Merge staging-next into staging

2025-06-12 04:35:41 +03:00 · 2024-10-10 18:05:19 +00:00 · 2024-10-10 18:05:19 +00:00 · 144082b47e
commit 144082b47e
parent 25ce480524 c64ae284c0
68 changed files with 1869 additions and 1148 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@ -228,7 +228,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/tools/misc/esphome @mweinelt

 # Network Time Daemons
-/pkgs/tools/networking/chrony @thoughtpolice
+/pkgs/by-name/ch/chrony @thoughtpolice
 /pkgs/tools/networking/ntp @thoughtpolice
 /pkgs/tools/networking/openntpd @thoughtpolice
 /nixos/modules/services/networking/ntp @thoughtpolice
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -207,6 +207,8 @@

 - `grafana` has been updated to version 11.1. This version doesn't support setting `http_addr` to a hostname anymore, an IP address is expected.

+- `deno` has been updated to v2 which has breaking changes. Upstream will be abandoning v1 soon but for now you can use `deno_1` if you are yet to migrate (will be removed prior to cutting a final 24.11 release).
+
 - `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes.

 - `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -287,6 +287,18 @@ let
        '';
      };

+      rssh = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          If set, the calling user's SSH agent is used to authenticate
+          against the configured keys. This module works in a manner
+          similar to pam_ssh_agent_auth, but supports a wider range
+          of SSH key types, including those protected by security
+          keys (FIDO2).
+        '';
+      };
+
      duoSecurity = {
        enable = lib.mkOption {
          default = false;
@ -673,6 +685,7 @@ let
          { name = "ssh_agent_auth"; enable = config.security.pam.sshAgentAuth.enable && cfg.sshAgentAuth; control = "sufficient"; modulePath = "${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so"; settings = {
            file = lib.concatStringsSep ":" config.security.pam.sshAgentAuth.authorizedKeysFiles;
          }; }
+          (let inherit (config.security.pam) rssh; in { name = "rssh"; enable = rssh.enable && cfg.rssh; control = "sufficient"; modulePath = "${pkgs.pam_rssh}/lib/libpam_rssh.so"; inherit (rssh) settings; })
          (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; args = [
            "${pkgs.opensc}/lib/opensc-pkcs11.so"
          ]; })
@ -950,8 +963,9 @@ let
      value.source = pkgs.writeText "${name}.pam" service.text;
    };

-  optionalSudoConfigForSSHAgentAuth = lib.optionalString config.security.pam.sshAgentAuth.enable ''
-    # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.
+  optionalSudoConfigForSSHAgentAuth = lib.optionalString
+    (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable) ''
+    # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so and libpam_rssh.so can do their magic.
    Defaults env_keep+=SSH_AUTH_SOCK
  '';

@ -1068,6 +1082,55 @@ in
      };
    };

+    security.pam.rssh = {
+      enable = lib.mkEnableOption "authenticating using a signature performed by the ssh-agent";
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = moduleSettingsType;
+          options = {
+            auth_key_file = lib.mkOption {
+              type = with lib.types; nullOr nonEmptyStr;
+              description = ''
+                Path to file with trusted public keys in OpenSSH's `authorized_keys` format. The following
+                variables are expanded to the respective PAM items:
+
+                - `service`: `PAM_SERVICE`, the service name,
+                - `user`: `PAM_USER`, the username of the entity under whose identity service will be given,
+                - `tty`: `PAM_TTY`, the terminal name,
+                - `rhost`: `PAM_RHOST`, the requesting hostname, and
+                - `ruser`: `PAM_RUSER`, the requesting entity.
+
+                These PAM items are explained in {manpage}`pam_get_item(3)`.
+
+                Variables may be specified as `$var`, `''${var}` or `''${var:defaultValue}`.
+
+                ::: {.note}
+                Specifying user-writeable files here results in an insecure configuration: a malicious process
+                can then edit such an `authorized_keys` file and bypass the ssh-agent-based authentication.
+
+                This option is ignored if {option}`security.pam.rssh.settings.authorized_keys_command` is set.
+
+                If both this option and {option}`security.pam.rssh.settings.authorized_keys_command` are unset,
+                the keys will be read from `''${HOME}/.ssh/authorized_keys`, which should be considered
+                insecure.
+              '';
+              default = "/etc/ssh/authorized_keys.d/$ruser";
+            };
+          };
+        };
+
+        default = { };
+        description = ''
+          Options to pass to the pam_rssh module. Refer to
+          <https://github.com/z4yx/pam_rssh/blob/main/README.md#optional-arguments>
+          for supported values.
+
+          ${moduleSettingsDescription}
+        '';
+      };
+    };
+
    security.pam.enableOTPW = lib.mkEnableOption "the OTPW (one-time password) PAM module";

    security.pam.dp9ik = {
@ -1512,16 +1575,30 @@ in
          Did you forget to set `services.openssh.enable` ?
        '';
      }
+      {
+        assertion = with config.security.pam.rssh;
+          enable -> (settings.auth_key_file or null != null || settings.authorized_keys_command or null != null);
+        message = ''
+          security.pam.rssh.enable requires either security.pam.rssh.settings.auth_key_file or
+          security.pam.rssh.settings.authorized_keys_command to be set.
+        '';
+      }
    ];

    warnings = lib.optional
-      (with lib; with config.security.pam.sshAgentAuth;
+      (with config.security.pam.sshAgentAuth;
        enable && lib.any (s: lib.hasPrefix "%h" s || lib.hasPrefix "~" s) authorizedKeysFiles)
      ''config.security.pam.sshAgentAuth.authorizedKeysFiles contains files in the user's home directory.

        Specifying user-writeable files there result in an insecure configuration:
        a malicious process can then edit such an authorized_keys file and bypass the ssh-agent-based authentication.
        See https://github.com/NixOS/nixpkgs/issues/31611
+      '' ++ lib.optional
+      (with config.security.pam.rssh;
+        enable && settings.auth_key_file or null != null && settings.authorized_keys_command or null != null) ''
+        security.pam.rssh.settings.auth_key_file will be ignored as
+        security.pam.rssh.settings.authorized_keys_command has been specified.
+        Explictly set the former to null to silence this warning.
      '';

    environment.systemPackages =
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@ -24,18 +24,19 @@ let
      setuptools
      sexpdata
      six
+      watchdog
    ]
  );
 in
 melpaBuild {
  pname = "lsp-bridge";
-  version = "0-unstable-2024-10-04";
+  version = "0-unstable-2024-10-07";

  src = fetchFromGitHub {
    owner = "manateelazycat";
    repo = "lsp-bridge";
-    rev = "2d0cd0bea3bd503ca3bb7bcf4a6a78af091c7ecc";
-    hash = "sha256-q6xIYUhXTqGeR9tnjd1xnCOnOeOMypJN6vfGjZDuIIM=";
+    rev = "f726a341c283a5b84d3587cf84e40817b8ec72c6";
+    hash = "sha256-JL02pYjM5DyUt5wCNN0UnLVSXv9DCfSaSBGy5PzLvyA=";
  };

  patches = [
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -136,7 +136,7 @@ let

 in {
  subversion = common {
-    version = "1.14.3";
-    sha256 = "sha256-lJ79RRoJQ19+hXNXTHHHtxsZTYRIkPpJzWHSJi6hpEA=";
+    version = "1.14.4";
+    sha256 = "sha256-ROrRFucuSA8Q8SPJFLtvn4wEFxHAQe16v/G4Y0oZnjw=";
  };
 }
--- a/pkgs/by-name/bi/biglybt/package.nix
+++ b/pkgs/by-name/bi/biglybt/package.nix
@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "biglybt";
-  version = "3.6.0.0";
+  version = "3.7.0.0";

  src = fetchurl {
    url = "https://github.com/BiglySoftware/BiglyBT/releases/download/v${version}/GitHub_BiglyBT_unix.tar.gz";
-    hash = "sha256-a7g9sB3orO2m0X7qNwQ1dDygYPhs/b6kX0RDSG8Wq2U=";
+    hash = "sha256-CfLKoX77yCanSzHq+Fy3jRqQAC2GeUo2SO9x0mk2Tf4=";
  };

