Merge remote-tracking branch 'upstream/nixos-24.05' into nixos-24.05

[Backport release-24.05] python311Packages.weatherflow4py: init at 0.2.20

.github/CODEOWNERS

@@ -306,8 +306,8 @@ nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 /pkgs/applications/networking/cluster/terraform-providers @zowoq
 
 # Forgejo
-nixos/modules/services/misc/forgejo.nix      @bendlas @emilylange
-pkgs/applications/version-management/forgejo @bendlas @emilylange
+nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
+pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
 
 # Dotnet
 /pkgs/build-support/dotnet                  @IvarWithoutBones

maintainers/maintainer-list.nix

@@ -7731,6 +7731,14 @@
       fingerprint = "7FC7 98AB 390E 1646 ED4D  8F1F 797F 6238 68CD 00C2";
     }];
   };
+  greaka = {
+    email = "git@greaka.de";
+    github = "greaka";
+    githubId = 2805834;
+    name = "Greaka";
+    keys =
+      [{ fingerprint = "6275 FB5C C9AC 9D85 FF9E  44C5 EE92 A5CD C367 118C"; }];
+  };
   greg = {
     email = "greg.hellings@gmail.com";
     github = "greg-hellings";
@@ -9963,6 +9971,12 @@
     githubId = 8580434;
     name = "Jonny Bolton";
   };
+  jonochang = {
+    name = "Jono Chang";
+    email = "j.g.chang@gmail.com";
+    github = "jonochang";
+    githubId = 13179;
+  };
   jonringer = {
     email = "jonringer117@gmail.com";
     matrix = "@jonringer:matrix.org";
@@ -11920,6 +11934,14 @@
     githubId = 10626;
     name = "Andreas Wagner";
   };
+  lpostula = {
+    email = "lois@postu.la";
+    github = "loispostula";
+    githubId = 1423612;
+    name = "Loïs Postula";
+    keys =
+      [{ fingerprint = "0B4A E7C7 D3B7 53F5 3B3D  774C 3819 3C6A 09C3 9ED1"; }];
+  };
   lrewega = {
     email = "lrewega@c32.ca";
     github = "lrewega";

maintainers/team-list.nix

@@ -345,6 +345,16 @@ with lib.maintainers; {
     shortName = "freedesktop.org packaging";
   };
 
+  fslabs = {
+    # Verify additions to this team with at least one already existing member of the team.
+    members = [
+      greaka
+      lpostula
+    ];
+    scope = "Group registration for packages maintained by Foresight Spatial Labs.";
+    shortName = "Foresight Spatial Labs employees";
+  };
+
   gcc = {
     members = [
       synthetica

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -6,11 +6,11 @@ Support is planned until the end of December 2024, handing over to 24.11.
 
 In addition to numerous new and upgraded packages, this release has the following highlights:
 
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+<!-- Please keep entries alphabetically sorted. -->
 
 - The default kernel package has been updated from 6.1 to 6.6. All supported kernels remain available.
 
-- For each supporting version of the Linux kernel firmware blobs
+- For each supporting version of the Linux kernel, firmware blobs
   are compressed with zstd. For firmware blobs this means an increase of 4.4% in size, however
   a significantly higher decompression speed.
 
@@ -53,7 +53,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 ## New Services {#sec-release-24.05-new-services}
 
-<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+<!-- Please keep entries alphabetically sorted. -->
 
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server software.
@@ -75,7 +75,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
-- [CommaFeed](https://github.com/Athou/commafeed), a Google Reader inspired self-hosted RSS reader. Available as [services.commafeed](#opt-services.commafeed.enable).
+- [CommaFeed](https://github.com/Athou/commafeed), a Google Reader-inspired self-hosted RSS reader. Available as [services.commafeed](#opt-services.commafeed.enable).
 
 - [davis](https://github.com/tchapi/davis), a simple CardDav and CalDav server inspired by Baïkal. Available as [services.davis](#opt-services.davis.enable).
 
@@ -85,6 +85,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [FCast Receiver](https://fcast.org), an open-source alternative to Chromecast and AirPlay. Available as [programs.fcast-receiver](#opt-programs.fcast-receiver.enable).
 
+- [FileSender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable).
+
 - [Firefly-iii](https://www.firefly-iii.org), a free and open source personal finance manager. Available as [services.firefly-iii](#opt-services.firefly-iii.enable).
 
 - [Flarum](https://flarum.org/), a delightfully simple discussion platform for your website. Available as [services.flarum](#opt-services.flarum.enable).
@@ -187,6 +189,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [wastebin](https://github.com/matze/wastebin), a pastebin server written in rust. Available as [services.wastebin](#opt-services.wastebin.enable).
 
+- [watchdogd](https://troglobit.com/projects/watchdogd/), a system and process supervisor using watchdog timers. Available as [services.watchdogd](#opt-services.watchdogd.enable).
+
 - [Workout-tracker](https://github.com/jovandeginste/workout-tracker), a workout tracking web application for personal use.
 
 - [wyoming-satellite](https://github.com/rhasspy/wyoming-satellite), a voice assistant satellite for Home Assistant using the Wyoming protocol. Available as [services.wyoming.satellite](#opt-services.wyoming.satellite.enable).
@@ -197,8 +201,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [your_spotify](https://github.com/Yooooomi/your_spotify), a self hosted Spotify tracking dashboard. Available as [services.your_spotify](#opt-services.your_spotify.enable)
 
-- [FileSender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable).
-
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -223,10 +225,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `buildGoModule` now throws an error when `vendorHash` is not specified. `vendorSha256`, deprecated in Nixpkgs 23.11, is now ignored and is no longer a `vendorHash` alias.
 
-- `chromium` and `ungoogled-chromium` had a long standing issue regarding Widevine DRM handling in nixpkgs fixed.
+- `chromium` and `ungoogled-chromium` had a long-standing issue regarding Widevine DRM handling in nixpkgs fixed.
   `chromium` now no longer automatically downloads Widevine when encountering DRM protected content.
   To be able to play DRM protected content in `chromium` now, you have to explicitly opt-in as originally intended using `chromium.override { enableWideVine = true; }`.
-  This override has been added almost 10 years ago.
+  This override was added almost 10 years ago.
 
 - `craftos-pc` package has been updated to v2.8, which includes [breaking changes](https://github.com/MCJack123/craftos2/releases/tag/v2.8).
   - Files are now handled in binary mode; this could break programs with embedded UTF-8 characters.
@@ -248,16 +250,16 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `cudaPackages.cudatoolkit` has been deprecated and replaced with a
   symlink-based wrapper for the splayed redistributable CUDA packages. The
   wrapper only includes tools and libraries necessary to build common packages
-  like e.g. tensorflow. The original runfile-based `cudatoolkit` is still
+  such as tensorflow. The original runfile-based `cudatoolkit` is still
   available as `cudatoolkit-legacy-runfile`.
 
-- `cudaPackages.nsight_systems` now has most vendored third party libraries removed, though we now only ship it for `cudaPackages_11_8` and later due to outdated dependencies. Users comfortable with the vendored dependencies may use `overrideAttrs` to amend the `postPatch` phase and the `meta.broken` correspondingly. Alternatively, one could package the deprecated `boost170` locally, as required for `cudaPackages_11_4.nsight_systems`.
+- `cudaPackages.nsight_systems` now has most vendored third party-libraries removed, though we now only ship it for `cudaPackages_11_8` and later, due to outdated dependencies. Users comfortable with the vendored dependencies may use `overrideAttrs` to amend the `postPatch` phase and the `meta.broken` correspondingly. Alternatively, one could package the deprecated `boost170` locally, as required for `cudaPackages_11_4.nsight_systems`.
 
 - `cudaPackages.autoFixElfFiles` has been deprecated for `pkgs.autoFixElfFiles`. Functionality has not changed, but the setuphook has been renamed and moved to the top-level package scope.
 
-- `davfs2`' `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.
+- `davfs2`'s `services.davfs2.extraConfig` setting has been deprecated and converted to the free-form type option named `services.davfs2.settings` according to RFC42.
 
-- `dwarf-fortress` has been updated to version 50, and its derivations continue to menace with spikes of Nix and bash. Version 50 is identical to the version on Steam, but without the paid elements like tilepacks.
+- `dwarf-fortress` has been updated to version 50, and its derivations continue to menace with spikes of Nix and bash [TODO what does this mean?]. Version 50 is identical to the version on Steam, but without the paid elements like tilepacks.
   dfhack and Dwarf Therapist still work, and older versions are still packaged in case you'd like to roll back. Note that DF 50 saves will not be compatible with DF 0.47 and earlier.
   See [Bay 12 Games](http://www.bay12games.com/dwarves/) for more details on what's new in Dwarf Fortress.
 
@@ -334,12 +336,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `livebook` package is now built as a `mix release` instead of an `escript`.
   This means that configuration now has to be done using [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) instead of command line arguments.
-  This has the further implication that the `livebook` service configuration has changed:
+  This has the further implication that the `livebook` service configuration has changed.
 
 - `lua` interpreters default LUA_PATH and LUA_CPATH are not overriden by nixpkgs
   anymore, we patch LUA_ROOT instead which is more respectful to upstream.
 
-- `luarocks-packages-updater` has changed the .csv format used to define lua packages updates: `src` (URL towards a git repository) has now become `rockspec` (URL towards a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.
+- `luarocks-packages-updater`'s .csv format used to define lua packages to be updated, has changed: `src` (URL of a git repository) has now become `rockspec` (URL of a rockspec) to remove ambiguity regarding which rockspec to use and simplify implementation.
 
 - `mkosi` was updated to v22. Parts of the user interface have changed. Consult the
   release notes of [v19](https://github.com/systemd/mkosi/releases/tag/v19),
@@ -388,7 +390,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
   - `nomad_1_4` has been removed, as it is now unsupported upstream.
 
-- `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`.
+- `nvtop` family of packages was reorganized into a nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are renamed to `nvtopPackages.{amd,nvidia,intel,msm}`.
 
 - `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading
   to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.
@@ -444,12 +446,12 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
   "mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`
   where the file `secret_file` contains the string `mysecret`.
 
-- `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
+- `services.avahi.nssmdns` was split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switches for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
-- `services.frp.settings` now generates the frp configuration file in TOML format as [recommended by upstream](https://github.com/fatedier/frp#configuration-files), instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options.
-  - The `settings.common` section in the configuration is no longer valid and all the options form inside it now goes directly under `settings`.
-  - The `_` separating words in the configuration options is removed so the options are now in camel case. For example: `server_addr` becomes `serverAddr`, `server_port` becomes `serverPort` etc.
+- `services.frp.settings` now generates the frp configuration file in TOML format as [recommended by upstream](https://github.com/fatedier/frp#configuration-files), instead of the legacy INI format. This has also introduced other changes in the configuration file structure and options:
+  - The `settings.common` section in the configuration is no longer valid and all the options form inside it now go directly under `settings`.
+  - Configuration option names have been changed from snake_case to camelCase. For example: `server_addr` becomes `serverAddr`, `server_port` becomes `serverPort` etc.
   - Proxies are now defined with a new option `settings.proxies` which takes a list of proxies.
   - Consult the [upstream documentation](https://github.com/fatedier/frp#example-usage) for more details on the changes.
 
@@ -505,11 +507,16 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `services.redis.vmOverCommit` now defaults to `true` and no longer enforces Transparent Hugepages (THP) to be disabled. Redis only works with THP configured to `madvise` which is the kernel's default.
 
-- `services.resolved.fallbackDns` can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
+- `services.resolved.fallbackDns`
+  - can now be used to disable the upstream fallback servers entirely by setting it to `[]`
+  - to get previous behaviour of upstream defaults, set it to `null`
+  - default value has changed from `[]` to `null`, in order to preserve default behaviour
+
+can now be used to disable the upstream fallback servers entirely by setting it to an empty list. To get the previous behaviour of the upstream defaults set it to null, the new default, instead.
 
 - `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.
 
-- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
+- `services.vikunja.setupNginx` setting has been removed. Users now need to set up the webserver configuration on their own with a proxy pass to the vikunja service.
 
 - `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
 
@@ -526,14 +533,14 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `system.forbiddenDependenciesRegex` has been renamed to `system.forbiddenDependenciesRegexes` and now has the type of `listOf string` instead of `string` to accept multiple regexes.
 
-- `systemd.oomd` module behavior is changed as:
+- `systemd.oomd` module behavior has changed:
 
   - Raise ManagedOOMMemoryPressureLimit from 50% to 80%. This should make systemd-oomd kill things less often, and fix issues like [this](https://pagure.io/fedora-workstation/issue/358).
     Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/806c95e1c70af18f81d499b24cd7acfa4c36ffd6?branch=806c95e1c70af18f81d499b24cd7acfa4c36ffd6).
 
   - Remove swap policy. This helps prevent killing processes when user's swap is small.
 
-  - Expand the memory pressure policy to system.slice, user-.slice, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb).
+  - Expand the memory pressure policy to `system.slice`, `user-.slice`, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb).
 
   - `systemd.oomd.enableUserServices` is renamed to `systemd.oomd.enableUserSlices`.
 
@@ -552,8 +559,6 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `virtialisation.incus` now defaults to the newly-added `incus-lts` release (v6.0.x). Users who wish to continue using the non-LTS release will need to set `virtualisation.incus.package = pkgs.incus`. Stable release users are encouraged to stay on the LTS release as non-LTS releases will by default not be backported.
 
-- [watchdogd](https://troglobit.com/projects/watchdogd/), a system and process supervisor using watchdog timers. Available as [services.watchdogd](#opt-services.watchdogd.enable).
-
 - `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
 
 - `wpaperd` has been updated to 1.0.1, which has a breaking change: previous version 0.3.0 had 2 different configuration files, one for wpaperd and one for the wallpapers. Remove the former and move the latter (`wallpaper.toml`) to `config.toml`.
@@ -583,7 +588,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
   allows to restart multiple services that are ordered before sysinit.target
   and respect the ordering between the services.
 
-- The configuration format for `services.prometheus.exporters.snmp` changed with release 0.23.0.
+- `services.prometheus.exporters.snmp`'s configuration format changed with release 0.23.0.
   The module now includes an optional config check, that is enabled by default, to make the change obvious before any deployment.
   More information about the configuration syntax change is available in the [upstream repository](https://github.com/prometheus/snmp_exporter/blob/b75fc6b839ee3f3ccbee68bee55f1ae99555084a/auth-split-migration.md).
 
@@ -593,7 +598,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `addDriverRunpath` has been added to facilitate the deprecation of the old `addOpenGLRunpath` setuphook. This change is motivated by the evolution of the setuphook to include all hardware acceleration.
 
-- `appimage`, `appimageTools.wrapAppImage` and `buildFHSEnvBubblewrap` now properly accepts `pname` and `version`.
+- `appimage`, `appimageTools.wrapAppImage` and `buildFHSEnvBubblewrap` now properly accept `pname` and `version`.
 
 - `bacula` now allows to configure `TLS` for encrypted communication.
 
@@ -608,11 +613,11 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - `buildDubPackage` can now be used to build Programs written in [D](https://dlang.org/) using the `dub` build system and package manager.
   See the [D section](https://nixos.org/manual/nixpkgs/unstable#dlang) in the manual for more information.
 
