Merge release-24.05 into staging-next-24.05

2026-07-22 08:30:57 +00:00 · 2024-09-08 00:17:42 +00:00
parent 26d59383f9 431c68f05f
commit d3a6c98bff
21 changed files with 901 additions and 889 deletions
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -32,7 +32,7 @@
        default = false;
        type = lib.types.bool;
        description = ''
-          Enable dynamic CDI configuration for NVidia devices by running
+          Enable dynamic CDI configuration for Nvidia devices by running
          nvidia-container-toolkit on boot.
        '';
      };
--- a/nixos/modules/services/web-apps/flarum.nix
+++ b/nixos/modules/services/web-apps/flarum.nix
@@ -106,8 +106,14 @@ in {

    createDatabaseLocally = mkOption {
      type = types.bool;
-      default = true;
-      description = "Create the database and database user locally, and run installation.";
+      default = false;
+      description = ''
+        Create the database and database user locally, and run installation.
+
+        WARNING: Due to https://github.com/flarum/framework/issues/4018, this option is set
+        to false by default. The 'flarum install' command may delete existing database tables.
+        Only set this to true if you are certain you are working with a fresh, empty database.
+      '';
    };
  };

@@ -116,6 +122,7 @@ in {
      isSystemUser = true;
      home = cfg.stateDir;
      createHome = true;
+      homeMode = "755";
      group = cfg.group;
    };
    users.groups.${cfg.group} = {};
@@ -194,8 +201,6 @@ in {
        cp -f ${cfg.package}/share/php/flarum/{extend.php,site.php,flarum} .
        ln -sf ${cfg.package}/share/php/flarum/vendor .
        ln -sf ${cfg.package}/share/php/flarum/public/index.php public/
-        chmod a+x . public
-        chmod +x site.php extend.php flarum
      '' + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
        if [ ! -f config.php ]; then
            php flarum install --file=${flarumInstallConfig}
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -84,7 +84,7 @@ in
      description = ''
        **Deprecated**, please use hardware.nvidia-container-toolkit.enable instead.

-        Enable use of NVidia GPUs from within podman containers.
+        Enable use of Nvidia GPUs from within podman containers.
      '';
    };

--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -33,11 +33,11 @@

  firefox-beta = buildMozillaMach rec {
    pname = "firefox-beta";
-    version = "129.0b9";
+    version = "131.0b2";
    applicationName = "Mozilla Firefox Beta";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "f4f9efb640c7db12301b1b7d23b417e6786a9072f617d2e8a1bdbcaaa4d50d6a4d49d06566d3fff7b066b32ad39aeb0dcd003721c110c2add77dbd3d68df6a0c";
+      sha512 = "1716b4189600d5eea9957c1ad2325a635f1f1178fb6e836bc9fe07d3ee2a71d5186af9511ad3e494403023834b58f7acb0b2716ee2acd5300797e2e8680b7cb8";
    };

