Merge master into staging-next

.mailmap

@@ -6,6 +6,8 @@ Fabian Affolter <[email protected]> <[email protected]>
 goatastronaut0212 <[email protected]> <[email protected]>
 Janne Heß <[email protected]> <[email protected]>
 Jörg Thalheim <[email protected]> <[email protected]>
+Lin Jian <[email protected]> <[email protected]>
+Lin Jian <[email protected]> <[email protected]>
 Martin Weinelt <[email protected]> <[email protected]>
 R. RyanTM <[email protected]>
 Robert Hensing <[email protected]> <[email protected]>

maintainers/maintainer-list.nix

@@ -4279,7 +4279,7 @@
     keys = [ { fingerprint = "2017 E152 BB81 5C16 955C  E612 45BC C1E2 709B 1788"; } ];
   };
   Cryolitia = {
-    name = "Beiyan Cryolitia";
+    name = "Cryolitia PukNgae";
     email = "[email protected]";
     github = "Cryolitia";
     githubId = 23723294;
@@ -15249,6 +15249,12 @@
     github = "o0th";
     githubId = 22490354;
   };
+  oakenshield = {
+    email = "[email protected]";
+    github = "HritwikSinghal";
+    githubId = 29531474;
+    name = "Hritwik Singhal";
+  };
   oaksoaj = {
     email = "[email protected]";
     name = "Oaksoaj";
@@ -20383,6 +20389,11 @@
     githubId = 156964;
     name = "Thomas Boerger";
   };
+  tbwanderer = {
+    github = "tbwanderer";
+    githubId = 125365236;
+    name = "Ice Layer";
+  };
   tcbravo = {
     email = "[email protected]";
     github = "tcbravo";
@@ -22600,6 +22611,12 @@
     githubId = 529003;
     name = "Christine Dodrill";
   };
+  xeals = {
+    email = "[email protected]";
+    github = "xeals";
+    githubId = 21125058;
+    name = "xeals";
+  };
   xeji = {
     email = "[email protected]";
     github = "xeji";

maintainers/scripts/luarocks-packages.csv

@@ -45,6 +45,7 @@ lpeglabel,,,,1.6.0,,
 lrexlib-gnu,,,,,,
 lrexlib-pcre,,,,,,vyp
 lrexlib-posix,,,,,,
+lsp-progress.nvim,,,,,,gepbird
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -289,6 +289,12 @@
   for `stateVersion` ≥ 24.11. (It was previously using SQLite for structured
   data and the filesystem for blobs).
 
+- The `stargazer` service has been hardened to improve security, but these
+  changes make break certain setups, particularly around traditional CGI.
+
+  - The `stargazer.allowCgiUser` option has been added, enabling
+    Stargazer's `cgi-user` option to work, which was previously broken.
+
 - The `shiori` service now requires an HTTP secret value `SHIORI_HTTP_SECRET_KEY` to be provided via environment variable. The nixos module therefore, now provides an environmentFile option:
 
   ```

nixos/modules/profiles/installation-device.nix

@@ -128,13 +128,13 @@ with lib;
     nix.settings.trusted-users = [ "nixos" ];
 
     # Install less voices for speechd to save some space
-    services.speechd.package = pkgs.speechd.override {
-      mbrola = pkgs.mbrola.override {
-        mbrola-voices = pkgs.mbrola-voices.override {
+    nixpkgs.overlays = [
+      (_: prev: {
+        mbrola-voices = prev.mbrola-voices.override {
           # only ship with one voice per language
           languages = [ "*1" ];
         };
-      };
-    };
+      })
+    ];
   };
 }

nixos/modules/services/cluster/kubernetes/addons/dns.nix

@@ -366,7 +366,7 @@ in {
       };
     };
 
-    services.kubernetes.kubelet.clusterDns = mkDefault cfg.clusterIp;
+    services.kubernetes.kubelet.clusterDns = mkDefault [ cfg.clusterIp ];
   };
 
   meta.buildDocsInSandbox = false;

nixos/modules/services/misc/prowlarr.nix

@@ -34,6 +34,7 @@ in
         ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
         Restart = "on-failure";
       };
+      environment.HOME = "/var/empty";
     };
 
     networking.firewall = mkIf cfg.openFirewall {