-- `castopod` has some migration actions to be taken in case of a S3 setup. Some new features may also need some manual migration actions. See [https://code.castopod.org/adaures/castopod/-/releases](https://code.castopod.org/adaures/castopod/-/releases) for more informations.
+- `castopod` has some migration actions to be taken in case of a S3 setup. Some new features may also need some manual migration actions. See [https://code.castopod.org/adaures/castopod/-/releases](https://code.castopod.org/adaures/castopod/-/releases) for more information.
 
 - `cinnamon` has been updated to 6.0. Please beware that the [Wayland session](https://blog.linuxmint.com/?p=4591) is still experimental in this release and could potentially [affect Xorg sessions](https://blog.linuxmint.com/?p=4639). We suggest a reboot when switching between sessions.
 
-- `documentation.man.mandoc` now by default uses `MANPATH` to set the directories where mandoc will search for manual pages.
+- `documentation.man.mandoc` now uses `MANPATH` by defaultwas to set the directories where mandoc will search for manual pages.
   This enables mandoc to find manual pages in Nix profiles. To set the manual search paths via the `mandoc.conf` configuration file like before, use `documentation.man.mandoc.settings.manpath` instead.
 
 - `drbd` out-of-tree Linux kernel driver has been added in version 9.2.7. With it the DRBD 9.x features can be used instead of the 8.x features provided by the 8.4.11 in-tree driver.
@@ -663,7 +668,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `services.github-runner` module has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
-- `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and was changed to use the ini type instead of using a multiline string.
+- `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and changed to use the ini type instead of using a multiline string.
 
 - `services.nextcloud.config.dbport` option of the Nextcloud module was removed to match upstream.
   The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
@@ -691,7 +696,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - `services.paperless` module no longer uses the previously downloaded NLTK data stored in `/var/cache/paperless/nltk`. This directory can be removed.
 
-- `services.postgresql.extraPlugins` changed its type from just a list of packages to also a function that returns such a list.
+- `services.postgresql.extraPlugins`' type has expanded. Previously it was a list of packages, now it can also be a function that returns such a list.
   For example a config line like ``services.postgresql.extraPlugins = with pkgs.postgresql_11.pkgs; [ postgis ];`` is recommended to be changed to ``services.postgresql.extraPlugins = ps: with ps; [ postgis ];``;
 
 - `services.slskd` has been refactored to include more configuation options in
@@ -741,8 +746,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - A new hardening flag, `trivialautovarinit` was made available, corresponding to the gcc/clang option `-ftrivial-auto-var-init=pattern`.
 
-- New options were added to the dnsdist module to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
-  The module can generate the DNSCrypt provider key pair, certificates and also performs their rotation automatically with no downtime.
+- `dnsdist` has new options to enable and configure a DNSCrypt endpoint (see `services.dnsdist.dnscrypt.enable`, etc.).
+  The module can generate the DNSCrypt provider key pair and certificates, and also rotates them automatically with no downtime.
 
 - The kernel Yama LSM is now enabled by default, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an

nixos/modules/config/nix-channel.nix

@@ -69,7 +69,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://nixos.org/channels/nixos-unstable";
+        default = "https://nixos.org/channels/nixos-24.05";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };

nixos/modules/misc/version.nix

@@ -31,6 +31,7 @@ let
       HOME_URL = optionalString isNixos "https://nixos.org/";
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      SUPPORT_END = "2024-12-31";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "1;34";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;

nixos/modules/programs/ccache.nix

@@ -60,14 +60,18 @@ in {
     # target configuration
     (lib.mkIf (cfg.packageNames != []) {
       nixpkgs.overlays = [
-        (self: super: lib.genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))
+        (self: super: lib.genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))];})
 
+    (lib.mkIf cfg.enable {
+      nixpkgs.overlays = [
         (self: super: {
           ccacheWrapper = super.ccacheWrapper.override {
             extraConfig = ''
-              export CCACHE_COMPRESS=1
+              export CCACHE_NOCOMPRESS=true
               export CCACHE_DIR="${cfg.cacheDir}"
               export CCACHE_UMASK=007
+              export CCACHE_MAXSIZE=300G
+              export CCACHE_SLOPPINESS=random_seed,time_macros
               if [ ! -d "$CCACHE_DIR" ]; then
                 echo "====="
                 echo "Directory '$CCACHE_DIR' does not exist"

nixos/modules/services/backup/borgbackup.nix

@@ -361,7 +361,7 @@ in {
             type = types.bool;
             example = true;
             description = ''
-              Set the `persistentTimer` option for the
+              Set the `Persistent` option for the
               {manpage}`systemd.timer(5)`
               which triggers the backup immediately if the last trigger
               was missed (e.g. if the system was powered down).

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -335,7 +335,7 @@ in
           mkdir -m 0700 -p ${baseDir}/queue-runner
           mkdir -m 0750 -p ${baseDir}/build-logs
           mkdir -m 0750 -p ${baseDir}/runcommand-logs
-          chown hydra-queue-runner.hydra \
+          chown hydra-queue-runner:hydra \
             ${baseDir}/queue-runner \
             ${baseDir}/build-logs \
             ${baseDir}/runcommand-logs

nixos/modules/services/databases/mysql.nix

@@ -462,9 +462,9 @@ in
 
         ${concatMapStrings (user:
           ''
-            ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
+            ( echo "CREATE USER IF NOT EXISTS '${user.name}' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
               ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
-                echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
+                echo "GRANT ${permission} ON ${database} TO '${user.name}';"
               '') user.ensurePermissions)}
             ) | ${cfg.package}/bin/mysql -N
           '') cfg.ensureUsers}

nixos/modules/services/hardware/kanata.nix

@@ -7,7 +7,7 @@ let
 
   upstreamDoc = "See [the upstream documentation](https://github.com/jtroo/kanata/blob/main/docs/config.adoc) and [example config files](https://github.com/jtroo/kanata/tree/main/cfg_samples) for more information.";
 
-  keyboard = {
+  keyboard = { name, config, ... }: {
     options = {
       devices = mkOption {
         type = types.listOf types.str;
@@ -48,6 +48,21 @@ let
           ${upstreamDoc}
         '';
       };
+      configFile = mkOption {
+        type = types.path;
+        default = mkConfig name config;
+        defaultText =
+          "A config file generated by values from other kanata module options.";
+        description = ''
+          The config file.
+
+          By default, it is generated by values from other kanata
+          module options.
+
+          You can also set it to your own full config file which
+          overrides all other kanata module options.  ${upstreamDoc}
+        '';
+      };
       extraArgs = mkOption {
         type = types.listOf types.str;
         default = [ ];
@@ -85,6 +100,10 @@ let
 
       ${keyboard.config}
     '';
+    # Only the config file generated by this module is checked.  A
+    # user-provided one is not checked because it may not be available
+    # at build time.  I think this is a good balance between module
+    # complexity and functionality.
     checkPhase = ''
       ${getExe cfg.package} --cfg "$target" --check --debug
     '';
@@ -96,7 +115,7 @@ let
       Type = "notify";
       ExecStart = ''
         ${getExe cfg.package} \
-          --cfg ${mkConfig name keyboard} \
+          --cfg ${keyboard.configFile} \
           --symlink-path ''${RUNTIME_DIRECTORY}/${name} \
           ${optionalString (keyboard.port != null) "--port ${toString keyboard.port}"} \
           ${utils.escapeSystemdExecArgs keyboard.extraArgs}

nixos/modules/services/home-automation/wyoming/faster-whisper.nix

@@ -113,6 +113,9 @@ in
       nameValuePair "wyoming-faster-whisper-${server}" {
         inherit (options) enable;
         description = "Wyoming faster-whisper server instance ${server}";
+        wants = [
+          "network-online.target"
+        ];
         after = [
           "network-online.target"
         ];

nixos/modules/services/home-automation/wyoming/openwakeword.nix

@@ -108,6 +108,9 @@ in
   config = mkIf cfg.enable {
     systemd.services."wyoming-openwakeword" = {
       description = "Wyoming openWakeWord server";
+      wants = [
+        "network-online.target"
+      ];
       after = [
         "network-online.target"
       ];

nixos/modules/services/home-automation/wyoming/piper.nix

@@ -117,6 +117,9 @@ in
       nameValuePair "wyoming-piper-${server}" {
         inherit (options) enable;
         description = "Wyoming Piper server instance ${server}";
+        wants = [
+          "network-online.target"
+        ];
         after = [
           "network-online.target"
         ];

nixos/modules/services/mail/stalwart-mail.nix

@@ -70,7 +70,9 @@ in {
       storage.lookup = mkDefault "db";
       storage.blob = mkDefault "blob";
       resolver.type = mkDefault "system";
-      resolver.public-suffix = mkDefault ["https://publicsuffix.org/list/public_suffix_list.dat"];
+      resolver.public-suffix = lib.mkDefault [
+        "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
+      ];
     };
 
     systemd.services.stalwart-mail = {

nixos/modules/services/misc/portunus.nix

@@ -98,6 +98,10 @@ in
 
           The OIDC secret must be set as the `DEX_CLIENT_''${id}` environment variable
           in the [](#opt-services.dex.environmentFile) setting.
+
+          ::: {.note}
+          Make sure the id only contains characters that are allowed in an environment variable name, e.g. no -.
+          :::
         '';
       };
 

nixos/modules/services/misc/snapper.nix

@@ -108,7 +108,7 @@ in
       type = types.bool;
       example = true;
       description = ''
-        Set the `persistentTimer` option for the
+        Set the `Persistent` option for the
         {manpage}`systemd.timer(5)`
         which triggers the snapshot immediately if the last trigger
         was missed (e.g. if the system was powered down).

nixos/modules/services/networking/kea.nix

@@ -278,6 +278,9 @@ in
         "https://kea.readthedocs.io/en/kea-${package.version}/arm/agent.html"
       ];
 
+      wants = [
+        "network-online.target"
+      ];
       after = [
         "network-online.target"
         "time-sync.target"

nixos/modules/services/security/bitwarden-directory-connector-cli.nix

@@ -260,6 +260,7 @@ in {
         description = "Sync timer for Bitwarden Directory Connector";
         wantedBy = ["timers.target"];
         after = ["network-online.target"];
+        wants = ["network-online.target"];
         timerConfig = {
           OnCalendar = cfg.interval;
           Unit = "bitwarden-directory-connector-cli.service";

nixos/modules/services/security/oauth2-proxy-nginx.nix

@@ -83,6 +83,15 @@ in
   } ++ (lib.mapAttrsToList (vhost: conf: {
     virtualHosts.${vhost} = {
       locations = {
+        "/".extraConfig = ''
+          # pass information via X-User and X-Email headers to backend, requires running with --set-xauthrequest flag
+          proxy_set_header X-User  $user;
+          proxy_set_header X-Email $email;
+
+          # if you enabled --cookie-refresh, this is needed for it to work with auth_request
+          add_header Set-Cookie $auth_cookie;
+        '';
+
         "/oauth2/auth" = let
           maybeQueryArg = name: value:
             if value == null then null
@@ -102,6 +111,7 @@ in
             proxy_pass_request_body           off;
           '';
         };
+
         "@redirectToAuth2ProxyLogin" = {
           return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
           extraConfig = ''
@@ -114,16 +124,10 @@ in
         auth_request /oauth2/auth;
         error_page 401 = @redirectToAuth2ProxyLogin;
 
-        # pass information via X-User and X-Email headers to backend,
-        # requires running with --set-xauthrequest flag
+        # set variables being used in locations."/".extraConfig
         auth_request_set $user   $upstream_http_x_auth_request_user;
         auth_request_set $email  $upstream_http_x_auth_request_email;
-        proxy_set_header X-User  $user;
-        proxy_set_header X-Email $email;
-
-        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
         auth_request_set $auth_cookie $upstream_http_set_cookie;
-        add_header Set-Cookie $auth_cookie;
       '';
     };
   }) cfg.virtualHosts)));

nixos/modules/services/web-apps/mastodon.nix

@@ -119,11 +119,11 @@ let
     in {
       after = [ "network.target" "mastodon-init-dirs.service" ]
         ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+        ++ lib.optional true "postgresql.service"
         ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
       requires = [ "mastodon-init-dirs.service" ]
         ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+        ++ lib.optional true "postgresql.service"
         ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
       description = "Mastodon sidekiq${jobClassLabel}";
       wantedBy = [ "mastodon.target" ];
@@ -151,11 +151,11 @@ let
         value = {
           after = [ "network.target" "mastodon-init-dirs.service" ]
             ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-            ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+            ++ lib.optional true "postgresql.service"
             ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
           requires = [ "mastodon-init-dirs.service" ]
             ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-            ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+            ++ lib.optional true "postgresql.service"
             ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
           wantedBy = [ "mastodon.target" "mastodon-streaming.target" ];
           description = "Mastodon streaming ${toString i}";
@@ -738,7 +738,7 @@ in {
     };
 
     systemd.services.mastodon-init-db = lib.mkIf cfg.automaticMigrations {
-      script = lib.optionalString (!databaseActuallyCreateLocally) ''
+      script = lib.optionalString (!true) ''
         umask 077
         export PGPASSWORD="$(cat '${cfg.database.passwordFile}')"
       '' + ''
@@ -759,11 +759,11 @@ in {
           echo "Migrating database (this might be a noop)"
           rails db:migrate
         fi
-      '' +  lib.optionalString (!databaseActuallyCreateLocally) ''
+      '' +  lib.optionalString (!true) ''
         unset PGPASSWORD
       '';
       path = [ cfg.package pkgs.postgresql ];
-      environment = env // lib.optionalAttrs (!databaseActuallyCreateLocally) {
+      environment = env // lib.optionalAttrs (!true) {
         PGHOST = cfg.database.host;
         PGPORT = toString cfg.database.port;
         PGDATABASE = cfg.database.name;
@@ -777,19 +777,19 @@ in {
         SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" "pipe" "pipe2" ];
       } // cfgService;
       after = [ "network.target" "mastodon-init-dirs.service" ]
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
+        ++ lib.optional true "postgresql.service";
       requires = [ "mastodon-init-dirs.service" ]
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
+        ++ lib.optional true "postgresql.service";
     };
 
     systemd.services.mastodon-web = {
       after = [ "network.target" "mastodon-init-dirs.service" ]
         ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+        ++ lib.optional true "postgresql.service"
         ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
       requires = [ "mastodon-init-dirs.service" ]
         ++ lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-        ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+        ++ lib.optional true "postgresql.service"
         ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
       wantedBy = [ "mastodon.target" ];
       description = "Mastodon web";
@@ -877,7 +877,7 @@ in {
         port = cfg.redis.port;
       })
     ]);
-    services.postgresql = lib.mkIf databaseActuallyCreateLocally {
+    services.postgresql = lib.mkIf false {
       enable = true;
       ensureUsers = [
         {

nixos/modules/services/web-servers/nginx/default.nix

@@ -103,6 +103,14 @@ let
     proxy_set_header        X-Forwarded-Server $host;
   '';
 