  nativeBuildInputs = [ wrapGAppsHook3 ];
--- a/pkgs/tools/networking/chrony/makefile.patch
+++ b/pkgs/tools/networking/chrony/makefile.patch
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@ -0,0 +1,116 @@
+{
+  lib,
+  stdenv,
+  overrideSDK,
+  fetchurl,
+  pkg-config,
+  gnutls,
+  libedit,
+  texinfo,
+  libcap,
+  libseccomp,
+  pps-tools,
+  nixosTests,
+}:
+
+let
+  stdenv' =
+    if stdenv.hostPlatform.isDarwin then
+      overrideSDK stdenv {
+        darwinSdkVersion = "11.0";
+        darwinMinVersion = "10.13";
+      }
+    else
+      stdenv;
+in
+stdenv'.mkDerivation rec {
+  pname = "chrony";
+  version = "4.6.1";
+
+  src = fetchurl {
+    url = "https://chrony-project.org/releases/${pname}-${version}.tar.gz";
+    hash = "sha256-Vx/3P78K4wl/BgTsouALHYuy6Rr/4aNJR4X/IdYZnFw=";
+  };
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    [
+      gnutls
+      libedit
+      texinfo
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libcap
+      libseccomp
+      pps-tools
+    ];
+
+  configureFlags = [
+    "--enable-ntp-signd"
+    "--sbindir=$(out)/bin"
+    "--chronyrundir=/run/chrony"
+  ] ++ lib.optional stdenv.hostPlatform.isLinux "--enable-scfilter";
+
+  patches = [
+    # Cleanup the installation script
+    ./makefile.patch
+  ];
+
+  postPatch = ''
+    patchShebangs test
+
+    # nts_ke_session unit test fails, so drop it.
+    # TODO: try again when updating?
+    rm test/unit/nts_ke_session.c
+  '';
+
+  enableParallelBuilding = true;
+  doCheck = true;
+
+  hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
+
+  passthru.tests = {
+    inherit (nixosTests) chrony chrony-ptp;
+  };
+
+  meta = {
+    description = "Sets your computer's clock from time servers on the Net";
+    homepage = "https://chrony-project.org/";
+    license = lib.licenses.gpl2Only;
+    platforms =
+      with lib.platforms;
+      builtins.concatLists [
+        linux
+        freebsd
+        netbsd
+        darwin
+        illumos
+      ];
+    maintainers = with lib.maintainers; [
+      fpletz
+      thoughtpolice
+      vifino
+    ];
+
+    longDescription = ''
+      Chronyd is a daemon which runs in background on the system. It obtains
+      measurements via the network of the system clock’s offset relative to
+      time servers on other systems and adjusts the system time accordingly.
+      For isolated systems, the user can periodically enter the correct time by
+      hand (using Chronyc). In either case, Chronyd determines the rate at
+      which the computer gains or loses time, and compensates for this. Chronyd
+      implements the NTP protocol and can act as either a client or a server.
+
+      Chronyc provides a user interface to Chronyd for monitoring its
+      performance and configuring various settings. It can do so while running
+      on the same computer as the Chronyd instance it is controlling or a
+      different computer.
+    '';
+  };
+}
--- a/pkgs/by-name/de/deno/1/librusty_v8.nix
+++ b/pkgs/by-name/de/deno/1/librusty_v8.nix
@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "0.105.0";
+  shas = {
+    x86_64-linux = "sha256-9yON4DNPxm4IUZSLZp9VZtzSRPPWX1tEuQLVJmN8cLs=";
+    aarch64-linux = "sha256-5vAjw2vimjCHKPxjIp5vcwMCWUUDYVlk4QyOeEI0DLY=";
+    x86_64-darwin = "sha256-o4WRkg4ptiJTNMkorn5K+P8xOJwpChM5PqkZCjP076g=";
+    aarch64-darwin = "sha256-ZuWBnvxu1PgDtjtguxtj3BhFO01AChlbjAS0kZUws3A=";
+  };
+}
--- a/pkgs/by-name/de/deno/1/package.nix
+++ b/pkgs/by-name/de/deno/1/package.nix
@ -0,0 +1,118 @@
+{
+  stdenv,
+  lib,
+  callPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  protobuf,
+  installShellFiles,
+  libiconv,
+  darwin,
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ../fetchers.nix { }) fetchLibrustyV8;
+  },
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "deno";
+  version = "1.46.3";
+
+  src = fetchFromGitHub {
+    owner = "denoland";
+    repo = "deno";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AM6SjcIHo6Koxcnznhkv3cXoKaMy2TEVpiWe/bczDuA=";
+  };
+
+  cargoHash = "sha256-D+CZpb6OTzM5Il0k8GQB7qSONy4myE5yKlaSkLLqHT8=";
+
+  postPatch = ''
+    # upstream uses lld on aarch64-darwin for faster builds
+    # within nix lld looks for CoreFoundation rather than CoreFoundation.tbd and fails
+    substituteInPlace .cargo/config.toml --replace "-fuse-ld=lld " ""
+  '';
+
+  # uses zlib-ng but can't dynamically link yet
+  # https://github.com/rust-lang/libz-sys/issues/158
+  nativeBuildInputs = [
+    # required by libz-ng-sys crate
+    cmake
+    # required by deno_kv crate
+    protobuf
+    installShellFiles
+  ];
+  buildInputs = lib.optionals stdenv.isDarwin (
+    [
+      libiconv
+      darwin.libobjc
+    ]
+    ++ (with darwin.apple_sdk_11_0.frameworks; [
+      Security
+      CoreServices
+      Metal
+      MetalPerformanceShaders
+      Foundation
+      QuartzCore
+    ])
+  );
+
+  buildAndTestSubdir = "cli";
+
+  # work around "error: unknown warning group '-Wunused-but-set-parameter'"
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unknown-warning-option";
+  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
+  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
+  env.RUSTY_V8_ARCHIVE = librusty_v8;
+
+  # Tests have some inconsistencies between runs with output integration tests
+  # Skipping until resolved
+  doCheck = false;
+
+  preInstall = ''
+    find ./target -name libswc_common${stdenv.hostPlatform.extensions.sharedLibrary} -delete
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd deno \
+      --bash <($out/bin/deno completions bash) \
+      --fish <($out/bin/deno completions fish) \
+      --zsh <($out/bin/deno completions zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/deno --help
+    $out/bin/deno --version | grep "deno ${version}"
+    runHook postInstallCheck
+  '';
+
+  passthru.tests = callPackage ./tests { };
+
+  meta = with lib; {
+    homepage = "https://deno.land/";
+    changelog = "https://github.com/denoland/deno/releases/tag/v${version}";
+    description = "Secure runtime for JavaScript and TypeScript";
+    longDescription = ''
+      Deno aims to be a productive and secure scripting environment for the modern programmer.
+      Deno will always be distributed as a single executable.
+      Given a URL to a Deno program, it is runnable with nothing more than the ~15 megabyte zipped executable.
+      Deno explicitly takes on the role of both runtime and package manager.
+      It uses a standard browser-compatible protocol for loading modules: URLs.
+      Among other things, Deno is a great replacement for utility scripts that may have been historically written with
+      bash or python.
+    '';
+    license = licenses.mit;
+    mainProgram = "deno";
+    maintainers = with maintainers; [ jk ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    # NOTE: `aligned_alloc` error on darwin SDK < 10.15. Can't do usual overrideSDK with rust toolchain in current implementation.
+    # Should be fixed with darwin SDK refactor and can be revisited.
+    badPlatforms = [ "x86_64-darwin" ];
+  };
+}
--- a/pkgs/by-name/de/deno/1/tests/basic.ts
+++ b/pkgs/by-name/de/deno/1/tests/basic.ts
@ -0,0 +1 @@
+console.log(1 + 1)
--- a/pkgs/by-name/de/deno/1/tests/default.nix
+++ b/pkgs/by-name/de/deno/1/tests/default.nix
@ -0,0 +1,79 @@
+{
+  deno,
+  runCommand,
+  lib,
+  testers,
+}:
+let
+  testDenoRun =
+    name:
+    {
+      args ? "",
+      dir ? ./. + "/${name}",
+      file ? "index.ts",
+      expected ? "",
+      expectFailure ? false,
+    }:
+    let
+      command = "deno run ${args} ${dir}/${file}";
+    in
+    runCommand "deno-test-${name}"
+      {
+        nativeBuildInputs = [ deno ];
+        meta.timeout = 60;
+      }
+      ''
+        HOME=$(mktemp -d)
+        if output=$(${command} 2>&1); then
+          if [[ $output =~ '${expected}' ]]; then
+            echo "Test '${name}' passed"
+            touch $out
+          else
+            echo -n ${lib.escapeShellArg command} >&2
+            echo " output did not match what was expected." >&2
+            echo "The expected was:" >&2
+            echo '${expected}' >&2
+            echo "The output was:" >&2
+            echo "$output" >&2
+            exit 1
+          fi
+        else
+          if [[ "${toString expectFailure}" == "1" ]]; then
+            echo "Test '${name}' failed as expected"
+            touch $out
+            exit 0
+          fi
+          echo -n ${lib.escapeShellArg command} >&2
+          echo " returned a non-zero exit code." >&2
+          echo "$output" >&2
+          exit 1
+        fi
+      '';
+in
+(lib.mapAttrs testDenoRun {
+  basic = {
+    dir = ./.;
+    file = "basic.ts";
+    expected = "2";
+  };
+  import-json = {
+    expected = "hello from JSON";
+  };
+  import-ts = {
+    expected = "hello from ts";
+  };
+  read-file = {
+    args = "--allow-read";
+    expected = "hello from a file";
+  };
+  fail-read-file = {
+    expectFailure = true;
+    dir = ./read-file;
+  };
+})
+// {
+  version = testers.testVersion {
+    package = deno;
+    command = "deno --version";
+  };
+}
--- a/pkgs/by-name/de/deno/1/tests/import-json/data.json
+++ b/pkgs/by-name/de/deno/1/tests/import-json/data.json
@ -0,0 +1 @@
+{ "msg": "hello from JSON" }
--- a/pkgs/by-name/de/deno/1/tests/import-json/index.ts
+++ b/pkgs/by-name/de/deno/1/tests/import-json/index.ts
@ -0,0 +1,2 @@
+import file from "./data.json" assert { type: "json" };
+console.log(file.msg);
--- a/pkgs/by-name/de/deno/1/tests/import-ts/index.ts
+++ b/pkgs/by-name/de/deno/1/tests/import-ts/index.ts
@ -0,0 +1,3 @@
+import { sayHello } from "./lib.ts"
+
+sayHello("ts")
--- a/pkgs/by-name/de/deno/1/tests/import-ts/lib.ts
+++ b/pkgs/by-name/de/deno/1/tests/import-ts/lib.ts
@ -0,0 +1,3 @@
+export function sayHello(thing: string) {
+  console.log(`hello from ${thing}`);
+}
--- a/pkgs/by-name/de/deno/1/tests/read-file/data.txt
+++ b/pkgs/by-name/de/deno/1/tests/read-file/data.txt
@ -0,0 +1 @@
+hello from a file
--- a/pkgs/by-name/de/deno/1/tests/read-file/index.ts
+++ b/pkgs/by-name/de/deno/1/tests/read-file/index.ts
@ -0,0 +1,5 @@
+// trim 'file://' prefix
+const thisDir = Deno.mainModule.substring(7, Deno.mainModule.length);
+const getParent = (path: string) => path.substring(0, path.lastIndexOf("/"))
+const text = await Deno.readTextFile(getParent(thisDir) + "/data.txt");
+console.log(text);
--- a/pkgs/by-name/de/deno/fetchers.nix
+++ b/pkgs/by-name/de/deno/fetchers.nix
@ -0,0 +1,21 @@
+# not a stable interface, do not reference outside the deno package but make a
+# copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}
--- a/pkgs/by-name/de/deno/librusty_v8.nix
+++ b/pkgs/by-name/de/deno/librusty_v8.nix
@ -1,23 +1,12 @@
 # auto-generated file -- DO NOT EDIT!
-{ lib, stdenv, fetchurl }:
+{ fetchLibrustyV8 }:

-let
-  fetch_librusty_v8 = args: fetchurl {
-    name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
-    sha256 = args.shas.${stdenv.hostPlatform.system};
-    meta = {
-      inherit (args) version;
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    };
-  };
-in
-fetch_librusty_v8 {
-  version = "0.105.0";
+fetchLibrustyV8 {
+  version = "0.106.0";
  shas = {
-    x86_64-linux = "sha256-9yON4DNPxm4IUZSLZp9VZtzSRPPWX1tEuQLVJmN8cLs=";
-    aarch64-linux = "sha256-5vAjw2vimjCHKPxjIp5vcwMCWUUDYVlk4QyOeEI0DLY=";
-    x86_64-darwin = "sha256-o4WRkg4ptiJTNMkorn5K+P8xOJwpChM5PqkZCjP076g=";
-    aarch64-darwin = "sha256-ZuWBnvxu1PgDtjtguxtj3BhFO01AChlbjAS0kZUws3A=";
+    x86_64-linux = "sha256-jLYl/CJp2Z+Ut6qZlh6u+CtR8KN+ToNTB+72QnVbIKM=";
+    aarch64-linux = "sha256-uAkBMg6JXA+aILd8TzDtuaEdM3Axiw43Ad5tZzxNt5w=";
+    x86_64-darwin = "sha256-60aR0YvQT8KyacY8J3fWKZcf9vny51VUB19NVpurS/A=";
+    aarch64-darwin = "sha256-pd/I6Mclj2/r/uJTIywnolPKYzeLu1c28d/6D56vkzQ=";
  };
 }
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@ -9,20 +9,26 @@
  installShellFiles,
  libiconv,
  darwin,
-  librusty_v8 ? callPackage ./librusty_v8.nix { },
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+  },
 }:
+
+let
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.46.3";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    rev = "refs/tags/v${version}";
-    hash = "sha256-AM6SjcIHo6Koxcnznhkv3cXoKaMy2TEVpiWe/bczDuA=";
+    hash = "sha256-3PfAjn2zWgxJOYgKwR7lvXu+rIENIHBMPwMM6dWNgR4=";
  };