    meta = {
@@ -62,13 +62,13 @@

  firefox-devedition = buildMozillaMach rec {
    pname = "firefox-devedition";
-    version = "129.0b9";
+    version = "131.0b2";
    applicationName = "Mozilla Firefox Developer Edition";
    requireSigning = false;
    branding = "browser/branding/aurora";
    src = fetchurl {
      url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "225c7abd58b7dd1e6c54e4a5172b7dc4ea19f9f90930d6823d15f2f80524f4f910eb4cb7cf3f863722490447ac8f146654ab129ee89766306b4a6992e2706b20";
+      sha512 = "704d30f4c5d2a7cddda53f572551cc5fe49bc380388bda5c0eceac121c7d91ee616f586231a33539bb277aa4ea4e963a0d7f4d40f9738d4d30e4a3da75233d97";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "6.8.3381.46";
+  version = "6.9.3447.37";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-OR79+Y2z9b8aE5WecIlbJsJx6wdMDnlWjCE9HYmOfn0=";
-      x86_64-linux = "sha256-F8HibI1fWI0nPWaXDNgrSHcp2iTuC9LZhble877zrMg=";
+      aarch64-linux = "sha256-kYTnWad/jrJt9z+AhjXzHYxVSIwIIO3RKD7szuPEg2s=";
+      x86_64-linux = "sha256-+h7SHci8gZ+epKFHD0PiXyME2xT+loD2KXpJGFCfIFg=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,52 +2,52 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.66";
-      ptb = "0.0.101";
-      canary = "0.0.479";
-      development = "0.0.25";
+      stable = "0.0.67";
+      ptb = "0.0.103";
+      canary = "0.0.483";
+      development = "0.0.27";
    } else {
-      stable = "0.0.317";
-      ptb = "0.0.131";
-      canary = "0.0.587";
-      development = "0.0.47";
+      stable = "0.0.318";
+      ptb = "0.0.133";
+      canary = "0.0.591";
+      development = "0.0.49";
    };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-tbpo1+fbziJk2JdaMyAW5Ynb0wuWkLdcDnzQbiZJ47A=";
+        hash = "sha256-L8COdPP4SFRO+1mipjn4tjLR+xShcJbT/72yhNHdSWg=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-JesxPoYybVLVwTrDwG2kO6Pikq7qvn7CO8j+24dwjBc=";
+        hash = "sha256-BYzISVHSlKqVN0Egkw5su1wJnrGjQYbxYV840bDCakM=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-mirioiRpwQB07sL1avGYk2+Cnmdw7PW808AAA6p2Y0U=";
+        hash = "sha256-AWYRQxD0FPqRo1TXUR9wWhZTUr34MRFaBTXzhNcwGKI=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-9dwZ89YOs2iNOeoVrGfNHwr4mvfXmPk1SrJYoteYakY=";
+        hash = "sha256-0AfATkHqw5gfbQ27DvM+QoLZgspYWKG09jWWNWERnmQ=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-SX6a2qPSFURL00dMLrHSI4+964Xc76ada4PUMlG1V9U=";
+        hash = "sha256-Ot6IM6EAg4MQPp0JqvUOZNAor6Nr6luc6pGY+722GMo=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/wuYPjGh/RJZSDeo8r78YEbCYj+qZWTaIDIfKuSH+r0=";
+        hash = "sha256-FFp6CRgD/kpCVxJ4+es0DaOGaW5v2Aa+lzJdG2Zu8eY=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-6m6wmGzVOEY2oVAHsSMsAtgQK5zqC0D7U3s28pcH0ss=";
+        hash = "sha256-TIXe8cy6feME0900R5aWyItZfUrUA8zXo0pqwQ79yAM=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-mgVCuTE2zYFRUW6Ukw7mUmPnOR4g/QUFYlWI3bux0es=";
+        hash = "sha256-kfHnS1NHuPD7UR7XvMdtY2LPsDRJVQHk7/Nm+cR/KGc=";
      };
    };
    aarch64-darwin = x86_64-darwin;
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -5,6 +5,7 @@
 , installShellFiles
 , nixosTests
 , enableDbusUi ? true
+, wrapGAppsHook3
 }:

 python3Packages.buildPythonApplication rec {
@@ -61,6 +62,15 @@ python3Packages.buildPythonApplication rec {
  ]
  ++ lib.flatten (lib.attrValues optional-dependencies);

+  nativeBuildInputs = lib.optionals enableDbusUi [
+    wrapGAppsHook3
+  ];
+
+  dontWrapGApps = enableDbusUi;
+  makeWrapperArgs = lib.optionals enableDbusUi [
+    "\${gappsWrapperArgs[@]}"
+  ];
+
  # darwin has difficulty communicating with server, fails some integration tests
  doCheck = !stdenv.isDarwin;

--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "runc";
-  version = "1.1.12";
+  version = "1.1.14";

  src = fetchFromGitHub {
    owner = "opencontainers";
    repo = "runc";
    rev = "v${version}";
-    hash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
+    hash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
  };

  vendorHash = null;
--- a/pkgs/development/compilers/unison/default.nix
+++ b/pkgs/development/compilers/unison/default.nix
@@ -13,17 +13,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "unison-code-manager";
-  version = "0.5.25";
+  version = "0.5.26";

  src = if stdenv.isDarwin then
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos.tar.gz";
-      hash = "sha256-Tc9XYWCap3N9KX5k6M83L1efwz2cG3bmv5tyY4zuFPQ=";
+      hash = "sha256-RF2Q5sCxT9F3IGM/8UP6bEe9sOjtpMVYHREuAPOzh8g=";
    }
  else
    fetchurl {
      url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux.tar.gz";
-      hash = "sha256-I1UIkwxw/ePv8dWFT4o/FSaYuBGbvoVURk5sHX7gtL4=";
+      hash = "sha256-t0rc1f4PfjHRu/tzoW8sJ/6R0KBbYQPiWHqsIaqc+SY=";
    };

  # The tarball is just the prebuilt binary, in the archive root.
--- a/pkgs/development/libraries/apr/default.nix
+++ b/pkgs/development/libraries/apr/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "apr";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchurl {
    url = "mirror://apache/apr/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-/GSN6YPzoqbJ543qHxgGOb0vrWwG1VbUNnpwH+XDVXc=";
+    hash = "sha256-zQ9dUrmrFwTHIWDF7j7V09TKLfSn+KtWTjyzUrZyMvI=";
  };

  patches = [
--- a/pkgs/development/libraries/arrayfire/default.nix
+++ b/pkgs/development/libraries/arrayfire/default.nix
@@ -32,7 +32,7 @@
 , openclSupport ? !stdenv.isDarwin
  # This argument lets one run CUDA & OpenCL tests on non-NixOS systems by
  # telling Nix where to find the drivers. If you know the version of the
-  # NVidia driver that is installed on your system, you can do:
+  # Nvidia driver that is installed on your system, you can do:
  #
  # arrayfire.override {
  #   nvidiaComputeDrivers =
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:

 callPackage ./generic.nix {
-  version = "2.28.8";
-  hash = "sha256-A1DYZrvJ8SRujroVwqPfcTOSgLnT5xRat/RVdq2fL/o=";
+  version = "2.28.9";
+  hash = "sha256-/Bm05CvS9t7WSh4qoMconCaD7frlmA/H9YDyJOuGuFE=";
 }
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,18 +1,6 @@
-{ callPackage
-, fetchpatch
-}:
+{ callPackage }:

 callPackage ./generic.nix {
-  version = "3.6.0";
-  hash = "sha256-tCwAKoTvY8VCjcTPNwS3DeitflhpKHLr6ygHZDbR6wQ=";
-
-  patches = [
-    # https://github.com/Mbed-TLS/mbedtls/pull/9000
-    # Remove at next version update
-    (fetchpatch {
-      name = "fix-darwin-memcpy-error.patch";
-      url = "https://github.com/Mbed-TLS/mbedtls/commit/b32d7ae0fee2f906be59780b42a0cd4468a39bd1.patch";
-      hash = "sha256-BTkJs9NEkCl+/Q8EwB/LW9uwF95jQOKWmoCK4B/7/sU=";
-    })
-  ];
+  version = "3.6.1";
+  hash = "sha256-SVWz2uOvGIplnBr4g6nwfxKMWVpzdZjusseAhw6GOJ8=";
 }
--- a/pkgs/development/libraries/openimageio/default.nix
+++ b/pkgs/development/libraries/openimageio/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , boost
 , cmake
 , giflib
@@ -24,6 +25,14 @@ stdenv.mkDerivation rec {
    hash = "sha256-FtUZqk1m9ahdnwhrBeMFkUbV0dangMY/w9ShevCASfo=";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-40630.patch";
+      url = "https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3.patch";
+      hash = "sha256-zwKcXRVjf8oq3MO6twfjbY9oM1M7GtV7usrXCT5cwWo=";
+    })
+  ];
+
  # Workaround broken zlib version detecion in CMake < 3.37.
  postPatch = ''
    substituteInPlace ./src/cmake/Config.cmake.in \
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -45,7 +45,7 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.0.8";
+  version = "5.0.9";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
    owner = "django";
    repo = "django";
    rev = "refs/tags/${version}";
-    hash = "sha256-mH8o1f3UMuKEHwfXK2ck1GVj/T50F+7IgTsnXJn7aHU=";
+    hash = "sha256-0SZoA9kQ+UTc6V28pRMqqpL9FlWSfKXbGrNWO93a19Y=";
  };

  patches =
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -11,12 +11,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.81.2";
+  version = "1.82.0";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-Yz4H71doc5QC+AX5iSmOwewuKjU9dnK5ijVzYoOedYc=";
+    hash = "sha256-+USKcwmjapDH+zet7lHSWS6vT1GZ0ch+yPBRD2BrLS0=";
  };

  dontPatch = true;
--- a/pkgs/tools/X11/bumblebee/default.nix
+++ b/pkgs/tools/X11/bumblebee/default.nix
@@ -11,7 +11,7 @@
 # 2. then run 'bumblebeed' as root
 # 3. Then either 'optirun glxinfo' or 'primusrun glxinfo' as user.
 #
-# The glxinfo output should indicate the NVidia driver is being used
+# The glxinfo output should indicate the Nvidia driver is being used
 # and all expected extensions are supported.
 #
 # To use at startup, see hardware.bumblebee options.
--- a/pkgs/tools/misc/nvfancontrol/default.nix
+++ b/pkgs/tools/misc/nvfancontrol/default.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
  '';

  meta = with lib; {
-    description = "NVidia dynamic fan control for Linux";
+    description = "Nvidia dynamic fan control for Linux";
    homepage = "https://github.com/foucault/nvfancontrol";
    changelog = "https://github.com/foucault/nvfancontrol/releases/tag/${version}";
    license = with licenses; [ gpl3Only ];
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "gitleaks";
-  version = "8.18.2";
+  version = "8.18.3";

  src = fetchFromGitHub {
    owner = "zricethezav";
    repo = "gitleaks";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+UPlknAwmIeXlosHBXl3qPREV186lfDZGZG/Zx1rxYs=";
+    hash = "sha256-OLs3rpP6s6ZyCUKkD5Sl/tAMl3gSBWrUUFYeNffiXEs=";
  };

-  vendorHash = "sha256-30IJNP4XuV2YNy1TumPUju+GrHFBYi76coy0bJBqDI4=";
+  vendorHash = "sha256-DgCtWRo5KNuFCdhGJvzoH2v8n7mIxNk8eHyZFPUPo24=";

  ldflags = [
    "-s"