+  recommendedProxyConfigNoHost = pkgs.writeText "nginx-recommended-proxy-headers-no-host.conf" ''
+    proxy_set_header        X-Real-IP $remote_addr;
+    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header        X-Forwarded-Proto $scheme;
+    proxy_set_header        X-Forwarded-Host $host;
+    proxy_set_header        X-Forwarded-Server $host;
+  '';
+
   proxyCachePathConfig = concatStringsSep "\n" (mapAttrsToList (name: proxyCachePath: ''
     proxy_cache_path ${concatStringsSep " " [
       "/var/cache/nginx/${name}"
@@ -456,6 +464,7 @@ let
       ${optionalString (config.return != null) "return ${toString config.return};"}
       ${config.extraConfig}
       ${optionalString (config.proxyPass != null && config.recommendedProxySettings) "include ${recommendedProxyConfig};"}
+      ${optionalString (config.proxyPass != null && config.recommendedProxySettingsNoHost) "include ${recommendedProxyConfigNoHost};"}
       ${mkBasicAuth "sublocation" config}
     }
   '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));

nixos/modules/services/web-servers/nginx/location-options.nix

@@ -137,5 +137,11 @@ with lib;
         Enable recommended proxy settings.
       '';
     };
+
+    recommendedProxySettingsNoHost = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''recommendedProxySettingsNoHost'';
+    };
   };
 }

nixos/modules/system/boot/loader/grub/grub.nix

@@ -756,7 +756,7 @@ in
 
       boot.loader.grub.extraPrepareConfig =
         concatStrings (mapAttrsToList (n: v: ''
-          ${pkgs.coreutils}/bin/install -Dp "${v}" "${efi.efiSysMountPoint}/"${escapeShellArg n}
+          ${pkgs.coreutils}/bin/install -Dp "${v}" "/boot/"${escapeShellArg n}
         '') config.boot.loader.grub.extraFiles);
 
       assertions = [

nixos/release.nix

@@ -12,7 +12,7 @@ let
 
   version = fileContents ../.version;
   versionSuffix =
-    (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
+    (if stableBranch then "." else "beta") + "${toString (nixpkgs.revCount - 630170)}.${nixpkgs.shortRev}";
 
   # Run the tests for each platform.  You can run a test by doing
   # e.g. ‘nix-build release.nix -A tests.login.x86_64-linux’,

nixos/tests/stalwart-mail.nix

@@ -1,122 +1,147 @@
 # Rudimentary test checking that the Stalwart email server can:
 # - receive some message through SMTP submission, then
 # - serve this message through IMAP.
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
 
+  lib ? pkgs.lib,
+}:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
+  makeTest = import ./make-test-python.nix;
+  mkTestName =
+    pkg: "${pkg.pname}_${pkg.version}";
+  stalwartPackages = {
+    inherit (pkgs) stalwart-mail_0_6 stalwart-mail;
+  };
+  stalwartAtLeast = lib.versionAtLeast;
+  makeStalwartTest =
+    {
+      package,
+      name ? mkTestName package,
+    }:
+    makeTest {
+      inherit name;
+      meta.maintainers = with lib.maintainers; [
+        happysalada pacien onny
+      ];
 
-in import ./make-test-python.nix ({ lib, ... }: {
-  name = "stalwart-mail";
+      nodes.machine = { lib, ... }: {
 
-  nodes.main = { pkgs, ... }: {
-    security.pki.certificateFiles = [ certs.ca.cert ];
+        security.pki.certificateFiles = [ certs.ca.cert ];
 
-    services.stalwart-mail = {
-      enable = true;
-      settings = {
-        server.hostname = domain;
-
-        certificate."snakeoil" = {
-          cert = "file://${certs.${domain}.cert}";
-          private-key = "file://${certs.${domain}.key}";
-        };
-
-        server.tls = {
-          certificate = "snakeoil";
+        services.stalwart-mail = {
           enable = true;
-          implicit = false;
-        };
+          inherit package;
+          settings = {
+            server.hostname = domain;
 
-        server.listener = {
-          "smtp-submission" = {
-            bind = [ "[::]:587" ];
-            protocol = "smtp";
-          };
+            # TODO: Remove backwards compatibility as soon as we drop legacy version 0.6.0
+            certificate."snakeoil" = let
+              certPath = if stalwartAtLeast package.version "0.7.0" then "%{file://${certs.${domain}.cert}}%" else "file://${certs.${domain}.cert}";
+              keyPath = if stalwartAtLeast package.version "0.7.0" then "%{file:${certs.${domain}.key}}%" else "file://${certs.${domain}.key}";
+            in {
+              cert = certPath;
+              private-key = keyPath;
+            };
 
-          "imap" = {
-            bind = [ "[::]:143" ];
-            protocol = "imap";
+            server.tls = {
+              certificate = "snakeoil";
+              enable = true;
+              implicit = false;
+            };
+
+            server.listener = {
+              "smtp-submission" = {
+                bind = [ "[::]:587" ];
+                protocol = "smtp";
+              };
+
+              "imap" = {
+                bind = [ "[::]:143" ];
+                protocol = "imap";
+              };
+            };
+
+            session.auth.mechanisms = "[plain]";
+            session.auth.directory = "'in-memory'";
+            storage.directory = "in-memory";
+
+            session.rcpt.directory = "'in-memory'";
+            queue.outbound.next-hop = "'local'";
+
+            directory."in-memory" = {
+              type = "memory";
+              # TODO: Remove backwards compatibility as soon as we drop legacy version 0.6.0
+              principals = let
+                condition = if stalwartAtLeast package.version "0.7.0" then "class" else "type";
+              in builtins.map (p: p // { ${condition} = "individual"; }) [
+                {
+                  name = "alice";
+                  secret = "foobar";
+                  email = [ "alice@${domain}" ];
+                }
+                {
+                  name = "bob";
+                  secret = "foobar";
+                  email = [ "bob@${domain}" ];
+                }
+              ];
+            };
           };
         };
 
-        resolver.public-suffix = [ ];  # do not fetch from web in sandbox
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "test-smtp-submission" { } ''
+            from smtplib import SMTP
 
-        session.auth.mechanisms = "[plain]";
-        session.auth.directory = "'in-memory'";
-        storage.directory = "in-memory";
+            with SMTP('localhost', 587) as smtp:
+                smtp.starttls()
+                smtp.login('alice', 'foobar')
+                smtp.sendmail(
+                    'alice@${domain}',
+                    'bob@${domain}',
+                    """
+                        From: alice@${domain}
+                        To: bob@${domain}
+                        Subject: Some test message
 
-        session.rcpt.directory = "'in-memory'";
-        queue.outbound.next-hop = "'local'";
+                        This is a test message.
+                    """.strip()
+                )
+          '')
+
+          (pkgs.writers.writePython3Bin "test-imap-read" { } ''
+            from imaplib import IMAP4
+
+            with IMAP4('localhost') as imap:
+                imap.starttls()
+                status, [caps] = imap.login('bob', 'foobar')
+                assert status == 'OK'
+                imap.select()
+                status, [ref] = imap.search(None, 'ALL')
+                assert status == 'OK'
+                [msgId] = ref.split()
+                status, msg = imap.fetch(msgId, 'BODY[TEXT]')
+                assert status == 'OK'
+                assert msg[0][1].strip() == b'This is a test message.'
+          '')
+        ];
 
-        directory."in-memory" = {
-          type = "memory";
-          principals = [
-            {
-              type = "individual";
-              name = "alice";
-              secret = "foobar";
-              email = [ "alice@${domain}" ];
-            }
-            {
-              type = "individual";
-              name = "bob";
-              secret = "foobar";
-              email = [ "bob@${domain}" ];
-            }
-          ];
-        };
       };
+
+      testScript = ''
+        start_all()
+        machine.wait_for_unit("stalwart-mail.service")
+        machine.wait_for_open_port(587)
+        machine.wait_for_open_port(143)
+
+        machine.succeed("test-smtp-submission")
+        machine.succeed("test-imap-read")
+      '';
     };
-
-    environment.systemPackages = [
-      (pkgs.writers.writePython3Bin "test-smtp-submission" { } ''
-        from smtplib import SMTP
-
-        with SMTP('localhost', 587) as smtp:
-            smtp.starttls()
-            smtp.login('alice', 'foobar')
-            smtp.sendmail(
-                'alice@${domain}',
-                'bob@${domain}',
-                """
-                    From: alice@${domain}
-                    To: bob@${domain}
-                    Subject: Some test message
-
-                    This is a test message.
-                """.strip()
-            )
-      '')
-
-      (pkgs.writers.writePython3Bin "test-imap-read" { } ''
-        from imaplib import IMAP4
-
-        with IMAP4('localhost') as imap:
-            imap.starttls()
-            status, [caps] = imap.login('bob', 'foobar')
-            assert status == 'OK'
-            imap.select()
-            status, [ref] = imap.search(None, 'ALL')
-            assert status == 'OK'
-            [msgId] = ref.split()
-            status, msg = imap.fetch(msgId, 'BODY[TEXT]')
-            assert status == 'OK'
-            assert msg[0][1].strip() == b'This is a test message.'
-      '')
-    ];
-  };
-
-  testScript = /* python */ ''
-    main.wait_for_unit("stalwart-mail.service")
-    main.wait_for_open_port(587)
-    main.wait_for_open_port(143)
-
-    main.succeed("test-smtp-submission")
-    main.succeed("test-imap-read")
-  '';
-
-  meta = {
-    maintainers = with lib.maintainers; [ happysalada pacien ];
-  };
-})
+in
+lib.mapAttrs (_: package: makeStalwartTest { inherit package; }) stalwartPackages

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -77,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.6";
+  version = "3.34.7";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-eWd8oIINWVN5Dt6s4bc1RtQbytFd0foPgIcd/N2hsMw=";
+    hash = "sha256-6fIBmIoCVo0AtkjC4Vn3jMjz93gZmvkFAgo+KnasyXo=";
   };
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -78,14 +78,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.36.2";
+  version = "3.36.3";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-/8mpzl/6UpjrMVjae2nqpS2DBRCq86rE+B3INzoRz8g=";
+    hash = "sha256-uPyW/zzoyyd3SXvP+h9joJEv9DjRNJSaorx1rNmAaFQ=";
   };
 
   passthru = {

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -27,11 +27,11 @@
         version = "2024-04-10";
       };
       ungoogled-patches = {
-        hash = "sha256-I3RQBa4LLuOdZQFKHIqePj9Ozw61dsuAOctqN1abij0=";
-        rev = "125.0.6422.60-1";
+        hash = "sha256-bGc8hQnuiGot0kThSAi4AFAwmvrNPs1bR7oZx2XoAGo=";
+        rev = "125.0.6422.76-1";
       };
     };
-    hash = "sha256-ewX7oRna7IYCXhAe98HS5HbS1psIEAguhZJ1ymK+dPE=";
-    version = "125.0.6422.60";
+    hash = "sha256-m7WeRloS6tGH2AwhkNicpqThUQmS+9w2xFS2dbmu1vw=";
+    version = "125.0.6422.76";
   };
 }

pkgs/applications/networking/dyndns/dyndnsc/default.nix

@@ -1,61 +1,83 @@
-{ lib, python3Packages, fetchPypi, stdenv }:
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchPypi,
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "dyndnsc";
   version = "0.6.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "13078d29eea2f9a4ca01f05676c3309ead5e341dab047e0d51c46f23d4b7fbb4";
+    hash = "sha256-EweNKe6i+aTKAfBWdsMwnq1eNB2rBH4NUcRvI9S3+7Q=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py --replace "bottle==" "bottle>="
+    substituteInPlace setup.py \
+      --replace-fail '"pytest-runner"' ""
   '';
 
-  nativeBuildInputs = with python3Packages; [ pytest-runner ];
-  propagatedBuildInputs = with python3Packages; [
+  pythonRelaxDeps = [ "bottle" ];
+
+  build-system = with python3Packages; [ setuptools ];
+
+  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
+
+  dependencies = with python3Packages; [
     daemonocle
     dnspython
+    json-logging
     netifaces
     requests
-    json-logging
     setuptools
   ];
-  nativeCheckInputs = with python3Packages; [ bottle mock pytest-console-scripts pytestCheckHook ];
 
-  disabledTests = [
-    # dnswanip connects to an external server to discover the
-    # machine's IP address.
-    "dnswanip"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # The tests that spawn a server using Bottle cannot be run on
-    # macOS or Windows as the default multiprocessing start method
-    # on those platforms is 'spawn', which requires the code to be
-    # run to be picklable, which this code isn't.
-    # Additionaly, other start methods are unsafe and prone to failure
-    # on macOS; see https://bugs.python.org/issue33725.
-    "BottleServer"
+  nativeCheckInputs = with python3Packages; [
+    bottle
+    pytest-console-scripts
+    pytestCheckHook
   ];
+
+  disabledTests =
+    [
+      # dnswanip connects to an external server to discover the
+      # machine's IP address.
+      "dnswanip"
+      # AssertionError
+      "test_null_dummy"
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # The tests that spawn a server using Bottle cannot be run on
+      # macOS or Windows as the default multiprocessing start method
+      # on those platforms is 'spawn', which requires the code to be
+      # run to be picklable, which this code isn't.
+      # Additionaly, other start methods are unsafe and prone to failure
+      # on macOS; see https://bugs.python.org/issue33725.
+      "BottleServer"
+    ];
   # Allow tests that bind or connect to localhost on macOS.
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "Dynamic DNS update client with support for multiple protocols";
-    mainProgram = "dyndnsc";
     longDescription = ''
       Dyndnsc is a command line client for sending updates to Dynamic
-      DNS (DDNS, DynDNS) services.  It supports multiple protocols and
-      services, and it has native support for IPv6.  The configuration
-      file allows using foreign, but compatible services.  Dyndnsc
+      DNS (DDNS, DynDNS) services. It supports multiple protocols and
+      services, and it has native support for IPv6. The configuration
+      file allows using foreign, but compatible services. Dyndnsc
       ships many different IP detection mechanisms, support for
       configuring multiple services in one place and it has a daemon
-      mode for running unattended.  It has a plugin system to provide
+      mode for running unattended. It has a plugin system to provide
       external notification services.
     '';
     homepage = "https://github.com/infothrill/python-dyndnsc";
+    changelog = "https://github.com/infothrill/python-dyndnsc/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ AluisioASG ];
+    mainProgram = "dyndnsc";
     platforms = platforms.unix;
   };
 }

pkgs/applications/office/libreoffice/default.nix

@@ -268,6 +268,8 @@ in stdenv.mkDerivation (finalAttrs: {
     substituteInPlace configure.ac --replace-fail \
       'GPGMEPP_CFLAGS=-I/usr/include/gpgme++' \
       'GPGMEPP_CFLAGS=-I${gpgme.dev}/include/gpgme++'
+  '' + optionalString (stdenv.hostPlatform.gcc.arch or null != null) ''
+    sed -e '/CPPUNIT_TEST(testDubiousArrayFormulasFODS);/d' -i './sc/qa/unit/functions_array.cxx'
   '';
 
   nativeBuildInputs = [

pkgs/applications/science/logic/cbmc/0001-Do-not-download-sources-in-cmake.patch

@@ -1,4 +1,4 @@
-From 206084d2e08198b0b5b67733c407bd3fb74affb1 Mon Sep 17 00:00:00 2001
+From 714f5ebe9ade721abdccf58edfcddba52465cb8d Mon Sep 17 00:00:00 2001
 From: Jiajie Chen <c@jia.je>
 Date: Sun, 2 Jul 2023 22:43:27 +0800
 Subject: [PATCH] Do not download sources in cmake
@@ -8,7 +8,7 @@ Subject: [PATCH] Do not download sources in cmake
  1 file changed, 1 insertion(+), 10 deletions(-)
 
 diff --git a/src/solvers/CMakeLists.txt b/src/solvers/CMakeLists.txt
-index 8bfcf4d13c..6ba858a461 100644
+index daa0853a57..4bcbbdaa47 100644
 --- a/src/solvers/CMakeLists.txt
 +++ b/src/solvers/CMakeLists.txt
 @@ -123,16 +123,6 @@ foreach(SOLVER ${sat_impl})
@@ -16,11 +16,11 @@ index 8bfcf4d13c..6ba858a461 100644
          message(STATUS "Building solvers with cadical")
  