-  cargoHash = "sha256-D+CZpb6OTzM5Il0k8GQB7qSONy4myE5yKlaSkLLqHT8=";
+  cargoHash = "sha256-3r5B9yWXKO/8ah+Etflws8RnlRTAdaaC5HZMlZduyHE=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
@ -54,14 +60,13 @@ rustPlatform.buildRustPackage rec {
    ])
  );

-  # work around "error: unknown warning group '-Wunused-but-set-parameter'"
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unknown-warning-option";
-
  buildAndTestSubdir = "cli";

+  # work around "error: unknown warning group '-Wunused-but-set-parameter'"
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unknown-warning-option";
  # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
  # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
-  RUSTY_V8_ARCHIVE = librusty_v8;
+  env.RUSTY_V8_ARCHIVE = librusty_v8;

  # Tests have some inconsistencies between runs with output integration tests
  # Skipping until resolved
@ -71,15 +76,15 @@ rustPlatform.buildRustPackage rec {
    find ./target -name libswc_common${stdenv.hostPlatform.extensions.sharedLibrary} -delete
  '';

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  postInstall = lib.optionalString (canExecute) ''
    installShellCompletion --cmd deno \
      --bash <($out/bin/deno completions bash) \
      --fish <($out/bin/deno completions fish) \
      --zsh <($out/bin/deno completions zsh)
  '';

-  doInstallCheck = true;
-  installCheckPhase = ''
+  doInstallCheck = canExecute;
+  installCheckPhase = lib.optionalString (canExecute) ''
    runHook preInstallCheck
    $out/bin/deno --help
    $out/bin/deno --version | grep "deno ${version}"
--- a/pkgs/by-name/de/deno/tests/default.nix
+++ b/pkgs/by-name/de/deno/tests/default.nix
@ -1,43 +1,54 @@
-{ deno, runCommand, lib, testers }:
+{
+  deno,
+  runCommand,
+  lib,
+  testers,
+}:
 let
  testDenoRun =
    name:
-    { args ? ""
-    , dir ? ./. + "/${name}"
-    , file ? "index.ts"
-    , expected ? ""
-    , expectFailure ? false
+    {
+      args ? "",
+      dir ? ./. + "/${name}",
+      file ? "index.ts",
+      expected ? "",
+      expectFailure ? false,
    }:
    let
      command = "deno run ${args} ${dir}/${file}";
    in
-    runCommand "deno-test-${name}" { nativeBuildInputs = [ deno ]; meta.timeout = 60; } ''
-      HOME=$(mktemp -d)
-      if output=$(${command} 2>&1); then
-        if [[ $output =~ '${expected}' ]]; then
-          echo "Test '${name}' passed"
-          touch $out
+    runCommand "deno-test-${name}"
+      {
+        nativeBuildInputs = [ deno ];
+        meta.timeout = 60;
+      }
+      ''
+        HOME=$(mktemp -d)
+        if output=$(${command} 2>&1); then
+          if [[ $output =~ '${expected}' ]]; then
+            echo "Test '${name}' passed"
+            touch $out
+          else
+            echo -n ${lib.escapeShellArg command} >&2
+            echo " output did not match what was expected." >&2
+            echo "The expected was:" >&2
+            echo '${expected}' >&2
+            echo "The output was:" >&2
+            echo "$output" >&2
+            exit 1
+          fi
        else
+          if [[ "${toString expectFailure}" == "1" ]]; then
+            echo "Test '${name}' failed as expected"
+            touch $out
+            exit 0
+          fi
          echo -n ${lib.escapeShellArg command} >&2
-          echo " output did not match what was expected." >&2
-          echo "The expected was:" >&2
-          echo '${expected}' >&2
-          echo "The output was:" >&2
+          echo " returned a non-zero exit code." >&2
          echo "$output" >&2
          exit 1
        fi
-      else
-        if [[ "${toString expectFailure}" == "1" ]]; then
-          echo "Test '${name}' failed as expected"
-          touch $out
-          exit 0
-        fi
-        echo -n ${lib.escapeShellArg command} >&2
-        echo " returned a non-zero exit code." >&2
-        echo "$output" >&2
-        exit 1
-      fi
-    '';
+      '';
 in
 (lib.mapAttrs testDenoRun {
  basic = {
@ -59,8 +70,8 @@ in
    expectFailure = true;
    dir = ./read-file;
  };
-}) //
-{
+})
+// {
  version = testers.testVersion {
    package = deno;
    command = "deno --version";
--- a/pkgs/by-name/de/deno/tests/import-json/index.ts
+++ b/pkgs/by-name/de/deno/tests/import-json/index.ts
@ -1,2 +1,2 @@
-import file from "./data.json" assert { type: "json" };
+import file from "./data.json" with { type: "json" };
 console.log(file.msg);
--- a/pkgs/by-name/de/deno/update/common.ts
+++ b/pkgs/by-name/de/deno/update/common.ts
@ -3,15 +3,11 @@ interface GHRelease {
 }

 const decode = (buffer: Uint8Array) => new TextDecoder("utf-8").decode(buffer);
-const decodeTrim = (b: Uint8Array) => decode(b).trimEnd();
 export const run = async (command: string, args: string[]) => {
-  const cmd = Deno.run({
-    cmd: [command, ...args],
-    stdout: "piped",
-    stderr: "piped",
-  });
-  if (!(await cmd.status()).success) {
-    const error = await cmd.stderrOutput().then(decodeTrim);
+  const cmd = new Deno.Command(command, { args });
+  const { code, stdout, stderr } = await cmd.output();
+  if (code !== 0) {
+    const error = decode(stderr).trimEnd();
    // Known error we can ignore
    if (error.includes("'allow-unsafe-native-code-during-evaluation'")) {
      // Extract the target sha256 out of the error
@ -26,7 +22,7 @@ export const run = async (command: string, args: string[]) => {
    }
    throw new Error(error);
  }
-  return cmd.output().then(decodeTrim);
+  return decode(stdout).trimEnd();
 };

 // Exports
--- a/pkgs/by-name/de/deno/update/librusty_v8.ts
+++ b/pkgs/by-name/de/deno/update/librusty_v8.ts
@ -1,4 +1,4 @@
-import * as toml from "https://deno.land/std@0.202.0/toml/mod.ts";
+import * as toml from "jsr:@std/toml@1.0.1";
 import { getExistingVersion, logger, run, write } from "./common.ts";

 const log = logger("librusty_v8");
@ -40,22 +40,15 @@ fetchurl {

 const templateDeps = (version: string, deps: PrefetchResult[]) =>
  `# auto-generated file -- DO NOT EDIT!
-{ lib, stdenv, fetchurl }:
+{ fetchLibrustyV8 }:

-let
-  fetch_librusty_v8 = args: fetchurl {
-    name = "librusty_v8-\${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v\${args.version}/librusty_v8_release_\${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
-    sha256 = args.shas.\${stdenv.hostPlatform.system};
-    meta = {
-      inherit (args) version;
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    };
-  };
-in
-fetch_librusty_v8 {
+fetchLibrustyV8 {
  version = "${version}";
  shas = {
+    x86_64-linux = "sha256-jLYl/CJp2Z+Ut6qZlh6u+CtR8KN+ToNTB+72QnVbIKM=";
+    aarch64-linux = "sha256-uAkBMg6JXA+aILd8TzDtuaEdM3Axiw43Ad5tZzxNt5w=";
+    x86_64-darwin = "sha256-60aR0YvQT8KyacY8J3fWKZcf9vny51VUB19NVpurS/A=";
+    aarch64-darwin = "sha256-pd/I6Mclj2/r/uJTIywnolPKYzeLu1c28d/6D56vkzQ=";
 ${deps.map(({ arch, sha256 }) => `    ${arch.nix} = "${sha256}";`).join("\n")}
  };
 }
--- a/pkgs/by-name/di/digikam/package.nix
+++ b/pkgs/by-name/di/digikam/package.nix
@ -4,6 +4,7 @@
  lib,
  fetchFromGitLab,
  fetchgit,
+  fetchpatch,

  cmake,
  ninja,
@ -71,7 +72,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-GJYlxJkvFEXppVk0yC9ojszylfAGt3eBMAjNUu60XDY=";
  };

-  patches = [ ./disable-tests-download.patch ];
+  patches = [
+    ./disable-tests-download.patch
+
+    # Fix build with Qt 6.8
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://invent.kde.org/graphics/digikam/-/commit/a8b49ed8df676cae0f48b3369831edde2b74903e.patch";
+      hash = "sha256-93kQ/Dg/A9FR83ChyiUaRwyelE1Iq14eIecUteVbnqI=";
+    })
+  ];

  strictDeps = true;

--- a/pkgs/by-name/ex/exo/package.nix
+++ b/pkgs/by-name/ex/exo/package.nix
@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication {
  pname = "exo";
-  version = "0-unstable-2024-10-06";
+  version = "0-unstable-2024-10-09";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exo-explore";
    repo = "exo";
-    rev = "7b2a523fd1e5f1281d89bc1f664a29dc2003b787";
-    hash = "sha256-o4tNbU9oa7WsAQ6eiTHqQVhliXbG/Y8d7PeH2TTWgGk=";
+    rev = "c1a26cd7fa447b2802a4bececfd7cb9d316c0600";
+    hash = "sha256-jtcfGmk03Yf5IaswIvi6N9oMXzNPYlJBf4WMLkogUVo=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@ -1,17 +1,17 @@
-{ lib, buildGoModule, fetchFromGitLab, installShellFiles, stdenv }:
+{ lib, buildGo123Module, fetchFromGitLab, installShellFiles, stdenv }:

-buildGoModule rec {
+buildGo123Module rec {
  pname = "glab";
-  version = "1.45.0";
+  version = "1.47.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-jTpddpS+FYSQg2aRxQiVlG+bitiIqmZ4kxOJLPZkICo=";
+    hash = "sha256-mAM11nQ6YJJWNFOR9xQbgma7Plvo4MdcW2Syniw7o60=";
  };

-  vendorHash = "sha256-o0sYObTeDgG+3X3YEnDbk1h4DkEiMwEgYMF7hGjCL3Q=";
+  vendorHash = "sha256-uwSVdebZtIpSol553gJC0ItkEqa6qXXOAVFvzjsHSSI=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/li/librewolf-bin/package.nix
+++ b/pkgs/by-name/li/librewolf-bin/package.nix
@ -6,11 +6,11 @@

 let
  pname = "librewolf-bin";
-  upstreamVersion = "129.0.2-1";
+  upstreamVersion = "131.0.2-1";
  version = lib.replaceStrings [ "-" ] [ "." ] upstreamVersion;
  src = fetchurl {
    url = "https://gitlab.com/api/v4/projects/24386000/packages/generic/librewolf/${upstreamVersion}/LibreWolf.x86_64.AppImage";
-    hash = "sha256-h4SZnI2BwCSsLADYIxTXu82Jyst1hqYGHt54MnluLss=";
+    hash = "sha256-Sj3WkY3t8UHsh2v3xPaDb0IGp66YQIw9MKmmFFQCGvk=";
  };
  appimageContents = appimageTools.extract { inherit pname version src; };
 in
@ -31,8 +31,5 @@ appimageTools.wrapType2 {
    platforms = [ "x86_64-linux" ];
    mainProgram = "librewolf";
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = [
-      "CVE-2024-9680"
-    ];
  };
 }
--- a/pkgs/by-name/mo/mold/package.nix
+++ b/pkgs/by-name/mo/mold/package.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "mold";
-  version = "2.34.0";
+  version = "2.34.1";

  src = fetchFromGitHub {
    owner = "rui314";
    repo = "mold";
    rev = "v${version}";
-    hash = "sha256-QH9mtigVqt9ZrVBUyQcgUMW/8jtXHSYDWz6pprt6Hlk=";
+    hash = "sha256-x5fQ+dJFcxwENyTpZpQsMqTLtYQ8uuhUHV8jDpmltWg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@ -24,14 +24,14 @@ in

 python.pkgs.buildPythonApplication rec {
  pname = "music-assistant";
-  version = "2.2.6";
+  version = "2.2.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "music-assistant";
    repo = "server";
    rev = "refs/tags/${version}";
-    hash = "sha256-BEbcIq+qtJ1OffT2we6qajzvDYDu09rMcmJF1F06xZQ=";
+    hash = "sha256-GMjeNX8C027F+Wl/HfluWap9pDOeQwlM9qOs0Sp5tTI=";
  };

  patches = [
--- a/pkgs/by-name/te/terraform-docs/package.nix
+++ b/pkgs/by-name/te/terraform-docs/package.nix
@ -1,7 +1,9 @@
 {
+  stdenv,
  lib,
  buildGoModule,
  fetchFromGitHub,
+  installShellFiles,
 }:
 buildGoModule rec {
  pname = "terraform-docs";
@ -16,6 +18,17 @@ buildGoModule rec {

  vendorHash = "sha256-aweKTHQBYYqSp8CymwhnVv1WNQ7cZ1/bJNz7DSo7PKc=";

+  excludedPackages = [ "scripts" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    $out/bin/terraform-docs completion bash >terraform-docs.bash
+    $out/bin/terraform-docs completion fish >terraform-docs.fish
+    $out/bin/terraform-docs completion zsh >terraform-docs.zsh
+    installShellCompletion terraform-docs.{bash,fish,zsh}
+  '';
+
  meta = with lib; {
    description = "Utility to generate documentation from Terraform modules in various output formats";
    mainProgram = "terraform-docs";
--- a/pkgs/by-name/tt/ttop/lock.json
+++ b/pkgs/by-name/tt/ttop/lock.json
@ -10,19 +10,19 @@
      "rev": "9f51fc4e94d0960ab63fa6ea274518159720aa69",
      "sha256": "1n8cx5vl26ppjsn889zmfpa37yhlxahy2va4bqp6q4v4r1dl1h14",
      "srcDir": "src",
-      "url": "https://github.com/Yardanico/asciigraph/archive/9f51fc4e94d0960ab63fa6ea274518159720aa69.tar.gz"
+      "url": "https://github.com/nimbackup/asciigraph/archive/9f51fc4e94d0960ab63fa6ea274518159720aa69.tar.gz"
    },
    {
      "method": "fetchzip",
      "packages": [
        "illwill"
      ],
-      "path": "/nix/store/3lmm3z36qn4gz7bfa209zv0pqrpm3di9-source",
-      "ref": "v0.3.2",
-      "rev": "1d12cb36ab7b76c31d2d25fa421013ecb382e625",
-      "sha256": "0f9yncl5gbdja18mrqf5ixrdgrh95k0khda923dm1jd1x1b7ar8z",
+      "path": "/nix/store/k3sxzm7qnkgnwkrfd8hc3gkwzbayb1h1-source",
+      "ref": "v0.4.1",
+      "rev": "2736d9e0eb6b2bf32cd2fdb8226407a388362cd1",
+      "sha256": "0hiic5yjsaw6sgl1jzmfpm5g6a5ckzmd29c3pzg30glchn2g94sk",
      "srcDir": "",
-      "url": "https://github.com/johnnovak/illwill/archive/1d12cb36ab7b76c31d2d25fa421013ecb382e625.tar.gz"
+      "url": "https://github.com/johnnovak/illwill/archive/99a120f7f69868b94f5d35ce7e21dd12535de70c.tar.gz"
    },
    {
      "method": "fetchzip",
@ -52,12 +52,12 @@
      "packages": [
        "zippy"
      ],
-      "path": "/nix/store/dj520pi1q9xh5gplcjs0jsn5wgnaa0cr-source",
-      "ref": "0.10.11",
-      "rev": "9560f3d20479fb390c97f731ef8d100f1ed54e6c",
-      "sha256": "140r42kgynwsnrga4x2mildx9pflwniyhjjzmid2jvnl4i6jrsr4",
+      "path": "/nix/store/zcd2hmjxlkp1bpb7c9xrpg153ssj3w0b-source",
+      "ref": "0.10.16",
+      "rev": "a99f6a7d8a8e3e0213b3cad0daf0ea974bf58e3f",
+      "sha256": "16qdnyql8d7nm7nwwpq0maflm3p6cpbb2jfaqx6xkld9xkc9lsbv",
      "srcDir": "src",
-      "url": "https://github.com/guzba/zippy/archive/9560f3d20479fb390c97f731ef8d100f1ed54e6c.tar.gz"
+      "url": "https://github.com/guzba/zippy/archive/a99f6a7d8a8e3e0213b3cad0daf0ea974bf58e3f.tar.gz"
    }
  ]
 }
--- a/pkgs/by-name/tt/ttop/package.nix
+++ b/pkgs/by-name/tt/ttop/package.nix
@ -2,13 +2,13 @@

 buildNimPackage (finalAttrs: {
  pname = "ttop";
-  version = "1.2.8";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "inv2004";
    repo = "ttop";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QMUrA3OjxlDa1OxptJL7T3SPDTzSwVz6zz+ueh9eovM=";
+    hash = "sha256-/rs5JjTXxptVHXL3fY8qP6Be3r5N871CEbUH7w6zx4A=";
  };

  lockFile = ./lock.json;
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@ -14398,7 +14398,7 @@ dependencies = [

 [[package]]
 name = "zed"
-version = "0.156.0"
+version = "0.156.1"
 dependencies = [
 "activity_indicator",
 "anyhow",
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -86,13 +86,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "zed-editor";
-  version = "0.156.0";
+  version = "0.156.1";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-HdiEVRssMJmn+ifa0oWhHzRXB9L4oyji0DZ3PopHSoY=";
+    hash = "sha256-cu+XcFJ6VAP+7fqVhptnjDNpRkq/lRmJBCNkiy5Mka8=";
    fetchSubmodules = true;
  };

--- a/pkgs/development/compilers/llvm/19/libclc/use-default-paths.patch
+++ b/pkgs/development/compilers/llvm/19/libclc/use-default-paths.patch
@ -0,0 +1,31 @@
+From e8b910246d0c7c3d9fff994f71c6f8a48ec09a50 Mon Sep 17 00:00:00 2001
+From: Tristan Ross <tristan.ross@midstall.com>
+Date: Sat, 24 Aug 2024 19:56:24 -0700
+Subject: [PATCH] [libclc] use default paths with find_program when possible
+
+---
+ libclc/CMakeLists.txt | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 02bb859ae8590b..6bcd8ae52a5794 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -55,7 +55,7 @@ if( LIBCLC_STANDALONE_BUILD OR CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DI
+   # Import required tools
+   if( NOT EXISTS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
+     foreach( tool IN ITEMS clang llvm-as llvm-link opt )
+-      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
+      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} )
+       set( ${tool}_exe ${LLVM_TOOL_${tool}} )
+       set( ${tool}_target )
+     endforeach()
+@@ -104,7 +104,7 @@ foreach( tool IN ITEMS clang opt llvm-as llvm-link )
+ endforeach()
+ 
+ # llvm-spirv is an optional dependency, used to build spirv-* targets.
+-find_program( LLVM_SPIRV llvm-spirv PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
+find_program( LLVM_SPIRV llvm-spirv PATHS ${LLVM_TOOLS_BINARY_DIR} )
+ 
+ if( LLVM_SPIRV )
+   add_executable( libclc::llvm-spirv IMPORTED GLOBAL )
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@ -294,6 +294,12 @@ let
                  path = ../14;
                }
              ];
+              "libclc/use-default-paths.patch" = [
+                {
+                  after = "19";
+                  path = ../19;
+                }
+              ];
            };

            constraints = patches."${p}" or null;
--- a/pkgs/development/compilers/llvm/common/libclc.nix
+++ b/pkgs/development/compilers/llvm/common/libclc.nix
@ -1,10 +1,28 @@
-{ lib, stdenv, version, runCommand, monorepoSrc, llvm, buildPackages, buildLlvmTools, ninja, cmake, python3 }:
-
+{
+  lib,
+  stdenv,
+  version,
+  runCommand,
+  monorepoSrc,
+  llvm,
+  buildPackages,
+  buildLlvmTools,
+  ninja,
+  cmake,
+  python3,
+  release_version,
+  getVersionFile,
+}:
+let
+  spirv-llvm-translator = buildPackages.spirv-llvm-translator.override {
+    inherit (buildLlvmTools) llvm;
+  };
+in
 stdenv.mkDerivation rec {
  pname = "libclc";
  inherit version;

