(cherry picked from commit 5821bf9)

Part of NixOS#323379

(cherry picked from commit ced695a)

…47410)

wire-desktop on Linux uses electron 29.4.5, which is known to be
vulnerable to CVE-2024-6775:

https://github.com/wireapp/wire-desktop/blob/cf65edb5981be370f3284555512696175099e234/package.json#L85

The MacOS version is even older, and affected by this too.

(cherry picked from commit 32309e4)

…erabilities (NixOS#348501)

…e` (NixOS#348295)

Changelog: https://github.com/mikf/gallery-dl/releases/tag/v1.27.6
Diff: mikf/gallery-dl@v1.27.5...v1.27.6
(cherry picked from commit 06923ad)

Changelog: https://arc.net/e/8554E66E-831C-459A-B6C9-1E814AA5CCD8
(cherry picked from commit 257097b)

…olyfill.io usage, bump KaTeX (NixOS#348478)

(cherry picked from commit 7c84a25)

(cherry picked from commit 35d91eb)

(cherry picked from commit bd50ef4)

https://www.mozilla.org/en-US/firefox/131.0.3/releasenotes/
(cherry picked from commit 068040b)

https://www.mozilla.org/en-US/firefox/131.0.3/releasenotes/
(cherry picked from commit 82f08f3)

https://www.mediawiki.org/wiki/Release_notes/1.41#MediaWiki_1.41.4

…ixOS#348573)

(cherry picked from commit 755657b)

(cherry picked from commit aae4960)

(cherry picked from commit e55b3cf)

This allows shell.nix to be run with the latest tools instead of
the pinned ones when desired, which is probably not very often,
but useful nonetheless.

(cherry picked from commit b07c441)

Allows reusing it in more places

(cherry picked from commit 1700d00)

Also post a comment in case base branch is wrong
  This guides newcomers in how to smoothly handle the potentially scary
  situation of having thousands of commits listed in a PR.

  While CI shows the same, people might not even look at CI if the PR
  looks botched.

(cherry picked from commit 369cfa0)

(cherry picked from commit 5695bf6)

(cherry picked from commit 87a2986)

(cherry picked from commit 93dcd42)

Since NixOS#336261 we have CI that
checks that the codeowners file is valid:

https://github.com/NixOS/nixpkgs/actions/runs/11243668280/job/31260095472#step:7:34

Which files are correct (or whether they were removed) was determined
using the Git history and some grepping

(cherry picked from commit dd28082)

Apparently it started requesting reviews from code owners already
because the DRY_MODE from the global env was overridden in the local job
declaration: NixOS#347354 (comment)

(cherry picked from commit c1710f2)

The automation should never rerequest reviews from users that already
reviewed the changes, which is what was happening before this change:

NixOS#347354 (comment)

Also reorder the arguments to make more sense

(cherry picked from commit 9a054bb)

This makes this codeowner mechanism behave differently than the native
one, but there's no other way to avoid rerequesting reviews from teams
when a member already reviewed the PR.

(cherry picked from commit 1ff83b2)

(cherry picked from commit a4626d4)

Upstream recently changed their resholve solutions somewhat to support
using the ambient Nix on the user's `$PATH` or falling back to the
default nixpkgs stable `nix` otherwise. Let's update our definitions to
match.

See: nix-community/nix-direnv#513
(cherry picked from commit ea8ab50)

This effectively disables the native GitHub codeowners feature
and enables the new alternate codeowners mechanism introduced in
NixOS#336261

This means that:
- We can now declare users without write access as code owners!
- Targeting the wrong branch won't trigger mass pings anymore!

(cherry-picked from commit b01ca00)

This is not a problem anymore with the parent commit

(cherry picked from commit c246403)

…arent

Also, fix the description of the text

(cherry picked from commit c721e91)

(cherry picked from commit ddeb2df)

The codeowner-validator build declared in ci/codeowners-validator was
not cached before and needed to be built for every PR, which is slow and
wasteful: https://github.com/NixOS/nixpkgs/actions/runs/11280533037/job/31373720922

(cherry picked from commit f9b28d5)

Turns out if :<something> is passed, a local branch is updated, which
can conflict if the PR branch starts with "pr". I tried to avoid that
with the original code but apparently that didn't work!

https://github.com/NixOS/nixpkgs/actions/runs/11284183639/job/31384967152?pr=347822

    Fetching the PR commit history
    From https://github.com/linj-fork/nixpkgs
     * [new branch]            pr/kanata-add-version-check -> fork/pr
    error: cannot lock ref 'refs/remotes/fork/pr/kanata-add-version-check': 'refs/remotes/fork/pr' exists; cannot create 'refs/remotes/fork/pr/kanata-add-version-check'
     ! [new branch]            pr/kanata-add-version-check -> fork/pr/kanata-add-version-check  (unable to update local ref)
    error: some local refs could not be updated; try running

(cherry picked from commit 299a181)

Previously, headRef points to the master branch of Nixpkgs, which
basically means no code owner review will be requested.

The problem can be verified using the following command.

$ DRY_MODE=1 ./ci/request-reviews/request-reviews.sh NixOS/nixpkgs 347973 ci/OWNERS
[...]
This PR touches 0 files
Requesting reviews from: {
  "reviewers": []
}
[...]

Additionally, the comment about conflicts is removed thanks to the
unambiguous way of specifying ref.

(cherry picked from commit f4c6e11)

It's possible to have different casings in OWNERS, so we need to handle
that

(cherry picked from commit e612b89)

NixOS#348591)

988bf19 (among other things) refactored this
expression a little. This made backports no longer apply cleanly, requiring
manual backports which are tedious.

This commit backports only the part that refactors the version declaration in
order to make automated backports work again.

(The `variant` variable was unused.)