 -        download_project(PROJ cadical
--            URL https://github.com/arminbiere/cadical/archive/rel-1.5.3.tar.gz
--            PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/../scripts/cadical-1.5.3-patch
+-            URL https://github.com/arminbiere/cadical/archive/rel-1.7.2.tar.gz
+-            PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/../scripts/cadical-1.7.2-patch
 -            COMMAND cmake -E copy ${CBMC_SOURCE_DIR}/../scripts/cadical_CMakeLists.txt CMakeLists.txt
 -            COMMAND ./configure
--            URL_MD5 265b1a715000ed3c5b6de36ddd1278a0
+-            URL_MD5 be646831a017f81b300664e58deba1b5
 -        )
 -
 -        add_subdirectory(${cadical_SOURCE_DIR} ${cadical_BINARY_DIR})
@@ -32,10 +32,10 @@ index 8bfcf4d13c..6ba858a461 100644
          target_include_directories(solvers
              PUBLIC
              ${cadical_SOURCE_DIR}/src
-+	    ${cadical_INCLUDE_DIR}
++            ${cadical_INCLUDE_DIR}
          )
  
          target_link_libraries(solvers cadical)
 -- 
-2.40.1
+2.42.0
 

pkgs/applications/science/logic/cbmc/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cbmc";
-  version = "5.91.0";
+  version = "5.95.1";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-7DzhGEDS9T6WIjGoxOw9Gf/q+tYNFJDPbQUBV3tbn/I=";
+    sha256 = "sha256-fDLSo5EeHyPTliAqFp+5mfaB0iZXIMXeMyF21fjl5k4=";
   };
 
   nativeBuildInputs = [
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     license = licenses.bsdOriginal;
     maintainers = with maintainers; [ jiegec ];
     platforms = platforms.unix;
-    # https://github.com/diffblue/cbmc/issues/7423
-    broken = stdenv.isLinux && stdenv.isAarch64;
+    # error: no member named 'aligned_alloc' in the global namespace
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }

pkgs/by-name/ca/castxml/package.nix

@@ -37,13 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    libclang
     libffi
     libxml2
     zlib
-  ];
-
-  propagatedBuildInputs = [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     libclang
   ];
 
@@ -51,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeOptionType "path" "CLANG_RESOURCE_DIR" "${lib.getDev libclang}")
     (lib.cmakeBool "SPHINX_HTML" withHTML)
     (lib.cmakeBool "SPHINX_MAN" withManual)
+  ] ++ lib.optionals stdenv.isDarwin [
+    (lib.cmakeOptionType "path" "Clang_DIR" "${lib.getDev libclang}/lib/cmake/clang")
   ];
 
   # 97% tests passed, 97 tests failed out of 2881

pkgs/by-name/cs/csvlens/package.nix

@@ -7,20 +7,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "csvlens";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "YS-L";
     repo = "csvlens";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Qpda9qADnj3eGz+nvD6VgxUOwTXrFI1rMam6+sfK6MQ=";
+    hash = "sha256-22IU+TpmmJNCsjrobXe0+0YhssbFMt/j9Vusz69lips=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
   ];
 
-  cargoHash = "sha256-PDOuAz+ov1S7i7TpRp4YaeoQQJ4paal6FI0VU25d4zU=";
+  cargoHash = "sha256-jLoVuDoarq6ZIWrNw04eyRo+M4jNcZ2zsMWKmZaDPf0=";
 
   meta = with lib; {
     description = "Command line csv viewer";

pkgs/by-name/fo/forgejo/package.nix

@@ -24,7 +24,7 @@ let
     pname = "forgejo-frontend";
     inherit (forgejo) src version;
 
-    npmDepsHash = "sha256-BffoEbIzTU61bw3ECEm5eDHcav4S27MB5jQKsMprkcw=";
+    npmDepsHash = "sha256-Nu9aOjJpEAuCWWnJfZXy/GayiUDiyc3hOu6Bx7GxfxA=";
 
     patches = [
       ./package-json-npm-build-frontend.patch
@@ -39,17 +39,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "7.0.2";
+  version = "7.0.3";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-YY5dHXWMqlCIPfqsDtHZLHjEdYmrFnh4yc0hfTUESww=";
+    hash = "sha256-P+HVZmfNA1ao+fQ253tK8A2DNGNPxvdyzCvByQJ0FGA=";
   };
 
-  vendorHash = "sha256-UcjaMi/4XYLdaJhi2j3UWqHqkpTbZBo6EwNXxdRIKLw=";
+  vendorHash = "sha256-8qMpnGL5GXJuxOpxh9a1Bcxd7tVweUKwbun8UBxCfQA=";
 
   subPackages = [ "." ];
 

pkgs/by-name/fu/furmark/package.nix

@@ -39,7 +39,9 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "furmark";
-  version = versions.${stdenv.hostPlatform.system};
+  version =
+    versions.${stdenv.hostPlatform.system}
+      or (throw "Furmark is not available on ${stdenv.hostPlatform.system}");
 
   src = fetchzip sources.${stdenv.hostPlatform.system};
 

pkgs/by-name/gi/githooks/package.nix

@@ -5,6 +5,7 @@
   git,
   testers,
   makeWrapper,
+  githooks
 }:
 buildGoModule rec {
   pname = "githooks";
@@ -70,7 +71,7 @@ buildGoModule rec {
   '';
 
   passthru.tests.version = testers.testVersion {
-    package = "githooks-cli";
+    package = githooks;
     command = "githooks-cli --version";
     inherit version;
   };

pkgs/by-name/go/google-chrome/package.nix

@@ -64,11 +64,11 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "google-chrome";
-  version = "125.0.6422.60";
+  version = "125.0.6422.76";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-Q0QMPthJLVquJp7fm6QN+lDb0quZsT7hv6KRXfdBMl4=";
+    hash = "sha256-hLGEwaTx11tqiS7skoNVwCEw+1GZ0pNHpfe11IFjTFc=";
   };
 
   nativeBuildInputs = [ patchelf makeWrapper ];

pkgs/by-name/ma/marge-bot/package.nix

@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg --replace "--flake8 --pylint --cov=marge" ""
+    substituteInPlace setup.cfg --replace-fail "--flake8 --pylint --cov=marge" ""
   '';
 
   nativeBuildInputs = [
@@ -30,12 +30,17 @@ python3.pkgs.buildPythonApplication rec {
     requests
   ];
 
-  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook ];
+  nativeCheckInputs = with python3.pkgs; [ pytestCheckHook pendulum ];
   disabledTests = [
     # test broken when run under Nix:
     #   "unittest.mock.InvalidSpecError: Cannot spec a Mock object."
     "test_get_mr_ci_status"
   ];
+  disabledTestPaths = [
+    # test errors due to API mismatch in test setup:
+    #   "ImportError: cannot import name 'set_test_now' from 'pendulum.helpers'"
+    "tests/test_interval.py"
+  ];
 
   pythonImportsCheck = [ "marge" ];
 

pkgs/by-name/mo/mods/package.nix

@@ -1,9 +1,10 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, gitUpdater
-, testers
-, mods
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  testers,
+  mods,
 }:
 
 buildGoModule rec {
@@ -19,7 +20,14 @@ buildGoModule rec {
 
   vendorHash = "sha256-BL5bxyeVkcm7GO1Kzk9d/hj2wY50UhauEFq9YQ/JbCE=";
 
-  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.Version=${version}"
+  ];
+
+  # These tests require internet access.
+  checkFlags = [ "-skip=^TestLoad/http_url$|^TestLoad/https_url$" ];
 
   passthru = {
     updateScript = gitUpdater {

pkgs/by-name/ne/nekoray/package.nix

@@ -96,6 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libsForQt5.qtbase
     libsForQt5.qttools
+    libsForQt5.qtwayland
     libsForQt5.qtx11extras
     protobuf
     yaml-cpp

pkgs/by-name/no/nomacs/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     exiv2
     libraw
     libtiff
-    opencv4
+    (lib.getOutput "cxxdev" opencv4)
   ] ++ (with libsForQt5; [
     qtbase
     qtimageformats

pkgs/by-name/sh/share-preview/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  meson,
+  ninja,
+  pkg-config,
+  rustc,
+  cargo,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  libadwaita,
+  openssl,
+  darwin,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "share-preview";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "rafaelmardojai";
+    repo = "share-preview";
+    rev = finalAttrs.version;
+    hash = "sha256-FqualaTkirB+gBcgkThQpSBHhM4iaXkiGujwBUnUX0E=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src;
+    name = "share-preview-${finalAttrs.version}";
+    hash = "sha256-Gh6bQZD1mlkj3XeGp+fF/NShC4PZCZSEqymrsSdX4Ec=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    libadwaita
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.apple_sdk.frameworks.SystemConfiguration
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.isDarwin [ "-Wno-error=incompatible-function-pointer-types" ]
+  );
+
+  meta = {
+    description = "Preview and debug websites metadata tags for social media share";
+    homepage = "https://apps.gnome.org/SharePreview";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "share-preview";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/st/stackql/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  testers,
+  stackql,
+}:
+
+buildGoModule rec {
+  pname = "stackql";
+  version = "0.5.643";
+
+  src = fetchFromGitHub {
+    owner = "stackql";
+    repo = "stackql";
+    rev = "v${version}";
+    hash = "sha256-9W6bEI+5Q0Kgbd14sWKde3I6WIVz1ZxsXmR009mOPog=";
+  };
+
+  vendorHash = "sha256-xcly4jtdUkx/s+YWYFBVeuI2kQBu2oqbLN9ZKkHppkA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/stackql/stackql/internal/stackql/cmd.BuildMajorVersion=${builtins.elemAt (lib.splitVersion version) 0}"
+    "-X github.com/stackql/stackql/internal/stackql/cmd.BuildMinorVersion=${builtins.elemAt (lib.splitVersion version) 1}"
+    "-X github.com/stackql/stackql/internal/stackql/cmd.BuildPatchVersion=${builtins.elemAt (lib.splitVersion version) 2}"
+    "-X github.com/stackql/stackql/internal/stackql/cmd.BuildDate=2024-05-15T07:51:52Z" # date of commit hash
+    "-X stackql/internal/stackql/planbuilder.PlanCacheEnabled=true"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  checkFlags = [ "--tags json1,sqleanal" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = stackql;
+    version = "v${version}";
+  };
+
+  meta = {
+    homepage = "https://github.com/stackql/stackql";
+    description = "Deploy, manage and query cloud resources and interact with APIs using SQL";
+    mainProgram = "stackql";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jonochang ];
+  };
+}

pkgs/by-name/st/stalwart-mail/package.nix

@@ -22,7 +22,7 @@ let
   # See upstream issue for rocksdb 9.X support
   # https://github.com/stalwartlabs/mail-server/issues/407
   rocksdb = rocksdb_8_11;
-  version = "0.8.0";
+  version = "0.8.1";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -32,11 +32,11 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "v${version}";
-    hash = "sha256-V6Gl59938AplFW7pbrbGWB42+zRQBEaTUSW0+TMBo8I=";
+    hash = "sha256-al2+/+HPbjJ30rju2ih/yFZgmTdO2bQ6jDv+dtoIqsc=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-LWA08GNCrDlSwcSAlAi58OkoLs41fL6J5DPCsacozsM=";
+  cargoHash = "sha256-ek9vPo/M4peDcDkfzjXoKlJ+gFZUiREwNflOKEJNaWQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/tu/turtle/package.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitLab,
+  gobject-introspection,
+  wrapGAppsHook4,
+  libadwaita,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "turtle";
+  version = "0.8";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "philippun1";
+    repo = "turtle";
+    rev = version;
+    hash = "sha256-YacuT5S6WrhSz031XXCQTo++r+DBozrIIXrn9BwmrR0=";
+  };
+
+  postPatch = ''
+    substituteInPlace ./install.py \
+      --replace-fail "/usr" "$out" \
+      --replace-fail "gtk-update-icon-cache" "gtk4-update-icon-cache"
+  '';
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [ libadwaita ];
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    pygobject3
+    pygit2
+  ];
+
+  postInstall = ''
+    python ./install.py install
+  '';
+
+  # Avoid wrapping two times
+  dontWrapGApps = true;
+
+  # Make sure we patch other scripts after wrapper is generated
+  # to get $program_PYTHONPATH
+  dontWrapPythonPrograms = true;
+
+  postFixup =
+    ''
+      makeWrapperArgs+=(''${gappsWrapperArgs[@]})
+      wrapPythonPrograms
+    ''
+    # Dialogs are not imported, but executed. The same does
+    # nautilus-python plugins. So we need to patch them as well.
+    + ''
+      for dialog_scripts in $out/lib/python*/site-packages/turtlevcs/dialogs/*.py; do
+        patchPythonScript $dialog_scripts
+      done
+      for nautilus_extensions in $out/share/nautilus-python/extensions/*.py; do
+        patchPythonScript $nautilus_extensions
+      done
+    '';
+
+  meta = {
+    description = "A graphical interface for version control intended to run on gnome and nautilus";
+    homepage = "https://gitlab.gnome.org/philippun1/turtle";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "turtle_cli";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/development/coq-modules/graph-theory/default.nix