-  src = runCommand "${pname}-src-${version}" {} ''
+  src = runCommand "${pname}-src-${version}" { } ''
    mkdir -p "$out"
    cp -r ${monorepoSrc}/cmake "$out"
    cp -r ${monorepoSrc}/${pname} "$out"
@ -12,31 +30,52 @@ stdenv.mkDerivation rec {

  sourceRoot = "${src.name}/${pname}";

-  outputs = [ "out" "dev" ];
-
-  patches = [
-    ./libclc/libclc-gnu-install-dirs.patch
+  outputs = [
+    "out"
+    "dev"
  ];

-  # cmake expects all required binaries to be in the same place, so it will not be able to find clang without the patch
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'find_program( LLVM_CLANG clang PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_CLANG clang PATHS "${buildLlvmTools.clang.cc}/bin" NO_DEFAULT_PATH )' \
-      --replace 'find_program( LLVM_AS llvm-as PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_AS llvm-as PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
-      --replace 'find_program( LLVM_LINK llvm-link PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_LINK llvm-link PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
-      --replace 'find_program( LLVM_OPT opt PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_OPT opt PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
-      --replace 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                'find_program( LLVM_SPIRV llvm-spirv PATHS "${buildPackages.spirv-llvm-translator.override { inherit (buildLlvmTools) llvm; }}/bin" NO_DEFAULT_PATH )'
-  '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
-  '';
+  patches =
+    [ ./libclc/libclc-gnu-install-dirs.patch ]
+    # LLVM 19 changes how host tools are looked up.
+    # Need to remove NO_DEFAULT_PATH and the PATHS arguments for find_program
+    # so CMake can actually find the tools in nativeBuildInputs.
+    # https://github.com/llvm/llvm-project/pull/105969
+    ++ lib.optional (lib.versionAtLeast release_version "19") (
+      getVersionFile "libclc/use-default-paths.patch"
+    );

-  nativeBuildInputs = [ cmake ninja python3 ];
+  # cmake expects all required binaries to be in the same place, so it will not be able to find clang without the patch
+  postPatch =
+    lib.optionalString (lib.versionOlder release_version "19") ''
+      substituteInPlace CMakeLists.txt \
+        --replace 'find_program( LLVM_CLANG clang PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
+                  'find_program( LLVM_CLANG clang PATHS "${buildLlvmTools.clang.cc}/bin" NO_DEFAULT_PATH )' \
+        --replace 'find_program( LLVM_AS llvm-as PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
+                  'find_program( LLVM_AS llvm-as PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
+        --replace 'find_program( LLVM_LINK llvm-link PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
+                  'find_program( LLVM_LINK llvm-link PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
+        --replace 'find_program( LLVM_OPT opt PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
+                  'find_program( LLVM_OPT opt PATHS "${buildLlvmTools.llvm}/bin" NO_DEFAULT_PATH )' \
+        --replace 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
+                  'find_program( LLVM_SPIRV llvm-spirv PATHS "${spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
+    ''
+    + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      substituteInPlace CMakeLists.txt \
+        --replace 'COMMAND prepare_builtins' 'COMMAND ${buildLlvmTools.libclc.dev}/bin/prepare_builtins'
+    '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+      python3
+    ]
+    ++ lib.optional (lib.versionAtLeast release_version "19") [
+      buildLlvmTools.clang.cc
+      buildLlvmTools.llvm
+      spirv-llvm-translator
+    ];
  buildInputs = [ llvm ];
  strictDeps = true;

--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@ -1,12 +1,14 @@
-{ lib, stdenv
-, fetchFromGitHub
-, fetchpatch
-, cmake
-, pkg-config
-, lit
-, llvm
-, spirv-headers
-, spirv-tools
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  pkg-config,
+  lit,
+  llvm,
+  spirv-headers,
+  spirv-tools,
 }:

 let
@ -15,31 +17,50 @@ let

  # ROCm, if actively updated will always be at the latest version
  branch =
-    if llvmMajor == "18" then rec {
-      version = "18.1.0";
-      rev = "v${version}";
-      hash = "sha256-64guZiuO7VpaX01wNIjV7cnjEAe6ineMdY44S6sA33k=";
-    } else if llvmMajor == "17" || isROCm then rec {
-      version = "17.0.0";
-      rev = "v${version}";
-      hash = "sha256-Rzm5Py9IPFtS9G7kME+uSwZ/0gPGW6MlL35ZWk4LfHM=";
-    } else if llvmMajor == "16" then rec {
-      version = "16.0.0";
-      rev = "v${version}";
-      hash = "sha256-EUabcYqSjXshbPmcs1DRLvCSL1nd9rEdpqELBrItCW8=";
-    } else if llvmMajor == "15" then rec {
-      version = "15.0.0";
-      rev = "v${version}";
-      hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
-    } else if llvmMajor == "14" then {
-      version = "14.0.0+unstable-2024-07-15";
-      rev = "2823e7052b7999c10fff63bc8089e5aa205716f4";
-      hash = "sha256-8/4B74hYge6WiH7PzRGEgE3W7f9IkQ4VMmfkWKYA/l4=";
-    } else if llvmMajor == "11" then {
-      version = "11.0.0+unstable-2022-05-04";
-      rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
-      hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
-    } else throw "Incompatible LLVM version.";
+    if llvmMajor == "19" then
+      rec {
+        version = "19.1.0";
+        rev = "dad1f0eaab8047a4f73c50ed5f3d1694b78aae97";
+        hash = "sha256-mUvDF5y+cBnqUaHjyiiE8cJGH5MfQMqGFy6bYv9vCVY=";
+      }
+    else if llvmMajor == "18" then
+      rec {
+        version = "18.1.0";
+        rev = "v${version}";
+        hash = "sha256-64guZiuO7VpaX01wNIjV7cnjEAe6ineMdY44S6sA33k=";
+      }
+    else if llvmMajor == "17" || isROCm then
+      rec {
+        version = "17.0.0";
+        rev = "v${version}";
+        hash = "sha256-Rzm5Py9IPFtS9G7kME+uSwZ/0gPGW6MlL35ZWk4LfHM=";
+      }
+    else if llvmMajor == "16" then
+      rec {
+        version = "16.0.0";
+        rev = "v${version}";
+        hash = "sha256-EUabcYqSjXshbPmcs1DRLvCSL1nd9rEdpqELBrItCW8=";
+      }
+    else if llvmMajor == "15" then
+      rec {
+        version = "15.0.0";
+        rev = "v${version}";
+        hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
+      }
+    else if llvmMajor == "14" then
+      {
+        version = "14.0.0+unstable-2024-07-15";
+        rev = "2823e7052b7999c10fff63bc8089e5aa205716f4";
+        hash = "sha256-8/4B74hYge6WiH7PzRGEgE3W7f9IkQ4VMmfkWKYA/l4=";
+      }
+    else if llvmMajor == "11" then
+      {
+        version = "11.0.0+unstable-2022-05-04";
+        rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
+        hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
+      }
+    else
+      throw "Incompatible LLVM version.";
 in
 stdenv.mkDerivation {
  pname = "SPIRV-LLVM-Translator";
@ -51,71 +72,87 @@ stdenv.mkDerivation {
    inherit (branch) rev hash;
  };

-  patches = lib.optionals (llvmMajor == "18") [
-    # Fixes build after SPV_INTEL_maximum_registers breaking change
-    # TODO: remove on next spirv-headers release
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/d970c9126c033ebcbb7187bc705eae2e54726b74.patch";
-      revert = true;
-      hash = "sha256-71sJuGqVjTcB549eIiCO0LoqAgxkdEHCoxh8Pd/Qzz8=";
-    })
-  ] ++ lib.optionals (lib.versionAtLeast llvmMajor "15" && lib.versionOlder llvmMajor "18") [
-    # Fixes build after spirv-headers breaking change
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/0166a0fb86dc6c0e8903436bbc3a89bc3273ebc0.patch";
-      excludes = ["spirv-headers-tag.conf"];
-      hash = "sha256-17JJG8eCFVphElY5fVT/79hj0bByWxo8mVp1ZNjQk/M=";
-    })
-  ] ++ lib.optionals (llvmMajor == "16") [
-    # Fixes builds that link against external LLVM dynamic library
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
-      hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
-    })
-  ] ++ lib.optionals (llvmMajor == "14") [
-    (fetchpatch {
-      # tries to install llvm-spirv into llvm nix store path
-      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
-      revert = true;
-      hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
-    })
-  ];
+  patches =
+    lib.optionals (llvmMajor == "18") [
+      # Fixes build after SPV_INTEL_maximum_registers breaking change
+      # TODO: remove on next spirv-headers release
+      (fetchpatch {
+        url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/d970c9126c033ebcbb7187bc705eae2e54726b74.patch";
+        revert = true;
+        hash = "sha256-71sJuGqVjTcB549eIiCO0LoqAgxkdEHCoxh8Pd/Qzz8=";
+      })
+    ]
+    ++ lib.optionals (lib.versionAtLeast llvmMajor "15" && lib.versionOlder llvmMajor "18") [
+      # Fixes build after spirv-headers breaking change
+      (fetchpatch {
+        url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/0166a0fb86dc6c0e8903436bbc3a89bc3273ebc0.patch";
+        excludes = [ "spirv-headers-tag.conf" ];
+        hash = "sha256-17JJG8eCFVphElY5fVT/79hj0bByWxo8mVp1ZNjQk/M=";
+      })
+    ]
+    ++ lib.optionals (llvmMajor == "16") [
+      # Fixes builds that link against external LLVM dynamic library
+      (fetchpatch {
+        url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
+        hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
+      })
+    ]
+    ++ lib.optionals (llvmMajor == "14") [
+      (fetchpatch {
+        # tries to install llvm-spirv into llvm nix store path
+        url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
+        revert = true;
+        hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
+      })
+    ];

-  nativeBuildInputs = [ pkg-config cmake ]
-    ++ (if isROCm then [ llvm ] else [ llvm.dev ]);
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ] ++ (if isROCm then [ llvm ] else [ llvm.dev ]);

-  buildInputs = [ spirv-headers spirv-tools ]
-    ++ lib.optionals (!isROCm) [ llvm ];
+  buildInputs = [
+    spirv-headers
+    spirv-tools
+  ] ++ lib.optionals (!isROCm) [ llvm ];

  nativeCheckInputs = [ lit ];

