Merge staging-next-24.05 into staging-24.05

NixOS · Sep 8, 2024 · 87b4838 · 87b4838
2 parents 9a15d72 + d3a6c98
commit 87b4838
Show file tree

Hide file tree

Showing 21 changed files with 901 additions and 889 deletions.
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -32,7 +32,7 @@
         default = false;
         type = lib.types.bool;
         description = ''
-          Enable dynamic CDI configuration for NVidia devices by running
+          Enable dynamic CDI configuration for Nvidia devices by running
           nvidia-container-toolkit on boot.
         '';
       };

diff --git a/nixos/modules/services/web-apps/flarum.nix b/nixos/modules/services/web-apps/flarum.nix
@@ -106,8 +106,14 @@ in {
 
     createDatabaseLocally = mkOption {
       type = types.bool;
-      default = true;
-      description = "Create the database and database user locally, and run installation.";
+      default = false;
+      description = ''
+        Create the database and database user locally, and run installation.
+
+        WARNING: Due to https://github.com/flarum/framework/issues/4018, this option is set
+        to false by default. The 'flarum install' command may delete existing database tables.
+        Only set this to true if you are certain you are working with a fresh, empty database.
+      '';
     };
   };
 
@@ -116,6 +122,7 @@ in {
       isSystemUser = true;
       home = cfg.stateDir;
       createHome = true;
+      homeMode = "755";
       group = cfg.group;
     };
     users.groups.${cfg.group} = {};
@@ -194,8 +201,6 @@ in {
         cp -f ${cfg.package}/share/php/flarum/{extend.php,site.php,flarum} .
         ln -sf ${cfg.package}/share/php/flarum/vendor .
         ln -sf ${cfg.package}/share/php/flarum/public/index.php public/
-        chmod a+x . public
-        chmod +x site.php extend.php flarum
       '' + optionalString (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
         if [ ! -f config.php ]; then
             php flarum install --file=${flarumInstallConfig}

diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
@@ -84,7 +84,7 @@ in
       description = ''
         **Deprecated**, please use hardware.nvidia-container-toolkit.enable instead.
 
-        Enable use of NVidia GPUs from within podman containers.
+        Enable use of Nvidia GPUs from within podman containers.
       '';
     };
 

diff --git a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
diff --git a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -33,11 +33,11 @@
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "129.0b9";
+    version = "131.0b2";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "f4f9efb640c7db12301b1b7d23b417e6786a9072f617d2e8a1bdbcaaa4d50d6a4d49d06566d3fff7b066b32ad39aeb0dcd003721c110c2add77dbd3d68df6a0c";
+      sha512 = "1716b4189600d5eea9957c1ad2325a635f1f1178fb6e836bc9fe07d3ee2a71d5186af9511ad3e494403023834b58f7acb0b2716ee2acd5300797e2e8680b7cb8";
     };
 
     meta = {
@@ -62,13 +62,13 @@
 
   firefox-devedition = buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "129.0b9";
+    version = "131.0b2";
     applicationName = "Mozilla Firefox Developer Edition";
     requireSigning = false;
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "225c7abd58b7dd1e6c54e4a5172b7dc4ea19f9f90930d6823d15f2f80524f4f910eb4cb7cf3f863722490447ac8f146654ab129ee89766306b4a6992e2706b20";
+      sha512 = "704d30f4c5d2a7cddda53f572551cc5fe49bc380388bda5c0eceac121c7d91ee616f586231a33539bb277aa4ea4e963a0d7f4d40f9738d4d30e4a3da75233d97";
     };
 