@@ -8,12 +8,14 @@ mkCoqDerivation {
   release."0.9.1".sha256 = "sha256-lRRY+501x+DqNeItBnbwYIqWLDksinWIY4x/iojRNYU=";
   release."0.9.2".sha256 = "sha256-DPYCZS8CzkfgpR+lmYhV2v20ezMtyWp8hdWpuh0OOQU=";
   release."0.9.3".sha256 = "sha256-9WX3gsw+4btJLqcGg2W+7Qy+jaZtkfw7vCp8sXYmaWw=";
+  release."0.9.4".sha256 = "sha256-fXTAsRdPisNhg8Umaa7S7gZ1M8zuPGg426KP9fAkmXQ=";
 
   releaseRev = v: "v${v}";
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.coq-version mathcomp.version ] [
-    { cases = [ (isGe "8.16") (range "2.0.0" "2.1.0") ]; out = "0.9.3"; }
+    { cases = [ (isGe "8.16") (range "2.0.0" "2.2.0") ]; out = "0.9.4"; }
+    { cases = [ (range "8.16" "8.18") (range "2.0.0"  "2.1.0" ) ]; out = "0.9.3"; }
     { cases = [ (range "8.14" "8.18") (range "1.13.0" "1.18.0") ]; out = "0.9.2"; }
     { cases = [ (range "8.14" "8.16") (range "1.13.0" "1.14.0") ]; out = "0.9.1"; }
     { cases = [ (range "8.12" "8.13") (range "1.12.0" "1.14.0") ]; out = "0.9"; }

pkgs/development/libraries/gdal/default.nix

@@ -265,8 +265,6 @@ stdenv.mkDerivation (finalAttrs: {
     # failing with PROJ 9.3.1
     # https://github.com/OSGeo/gdal/issues/8908
     "test_osr_esri_28"
-  ] ++ lib.optionals (!stdenv.isx86_64) [
-    # likely precision-related expecting x87 behaviour
     "test_jp2openjpeg_22"
   ] ++ lib.optionals stdenv.isDarwin [
     # flaky on macos

pkgs/development/libraries/gsl/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isx86_64 "-mno-fma";
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
-  doCheck = stdenv.hostPlatform.system != "i686-linux";
+  doCheck = stdenv.hostPlatform.system != "i686-linux" && stdenv.hostPlatform.gcc.arch or null != "znver4";
 
   meta = {
     description = "The GNU Scientific Library, a large numerical library";

pkgs/development/libraries/lib2geom/default.nix

@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
   # TODO: Update cmake hook to make it simpler to selectively disable cmake tests: #113829
   checkPhase = let
     disabledTests =
-      lib.optionals stdenv.isAarch64 [
+      [
         # Broken on all platforms, test just accidentally passes on some.
         # https://gitlab.com/inkscape/lib2geom/-/issues/63
         "elliptical-arc-test"

pkgs/development/python-modules/aiocache/default.nix

@@ -58,10 +58,15 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # calls apache benchmark and fails, no usable output
+    # Test calls apache benchmark and fails, no usable output
     "test_concurrency_error_rates"
   ];
 
+  disabledTestPaths = [
+    # Benchmark and performance tests are not relevant for Nixpkgs
+    "tests/performance/"
+  ];
+
   preCheck = ''
     ${lib.getBin pkgs.redis}/bin/redis-server &
     REDIS_PID=$!
@@ -83,7 +88,7 @@ buildPythonPackage rec {
     description = "Python API Rate Limit Decorator";
     homepage = "https://github.com/aio-libs/aiocache";
     changelog = "https://github.com/aio-libs/aiocache/releases/tag/v${version}";
-    license = with licenses; [ bsd3 ];
+    license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/aioquic/default.nix

@@ -4,7 +4,6 @@
   certifi,
   cryptography,
   fetchPypi,
-  fetchpatch,
   openssl,
   pylsqpack,
   pyopenssl,
@@ -16,26 +15,19 @@
 
 buildPythonPackage rec {
   pname = "aioquic";
-  version = "0.9.25";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cHlceJBTJthVwq5SQHIjSq5YbHibgSkuJy0CHpsEMKM=";
+    hash = "sha256-7THCta+pjFtsr6TzYUnerx3/bFppcB6t0nFnQV+fFmA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/aiortc/aioquic/commit/e899593805e0b31325a1d347504eb8e6100fe87d.diff";
-      hash = "sha256-TTpIIWX/R4k2KxhsN17O9cRW/dN0AARYnju8JTht3D8=";
-    })
-  ];
+  build-system = [ setuptools ];
 
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     cryptography
     pylsqpack

pkgs/development/python-modules/aiosasl/default.nix

@@ -5,13 +5,16 @@
   fetchpatch,
   pyopenssl,
   pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiosasl";
   version = "0.5.0";
+  pyproject = true;
 
-  format = "setuptools";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "horazont";
@@ -28,6 +31,14 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    # https://github.com/horazont/aiosasl/issues/28
+    substituteInPlace tests/test_aiosasl.py \
+      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
+  '';
+
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     pyopenssl
     pytestCheckHook

pkgs/development/python-modules/aioxmpp/default.nix

@@ -1,27 +1,32 @@
 {
   lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  aiosasl,
   aioopenssl,
+  aiosasl,
   babel,
+  buildPythonPackage,
   dnspython,
+  fetchFromGitHub,
   lxml,
   multidict,
-  pyasn1,
   pyasn1-modules,
+  pyasn1,
   pyopenssl,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  pythonRelaxDepsHook,
   pytz,
+  setuptools,
   sortedcollections,
   tzlocal,
-  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "aioxmpp";
   version = "0.13.3";
+  pyproject = true;
 
-  format = "setuptools";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "horazont";
@@ -30,7 +35,15 @@ buildPythonPackage rec {
     hash = "sha256-bQPKEM5eKhFI3Kx3U1espdxqjnG4yUgOXmYCrd98PDo=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [
+    "lxml"
+  ];
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+
+  dependencies = [
     aiosasl
     aioopenssl
     babel
@@ -60,12 +73,23 @@ buildPythonPackage rec {
   disabledTests = [
     # AttributeError: 'zoneinfo.ZoneInfo' object has no attribute 'normalize'
     "test_convert_field_datetime_default_locale"
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # asyncio issues
+    "test_is_abstract"
+    "Testbackground"
+    "TestCapturingXSO"
+    "Testcheck_x509"
+    "TestClient"
+    "TestIntegerType"
+    "TestStanzaStream"
+    "TestStanzaToken"
+    "TestXMLStream"
   ];
 
   meta = {
-    changelog = "https://github.com/horazont/aioxmpp/blob/${src.rev}/docs/api/changelog.rst";
     description = "Pure-python XMPP library for asyncio";
     homepage = "https://github.com/horazont/aioxmpp";
+    changelog = "https://github.com/horazont/aioxmpp/blob/${src.rev}/docs/api/changelog.rst";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ dotlambda ];
   };

pkgs/development/python-modules/amazon-kclpy/default.nix

@@ -2,45 +2,49 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  python,
+  fetchpatch,
+  setuptools,
   mock,
-  boto,
-  pytest,
+  boto3,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "amazon-kclpy";
-  version = "2.1.3";
-  format = "setuptools";
+  version = "2.1.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "amazon-kinesis-client-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3BhccRJd6quElXZSix1aVIqWr9wdcTTziDhnIOLiPPo=";
+    hash = "sha256-TWIGu7WuoaPhk8cz+hMXvGLIPQ5kly8aj20ZtvTZzwg=";
   };
 
-  # argparse is just required for python2.6
-  prePatch = ''
-    substituteInPlace setup.py \
-      --replace "'argparse'," ""
-  '';
-
-  propagatedBuildInputs = [
-    mock
-    boto
+  patches = [
+    (fetchpatch {
+      name = "remove-deprecated-boto.patch";
+      url = "https://github.com/awslabs/amazon-kinesis-client-python/commit/bd2c442cdd1b0e2c99d3471c1d3ffcc9161a7c42.patch";
+      hash = "sha256-5W0qItDGjx1F6IllzLH57XCpToKrAu9mTbzv/1wMXuY=";
+    })
   ];
 
-  nativeCheckInputs = [ pytest ];
+  build-system = [ setuptools ];
 
-  checkPhase = ''
-    ${python.interpreter} -m pytest
-  '';
+  dependencies = [
+    mock
+    boto3
+  ];
+
+  pythonImportsCheck = [ "amazon_kclpy" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     description = "Amazon Kinesis Client Library for Python";
     homepage = "https://github.com/awslabs/amazon-kinesis-client-python";
-    license = licenses.amazonsl;
+    license = licenses.asl20;
     maintainers = with maintainers; [ psyanticy ];
+    broken = true;
   };
 }

pkgs/development/python-modules/boltztrap2/default.nix

@@ -8,16 +8,18 @@
   matplotlib,
   ase,
   netcdf4,
-  pytest,
   pythonOlder,
   cython,
   cmake,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "boltztrap2";
   version = "24.1.1";
-  format = "setuptools";
+
+  pyproject = true;
+  build-system = [ setuptools ];
 
   disabled = pythonOlder "3.5";
 
@@ -27,6 +29,11 @@ buildPythonPackage rec {
     hash = "sha256-kgv4lPBxcBmRKihaTwPRz8bHTWAWUOGZADtJUb3y+C4=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "USE_CYTHON = False" "USE_CYTHON = True"
+  '';
+
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [
@@ -34,7 +41,7 @@ buildPythonPackage rec {
     cython
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     spglib
     numpy
     scipy

pkgs/development/python-modules/chromadb/default.nix

@@ -150,10 +150,11 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "The AI-native open-source embedding database";
-    mainProgram = "chroma";
     homepage = "https://github.com/chroma-core/chroma";
     changelog = "https://github.com/chroma-core/chroma/releases/tag/${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "chroma";
+    broken = stdenv.isLinux && stdenv.isAarch64;
   };
 }

pkgs/development/python-modules/circus/default.nix

@@ -6,6 +6,7 @@
   flit-core,
   psutil,
   pytestCheckHook,
+  pythonOlder,
   pyyaml,
   pyzmq,
   tornado,
@@ -14,16 +15,18 @@
 buildPythonPackage rec {
   pname = "circus";
   version = "0.18.0";
-  format = "pyproject";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-GTzoIk4GjO1mckz0gxBvtmdLUaV1g6waDn7Xp+6Mcas=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     psutil
     pyzmq
     tornado
@@ -41,38 +44,39 @@ buildPythonPackage rec {
 
   disabledTests = [
     # these tests raise circus.tests.support.TimeoutException
-    "test_reload1"
-    "test_reload2"
+    "test_add_start"
+    "test_add"
+    "test_command_already_running"
+    "test_dummy"
+    "test_exits_within_graceful_timeout"
+    "test_full_stats"
+    "test_handler"
+    "test_handler"
+    "test_inherited"
+    "test_kills_after_graceful_timeout"
+    "test_launch_cli"
+    "test_max_age"
     "test_reload_sequential"
     "test_reload_uppercase"
     "test_reload_wid_1_worker"
     "test_reload_wid_4_workers"
-    "test_add"
-    "test_add_start"
-    "test_command_already_running"
-    "test_launch_cli"
-    "test_handler"
+    "test_reload1"
+    "test_reload2"
     "test_resource_watcher_max_cpu"
-    "test_resource_watcher_max_mem"
     "test_resource_watcher_max_mem_abs"
+    "test_resource_watcher_max_mem"
     "test_resource_watcher_min_cpu"
-    "test_resource_watcher_min_mem"
     "test_resource_watcher_min_mem_abs"
-    "test_full_stats"
-    "test_watchdog_discovery_found"
-    "test_watchdog_discovery_not_found"
-    "test_dummy"
-    "test_handler"
+    "test_resource_watcher_min_mem"
+    "test_set_before_launch"
+    "test_set_by_arbiter"
+    "test_signal"
     "test_stdin_socket"
     "test_stop_and_restart"
     "test_stream"
-    "test_inherited"
-    "test_set_before_launch"
-    "test_set_by_arbiter"
-    "test_max_age"
-    "test_signal"
-    "test_exits_within_graceful_timeout"
-    "test_kills_after_graceful_timeout"
+    "test_venv"
+    "test_watchdog_discovery_found"
+    "test_watchdog_discovery_not_found"
     # this test requires socket communication
     "test_plugins"
   ];
@@ -82,6 +86,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A process and socket manager";
     homepage = "https://github.com/circus-tent/circus";
+    changelog = "https://github.com/circus-tent/circus/releases/tag/${version}";
     license = licenses.asl20;
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/dask-expr/default.nix

@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask-expr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ltsRKbb/p+qHeNiX0oeZUKbbjPoPxSM4uFnWUFqoqhc=";
+    hash = "sha256-N+hvalSn8mwlAaN3Xhu+YxECORfLN4UHutwmeiGR9WI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/datashape/default.nix

@@ -7,6 +7,8 @@
   numpy,
   multipledispatch,
   python-dateutil,
+  setuptools,
+  versioneer,
 }:
 
 let
@@ -29,18 +31,28 @@ in
 buildPythonPackage rec {
   pname = "datashape";
   version = "0.5.4";
-  format = "setuptools";
+
+  pyproject = true;
+  build-system = [
+    setuptools
+    versioneer
+  ];
 
   src = fetcher {
     inherit pname version;
     sha256 = "0rhlj2kjj1vx5m73wnc5518rd6cs1zsbgpsvzk893n516k69shcf";
   };
 
+  postPatch = ''
+    # Remove vendorized versioneer.py
+    rm versioneer.py
+  '';
+
   nativeCheckInputs = [
     pytest
     mock
   ];
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     multipledispatch
     python-dateutil

pkgs/development/python-modules/ds4drv/default.nix

@@ -5,12 +5,15 @@
   evdev,
   pyudev,
   bluez,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ds4drv";
   version = "0.5.1";
-  format = "setuptools";
+
+  pyproject = true;
+  build-system = [ setuptools ];
 
   # PyPi only carries py3 wheel
   src = fetchFromGitHub {
@@ -20,7 +23,12 @@ buildPythonPackage rec {
     sha256 = "0vinpla0apizzykcyfis79mrm1i6fhns83nkzw85svypdhkx2g8v";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace ds4drv/config.py \
+      --replace-fail SafeConfigParser ConfigParser
+  '';
+
+  dependencies = [
     evdev
     pyudev
   ];

pkgs/development/python-modules/faraday-agent-parameters-types/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-agent-parameters-types";
-  version = "1.5.1";
+  version = "1.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "faraday_agent_parameters_types";
     inherit version;
-    hash = "sha256-Bh1s0IeUEa4EnGElQn5ruBxFSbcOqsrDqbw1nVjdi5s=";
+    hash = "sha256-yw4u1xhfY9WYLSf9CNAsiDpY7y2Llf8j4gDoNZjACw0=";
   };
 
   postPatch = ''
@@ -27,9 +27,9 @@ buildPythonPackage rec {
       --replace-warn '"pytest-runner",' ""
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     marshmallow
     packaging
   ];
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     description = "Collection of Faraday agent parameters types";
     homepage = "https://github.com/infobyte/faraday_agent_parameters_types";
     changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${version}/CHANGELOG.md";
-    license = with licenses; [ gpl3Plus ];
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/faraday-plugins/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.17.0";
+  version = "1.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -29,17 +29,17 @@ buildPythonPackage rec {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-EE61RPantD1u9NNhyPRjoRkBifM3u16b0BC2aQC8UBA=";
+    hash = "sha256-oYE7Iik0+CbOfxF9IeeZotpGqV8TTz15MxJEC4VBrhk=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-warn "version=version," "version='${version}',"
+      --replace-fail "version=version," "version='${version}',"
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     beautifulsoup4
     click
     colorama
@@ -73,10 +73,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Security tools report parsers for Faraday";
-    mainProgram = "faraday-plugins";
     homepage = "https://github.com/infobyte/faraday_plugins";
     changelog = "https://github.com/infobyte/faraday_plugins/releases/tag/${version}";
-    license = with licenses; [ gpl3Only ];
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "faraday-plugins";
   };
 }

pkgs/development/python-modules/gmpy2/default.nix

@@ -51,11 +51,17 @@ buildPythonPackage rec {
     mpmath
   ];
 
