awscli, firefox: track version changes in our release change logs. They
are also built by our Hydra (cache) now to make sure that machines don't
have to compile these if the upstream NixOS cache doesn't have them, yet.
We noticed this when rolling out the last release which caused a mass
rebuild of packages which was due to the glibc security patch (PL-131831).
matomo (PL-131600, PL-131631)
Update package to 4.15.1.
Add role documentation.
Allow sudo-srv users to run matomo-console.
Automatically enable Nginx service when matomo role is enabled.
Pull upstream NixOS changes, security fixes and package updates (PL-131842):
clamav: 1.0.1 -> 1.0.3
curl: apply patch for CVE-2023-38039
curl: apply patch for CVE-2023-38545
ghostscript: 10.01.2 -> 10.02.0
gitlab-runner: 16.1.0 -> 16.4.0
github-runner: 2.309.0 -> 2.310.2
go_1_19: 1.19.12 -> 1.19.13
imagemagick: 7.1.1-18 -> 7.1.1-19
libwebp: 1.3.1 -> 1.3.2 (CVE-2023-4863)
linux: 6.1.55 -> 6.1.57
nss_latest: 3.93 -> 3.94
openssl: 3.0.10 -> 3.0.11 (CVE-2023-4807)
percona-xtrabackup_8_0: 8.0.32-26 -> 8.0.34-29
python310: 3.10.12 -> 3.10.13 (CVE-2023-40217)
python311: 3.11.4 -> 3.11.5 (CVE-2023-40217)
redis: 7.0.12 -> 7.0.13 (CVE-2023-41053)
xorg.libX11: 1.8.6 -> 1.8.7
Improve monitoring of automated maintenance to detect stuck requests and
other anomalies earlier (PL-131185).
Introduce Molly Miller as new global admin (PL-131590).
opensearch: implement automated migration from ElasticSearch 7. Note that
migrations from ES6 require re-indexing on ES7 before migrating to
OpenSearch. See the OpenSearch role docs for details (PL-1315530).
Introduce Molly Miller as new global admin (PL-131590).