-  cmakeFlags = [
-    "-DLLVM_INCLUDE_TESTS=ON"
-    "-DLLVM_DIR=${(if isROCm then llvm else llvm.dev)}"
-    "-DBUILD_SHARED_LIBS=YES"
-    "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
-    # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}";
+  cmakeFlags =
+    [
+      "-DLLVM_INCLUDE_TESTS=ON"
+      "-DLLVM_DIR=${(if isROCm then llvm else llvm.dev)}"
+      "-DBUILD_SHARED_LIBS=YES"
+      "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
+      # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
+      "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    ]
+    ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}"
+    ++ lib.optional (llvmMajor == "19") "-DBASE_LLVM_VERSION=${lib.versions.majorMinor llvm.version}.0";

  # FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
  doCheck = false;

-  makeFlags = [ "all" "llvm-spirv" ];
+  makeFlags = [
+    "all"
+    "llvm-spirv"
+  ];

-  postInstall = ''
-    install -D tools/llvm-spirv/llvm-spirv $out/bin/llvm-spirv
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    install_name_tool $out/bin/llvm-spirv \
-      -change @rpath/libLLVMSPIRVLib.dylib $out/lib/libLLVMSPIRVLib.dylib
-  '';
+  postInstall =
+    ''
+      install -D tools/llvm-spirv/llvm-spirv $out/bin/llvm-spirv
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      install_name_tool $out/bin/llvm-spirv \
+        -change @rpath/libLLVMSPIRVLib.dylib $out/lib/libLLVMSPIRVLib.dylib
+    '';

  meta = with lib; {
-    homepage    = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator";
+    homepage = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator";
    description = "Tool and a library for bi-directional translation between SPIR-V and LLVM IR";
    mainProgram = "llvm-spirv";
-    license     = licenses.ncsa;
-    platforms   = platforms.unix;
+    license = licenses.ncsa;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ gloaming ];
  };
 }
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "level-zero";
-  version = "1.17.42";
+  version = "1.17.45";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "level-zero";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IjYRzjC7CUPDdVBVoWSZtUQaY7QtSfS/Nej/2BdVziY=";
+    hash = "sha256-2uWZsy8aIV/ToDVuVxpyXoI1GbwZ9IxeLh+1hgjlfEM=";
  };

  nativeBuildInputs = [ cmake addDriverRunpath ];
--- a/pkgs/development/python-modules/beancount-black/default.nix
+++ b/pkgs/development/python-modules/beancount-black/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "beancount-black";
-  version = "1.0.4";
+  version = "1.0.5";

  disabled = pythonOlder "3.9";
  format = "pyproject";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "LaunchPlatform";
    repo = "beancount-black";
    rev = "refs/tags/${version}";
-    hash = "sha256-GrdQCxVsAzCusxxfQHF48doWG8OVrqBayCFof9RHTkE=";
+    hash = "sha256-vo11mlgDhyc8YFnULJ4AFrANWmGpAMNX5jJ6QaUNqk0=";
  };

  buildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/cgal/default.nix
+++ b/pkgs/development/python-modules/cgal/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "cgal";
-  version = "5.6.1.post202403291426";
+  version = "6.0.post202410011635";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CGAL";
    repo = "cgal-swig-bindings";
-    rev = "v${version}";
-    hash = "sha256-EcvS1TWL3uGCE1G8Lbfiu/AzifMdUSei+z91bzkiKes=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KXcXykL/m+A5dCDc+f8j7GgVeQahAOaZ/+LLKHyqbS4=";
  };

  dontUseCmakeConfigure = true;
--- a/pkgs/development/python-modules/drf-extra-fields/default.nix
+++ b/pkgs/development/python-modules/drf-extra-fields/default.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  djangorestframework,
+  filetype,
+  pillow,
+  psycopg2,
+  pytestCheckHook,
+  pytest-django,
+}:
+
+buildPythonPackage rec {
+  pname = "drf-extra-fields";
+  version = "3.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "hipo";
+    repo = "drf-extra-fields";
+    rev = "v${version}";
+    hash = "sha256-Ym4vnZ/t0ZdSxU53BC0ducJl1YiTygRSWql/35PNbOU";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    djangorestframework
+    filetype
+  ];
+
+  optional-dependencies = {
+    Base64ImageField = [ pillow ];
+  };
+
+  nativeCheckInputs = [
+    (django.override { withGdal = true; })
+    psycopg2
+    pytestCheckHook
+    pytest-django
+  ] ++ optional-dependencies.Base64ImageField;
+
+  pythonImportsCheck = [ "drf_extra_fields" ];
+
+  meta = {
+    description = "Extra Fields for Django Rest Framework";
+    homepage = "https://github.com/Hipo/drf-extra-fields";
+    changelog = "https://github.com/Hipo/drf-extra-fields/releases/tag/${src.rev}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+}
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "labelbox";
-  version = "5.1.0";
+  version = "5.2.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -40,7 +40,7 @@ buildPythonPackage rec {
    owner = "Labelbox";
    repo = "labelbox-python";
    rev = "refs/tags/v.${version}";
-    hash = "sha256-M55cwT7BrY+8m9ec+2bKDCxGkHJp/c50Gzib4sEg7Bk=";
+    hash = "sha256-vfhlzkCTm1fhvCpzwAaXWPyXE8/2Yx63fTVHl5CWon4=";
  };

  sourceRoot = "${src.name}/libs/labelbox";
--- a/pkgs/development/python-modules/netbox-documents/default.nix
+++ b/pkgs/development/python-modules/netbox-documents/default.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  drf-extra-fields,
+  python,
+  netbox,
+}:
+
+buildPythonPackage rec {
+  pname = "netbox-documents";
+  version = "0.7.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jasonyates";
+    repo = "netbox-documents";
+    rev = "v${version}";
+    hash = "sha256-Uijdaicbx9A9fBgFx3zyhhFlokFdb9TSolnExbfkkc4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ drf-extra-fields ];
+
+  nativeCheckInputs = [ netbox ];
+
+  preFixup = ''
+    export PYTHONPATH=${netbox}/opt/netbox/netbox:$PYTHONPATH
+  '';
+
+  dontUsePythonImportsCheck = python.pythonVersion != netbox.python.pythonVersion;
+  pythonImportsCheck = [ "netbox_documents" ];
+
+  meta = {
+    description = "Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox";
+    homepage = "https://github.com/jasonyates/netbox-documents";
+    changelog = "https://github.com/jasonyates/netbox-documents/releases/tag/${src.rev}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+}
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-celery/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-celery/default.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  hatchling,
+  opentelemetry-api,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  opentelemetry-test-utils,
+  billiard,
+  celery,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  inherit (opentelemetry-instrumentation) version src;
+  pname = "opentelemetry-instrumentation-celery";
+  pyproject = true;
+
+  sourceRoot = "${opentelemetry-instrumentation.src.name}/instrumentation/opentelemetry-instrumentation-celery";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    billiard
+    celery
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+  ];
+
+  optional-dependencies = {
+    instruments = [ celery ];
+  };
+
+  nativeCheckInputs = [
+    opentelemetry-test-utils
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "opentelemetry.instrumentation.celery" ];
+
+  meta = opentelemetry-instrumentation.meta // {
+    homepage = "https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/instrumentation/opentelemetry-instrumentation-celery";
+    description = "Celery instrumentation for OpenTelemetry";
+  };
+}
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
  setuptools,
@ -70,6 +71,9 @@ buildPythonPackage rec {
    scikit-image
  ];

+  # the check inputs are broken on darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
  disabledTests = [
    # FAILED plotly/matplotlylib/mplexporter/tests/test_basic.py::test_legend_dots - AssertionError: assert '3' == '2'
    "test_legend_dots"
@ -116,6 +120,9 @@ buildPythonPackage rec {
    "test_dependencies_not_imported"
    # FAILED test_init/test_lazy_imports.py::test_lazy_imports - AssertionError: assert 'plotly' not in {'IPython': <module 'IPython' from '...
    "test_lazy_imports"
+    # requires vaex and polars, vaex is not packaged
+    "test_build_df_from_vaex_and_polars"
+    "test_build_df_with_hover_data_from_vaex_and_polars"
  ];

  pythonImportsCheck = [ "plotly" ];
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@ -13,12 +13,13 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "shiboken6";
-  version = "6.7.2";
+  version = "6.8";

  src = fetchurl {
    # https://download.qt.io/official_releases/QtForPython/shiboken6/
-    url = "mirror://qt/official_releases/QtForPython/shiboken6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-OisNDW54yapd3H8GyktvEaP+FFYLrrFI7qU7XZjjaMc=";
+    # FIXME: inconsistent version numbers in directory name and tarball?
+    url = "mirror://qt/official_releases/QtForPython/shiboken6/PySide6-${finalAttrs.version}.0-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
+    hash = "sha256-XAWtOufnJ51tudyUpG6woF/Qk1NzCfdDnDhnG9clUZA=";
  };

  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";
--- a/pkgs/development/python-modules/tokenizers/Cargo.lock
+++ b/pkgs/development/python-modules/tokenizers/Cargo.lock
@ -62,9 +62,9 @@ dependencies = [

 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

 [[package]]
 name = "base64"
@ -92,9 +92,12 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "cc"
-version = "1.1.8"
+version = "1.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "504bdec147f2cc13c8b57ed9401fd8a147cc66b67ad5cb241394244f2c947549"
+checksum = "9540e661f81799159abee814118cc139a2004b3a3aa3ea37724a1b66530b90e0"
+dependencies = [
+ "shlex",
+]

 [[package]]
 name = "cfg-if"
@ -183,18 +186,18 @@ dependencies = [

 [[package]]
 name = "derive_builder"
-version = "0.20.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0350b5cb0331628a5916d6c5c0b72e97393b8b6b03b47a9284f4e7f5a405ffd7"
+checksum = "cd33f37ee6a119146a1781d3356a7c26028f83d779b2e04ecd45fdc75c76877b"
 dependencies = [
 "derive_builder_macro",
 ]

 [[package]]
 name = "derive_builder_core"
-version = "0.20.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d48cda787f839151732d396ac69e3473923d54312c070ee21e9effcaa8ca0b1d"
+checksum = "7431fa049613920234f22c47fdc33e6cf3ee83067091ea4277a3f8c4587aae38"
 dependencies = [
 "darling",
 "proc-macro2",
@ -204,9 +207,9 @@ dependencies = [

 [[package]]
 name = "derive_builder_macro"
-version = "0.20.0"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "206868b8242f27cecce124c19fd88157fbd0dd334df2587f36417bafbc85097b"
+checksum = "4abae7035bf79b9877b779505d8cf3749285b80c43941eda66604841889451dc"
 dependencies = [
 "derive_builder_core",
 "syn",
@ -268,9 +271,9 @@ dependencies = [

 [[package]]
 name = "fastrand"
-version = "2.1.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"