     meta = {

diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "6.8.3381.46";
+  version = "6.9.3447.37";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-OR79+Y2z9b8aE5WecIlbJsJx6wdMDnlWjCE9HYmOfn0=";
-      x86_64-linux = "sha256-F8HibI1fWI0nPWaXDNgrSHcp2iTuC9LZhble877zrMg=";
+      aarch64-linux = "sha256-kYTnWad/jrJt9z+AhjXzHYxVSIwIIO3RKD7szuPEg2s=";
+      x86_64-linux = "sha256-+h7SHci8gZ+epKFHD0PiXyME2xT+loD2KXpJGFCfIFg=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,52 +2,52 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.66";
-      ptb = "0.0.101";
-      canary = "0.0.479";
-      development = "0.0.25";
+      stable = "0.0.67";
+      ptb = "0.0.103";
+      canary = "0.0.483";
+      development = "0.0.27";
     } else {
-      stable = "0.0.317";
-      ptb = "0.0.131";
-      canary = "0.0.587";
-      development = "0.0.47";
+      stable = "0.0.318";
+      ptb = "0.0.133";
+      canary = "0.0.591";
+      development = "0.0.49";
     };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-tbpo1+fbziJk2JdaMyAW5Ynb0wuWkLdcDnzQbiZJ47A=";
+        hash = "sha256-L8COdPP4SFRO+1mipjn4tjLR+xShcJbT/72yhNHdSWg=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-JesxPoYybVLVwTrDwG2kO6Pikq7qvn7CO8j+24dwjBc=";
+        hash = "sha256-BYzISVHSlKqVN0Egkw5su1wJnrGjQYbxYV840bDCakM=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-mirioiRpwQB07sL1avGYk2+Cnmdw7PW808AAA6p2Y0U=";
+        hash = "sha256-AWYRQxD0FPqRo1TXUR9wWhZTUr34MRFaBTXzhNcwGKI=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-9dwZ89YOs2iNOeoVrGfNHwr4mvfXmPk1SrJYoteYakY=";
+        hash = "sha256-0AfATkHqw5gfbQ27DvM+QoLZgspYWKG09jWWNWERnmQ=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-SX6a2qPSFURL00dMLrHSI4+964Xc76ada4PUMlG1V9U=";
+        hash = "sha256-Ot6IM6EAg4MQPp0JqvUOZNAor6Nr6luc6pGY+722GMo=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/wuYPjGh/RJZSDeo8r78YEbCYj+qZWTaIDIfKuSH+r0=";
+        hash = "sha256-FFp6CRgD/kpCVxJ4+es0DaOGaW5v2Aa+lzJdG2Zu8eY=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-6m6wmGzVOEY2oVAHsSMsAtgQK5zqC0D7U3s28pcH0ss=";
+        hash = "sha256-TIXe8cy6feME0900R5aWyItZfUrUA8zXo0pqwQ79yAM=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-mgVCuTE2zYFRUW6Ukw7mUmPnOR4g/QUFYlWI3bux0es=";
+        hash = "sha256-kfHnS1NHuPD7UR7XvMdtY2LPsDRJVQHk7/Nm+cR/KGc=";
       };
     };
     aarch64-darwin = x86_64-darwin;

diff --git a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@@ -5,6 +5,7 @@
 , installShellFiles
 , nixosTests
 , enableDbusUi ? true
+, wrapGAppsHook3
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -61,6 +62,15 @@ python3Packages.buildPythonApplication rec {
   ]
   ++ lib.flatten (lib.attrValues optional-dependencies);
 
+  nativeBuildInputs = lib.optionals enableDbusUi [
+    wrapGAppsHook3
+  ];
+
+  dontWrapGApps = enableDbusUi;
+  makeWrapperArgs = lib.optionals enableDbusUi [
+    "\${gappsWrapperArgs[@]}"
+  ];
+
   # darwin has difficulty communicating with server, fails some integration tests
   doCheck = !stdenv.isDarwin;
 

diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.1.12";
+  version = "1.1.14";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    hash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
+    hash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
   };
 
   vendorHash = null;

diff --git a/pkgs/development/compilers/unison/default.nix b/pkgs/development/compilers/unison/default.nix
@@ -13,17 +13,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unison-code-manager";
-  version = "0.5.25";
+  version = "0.5.26";
 
   src = if stdenv.isDarwin then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos.tar.gz";
-      hash = "sha256-Tc9XYWCap3N9KX5k6M83L1efwz2cG3bmv5tyY4zuFPQ=";
+      hash = "sha256-RF2Q5sCxT9F3IGM/8UP6bEe9sOjtpMVYHREuAPOzh8g=";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux.tar.gz";
-      hash = "sha256-I1UIkwxw/ePv8dWFT4o/FSaYuBGbvoVURk5sHX7gtL4=";
+      hash = "sha256-t0rc1f4PfjHRu/tzoW8sJ/6R0KBbYQPiWHqsIaqc+SY=";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.

diff --git a/pkgs/development/libraries/apr/default.nix b/pkgs/development/libraries/apr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apr";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchurl {
     url = "mirror://apache/apr/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-/GSN6YPzoqbJ543qHxgGOb0vrWwG1VbUNnpwH+XDVXc=";
+    hash = "sha256-zQ9dUrmrFwTHIWDF7j7V09TKLfSn+KtWTjyzUrZyMvI=";
   };
 
   patches = [

diff --git a/pkgs/development/libraries/arrayfire/default.nix b/pkgs/development/libraries/arrayfire/default.nix
@@ -32,7 +32,7 @@
 , openclSupport ? !stdenv.isDarwin
   # This argument lets one run CUDA & OpenCL tests on non-NixOS systems by
   # telling Nix where to find the drivers. If you know the version of the
-  # NVidia driver that is installed on your system, you can do:
+  # Nvidia driver that is installed on your system, you can do:
   #
   # arrayfire.override {
   #   nvidiaComputeDrivers =

diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "2.28.8";
-  hash = "sha256-A1DYZrvJ8SRujroVwqPfcTOSgLnT5xRat/RVdq2fL/o=";
+  version = "2.28.9";
+  hash = "sha256-/Bm05CvS9t7WSh4qoMconCaD7frlmA/H9YDyJOuGuFE=";
 }
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,18 +1,6 @@
-{ callPackage
-, fetchpatch
-}:
+{ callPackage }:
 
 callPackage ./generic.nix {
-  version = "3.6.0";
-  hash = "sha256-tCwAKoTvY8VCjcTPNwS3DeitflhpKHLr6ygHZDbR6wQ=";
-
-  patches = [
-    # https://github.com/Mbed-TLS/mbedtls/pull/9000
-    # Remove at next version update
-    (fetchpatch {
-      name = "fix-darwin-memcpy-error.patch";
-      url = "https://github.com/Mbed-TLS/mbedtls/commit/b32d7ae0fee2f906be59780b42a0cd4468a39bd1.patch";
-      hash = "sha256-BTkJs9NEkCl+/Q8EwB/LW9uwF95jQOKWmoCK4B/7/sU=";
-    })
-  ];
+  version = "3.6.1";
+  hash = "sha256-SVWz2uOvGIplnBr4g6nwfxKMWVpzdZjusseAhw6GOJ8=";
 }
diff --git a/pkgs/development/libraries/openimageio/default.nix b/pkgs/development/libraries/openimageio/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , boost
 , cmake
 , giflib
@@ -24,6 +25,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-FtUZqk1m9ahdnwhrBeMFkUbV0dangMY/w9ShevCASfo=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-40630.patch";
+      url = "https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/0a2dcb4cf2c3fd4825a146cd3ad929d9d8305ce3.patch";
+      hash = "sha256-zwKcXRVjf8oq3MO6twfjbY9oM1M7GtV7usrXCT5cwWo=";
+    })
+  ];
+
   # Workaround broken zlib version detecion in CMake < 3.37.
   postPatch = ''
     substituteInPlace ./src/cmake/Config.cmake.in \

diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.0.8";
+  version = "5.0.9";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-mH8o1f3UMuKEHwfXK2ck1GVj/T50F+7IgTsnXJn7aHU=";
+    hash = "sha256-0SZoA9kQ+UTc6V28pRMqqpL9FlWSfKXbGrNWO93a19Y=";
   };
 
   patches =

diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
@@ -11,12 +11,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.81.2";
+  version = "1.82.0";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-Yz4H71doc5QC+AX5iSmOwewuKjU9dnK5ijVzYoOedYc=";
+    hash = "sha256-+USKcwmjapDH+zet7lHSWS6vT1GZ0ch+yPBRD2BrLS0=";
   };
 
   dontPatch = true;

diff --git a/pkgs/tools/X11/bumblebee/default.nix b/pkgs/tools/X11/bumblebee/default.nix
@@ -11,7 +11,7 @@
 # 2. then run 'bumblebeed' as root
 # 3. Then either 'optirun glxinfo' or 'primusrun glxinfo' as user.
 #
-# The glxinfo output should indicate the NVidia driver is being used
+# The glxinfo output should indicate the Nvidia driver is being used
 # and all expected extensions are supported.
 #
 # To use at startup, see hardware.bumblebee options.

diff --git a/pkgs/tools/misc/nvfancontrol/default.nix b/pkgs/tools/misc/nvfancontrol/default.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = with lib; {
-    description = "NVidia dynamic fan control for Linux";
+    description = "Nvidia dynamic fan control for Linux";
     homepage = "https://github.com/foucault/nvfancontrol";
     changelog = "https://github.com/foucault/nvfancontrol/releases/tag/${version}";
     license = with licenses; [ gpl3Only ];

diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.18.2";
+  version = "8.18.3";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = "gitleaks";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+UPlknAwmIeXlosHBXl3qPREV186lfDZGZG/Zx1rxYs=";
+    hash = "sha256-OLs3rpP6s6ZyCUKkD5Sl/tAMl3gSBWrUUFYeNffiXEs=";
   };
 
-  vendorHash = "sha256-30IJNP4XuV2YNy1TumPUju+GrHFBYi76coy0bJBqDI4=";
+  vendorHash = "sha256-DgCtWRo5KNuFCdhGJvzoH2v8n7mIxNk8eHyZFPUPo24=";
 
   ldflags = [
     "-s"