-  disabledTests = lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
-    # issue with some overflow logic
-    "test_mpz_to_bytes"
-    "test_mpz_from_bytes"
-  ];
+  disabledTests =
+    lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
+      # issue with some overflow logic
+      "test_mpz_to_bytes"
+      "test_mpz_from_bytes"
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # TypeError: mpq() requires numeric or string argument
+      # not sure why it only fails on Darwin
+      "test_mpq_from_Decimal"
+    ];
 
   pythonImportsCheck = [ "gmpy2" ];
 

pkgs/development/python-modules/ics/default.nix

@@ -16,7 +16,7 @@ buildPythonPackage rec {
   version = "0.7.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ics-py";
@@ -25,9 +25,14 @@ buildPythonPackage rec {
     hash = "sha256-hdtnET7YfSb85+TGwpwzoxOfxPT7VSj9eKSiV6AXUS8=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "--pep8" ""
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     attrs
     arrow
     tatsu
@@ -38,18 +43,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # 0.8 will move to python-dateutil
-    substituteInPlace requirements.txt \
-      --replace "arrow>=0.11,<0.15" "arrow"
-    substituteInPlace setup.cfg --replace "--pep8" ""
-  '';
-
   disabledTests = [
     # Failure seems to be related to arrow > 1.0
     "test_event"
     # Broke with TatSu 5.7:
     "test_many_lines"
+    # AssertionError: 'Europe/Berlin' not found in "tzfile('Atlantic/Jan_Mayen')"
+    "test_timezone_not_dropped"
   ];
 
   pythonImportsCheck = [ "ics" ];

pkgs/development/python-modules/marimo/default.nix

@@ -17,19 +17,20 @@
   tomlkit,
   uvicorn,
   websockets,
+  pyyaml,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.6.0";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L6ICaaMRrMOr/d8CJGcXxOYCWTVh8ObckW7xNeLRB2Q=";
+    hash = "sha256-sp3lQPLpU5qvHKQ02c/Ga1M8IsbmOX5nz2XPBMbGj30=";
   };
 
   build-system = [ setuptools ];
@@ -48,6 +49,7 @@ buildPythonPackage rec {
     tomlkit
     uvicorn
     websockets
+    pyyaml
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];

pkgs/development/python-modules/mitmproxy-macos/default.nix

@@ -33,5 +33,6 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ boltzmannrain ];
     platforms = platforms.darwin;
+    broken = true; # last successful build 2023-12-04
   };
 }

pkgs/development/python-modules/mutag/default.nix

@@ -2,30 +2,39 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  isPy3k,
   pyparsing,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage {
   pname = "mutag";
-  version = "0.0.2-2ffa0258ca";
-  format = "setuptools";
-  disabled = !isPy3k;
+  version = "0.0.2-unstable-2018-08-20";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "aroig";
     repo = "mutag";
-    rev = "2ffa0258cadaf79313241f43bf2c1caaf197d9c2";
-    hash = "sha256-YT3DGvYPyTuB70gg6p/3oXcTahEPcNuSIqe56xu3rSs=";
+    rev = "9425169eb5d4aa9eb09f2809a09b83855b3acbef";
+    hash = "sha256-fEMmFRoFyLkqusAuhdx3XEPaPsu1x86ACAz9Vkl9YfA=";
   };
 
-  propagatedBuildInputs = [ pyparsing ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyparsing ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "mutag" ];
 
   meta = with lib; {
-    homepage = "https://github.com/aroig/mutag";
     description = "A script to change email tags in a mu indexed maildir";
-    mainProgram = "mutag";
-    license = licenses.gpl3;
+    homepage = "https://github.com/aroig/mutag";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
+    mainProgram = "mutag";
   };
 }

pkgs/development/python-modules/ppscore/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonRelaxDepsHook,
   setuptools,
   pandas,
   pytestCheckHook,
@@ -23,7 +24,10 @@ buildPythonPackage rec {
     hash = "sha256-gJStsL8fN17kvXO8EH/NHGIBelPknJzYw5WEvHsFooU=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     pandas
@@ -32,6 +36,8 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  pythonRelaxDeps = [ "pandas" ];
+
   pythonImportsCheck = [ "ppscore" ];
 
   meta = with lib; {

pkgs/development/python-modules/pyannote-metrics/default.nix

@@ -1,19 +1,20 @@
 {
   lib,
   buildPythonPackage,
+  docopt,
   fetchFromGitHub,
-  setuptools,
-  wheel,
+  matplotlib,
+  numpy,
+  pandas,
   pyannote-core,
   pyannote-database,
-  pandas,
-  scipy,
+  pythonOlder,
   scikit-learn,
-  docopt,
-  tabulate,
-  matplotlib,
+  scipy,
+  setuptools,
   sympy,
-  numpy,
+  tabulate,
+  versioneer,
 }:
 
 buildPythonPackage rec {
@@ -21,14 +22,26 @@ buildPythonPackage rec {
   version = "3.2.1";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "pyannote";
     repo = "pyannote-metrics";
-    rev = version;
+    rev = "refs/tags/${version}";
     hash = "sha256-V4qyaCaFsoikfFILm2sccf6m7lqJSDTdLxS1sr/LXAY=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    # Remove vendorized versioneer.py
+    rm versioneer.py
+  '';
+
+  build-system = [
+    setuptools
+    versioneer
+  ];
+
+  dependencies = [
     pyannote-core
     pyannote-database
     pandas
@@ -41,18 +54,14 @@ buildPythonPackage rec {
     numpy
   ];
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
-
   pythonImportsCheck = [ "pyannote.metrics" ];
 
   meta = with lib; {
     description = "A toolkit for reproducible evaluation, diagnostic, and error analysis of speaker diarization systems";
-    mainProgram = "pyannote-metrics";
     homepage = "https://github.com/pyannote/pyannote-metrics";
+    changelog = "http://pyannote.github.io/pyannote-metrics/changelog.html";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
+    mainProgram = "pyannote-metrics";
   };
 }

pkgs/development/python-modules/pyrympro/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "pyrympro";
+  version = "0.0.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "OnFreund";
+    repo = "pyrympro";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-mRvKLPgtBgmFDTHqra7GslxsgsJpQ2w/DE0Zgz5jujk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyrympro" ];
+
+  meta = with lib; {
+    description = "Module to interact with Read Your Meter Pro";
+    homepage = "https://github.com/OnFreund/pyrympro";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/python-ironicclient/default.nix

@@ -2,8 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pbr,
-  appdirs,
   cliff,
   dogpile-cache,
   jsonschema,
@@ -11,12 +9,14 @@
   openstacksdk,
   osc-lib,
   oslo-utils,
+  oslotest,
+  pbr,
+  platformdirs,
   pyyaml,
   requests,
-  stevedore,
-  stestr,
   requests-mock,
-  oslotest,
+  stestr,
+  stevedore,
 }:
 
 buildPythonPackage rec {
@@ -30,8 +30,6 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    pbr
-    appdirs
     cliff
     dogpile-cache
     jsonschema
@@ -39,6 +37,8 @@ buildPythonPackage rec {
     openstacksdk
     osc-lib
     oslo-utils
+    pbr
+    platformdirs
     pyyaml
     requests
     stevedore

pkgs/development/python-modules/scikits-samplerate/default.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  numpy,
-  libsamplerate,
-  fetchFromGitHub,
-}:
-
-buildPythonPackage {
-  pname = "scikits-samplerate";
-  version = "0.3.3";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "cournape";
-    repo = "samplerate";
-    rev = "a536c97eb2d6195b5f266ea3cc3a35364c4c2210";
-    hash = "sha256-7x03Q6VXfP9p8HCk15IDZ9HeqTyi5F1AlGX/otdh8VU=";
-  };
-
-  buildInputs = [ libsamplerate ];
-
-  propagatedBuildInputs = [ numpy ];
-
-  preConfigure = ''
-    cat > site.cfg << END
-    [samplerate]
-    library_dirs=${libsamplerate.out}/lib
-    include_dirs=${lib.getDev libsamplerate}/include
-    END
-  '';
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/cournape/samplerate";
-    description = "High quality sampling rate convertion from audio data in numpy arrays";
-    license = licenses.gpl2;
-  };
-}

pkgs/development/python-modules/scipy/default.nix

@@ -136,7 +136,7 @@ buildPythonPackage {
     "hyp2f1_test_case47"
     "hyp2f1_test_case3"
     "test_uint64_max"
-  ];
+  ] ++ lib.optionals (stdenv.hostPlatform.gcc.arch or null != null) [ "test_equal_bounds" ];
 
   doCheck = !(stdenv.isx86_64 && stdenv.isDarwin);
 

pkgs/development/python-modules/strawberry-graphql/default.nix

@@ -43,16 +43,16 @@
 
 buildPythonPackage rec {
   pname = "strawberry-graphql";
-  version = "0.219.2";
-  format = "pyproject";
+  version = "0.230.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "strawberry-graphql";
     repo = "strawberry";
     rev = "refs/tags/${version}";
-    hash = "sha256-uIUETjzuDnlQp6wM7uxyLRSMT5uyrXFrI9NilcjP0BU=";
+    hash = "sha256-jhInHoOvPGIEoSddv8+30gY38L6XR5OEATUTdrHbNpA=";
   };
 
   patches = [
@@ -62,22 +62,16 @@ buildPythonPackage rec {
       url = "https://github.com/strawberry-graphql/strawberry/commit/710bb96f47c244e78fc54c921802bcdb48f5f421.patch";
       hash = "sha256-ekUZ2hDPCqwXp9n0YjBikwSkhCmVKUzQk7LrPECcD7Y=";
     })
-    (fetchpatch {
-      # https://github.com/strawberry-graphql/strawberry/pull/3255
-      name = "fix-tests-with-pydantic_2.patch";
-      url = "https://github.com/strawberry-graphql/strawberry/commit/0a0dc284ee6d31d4e82ac7ff1ed9fea4dff39fa6.patch";
-      hash = "sha256-LACWD7XA6YL/apJwhpx3LPCKxKUfa+XWyTLK+Zkxlaw=";
-    })
   ];
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "--emoji --mypy-ini-file=mypy.ini" "" \
+      --replace-fail "--emoji --mypy-ini-file=mypy.ini" "" \
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     graphql-core
     python-dateutil
     typing-extensions
@@ -135,9 +129,8 @@ buildPythonPackage rec {
       rich
       libcst
     ];
-    # starlite = [
-    #   starlite
-    # ];
+    # starlite = [ starlite ];
+    # litestar = [ litestar ];
     pyinstrument = [ pyinstrument ];
   };
 
@@ -169,16 +162,17 @@ buildPythonPackage rec {
     "tests/test_dataloaders.py"
     "tests/utils/test_pretty_print.py"
     "tests/websockets/test_graphql_transport_ws.py"
+    "tests/litestar/"
   ];
 
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
     description = "A GraphQL library for Python that leverages type annotations";
-    mainProgram = "strawberry";
     homepage = "https://strawberry.rocks";
     changelog = "https://github.com/strawberry-graphql/strawberry/blob/${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ izorkin ];
+    mainProgram = "strawberry";
   };
 }

pkgs/development/python-modules/tableaudocumentapi/default.nix

@@ -5,12 +5,16 @@
   lxml,
   pytestCheckHook,
   pythonOlder,
+  fetchpatch,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "tableaudocumentapi";
   version = "0.11";
-  format = "setuptools";
+
+  pyproject = true;
+  build-system = [ setuptools ];
 
   disabled = pythonOlder "3.7";
 
@@ -18,8 +22,17 @@ buildPythonPackage rec {
     inherit pname version;
     hash = "sha256-g6V1UBf+P21FcZkR3PHoUmdmrQwEvjdd1VKhvNmvOys=";
   };
+  patches = [
+    # distutils has been removed since python 3.12
+    # see https://github.com/tableau/document-api-python/pull/255
+    (fetchpatch {
+      name = "no-distutils.patch";
+      url = "https://github.com/tableau/document-api-python/pull/255/commits/59280bbe073060d1249e6404e11303ed6faa84f6.patch";
+      hash = "sha256-mjIF9iP1BQXvqkS0jYNTm8otkhSKLj2b2iHSMZ2K0iI=";
+    })
+  ];
 
-  propagatedBuildInputs = [ lxml ];
+  dependencies = [ lxml ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/weatherflow4py/default.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  dataclasses-json,
+  fetchFromGitHub,
+  marshmallow,
+  poetry-core,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  websockets,
+}:
+
+buildPythonPackage rec {
+  pname = "weatherflow4py";
+  version = "0.2.20";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "jeeftor";
+    repo = "weatherflow4py";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kkNGhFhciOfhrbjxLM01YC2IRmkdKEbk4EUyDJZJuxU=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiohttp
+    dataclasses-json
+    marshmallow
+    websockets
+  ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "weatherflow4py" ];
+
+  meta = with lib; {
+    description = "Module to interact with the WeatherFlow REST API";
+    homepage = "https://github.com/jeeftor/weatherflow4py";
+    changelog = "https://github.com/jeeftor/weatherflow4py/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/kde/default.nix

@@ -75,6 +75,9 @@
       phonon-vlc = self.callPackage ./misc/phonon-vlc {};
       polkit-qt-1 = self.callPackage ./misc/polkit-qt-1 {};
       pulseaudio-qt = self.callPackage ./misc/pulseaudio-qt {};
+
+      # Convenient for users to install various tools provided by kde
+      kdeGear = gear;
     }
   );
 in

pkgs/servers/home-assistant/component-packages.nix

@@ -3802,7 +3802,8 @@
       zeroconf
     ];
     "rympro" = ps: with ps; [
-    ]; # missing inputs: pyrympro
+      pyrympro
+    ];
     "sabnzbd" = ps: with ps; [
       pysabnzbd
     ];
@@ -4895,7 +4896,8 @@
       pyweatherflowudp
     ];
     "weatherflow_cloud" = ps: with ps; [
-    ]; # missing inputs: weatherflow4py
+      weatherflow4py
+    ];
     "weatherkit" = ps: with ps; [
       apple-weatherkit
     ];
@@ -5777,6 +5779,7 @@
     "ruckus_unleashed"
     "ruuvi_gateway"
     "ruuvitag_ble"
+    "rympro"
     "sabnzbd"
     "samsungtv"
     "sanix"
@@ -5972,6 +5975,7 @@
     "waze_travel_time"
     "weather"
     "weatherflow"
+    "weatherflow_cloud"
     "weatherkit"
     "webhook"
     "webostv"

pkgs/servers/jellyfin/web.nix

@@ -26,16 +26,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "jellyfin-web";
-  version = "10.9.1";
+  version = "10.9.2";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    hash = "sha256-KkPZ8OvGN/0gdoSVh9q0qEilae3tccgHRQQvrTsvycA=";
+    hash = "sha256-0MBVcMajRk+CR0nZ8Dtd3Mg4tKdLiHGs3AhI8BEqZyE=";
   };
 
