; nativeBuildInputs = [ cmake ninja python3 ]; diff --git a/pkgs/development/tools/database/litestream/default.nix b/pkgs/development/tools/database/litestream/default.nix index fa47959a333c..976bc77e544e 100644 --- a/pkgs/development/tools/database/litestream/default.nix +++ b/pkgs/development/tools/database/litestream/default.nix @@ -27,5 +27,6 @@ buildGoModule rec { license = licenses.asl20; homepage = "https://litestream.io/"; maintainers = with maintainers; [ fbrs ]; + knownVulnerabilities = [ "CVE-2024-41254" ]; }; } diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix index 666e812a691b..fd66967da051 100644 --- a/pkgs/servers/mattermost/default.nix +++ b/pkgs/servers/mattermost/default.nix @@ -12,13 +12,13 @@ buildGoModule rec { # See https://docs.mattermost.com/upgrade/extended-support-release.html # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update # the version regex in passthru.updateScript as well. - version = "9.5.8"; + version = "9.5.9"; src = fetchFromGitHub { owner = "mattermost"; repo = "mattermost"; rev = "v${version}"; - hash = "sha256-WK3O1t2mMqftH8EB12g1/xzQnnmJxSsBjaGrRk0Hypw="; + hash = "sha256-mGTLn1aV6pB/ubqtYYF1zNRAaLj5IsdQTLhf1LzcNho="; }; # Needed because buildGoModule does not support go workspaces yet. @@ -34,7 +34,7 @@ buildGoModule rec { webapp = fetchurl { url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz"; - hash = "sha256-gUp/Y0hI3oZkyTnEvyNXtHtPx77MC5zz+Z4b0FdrsqM="; + hash = "sha256-TgaRDIxGBoow1//99bGpp91HNYgdWRnoS09EDAFcHDs="; }; # Makes nix-update-script pick up the fetchurl for the webapp. diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 52937b2d7a59..36168290db68 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6472,8 +6472,6 @@ with pkgs; bumpver = callPackage ../applications/version-management/bumpver { }; - bup = callPackage ../tools/backup/bup { }; - bupstash = darwin.apple_sdk_11_0.callPackage ../tools/backup/bupstash { }; burp = callPackage ../tools/backup/burp { };