Release 2023_009 (2023-05-08)

Impact

  • [NixOS 22.11] Most services will restarted because of a core dependency change. Machines will schedule a reboot to activate the changed kernel.

NixOS 22.11 platform

  • matomo: add role matomo. Service supports external plugins and Tag Manager containers now. Migration of older Matomo installations is done automatically (PL-131353).

  • Fix IPv6 networking after first boot by re-enabling automatic link-local address generation. This problem led to confusing networking problems with new machines which went away after the first reboot (PL-130011).

  • Add opensearch and opensearch_dashboards roles, version 2.6.0. They are intended to replace Elasticsearch/Kibana 7.10.2 but the roles should only be used for new installations right now. We will provide a migration path from ES to OpenSearch later (PL-130611).

  • Pull upstream NixOS changes, security fixes and package updates (PL-131463, PL-131472):

    • element-web: 1.11.29 -> 1.11.30 (CVE-2023-30609)

    • ghostscript: add patch for CVE-2023-28879

    • gitlab: 15.10.2 -> 15.11.2

    • grafana: 9.4.7 -> 9.4.9 (CVE-2023-1387, CVE-2023-28119)

    • imagemagick: 7.1.1-6 -> 7.1.1-8

    • keycloak: 20.0.3 -> 20.0.5 (CVE-2022-1274)

    • libtiff: add patches for many related CVEs

    • libxml2: 2.10.3 → 2.10.4 (CVE-2023-29469, CVE-2023-28484)

    • linux: 5.15.107 -> 5.15.109

    • matrix-synapse: 1.81.0 -> 1.82.0

    • php81: 8.1.17 -> 8.1.18

    • python310: 3.10.9 -> 3.10.11

    • python311: 3.11.1 -> 3.11.3

    • redis: 7.0.10 -> 7.0.11 (CVE-2023-28856)

    • screen: add patch from CVE-2023-24626

    • systemd: 251.13 -> 251.15

    • tcpdump: 4.99.1 -> 4.99.4

  • Production channel URL for this release: https://hydra.flyingcircus.io/build/253806/download/1/nixexprs.tar.xz

Detailed Changes