-  npmDepsHash = "sha256-LmbygyCYSp0gtjU2pNCV17WEyEoaIzPs7H9UoMFV+PU=";
+  npmDepsHash = "sha256-aN+EXHRXez26oS4Ad1d9HSBkwVKnvYQMJvJVypDCk+0=";
 
   npmBuildScript = [ "build:production" ];
 

pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix

@@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "grafana-oncall-app";
+  version = "1.5.1";
+  zipHash = "sha256-3mC4TJ9ACM9e3e6UKI5vaDwXuW6RjbsOQFJU5v0wjk8=";
+  meta = with lib; {
+    description = "Developer-friendly incident response for Grafana";
+    license = licenses.agpl3Only;
+    maintainers = lib.teams.fslabs.members;
+    platforms = platforms.unix;
+  };
+}

pkgs/servers/monitoring/grafana/plugins/plugins.nix

@@ -8,6 +8,7 @@
   grafadruid-druid-datasource = callPackage ./grafadruid-druid-datasource { };
   grafana-clickhouse-datasource = callPackage ./grafana-clickhouse-datasource { };
   grafana-clock-panel = callPackage ./grafana-clock-panel { };
+  grafana-oncall-app = callPackage ./grafana-oncall-app { };
   grafana-piechart-panel = callPackage ./grafana-piechart-panel { };
   grafana-polystat-panel = callPackage ./grafana-polystat-panel { };
   grafana-worldmap-panel = callPackage ./grafana-worldmap-panel { };

pkgs/servers/pleroma/default.nix

@@ -7,14 +7,14 @@
 
 beamPackages.mixRelease rec {
   pname = "pleroma";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitLab {
     domain = "git.pleroma.social";
     owner = "pleroma";
     repo = "pleroma";
     rev = "v${version}";
-    sha256 = "sha256-KVB6e/B6DJbylpfR8QTZJ1GOJrAqF6shqoU/zIndi1U=";
+    sha256 = "sha256-ZiupcCu6ES/G9rsdNo5+JXOIPhb4CHT2YhKThWiLisw=";
   };
 
   patches = [

pkgs/servers/swego/default.nix

@@ -1,28 +1,34 @@
-{ buildGoModule
-, fetchFromGitHub
-, lib
-, stdenv
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
   pname = "swego";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "nodauf";
     repo = "Swego";
-    rev = "v${version}";
-    sha256 = "sha256-OlaNDXKaIim5n0niqYIpRliVo7lse76vNxPKF6B6yF0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-O/wczHyaMev0CpAXoDxiN7TtHDsthG+jaH31SPMEB34=";
   };
 
-  vendorHash = "sha256-N4HDngQFNCzQ74W52R0khetN6+J7npvBC/bYZBAgLB4=";
+  vendorHash = "sha256-mJWJdwbZq042//hM3WWp2rnLC1GebckUnsIopbF858Q=";
 
   postInstall = ''
     mv $out/bin/src $out/bin/$pname
   '';
 
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
   meta = with lib; {
-    description = "Simple Webserver in Golang";
+    description = "Simple Webserver";
     longDescription = ''
       Swiss army knife Webserver in Golang. Similar to the Python
       SimpleHTTPServer but with many features.

pkgs/tools/misc/calamares-nixos-extensions/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calamares-nixos-extensions";
-  version = "0.3.15";
+  version = "0.3.16";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "calamares-nixos-extensions";
     rev = version;
-    hash = "sha256-PZQjrteLWcInXIavuANHfzfl9gOXATWtIlDUp45j5Ao=";
+    hash = "sha256-ajQWmZVY60Q2cGJcLqMT2ypIi7bMMiyHMgdlp3g9874=";
   };
 
   installPhase = ''

pkgs/tools/misc/fluent-bit/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nlBzD9u7DsCbJq9FxsbsP8F/tPklZ43NV8T2eiwWE24=";
+    hash = "sha256-XMfUMyoI2mK0imvz/5HTO8CHyKubyPGSTN69v79fkjg=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];

pkgs/tools/security/metasploit/Gemfile

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.9"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.10"

pkgs/tools/security/metasploit/Gemfile.lock

@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: eac2a919309b9ec735cae13ceead0f4aa0e412e8
-  ref: refs/tags/6.4.9
+  revision: 19234871c7edcc534f2bd34505ec08a1f33319b0
+  ref: refs/tags/6.4.10
   specs:
-    metasploit-framework (6.4.9)
+    metasploit-framework (6.4.10)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
@@ -105,26 +105,26 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    Ascii85 (1.1.0)
-    actionpack (7.0.8.1)
-      actionview (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    Ascii85 (1.1.1)
+    actionpack (7.0.8.3)
+      actionview (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
       rack (~> 2.0, >= 2.2.4)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (7.0.8.1)
-      activesupport (= 7.0.8.1)
+    actionview (7.0.8.3)
+      activesupport (= 7.0.8.3)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activemodel (7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activerecord (7.0.8.1)
-      activemodel (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
-    activesupport (7.0.8.1)
+    activemodel (7.0.8.3)
+      activesupport (= 7.0.8.3)
+    activerecord (7.0.8.3)
+      activemodel (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
+    activesupport (7.0.8.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -135,37 +135,37 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.3.0)
-    aws-partitions (1.916.0)
-    aws-sdk-core (3.192.1)
+    aws-partitions (1.933.0)
+    aws-sdk-core (3.196.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.450.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-ec2 (1.457.1)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-ec2instanceconnect (1.38.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-ec2instanceconnect (1.40.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.96.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-iam (1.98.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.79.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-kms (1.82.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.147.0)
-      aws-sdk-core (~> 3, >= 3.192.0)
+    aws-sdk-s3 (1.151.0)
+      aws-sdk-core (~> 3, >= 3.194.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
-    aws-sdk-ssm (1.166.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-ssm (1.169.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.2.0)
     bcrypt (3.1.20)
-    bcrypt_pbkdf (1.1.0)
-    bigdecimal (3.1.7)
+    bcrypt_pbkdf (1.1.1)
+    bigdecimal (3.1.8)
     bindata (2.4.15)
     bootsnap (1.18.3)
       msgpack (~> 1.2)
@@ -219,7 +219,7 @@ GEM
       domain_name (~> 0.5)
     http_parser.rb (0.8.0)
     httpclient (2.8.3)
-    i18n (1.14.4)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
     io-console (0.7.2)
     irb (1.7.4)
@@ -269,14 +269,14 @@ GEM
     metasploit_payloads-mettle (1.0.26)
     method_source (1.1.0)
     mini_portile2 (2.8.6)
-    minitest (5.22.3)
+    minitest (5.23.1)
     mqtt (0.6.0)
     msgpack (1.6.1)
     multi_json (1.15.0)
     mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
     nessus_rest (0.1.6)
-    net-imap (0.4.10)
+    net-imap (0.4.11)
       date
       net-protocol
     net-ldap (0.19.0)
@@ -287,7 +287,7 @@ GEM
     net-ssh (7.2.3)
     network_interface (0.0.4)
     nexpose (7.3.0)
-    nio4r (2.7.1)
+    nio4r (2.7.3)
     nokogiri (1.14.5)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
@@ -302,7 +302,7 @@ GEM
     packetfu (2.0.0)
       pcaprub (~> 0.13.1)
     patch_finder (1.0.2)
-    pcaprub (0.13.1)
+    pcaprub (0.13.2)
     pdf-reader (2.12.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
@@ -313,7 +313,7 @@ GEM
     public_suffix (5.0.5)
     puma (6.4.2)
       nio4r (~> 2.0)
-    racc (1.7.3)
+    racc (1.8.0)
     rack (2.2.9)
     rack-protection (3.2.0)
       base64 (>= 0.1.0)
@@ -327,9 +327,9 @@ GEM
     rails-html-sanitizer (1.6.0)
       loofah (~> 2.21)
       nokogiri (~> 1.14)
-    railties (7.0.8.1)
-      actionpack (= 7.0.8.1)
-      activesupport (= 7.0.8.1)
+    railties (7.0.8.3)
+      actionpack (= 7.0.8.3)
+      activesupport (= 7.0.8.3)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
@@ -341,7 +341,7 @@ GEM
     recog (3.1.5)
       nokogiri
     redcarpet (3.6.0)
-    reline (0.5.2)
+    reline (0.5.7)
       io-console (~> 0.5)
     rex-arch (0.1.15)
       rex-text
@@ -351,7 +351,7 @@ GEM
       rex-core
       rex-struct2
       rex-text
-    rex-core (0.1.31)
+    rex-core (0.1.32)
     rex-encoder (0.1.7)
       metasm
       rex-arch
@@ -374,7 +374,7 @@ GEM
       rex-random_identifier
       rex-text
       ruby-rc4
-    rex-random_identifier (0.1.11)
+    rex-random_identifier (0.1.12)
       rex-text
     rex-registry (0.1.5)
     rex-rop_builder (0.1.5)
@@ -388,16 +388,17 @@ GEM
       rex-socket
       rex-text
     rex-struct2 (0.1.4)
-    rex-text (0.2.57)
+    rex-text (0.2.58)
     rex-zip (0.1.5)
       rex-text
-    rexml (3.2.6)
+    rexml (3.2.8)
+      strscan (>= 3.0.9)
     rkelly-remix (0.0.7)
     ruby-macho (4.0.1)
     ruby-mysql (4.1.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.3.5)
+    ruby_smb (3.3.8)
       bindata (= 2.4.15)
       openssl-ccm
       openssl-cmac
@@ -408,8 +409,7 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    simpleidn (0.2.1)
-      unf (~> 0.1.4)
+    simpleidn (0.2.3)
     sinatra (3.2.0)
       mustermann (~> 3.0)
       rack (~> 2.2, >= 2.2.4)
@@ -419,6 +419,7 @@ GEM
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     strptime (0.2.5)
+    strscan (3.1.0)
     swagger-blocks (3.0.0)
     thin (1.8.2)
       daemons (~> 1.0, >= 1.0.9)
@@ -433,9 +434,6 @@ GEM
       concurrent-ruby (~> 1.0)
     tzinfo-data (1.2024.1)
       tzinfo (>= 1.0.0)
-    unf (0.1.4)
-      unf_ext
-    unf_ext (0.0.9.1)
     unix-crypt (1.3.1)
     warden (1.2.9)
       rack (>= 2.0.9)
@@ -459,7 +457,7 @@ GEM
       activesupport (>= 4.2, < 8.0)
     xmlrpc (0.3.3)
       webrick
-    zeitwerk (2.6.13)
+    zeitwerk (2.6.14)
 
 PLATFORMS
   ruby
@@ -468,4 +466,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.5.9
+   2.4.13

pkgs/tools/security/metasploit/default.nix

@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.9";
+  version = "6.4.10";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-0f7kpzeOY6EbFb7LRZc/J5lFYcf21HC6H6q0+qtTcao=";
+    hash = "sha256-RocCo0InffP2Dn0kZB4vEgct95dJbdDSxBND8UyuUGU=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/metasploit/gemset.nix

