…24-09-02

(cherry picked from commit f8a752f)

(cherry picked from commit a597aac)

…r script (NixOS#342234)

(cherry picked from commit 9f3c106)

(cherry picked from commit f24fd1b)

…24-02-23 -> 0-unstable-2024-09-02 (NixOS#342958)

smartctl_exporter already runs with SupplementaryGroups "disk", which
gives full access to SATA drives, but NVMe devices are owned by
root:root, resulting in no access:

  [...] msg="Smartctl open device: /dev/nvme0 failed: Permission denied"

This patch introduces a "smartctl-exporter-access" supplementary
group, and an udev rule with setfacl to give the exporter access to NVMe
drives, without changing the base root:root ownership.

Fixes NixOS#210041

(cherry picked from commit 86a6ef5)

(cherry picked from commit cf71c1d)

(cherry picked from commit 14dec03)

(cherry picked from commit 1389dc9)

Follow up to NixOS#342584.

Similarly to that PR, it is surprising that software which was installed by the user isn't available to a script run over ssm by default.

When executing commands with ssm, users will now have more predictable access to baked-in software instead of an extremely bare-minimum set currently there.

(cherry picked from commit 7547a1f)

It is surprising that software which was installed by the user at AMI
generation time isn't available to a script run over user data by
default.

When authoring user data to execute at startup, users will now have
more predictable access to baked-in software instead of an extremely
bare-minimum set currently there.

(cherry picked from commit 76b614b)

https://blog.torproject.org/new-release-tor-browser-1354/
(cherry picked from commit 9366f2b)

https://github.com/patroni/patroni/blob/v3.3.3/docs/releases.rst#version-333

https://github.com/envoyproxy/envoy/releases/tag/v1.30.6

CVE-2024-45808: Malicious log injection via access logs
CVE-2024-45806: Potential manipulate x-envoy headers from external sources
CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs
CVE-2024-45810: Envoy crashes for LocalReply in http async client

(cherry picked from commit ff4117b)

…ixOS#342917)

…43160)

…28892)

Diff: NixOS/nix@2.24.6...2.24.7
(cherry picked from commit 1517e22)

Diff: NixOS/nix@2.18.5...2.18.7
(cherry picked from commit 9d6e0fc)

Diff: NixOS/nix@b9d3cdf...ca3fc16
(cherry picked from commit 4976e15)

- rcu uses requireFile as src, so it cannot be built on Hydra

(cherry picked from commit fe0a550)

This update cannot be done by the nixpkgs bot, as
the structure of the project has been changed, so why wait.

The mautrix-meta project has been moved under "cmd/mautrix-meta"
There is also "cmd/lscli", but since this package is mainly
about mautrix-meta, I think we can stay with this specific cmd.
If we wanted, we could switch to both of them by removing this
`subPackages` attribute.

(cherry picked from commit 9ef2c90)

Based on 2641d97, to allow easier backporting.

(cherry picked from commit 1521f96)

https://github.com/grafana/agent/releases/tag/v0.43.0

https://github.com/grafana/agent/blob/v0.43.0/CHANGELOG.md

diff: grafana/agent@v0.42.0...v0.43.0
(cherry picked from commit 3e49c02)

Changelog: https://arc.net/e/123493AC-A3B7-470F-BC09-DC700B348B59
(cherry picked from commit 7a16ca4)

…ixOS#343301)

…14 -> 3.10.15; python313: 3.13.0rc1 -> 3.13.0rc2 (NixOS#341284)

…ilities (NixOS#338019)

(cherry picked from commit 6eccab7)

(cherry picked from commit 3256113)

https://community.brave.com/t/release-channel-1-70-117/569641
(cherry picked from commit c85d499)

Changelog: https://arc.net/e/2ADFA60D-66AF-42A2-9775-DA1E8152D050
(cherry picked from commit 8acb918)

https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html

This update includes 9 security fixes.

CVEs:
CVE-2024-8904 CVE-2024-8905 CVE-2024-8906 CVE-2024-8907 CVE-2024-8908
CVE-2024-8909

(cherry picked from commit a444490)

(cherry picked from commit 67b5852)

…ixOS#343495)

…0.6668.58-1 (NixOS#343548)

…3581)

(cherry picked from commit 0c6b57f)

(cherry picked from commit 7be9dd1)

(cherry picked from commit 9caaafc)

(cherry picked from commit 8429191)

(cherry picked from commit 53426bf)

(cherry picked from commit 718c93e)

…58 (Linux) (NixOS#343666)

https://github.com/element-hq/synapse/releases/tag/v1.115.0
(cherry picked from commit 8d761e6)

ChangeLog: https://github.com/requarks/wiki/releases/tag/v2.5.304
(cherry picked from commit 149ed25)

…31.0b2 -> 131.0b9 (NixOS#343685)

…2024-45298 (NixOS#343754)

…1.115.0 (NixOS#343740)

Changelog: https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v1.0.1
(cherry picked from commit 061d9eb)

(cherry picked from commit e644b0d)

Chrome uses partial rollout for Darwin and Windows

This is represented by `fractionGroup` and `fraction`.

0.25 means 25% of users, 0.5 means 50% of users and so on.

Partial rollouts aren't done on linux, and so `fraction` and `fractionalGroup` is always 1 for it.

Here we add some additional parameters to chrome version history api endpoint, to get the latest version, sort the versions in descending order.

These parameters are redundant on Linux but kept anyway.

See NixOS#343552 (comment)
Docs: https://developer.chrome.com/docs/web-platform/versionhistory/reference#filter

(cherry picked from commit bc4914b)

update script works now, yay!

(cherry picked from commit 22d8492)

…59 (Darwin); fix update script (NixOS#343879)

…xOS#340761)

…0esr (NixOS#342228)

(cherry picked from commit 03f1d51)

(cherry picked from commit a7b2353)

(cherry picked from commit f4c81f9)

(cherry picked from commit 02e6cbc)

(cherry picked from commit 28306a7)

…ixOS#343932)

(cherry picked from commit a0b89aa)

(cherry picked from commit 4008474)

Changelog: https://github.com/LostRuins/koboldcpp/releases/tag/v1.75.2
Diff: LostRuins/koboldcpp@v1.74...v1.75.2
(cherry picked from commit 6539d1b)

…indicator patch (NixOS#343894)

rustdesk-flutter: add missing libayatana-appindicator patch (NixOS#343742)

* rustdesk-flutter: nixfmt

* rustdesk-flutter: add missing libayatana-appindicator patch

(cherry picked from commit a0a0b4d)

Co-authored-by: Bot_wxt1221 <3264117476@qq.com>

…ftware and wrappers in PATH (NixOS#343105)

…to the path (NixOS#343104)

This make sure the credentials cannot be leaked in a MITM attack.
Note that this change might break some existing deployments if the users
tries to fetch resources on endpoints with invalid certificates.
The impacted users will have the following choices:
* fix the endpoint providing the resource
* override SSL_CERT_FILE to either disable the verification (not
  recommended) or to set it to a path including their CA certificate.

(cherry picked from commit a169553)

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>

…NixOS#327930)