redmine: 5.1.4 -> 5.1.5

[felixsinger]

Update Redmine and also used gems.

Updating gems fixes the following CVEs:

• CVE-2024-53985
• CVE-2024-53986
• CVE-2024-53987
• CVE-2024-53988
• CVE-2024-53989

The following vulnerabilities remain:

• CVE-2024-54133
• GHSA-r95h-9x8f-r3f7

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[felixsinger]

@GrahamcOfBorg test redmine

[felixsinger]

For whatever reason mariadb is unable to start :/

[aanderse]

For whatever reason mariadb is unable to start :/

any success resolving that?

The following vulnerabilities remain:

since we're vendoring those dependencies into redmine it sounds like we should add the following to meta:

knownVulnerabilities = [ "CVE-2024-54133" "GHSA-r95h-9x8f-r3f7" ];

[felixsinger]

@GrahamcOfBorg test redmine

[felixsinger]

@GrahamcOfBorg test redmine

[felixsinger]

@GrahamcOfBorg test redmine

[felixsinger]

For whatever reason mariadb is unable to start :/

any success resolving that?

Fixed it. x86_64-linux needed to be removed from bundler platforms. Added a line to the update script. That messed up the gems. I feel like the list gets longer and longer :D

The following vulnerabilities remain:

since we're vendoring those dependencies into redmine it sounds like we should add the following to meta:

knownVulnerabilities = [ "CVE-2024-54133" "GHSA-r95h-9x8f-r3f7" ];

With that the tests aren't executed as "insecure" packages need to be allowed.