 [[package]]
 name = "fnv"
@ -373,9 +376,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"

 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.159"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"

 [[package]]
 name = "linux-raw-sys"
@ -540,9 +543,12 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "82881c4be219ab5faaf2ad5e5e5ecdff8c66bd7402ca3160975c93b24961afd1"
+dependencies = [
+ "portable-atomic",
+]

 [[package]]
 name = "onig"
@ -597,15 +603,15 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"

 [[package]]
 name = "pkg-config"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"

 [[package]]
 name = "portable-atomic"
-version = "1.7.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da544ee218f0d287a911e9c99a39a8c9bc8fcad3cb8db5959940044ecfc67265"
+checksum = "cc9c68a3f6da06753e9335d63e27f6b9754dd1920d941135b7ea8224f141adb2"

 [[package]]
 name = "ppv-lite86"
@ -690,9 +696,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
 dependencies = [
 "proc-macro2",
 ]
@ -766,18 +772,18 @@ dependencies = [

 [[package]]
 name = "redox_syscall"
-version = "0.5.3"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
+checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
 dependencies = [
 "bitflags 2.6.0",
 ]

 [[package]]
 name = "regex"
-version = "1.10.6"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
+checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -787,9 +793,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -798,9 +804,9 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"

 [[package]]
 name = "rustc-hash"
@ -810,9 +816,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"

 [[package]]
 name = "rustix"
-version = "0.38.34"
+version = "0.38.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
 dependencies = [
 "bitflags 2.6.0",
 "errno",
@ -835,18 +841,18 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.205"
+version = "1.0.210"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e33aedb1a7135da52b7c21791455563facbbcc43d0f0f66165b42c21b3dfb150"
+checksum = "c8e3592472072e6e22e0a54d5904d9febf8508f65fb8552499a1abc7d1078c3a"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.205"
+version = "1.0.210"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692d6f5ac90220161d6774db30c662202721e64aed9058d2c394f451261420c1"
+checksum = "243902eda00fad750862fc144cea25caca5e20d615af0a81bee94ca738f1df1f"
 dependencies = [
 "proc-macro2",
 "quote",
@ -855,9 +861,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.122"
+version = "1.0.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784b6203951c57ff748476b126ccb5e8e2959a5c19e5c617ab1956be3dbc68da"
+checksum = "6ff5456707a1de34e7e37f2a6fd3d3f808c318259cbd01ab6377795054b483d8"
 dependencies = [
 "itoa",
 "memchr",
@ -865,6 +871,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "smallvec"
 version = "1.13.2"
@ -891,9 +903,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "syn"
-version = "2.0.72"
+version = "2.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
+checksum = "89132cd0bf050864e1d38dc3bbc07a0eb8e7530af26344d3d2bbbef83499f590"
 dependencies = [
 "proc-macro2",
 "quote",
@ -908,9 +920,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"

 [[package]]
 name = "tempfile"
-version = "3.12.0"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbcdd0c794ebb0d4cf35e88edd2f7d2c4c3e9a5a6dab322839b321c6a87a64"
+checksum = "f0f2c9fc62d0beef6951ccffd757e241266a2c833136efbe35af6cd2567dca5b"
 dependencies = [
 "cfg-if",
 "fastrand",
@ -921,18 +933,18 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+checksum = "d50af8abc119fb8bb6dbabcfa89656f46f84aa0ac7688088608076ad2b459a84"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.63"
+version = "1.0.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+checksum = "08904e7672f5eb876eaaf87e0ce17857500934f4981c4a0ab2b4aa98baac7fc3"
 dependencies = [
 "proc-macro2",
 "quote",
@ -941,7 +953,7 @@ dependencies = [

 [[package]]
 name = "tokenizers"
-version = "0.20.0-rc1"
+version = "0.20.0-dev.0"
 dependencies = [
 "aho-corasick",
 "derive_builder",
@ -971,7 +983,7 @@ dependencies = [

 [[package]]
 name = "tokenizers-python"
-version = "0.20.0-rc1"
+version = "0.20.0-dev.0"
 dependencies = [
 "env_logger",
 "itertools 0.12.1",
@ -988,9 +1000,9 @@ dependencies = [

 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"

 [[package]]
 name = "unicode-normalization-alignments"
@ -1003,15 +1015,15 @@ dependencies = [

 [[package]]
 name = "unicode-segmentation"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"

 [[package]]
 name = "unicode-width"
-version = "0.1.13"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"

 [[package]]
 name = "unicode_categories"
--- a/pkgs/development/python-modules/tokenizers/default.nix
+++ b/pkgs/development/python-modules/tokenizers/default.nix
@ -52,7 +52,7 @@ let
    };
    "big.txt" = fetchurl {
      url = "https://norvig.com/big.txt";
-      sha256 = "sha256-+gZsfUDw8gGsQUTmUqpiQw5YprOAXscGUPZ42lgE6Hs=";
+      hash = "sha256-+gZsfUDw8gGsQUTmUqpiQw5YprOAXscGUPZ42lgE6Hs=";
    };
    "bert-wiki.json" = fetchurl {
      url = "https://s3.amazonaws.com/models.huggingface.co/bert/anthony/doc-pipeline/tokenizer.json";
@ -74,14 +74,14 @@ let
 in
 buildPythonPackage rec {
  pname = "tokenizers";
-  version = "0.20.0";
+  version = "0.20.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "tokenizers";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uuSHsdyx77YQjf1aiz7EJ/X+6RaOgfmjGqHSlMaCWDI=";
+    hash = "sha256-QTe1QdmJHSoosNG9cCJS7uQNdoMwgL+CJHQQUX5VtSY=";
  };

  cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };
@ -149,6 +149,7 @@ buildPythonPackage rec {
  meta = {
    description = "Fast State-of-the-Art Tokenizers optimized for Research and Production";
    homepage = "https://github.com/huggingface/tokenizers";
+    changelog = "https://github.com/huggingface/tokenizers/releases/tag/v${version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
    platforms = lib.platforms.unix;
--- a/pkgs/kde/gear/akonadi-search/default.nix
+++ b/pkgs/kde/gear/akonadi-search/default.nix
@ -7,7 +7,7 @@
  cargo,
  rustc,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-myS9icWi2ZeQCCHZRP3xEMKToAa+afc8C+s3T8y19RE=",
+  cargoHash ? "sha256-E+QaicYnFF79FDIhhvuEPQLikiLk5oKIjvLA132RUZo=",
 }:
 mkKdeDerivation rec {
  pname = "akonadi-search";
--- a/pkgs/kde/gear/angelfish/default.nix
+++ b/pkgs/kde/gear/angelfish/default.nix
@ -8,7 +8,7 @@
  cargo,
  rustc,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-xZkFVINKcJlJizHpBFLsMheQ45GsgWafzlDmxUydf5k=",
+  cargoHash ? "sha256-B3M5tkmftR4nFbPAQqJDvvPidVGxq/8zH0KRgpBR92w=",
  qcoro,
 }:
 mkKdeDerivation rec {
--- a/pkgs/kde/gear/kalzium/default.nix
+++ b/pkgs/kde/gear/kalzium/default.nix
@ -1,5 +1,6 @@
 {
  mkKdeDerivation,
+  fetchpatch,
  pkg-config,
  ocaml,
  eigen,
@ -10,6 +11,15 @@
 mkKdeDerivation {
  pname = "kalzium";

+  patches = [
+    # Fix build with Qt 6.8
+    # FIXME: remove in next major update
+    (fetchpatch {
+      url = "https://invent.kde.org/education/kalzium/-/commit/557d9bc96636f413430d0789cbf775915fc0dc45.patch";
+      hash = "sha256-KDCT/COqk7OTuF8pN7qrRrIPRU4PSGm+efpCDGbtZwA=";
+    })
+  ];
+
  # FIXME: look into how to make it find libfacile
  extraNativeBuildInputs = [
    pkg-config
--- a/pkgs/kde/gear/kdepim-addons/default.nix
+++ b/pkgs/kde/gear/kdepim-addons/default.nix
@ -8,7 +8,7 @@
  corrosion,
  alpaka,
  # provided as callPackage input to enable easier overrides through overlays
-  cargoHash ? "sha256-hIiJEuUk950g29Qkka4oS7EsZDbPvm8Q3CrqxQG40bU=",
+  cargoHash ? "sha256-t7izRAYjuCYA0YMZaCnvwbVo2UvfTTvdlYUd69T6w/Q=",
 }:
 mkKdeDerivation rec {
  pname = "kdepim-addons";
--- a/pkgs/kde/generated/sources/gear.json
+++ b/pkgs/kde/generated/sources/gear.json
--- a/pkgs/kde/misc/kirigami-addons/default.nix
+++ b/pkgs/kde/misc/kirigami-addons/default.nix
@ -7,11 +7,11 @@
 }:
 mkKdeDerivation rec {
  pname = "kirigami-addons";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchurl {
    url = "mirror://kde/stable/kirigami-addons/kirigami-addons-${version}.tar.xz";
-    hash = "sha256-VuPOtSBVtWAzIOoIsn02c9MqORqNWGRtmYIn2LUfCpM=";
+    hash = "sha256-+d/RkQIrYz6jNI+Ecw1xWKFZ3+SWaNugqem9Z4rETlQ=";
  };

  extraBuildInputs = [ qtdeclarative ];
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "6.12-rc1",
-        "hash": "sha256:16zwvjcvgndvr0izx0qs2k7v85nvxwlx6j7y2yrdl3shalsdlmx2"
+        "version": "6.12-rc2",
+        "hash": "sha256:1cwivhfnfam79dvqj22vr63ng7330w6wihkx01l4l2q7f5kl896x"
    },
    "6.1": {
        "version": "6.1.112",
@ -20,15 +20,15 @@
        "hash": "sha256:0axkwfhvq3w2072xjqww476qa3rjglxyqmf72mlp9b5ymswil8kp"
    },
    "6.6": {
-        "version": "6.6.54",
-        "hash": "sha256:186ggr0yz7fgp05qav6k6j72aazvwdljdnf2zwb5q194dafqdbjz"
+        "version": "6.6.56",
+        "hash": "sha256:158snxmb2silss8bndpzp8fmafp175v11jrlci0jr6c8ivvi4j7p"
    },
    "6.10": {
-        "version": "6.10.13",
-        "hash": "sha256:0smimvnivdswiggplz9x65d03vdysgr3v9iijbk4f5fva0iypz2z"
+        "version": "6.10.14",
+        "hash": "sha256:0gj2z9ax1qv59n2mld0pg2svwi28lbq92ql98vy7crynd2ybrram"
    },
    "6.11": {
-        "version": "6.11.2",
-        "hash": "sha256:0hlwsfq6brdkdcwdq6d1aq2b210hkqgpmy0y1sa5bfyfp6hgg7pc"
+        "version": "6.11.3",
+        "hash": "sha256:0wwv8jaipx352rna6bxj6jklmnm4kcikvzaag59m4zf1mz866wh5"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19631";
-    sha256 = "0hydmrdwqrrmrnk6r583m7c2hq1k68c9c8yqjc0bd6q4x7ys32ci";
+    rev = "19643";
+    sha256 = "1gnji0hglzh6kj9ssawlrix1vlbcyfjdjx5d9qwpnn2p0sgsq7nj";
  }
 , ...
 } @ args:
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@ -52,6 +52,8 @@

  moonraker = callPackage ./moonraker {};