@@ -4,50 +4,50 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jh83rqd6glys1b2wsihzsln8yk6zdwgiyn9xncyiav9rcwjpkax";
+      sha256 = "11c5pm65m46wlqd25glmwpkji1jn1v2n918jmklxp4w9rr43dzi6";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   actionview = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ygpg75f3ffdcbxvf7s14xw3hcjin1nnx1nk3mg9mj2xc1nb60aa";
+      sha256 = "0p0w1rl3f5k7m39j9gnyw5wqz6ym18bhcacisqq4zng2k6jf4893";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   activemodel = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0grdpvglh0cj96qhlxjj9bcfqkh13c1pfpcwc9ld3aw0yzvsw5a1";
+      sha256 = "0y8w73rdd7x1m1gwswjhpqfbjr95hh7hcnkjqk1wz8x9gjk9njb6";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   activerecord = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rlky1cr5kcdl0jad3nk5jpim6vjzbgkfhxnk7y492b3j2nznpcf";
+      sha256 = "03pqj57md528dgwwplr234hq628allla71i1pxys2inbpp7s7vn8";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   activesupport = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ff3x7q400flzhml131ix8zfwmh13h70rs6yzbzf513g781gbbxh";
+      sha256 = "1ybapgiiysxgcjyzifn34ksbwjdjzslbvbcd7v83wiry1qmiyg93";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   addressable = {
     groups = ["default"];
@@ -84,10 +84,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ds4v9xgsyvijnlflak4dzf1qwmda9yd5bv8jwsb56nngd399rlw";
+      sha256 = "1c62cx96r0v265mywnlik43qx0wf6bjbzl54qa47x6dzjg861mvk";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   aws-eventstream = {
     groups = ["default"];
@@ -104,80 +104,80 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gilrh9fb1576xm2ah0l6d33qkiabz55zpq004qqia9xavl43ylz";
+      sha256 = "1axv3iicp4as5dxhmwrxf3rc7389ba94gk11yilw3vwv4hch87yx";
       type = "gem";
     };
-    version = "1.916.0";
+    version = "1.933.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hp8rxk9wl3kmb7xabcz5hbcv7kzsvsx0wyib2fsg9d42kz149n0";
+      sha256 = "0f44kp3g9g8v60f7xw769r734b7w6n774jj2njn42444ip3zwsz3";
       type = "gem";
     };
-    version = "3.192.1";
+    version = "3.196.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "101jjqf912jwca119v86i4inlkf2gldmmhgdm2rdk5hqrwl4yrf4";
+      sha256 = "114xd77sb1wzxv1ys2dg7adzyfbfzy3k2x885slgbdwh6q9nby0f";
       type = "gem";
     };
-    version = "1.450.0";
+    version = "1.457.1";
   };
   aws-sdk-ec2instanceconnect = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mhqk2s8klp8djibrhgmh9lz9nr4rh1yy7y6c86if55r07i1912c";
+      sha256 = "1sjjyp90hhgbxmiw9sdscyfgjpy86m10dbr1dmxw3dmq244p3ilq";
       type = "gem";
     };
-    version = "1.38.0";
+    version = "1.40.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zcvkal9ahwr84pz1cb3y9ylx3f74m4kgs4n160dfzf51b8m917l";
+      sha256 = "0a2kir61jwjpwwk5nld3daxkbc38ivszrxyjs9v320cq6hk6g80v";
       type = "gem";
     };
-    version = "1.96.0";
+    version = "1.98.0";
   };
   aws-sdk-kms = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cb0006xf5isq5drdwkvd6xz20886x3rzcj5qyly7g8gql5lc8aw";
+      sha256 = "0j6wlmn9h8l571ll7pamqxk5b3mg5ms65b85w0r1qjs3v1i5xfcd";
       type = "gem";
     };
-    version = "1.79.0";
+    version = "1.82.0";
   };
   aws-sdk-s3 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ibw2v56k8v2sw92cyliprq1xxfyavnd60yl6ach3f4qbp156xrn";
+      sha256 = "023h9xx65dd91z1sk9znhfwp4wr48imnnhdhvczv64m17r7ych4y";
       type = "gem";
     };
-    version = "1.147.0";
+    version = "1.151.0";
   };
   aws-sdk-ssm = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0drad0zka0kjayiy971vcl5dfp6j37wgga4xncya8w8xsrknh9s8";
+      sha256 = "1liyqnj8hjyrix96kbbqflr4bh3hg07jjcx5x6bsiiqsixblq4md";
       type = "gem";
     };
-    version = "1.166.0";
+    version = "1.169.0";
   };
   aws-sigv4 = {
     groups = ["default"];
@@ -214,20 +214,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ndamfaivnkhc6hy0yqyk2gkwr6f3bz6216lh74hsiiyk3axz445";
+      sha256 = "04rb3rp9bdxn1y3qiflfpj7ccwb8ghrfbydh5vfz1l9px3fpg41g";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   bigdecimal = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   bindata = {
     groups = ["default"];
@@ -554,10 +554,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
+      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
       type = "gem";
     };
-    version = "1.14.4";
+    version = "1.14.5";
   };
   io-console = {
     groups = ["default"];
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "eac2a919309b9ec735cae13ceead0f4aa0e412e8";
-      sha256 = "1akiafmzmd5a3yx71m7nqxhlb6977yblbjxy2lds2qwf6yky9zni";
+      rev = "19234871c7edcc534f2bd34505ec08a1f33319b0";
+      sha256 = "0rahmr6g2hqkqk9d0va9jzvjs1qj5wg6893x1vvg6z978aih51s6";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.9";
+    version = "6.4.10";
   };
   metasploit-model = {
     groups = ["default"];
@@ -746,10 +746,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07lq26b86giy3ha3fhrywk9r1ajhc2pm2mzj657jnpnbj1i6g17a";
+      sha256 = "1gkslxvkhh44s21rbjvka3zsvfxxrf5pcl6f75rv2vyrzzbgis7i";
       type = "gem";
     };
-    version = "5.22.3";
+    version = "5.23.1";
   };
   mqtt = {
     groups = ["default"];
@@ -806,10 +806,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zn7j2w0hc622ig0rslk4iy6yp3937dy9ibhyr1mwwx39n7paxaj";
+      sha256 = "1y0pzapcasfjayk4nydy04hnx11xmsv8jl8myizxhbpkdmrl10dc";
       type = "gem";
     };
-    version = "0.4.10";
+    version = "0.4.11";
   };
   net-ldap = {
     groups = ["default"];
@@ -876,10 +876,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15iwbiij52x6jhdbl0rkcldnhfndmsy0sbnsygkr9vhskfqrp72m";
+      sha256 = "017nbw87dpr4wyk81cgj8kxkxqgsgblrkxnmmadc77cg9gflrfal";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.7.3";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -967,10 +967,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0886fcc5bi0kc0rbma5fj3wa3hbg2nl7ivnbi2j995yzg36zq7xy";
+      sha256 = "0bwhm5b7f0ncazffxzlyql83khcgydx2ncav9k241gab4knkhb7l";
       type = "gem";
     };
-    version = "0.13.1";
+    version = "0.13.2";
   };
   pdf-reader = {
     groups = ["default"];
@@ -1017,10 +1017,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01b9662zd2x9bp4rdjfid07h09zxj7kvn7f5fghbqhzc625ap1dp";
+      sha256 = "021s7maw0c4d9a6s07vbmllrzqsj2sgmrwimlh8ffkvwqdjrld09";
       type = "gem";
     };
-    version = "1.7.3";
+    version = "1.8.0";
   };
   rack = {
     groups = ["default"];
@@ -1077,10 +1077,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08ga56kz6a37dnlmi7y45r19fcc7jzb62mrc3ifavbzggmhy7r62";
+      sha256 = "0sxki005rl1315mp78csayvfdx5zxjvwv8xmcfyjksgq27cimk5r";
       type = "gem";
     };
-    version = "7.0.8.1";
+    version = "7.0.8.3";
   };
   rake = {
     groups = ["default"];
@@ -1137,10 +1137,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xwf7i2kvgaxbpdqqkncv9dpfhlj55shig4sdzgy7kgbfj09mm03";
+      sha256 = "06rlp3wjcbwbgw3xlawclzzmj6ryn6ap65nh54x5yzgx0c3jlqqz";
       type = "gem";
     };
-    version = "0.5.2";
+    version = "0.5.7";
   };
   rex-arch = {
     groups = ["default"];
@@ -1167,10 +1167,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s5fz1fipk2x9grd8rj7n09wfmq78kdhw9fvrmgr9z52zi640xzs";
+      sha256 = "0468gxcwhzp5y7lahkf0cg4vyy01wb2fk6w1rx4fgh1l9330a64b";
       type = "gem";
     };
-    version = "0.1.31";
+    version = "0.1.32";
   };
   rex-encoder = {
     groups = ["default"];
@@ -1247,10 +1247,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qxc05f0xvradyp50vz8s1h9lzgh9c31nz8yq7r22bph03v71f0c";
+      sha256 = "02709z33zcbq2i3ca66b94n3aqbd8r6ib1dgb2fby1vk5nrg18p9";
       type = "gem";
     };
-    version = "0.1.11";
+    version = "0.1.12";
   };
   rex-registry = {
     groups = ["default"];
@@ -1307,10 +1307,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08wrqy8sgncsn6kcplw7bl6c2bmyj9fza7x77wrlwh1gza7pcjk4";
+      sha256 = "04icj61kn5bnd939km6y49ylv8sbkqb96jld91nbrijahawcf5yz";
       type = "gem";
     };
-    version = "0.2.57";
+    version = "0.2.58";
   };
   rex-zip = {
     groups = ["default"];
@@ -1327,10 +1327,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05i8518ay14kjbma550mv0jm8a6di8yp5phzrd8rj44z9qnrlrp0";
+      sha256 = "0d8ivcirrrxpkpjc1c835wknc9s2fl54xpw08s177yfrh5ish209";
       type = "gem";
     };
-    version = "3.2.6";
+    version = "3.2.8";
   };
   rkelly-remix = {
     groups = ["default"];
@@ -1387,10 +1387,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fwk5hqaph37apa5zf1mg2n2wd5lkz3sgwl0f4ndhkv1vfxbb2ys";
+      sha256 = "1hw3hj2q0xkqr90snzrpiqfa7lsc5k4w6bgdj624vxkh7q0nnfw7";
       type = "gem";
     };
-    version = "3.3.5";
+    version = "3.3.8";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1427,10 +1427,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06f7w6ph3bzzqk212yylfp4jfx275shgp9zg3xszbpv1ny2skp9m";
+      sha256 = "0a9c1mdy12y81ck7mcn9f9i2s2wwzjh1nr92ps354q517zq9dkh8";
       type = "gem";
     };
-    version = "0.2.1";
+    version = "0.2.3";
   };
   sinatra = {
     groups = ["default"];
@@ -1472,6 +1472,16 @@
     };
     version = "0.2.5";
   };
+  strscan = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mamrl7pxacbc79ny5hzmakc9grbjysm3yy6119ppgsg44fsif01";
+      type = "gem";
+    };
+    version = "3.1.0";
+  };
   swagger-blocks = {
     groups = ["default"];
     platforms = [];
@@ -1552,26 +1562,6 @@
     };
     version = "1.2024.1";
   };
-  unf = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0bh2cf73i2ffh4fcpdn9ir4mhq8zi50ik0zqa1braahzadx536a9";
-      type = "gem";
-    };
-    version = "0.1.4";
-  };
-  unf_ext = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1sf6bxvf6x8gihv6j63iakixmdddgls58cpxpg32chckb2l18qcj";
-      type = "gem";
-    };
-    version = "0.0.9.1";
-  };
   unix-crypt = {
     groups = ["default"];
     platforms = [];
@@ -1677,9 +1667,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m67qmsak3x8ixs8rb971azl3l7wapri65pmbf5z886h46q63f1d";
+      sha256 = "0ayraiqfhhjzpyr4yxp035002lq78ip1zhr0ix87rn3rqpnsrn3h";
       type = "gem";
     };
-    version = "2.6.13";
+    version = "2.6.14";
   };
 }

pkgs/tools/security/nitrokey-app2/default.nix

@@ -1,49 +1,27 @@
 { lib
 , stdenv
 , python3
-, fetchPypi
 , fetchFromGitHub
 , wrapQtAppsHook
 , qtbase
 , qtwayland
 }:
 
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      pynitrokey = super.pynitrokey.overridePythonAttrs (old: rec {
-        version = "0.4.45";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-iY4ThrmXP7pEjTYYU4lePVAbuJGTdHX3iKswXzuf7W8=";
-        };
-      });
-    };
-  };
-in python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "nitrokey-app2";
-  version = "2.2.2";
+  version = "2.3.0";
   pyproject = true;
 
-  disabled = python.pythonOlder "3.9";
+  disabled = python3.pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Nitrokey";
     repo = "nitrokey-app2";
     rev = "v${version}";
-    hash = "sha256-MiyfmsrKZRoe7YMEjR1LHPesfJh6+dcSydoEAgrALJ8=";
+    hash = "sha256-BSq3ezNt6btQUO1hMVw9bN3VCyUOUhfRFJcHDGkIm6Q=";
   };
 
-  # https://github.com/Nitrokey/nitrokey-app2/issues/152
-  #
-  # pythonRelaxDepsHook does not work here, because it runs in postBuild and
-  # only modifies the dependencies in the built distribution.
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace 'pynitrokey = "' 'pynitrokey = ">='
-  '';
-
-  nativeBuildInputs = with python.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
     poetry-core
     wrapQtAppsHook
   ];
@@ -52,7 +30,7 @@ in python.pkgs.buildPythonApplication rec {
     qtwayland
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
     pynitrokey
     pyudev
     pyside6

pkgs/tools/security/wapiti/default.nix

@@ -1,57 +1,59 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "wapiti";
   version = "3.1.8";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wapiti-scanner";
-    repo = pname;
+    repo = "wapiti";
     rev = "refs/tags/${version}";
     hash = "sha256-2ssbczUa4pTA5Fai+sK1hES8skJMIHxa/R2hNIiEVLs=";
   };
 
   postPatch = ''
-    # Ignore pinned versions
-    sed -i -e "s/==[0-9.]*//;s/>=[0-9.]*//" pyproject.toml
-
     # Remove code coverage checking
     substituteInPlace pyproject.toml \
       --replace "--cov --cov-report=xml" ""
   '';
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-    wheel
-  ];
+  pythonRelaxDeps = true;
 
-  propagatedBuildInputs = with python3.pkgs; [
-    aiocache
-    aiohttp
-    aiosqlite
-    arsenic
-    beautifulsoup4
-    browser-cookie3
-    dnspython
-    h11
-    httpcore
-    httpx
-    httpx-ntlm
-    loguru
-    mako
-    markupsafe
-    mitmproxy
-    pyasn1
-    six
-    sqlalchemy
-    tld
-    yaswfp
-  ] ++ httpx.optional-dependencies.brotli
-  ++ httpx.optional-dependencies.socks;
+  build-system = with python3.pkgs; [ setuptools ];
+
+  nativeBuildInputs = with python3.pkgs; [ pythonRelaxDepsHook ];
+
+  dependencies =
+    with python3.pkgs;
+    [
+      aiocache
+      aiohttp
+      aiosqlite
+      arsenic
+      beautifulsoup4
+      browser-cookie3
+      dnspython
+      h11
+      httpcore
+      httpx
+      httpx-ntlm
+      loguru
+      mako
+      markupsafe
+      mitmproxy
+      pyasn1
+      six
+      sqlalchemy
+      tld
+      yaswfp
+    ]
+    ++ httpx.optional-dependencies.brotli
+    ++ httpx.optional-dependencies.socks;
 
   __darwinAllowLocalNetworking = true;
 
@@ -138,9 +140,7 @@ python3.pkgs.buildPythonApplication rec {
     "tests/attack/test_mod_ssl.py"
   ];
 
-  pythonImportsCheck = [
-    "wapitiCore"
-  ];
+  pythonImportsCheck = [ "wapitiCore" ];
 
   meta = with lib; {
     description = "Web application vulnerability scanner";
@@ -154,7 +154,7 @@ python3.pkgs.buildPythonApplication rec {
     '';
     homepage = "https://wapiti-scanner.github.io/";
     changelog = "https://github.com/wapiti-scanner/wapiti/blob/${version}/doc/ChangeLog_Wapiti";
-    license = with licenses; [ gpl2Only ];
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/tools/wayland/shotman/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shotman";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SctWNhYCFTAOOnDEcsFZH61+QQAcmup11GVVXA1U5Dw=";
+    hash = "sha256-OmYCeB2szWmFJQ+MXWmVI7IzeXgbix9ZK4/4kgR5S6A=";
   };
 
-  cargoHash = "sha256-q5scdgfB5NgtjAgnIy/+c+y/mymF0b9ZZSz2LmM0pfw=";
+  cargoHash = "sha256-Kq2uq171B+4WzEJauH19/nzkm2irM4ggoFfxlARfyEg=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 

pkgs/top-level/all-packages.nix

@@ -1067,8 +1067,6 @@ with pkgs;
 
   mod = callPackage ../development/tools/mod { };
 
-  mods = callPackage ../tools/misc/mods { };
-
   mongosh = callPackage ../development/tools/mongosh { };
 
   mya = callPackage ../applications/misc/mya { };

pkgs/top-level/python-aliases.nix

@@ -485,6 +485,7 @@ mapAliases ({
   sapi-python-client = kbcstorage; # added 2022-04-20
   scikitimage = scikit-image; # added 2023-05-14
   scikitlearn = scikit-learn; # added 2021-07-21
+  scikits-samplerate = throw "scikits-samplerate has been removed, it was unsed and unmaintained since 2015"; # added 2024-05-23
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
   sequoia = throw "python3Packages.sequoia was replaced by pysequoia - built from a dedicated repository, with a new API."; # added 2023-06-24
   setuptools_dso = setuptools-dso; # added 2024-03-03

pkgs/top-level/python-packages.nix

@@ -10018,6 +10018,8 @@ self: super: with self; {
 
   pyrogram = callPackage ../development/python-modules/pyrogram { };
 
+  pyrympro = callPackage ../development/python-modules/pyrympro { };
+
   pysabnzbd = callPackage ../development/python-modules/pysabnzbd { };
 
   pysbd = callPackage ../development/python-modules/pysbd { };
@@ -13617,10 +13619,6 @@ self: super: with self; {
 
   scikits-odes = callPackage ../development/python-modules/scikits-odes { };
 
-  scikits-samplerate = callPackage ../development/python-modules/scikits-samplerate {
-    inherit (pkgs) libsamplerate;
-  };
-
   scikit-tda = callPackage ../development/python-modules/scikit-tda { };
 
   scipy = callPackage ../development/python-modules/scipy { };
@@ -16828,6 +16826,8 @@ self: super: with self; {
 
   weasyprint = callPackage ../development/python-modules/weasyprint { };
 
+  weatherflow4py = callPackage ../development/python-modules/weatherflow4py { };
+
   weaviate-client = callPackage ../development/python-modules/weaviate-client { };
 
   web3 = callPackage ../development/python-modules/web3 { };