This is technically a refactor which shouldn't typically be backported but the
change is very minor and trivial to verify to be correct.

https://github.com/signalapp/Signal-Desktop/releases/tag/v7.28.0
(cherry picked from commit 6cb9724)

(cherry picked from commit df0c496)

…top-beta: 7.25.0-beta.2 -> 7.29.0-beta.1 (NixOS#348731)

NixOS#348702)

https://github.com/element-hq/element-desktop/releases/tag/v1.11.80
https://github.com/element-hq/element-desktop/releases/tag/v1.11.81

Fixes CVE-2024-47771 / GHSA-963w-49j9-gxj6

(cherry picked from commit ad974fe)

(cherry picked from commit f0ad87b)

I encountered errors when attempting to run Vitess which calls out to
mysqld_safe[1]. Several utilities are needed in order for it to run e.g.
grep, sed, env, ps, date, hostname, etc.

Additionally, if ps, kill, and grep aren't available to
scripts/CMakeLists.txt, mysqld_start can end up getting generated with
syntax errors as FIND_PROC will be substituted into the script template
as an empty string[2][3].

The presence of systemd in percona-server_innovation seems to prevent
mysqld_multi from being built on Linux so it gets patched conditionally.

This same patch could be applied to MySQL if desired.

[1]: https://github.com/vitessio/vitess/blob/v20.0.1/go/vt/mysqlctl/mysqld.go#L363-L369
[2]: https://github.com/percona/percona-server/blob/79c1086e8272ea96f162b25121b58e1b01ff853b/scripts/CMakeLists.txt#L255
[3]: https://github.com/percona/percona-server/blob/79c1086e8272ea96f162b25121b58e1b01ff853b/scripts/mysqld_safe.sh#L869

(cherry picked from commit a5dcd41)

When reworking the percona package naming towards the two release
streams "innovation" and "lts", I did not anticipate the case that two
releases are long-term supported in parallel, and that the latest
Innovation release is end-of-life and replaced by a more recent lts.

Hence, the first-level attribute names now reflect the package
major-minor versions again, augmented by attribute names pointing to
respective lts and innovation releases.

(cherry picked from commit 188b5df)

This is a new LTS release as well.

(cherry picked from commit 712028e)

This is a new LTS release as well.

(cherry picked from commit b04c93f)

(cherry picked from commit a309521)

(cherry picked from commit 1e514dc)

(cherry picked from commit 8d14fa2)

(cherry picked from commit db92bb5)

In the stable branch, the `_lts` package names for percona-server and
percona-xtrabackup remain at the still suported 8_0 packages to avoid
major version bumps during a release cycle.

…48838)

See NixOS#348931.

According to upstream, the loader blobs shipped with EDL are usually
illicitly obtained from vendors and sold [0].

[0]: https://github.com/bkerler/Loaders

(cherry picked from commit 978f4e4)

… throw with migration details (NixOS#347988)

This fixes the following warning:
ntlm_auth: /home/reloner/.local/share/lutris/runtime/Ubuntu-18.04-x86_64/libjansson.so.4: no version information available (required by /nix/store/4gcggjvzrbywi92r66p6l15hckxng2q0-samba-4.20.1/lib/samba/libcommon-auth-private-samba.so)
The reason why this issue is happening is because the Lutris FHS that you are running doesn't install jansson as a dependency. By default the WoW entry tries to prioritize the System's libraries and if it doesn't find something, it will fallback to the Lutris runtime. Since the runtime version is really old, you'll see that error.

This commit also fixes cursor issues caused by xorg in WoW.

(cherry picked from commit 8931ed7)

…xOS#349003)

Changelog: https://github.com/exelban/stats/releases/tag/v2.11.11
Diff: exelban/stats@v2.11.7...v2.11.11
(cherry picked from commit cbb3d6d)

Changelog: https://github.com/exelban/stats/releases/tag/v2.11.14
Diff: exelban/stats@v2.11.11...v2.11.14
(cherry picked from commit 656cbc4)

(cherry picked from commit a96c250)

Co-authored-by: Ulli Kehrle <[email protected]>
(cherry picked from commit 272bb21)

…ble_01

(cherry picked from commit b74a9a6)

…ble_00

(cherry picked from commit ef857f7)

…ble_04

(cherry picked from commit f60c6bd)

…ble_00

(cherry picked from commit 5126556)

(cherry picked from commit a975094)

…ble_03

Changelog: https://docs.warp.dev/getting-started/changelog#id-2024.09.05-v0.2024.09.03.08.02
(cherry picked from commit 002e1de)

…ble_01

(cherry picked from commit 95bccd3)

…ble_01

Changelog: https://docs.warp.dev/getting-started/changelog#id-2024.09.19-v0.2024.09.17.08.02
(cherry picked from commit c4b9fe0)

…ble_01

(cherry picked from commit a9b6a73)

…ble_01

(cherry picked from commit dbb8380)

…ble_02

Changelog: https://docs.warp.dev/getting-started/changelog#id-2024.10.08-v0.2024.10.08.08.02
(cherry picked from commit 3753425)

(cherry picked from commit 77ead85)

(cherry picked from commit 744a8eb)

Changelog: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html
(cherry picked from commit 484f4d9)

Changelog: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html
(cherry picked from commit ca271dd)

…iscord-ptb, refactor meta (NixOS#348303)

…ixOS#346437)

…filter, add `shellcheck`, 129.0.6668.{100,101} -> 130.0.6723.{58,59} (NixOS#349061)

Capturing and Texture.

Doesn't need to use `LD_PRELOAD`, `LD_LIBRARY_PATH` works.

https://www.github.com/NixOS/nixpkgs/issues/265817#issuecomment-2345008152
(cherry picked from commit 200e209)