+  nest_protect = callPackage ./nest_protect {};
+
  ntfy = callPackage ./ntfy {};

  omnik_inverter = callPackage ./omnik_inverter {};
--- a/pkgs/servers/home-assistant/custom-components/miele/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/miele/default.nix
@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
  owner = "astrandb";
  domain = "miele";
-  version = "2024.3.0";
+  version = "2024.8.1";

  src = fetchFromGitHub {
    inherit owner;
    repo = domain;
    rev = "refs/tags/v${version}";
-    hash = "sha256-J9n4PFcd87L301B2YktrLcxp5Vu1HwDeCYnrMEJ0+TA=";
+    hash = "sha256-XwaOQJvosCUXMZYrKX7sMWJIrMx36RhuVYUq163vvNg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/servers/home-assistant/custom-components/nest_protect/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/nest_protect/default.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildHomeAssistantComponent,
+}:
+buildHomeAssistantComponent rec {
+  owner = "iMicknl";
+  domain = "nest_protect";
+  version = "0.3.12";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "ha-nest-protect";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IiHndx+mQVfpMLisiRwSEhrFJ3mJ4qaWTxZrubowkQs=";
+  };
+
+  dontBuild = true;
+
+  # AttributeError: 'async_generator' object has no attribute 'data'
+  doCheck = false;
+
+  meta = with lib; {
+    changelog = "https://github.com/iMicknl/ha-nest-protect/releases/tag/v${version}";
+    description = "Nest Protect integration for Home Assistant";
+    homepage = "https://github.com/iMicknl/ha-nest-protect";
+    maintainers = with maintainers; [ jamiemagee ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@ -1,64 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config
-, gnutls, libedit, nspr, nss, readline, texinfo
-, libcap, libseccomp, pps-tools
-, nixosTests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "chrony";
-  version = "4.5";
-
-  src = fetchurl {
-    url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    hash = "sha256-Gf4dn0Zk1EWmmpbHHo/bYLzY3yTHPROG4CKH9zZq1CI=";
-  };
-
-  outputs = [ "out" "man" ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ gnutls libedit nspr nss readline texinfo ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libcap libseccomp pps-tools ];
-
-  configureFlags = [
-    "--enable-ntp-signd"
-    "--sbindir=$(out)/bin"
-    "--chronyrundir=/run/chrony"
-  ] ++ lib.optional stdenv.hostPlatform.isLinux "--enable-scfilter";
-
-  patches = [
-    # Cleanup the installation script
-    ./makefile.patch
-  ];
-
-  postPatch = ''
-    patchShebangs test
-  '';
-
-  hardeningEnable = [ "pie" ];
-
-  passthru.tests = { inherit (nixosTests) chrony chrony-ptp; };
-
-  meta = with lib; {
-    description = "Sets your computer's clock from time servers on the Net";
-    homepage = "https://chrony.tuxfamily.org/";
-    license = licenses.gpl2Only;
-    platforms = with platforms; linux ++ freebsd ++ openbsd;
-    maintainers = with maintainers; [ fpletz thoughtpolice ];
-
-    longDescription = ''
-      Chronyd is a daemon which runs in background on the system. It obtains
-      measurements via the network of the system clock’s offset relative to
-      time servers on other systems and adjusts the system time accordingly.
-      For isolated systems, the user can periodically enter the correct time by
-      hand (using Chronyc). In either case, Chronyd determines the rate at
-      which the computer gains or loses time, and compensates for this. Chronyd
-      implements the NTP protocol and can act as either a client or a server.
-
-      Chronyc provides a user interface to Chronyd for monitoring its
-      performance and configuring various settings. It can do so while running
-      on the same computer as the Chronyd instance it is controlling or a
-      different computer.
-    '';
-  };
-}
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@ -53,7 +53,7 @@ let
  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
 in
 stdenv'.mkDerivation (finalAttrs: {
-  version = "1.47.1";
+  version = "1.47.3";
  pname = "netdata";

  src = fetchFromGitHub {
@ -62,10 +62,10 @@ stdenv'.mkDerivation (finalAttrs: {
    rev = "v${finalAttrs.version}";
    hash =
      if withCloudUi then
-        "sha256-/iXmIjWpZ0s/LELZM7rYYQ9cjLNdfdisyOvDyLddSY4="
+        "sha256-rua4wDkTEQbH5fS6gVDF0y3QsQ+eG8Eki4JFxmiRN5k="
      # we delete the v2 GUI after fetching
      else
-        "sha256-pAqxxsWYgqbmF6wFBfTCYYc3x/Ufyz2Xs4bwB1ToHjo=";
+        "sha256-IR54OgYiOAmDgysm+3MLeMkxyNWkJe3BLKL9gaFHdvo=";
    fetchSubmodules = true;

    # Remove v2 dashboard distributed under NCUL1. Make sure an empty
--- a/pkgs/tools/video/rtmpdump/default.nix
+++ b/pkgs/tools/video/rtmpdump/default.nix
@ -31,14 +31,17 @@ stdenv.mkDerivation {
    })
  ];

+  preBuild = ''
+    makeFlagsArray+=(CC="$CC")
+  '';
+
  makeFlags = [
    "prefix=$(out)"
    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
  ]
    ++ lib.optional gnutlsSupport "CRYPTO=GNUTLS"
    ++ lib.optional opensslSupport "CRYPTO=OPENSSL"
-    ++ lib.optional stdenv.hostPlatform.isDarwin "SYS=darwin"
-    ++ lib.optional stdenv.cc.isClang "CC=clang";
+    ++ lib.optional stdenv.hostPlatform.isDarwin "SYS=darwin";

  propagatedBuildInputs = [ zlib ]
    ++ lib.optionals gnutlsSupport [ gnutls nettle ]
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -308,6 +308,7 @@ mapAliases {
  clang16Stdenv = lowPrio llvmPackages_16.stdenv;
  clang17Stdenv = lowPrio llvmPackages_17.stdenv;
  clang18Stdenv = lowPrio llvmPackages_18.stdenv;
+  clang19Stdenv = lowPrio llvmPackages_19.stdenv;

  clang-tools_6 = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
  clang-tools_7 = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
@ -329,6 +330,7 @@ mapAliases {
  clang-tools_16 = llvmPackages_16.clang-tools; # Added 2024-04-22
  clang-tools_17 = llvmPackages_17.clang-tools; # Added 2024-04-22
  clang-tools_18 = llvmPackages_18.clang-tools; # Added 2024-04-22
+  clang-tools_19 = llvmPackages_19.clang-tools; # Added 2024-08-21

  cq-editor = throw "cq-editor has been removed, as it use a dependency that was disabled since python 3.8 and was last updated in 2021"; # Added 2024-05-13

@ -830,7 +832,6 @@ mapAliases {
  libbpf_1 = libbpf; # Added 2022-12-06
  libbson = mongoc; # Added 2024-03-11
  libcap_pam = throw "'libcap_pam' has been replaced with 'libcap'"; # Converted to throw 2023-09-10
-  libclc = llvmPackages_18.libclc; # Added 2023-10-28
  libcxxabi = throw "'libcxxabi' was merged into 'libcxx'"; # Converted to throw 2024-03-08
  libdwarf_20210528 = throw "'libdwarf_20210528' has been removed because it is not used in nixpkgs, move to libdwarf"; # Added 2024-03-23
  libgme = game-music-emu; # Added 2022-07-20
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2380,8 +2380,6 @@ with pkgs;

  gitweb = callPackage ../applications/version-management/gitweb { };

-  glab = callPackage ../applications/version-management/glab { };
-
  glitter = callPackage ../applications/version-management/glitter { };

  globalping-cli = callPackage ../tools/networking/globalping-cli { };
@ -6259,8 +6257,6 @@ with pkgs;

  chkrootkit = callPackage ../tools/security/chkrootkit { };

-  chrony = callPackage ../tools/networking/chrony { };
-
  chunkfs = callPackage ../tools/filesystems/chunkfs { };

  chunksync = callPackage ../tools/backup/chunksync { };
@ -6829,6 +6825,8 @@ with pkgs;

  deer = callPackage ../shells/zsh/zsh-deer { };

+  deno_1 = callPackage ../by-name/de/deno/1/package.nix { };
+
  deqp-runner = callPackage ../tools/graphics/deqp-runner { };

  detox = callPackage ../tools/misc/detox { };
@ -15253,6 +15251,7 @@ with pkgs;
  mlir_16 = llvmPackages_16.mlir;
  mlir_17 = llvmPackages_17.mlir;

+  libclc = llvmPackages.libclc;
  libllvm = llvmPackages.libllvm;
  llvm-manpages = llvmPackages.llvm-manpages;

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3734,6 +3734,8 @@ self: super: with self; {

  dremel3dpy = callPackage ../development/python-modules/dremel3dpy { };

+  drf-extra-fields = callPackage ../development/python-modules/drf-extra-fields { };
+
  drf-jwt = callPackage ../development/python-modules/drf-jwt { };

  drf-nested-routers = callPackage ../development/python-modules/drf-nested-routers { };
@ -8859,6 +8861,8 @@ self: super: with self; {

  netapp-ontap = callPackage ../development/python-modules/netapp-ontap { };

+  netbox-documents = callPackage ../development/python-modules/netbox-documents { };
+
  netbox-reorder-rack = callPackage ../development/python-modules/netbox-reorder-rack { };

  netcdf4 = callPackage ../development/python-modules/netcdf4 { };
@ -9389,6 +9393,8 @@ self: super: with self; {

  opentelemetry-instrumentation-asgi = callPackage ../development/python-modules/opentelemetry-instrumentation-asgi { };

+  opentelemetry-instrumentation-celery = callPackage ../development/python-modules/opentelemetry-instrumentation-celery { };
+
  opentelemetry-instrumentation-dbapi = callPackage ../development/python-modules/opentelemetry-instrumentation-dbapi { };

  opentelemetry-instrumentation-django = callPackage ../development/python-modules/opentelemetry-instrumentation-django { };