Update nixpkgs (2024-09-23)

[dpausp]

Update nixpkgs (2024-09-23)

Pull upstream NixOS changes, security fixes and package updates:

• asterisk: 20.9.2 -> 20.9.3
• cacert: 3.101 -> 3.104
• calibre: add patches for CVE-2024-6781, CVE-2024-6782, CVE-2024-7008, CVE-2024-7009
• clamav: 1.3.1 -> 1.3.2
• curl: apply patch for CVE-2024-8096
• k3s_1_28: 1.28.12+k3s1 -> 1.28.13+k3s1
• k3s_1_29: 1.29.7+k3s2 -> 1.29.8+k3s1
• k3s_1_30: 1.30.3+k3s1 -> 1.30.4+k3s1
• k3s_1_31: init 1.31.0+k3s1
• python312: 3.12.4 -> 3.12.5
• python3Packages.urllib3: 2.2.1 -> 2.2.2
• ruby: 3.3.4 -> 3.3.5
• runc: 1.1.12 -> 1.1.14
• slurm: 23.11.9.1 -> 23.11.10.1
• strace: 6.10 -> 6.11
• tcpdump: 4.99.4 -> 4.99.5
• unifi7: mark insecure due to CVE-2024-42025
• unifi8: 8.1.127 -> 8.4.62
• vim: 9.1.0377 -> 9.1.0707

PL-133043

Additional commits:

• update_nixpkgs rebase fixes and output improvements
• various additions and removals in the important package list
• pinned kernel to 5.15.164 (no change)
• brought back k3s 1.27 in our nixpkgs fork which was removed upstream

@flyingcircusio/release-managers

Release process

Impact:

Changelog:

(include pkg changes)

PR release workflow (internal)

• PR has internal ticket
• internal issue ID (PL-…) part of branch name
• internal issue ID mentioned in PR description text
• ticket is on Platform agile board
• ticket state set to Pull request ready
• if ticket is more urgent than within the next few days, directly contact a member of the Platform team

Design notes

• Provide a feature toggle if the change might need to be adjusted/reverted quickly depending on context. Consider whether the default should be on or off. Example: rate limiting.
• All customer-facing features and (NixOS) options need to be discoverable from documentation. Add or update relevant documentation such that hosted and guided customers can understand it as well.

Security implications

• Security requirements defined? (WHERE)
  • pull in upstream security fixes from nixpkgs and for Gitlab regularly
• Security requirements tested? (EVIDENCE)
  • automated tests still run, works on various test VMs, including a Gitlab test machine
  • checked commit log for fixed CVEs and possible problems with updates; looked at GitLab 17 changes | GitLab