Merge staging-next into staging

.github/workflows/backport.yml

@@ -8,26 +8,31 @@ on:
 # the GitHub repository. This means that it should not evaluate user input in a
 # way that allows code injection.
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   backport:
-    permissions:
-      contents: write # for korthout/backport-action to create branch
-      pull-requests: write # for korthout/backport-action to create PR to backport
     name: Backport Pull Request
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+        id: app-token
+        with:
+          app-id: ${{ vars.BACKPORT_APP_ID }}
+          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          token: ${{ steps.app-token.outputs.token }}
       - name: Create backport PRs
         uses: korthout/backport-action@bd410d37cdcae80be6d969823ff5a225fe5c833f # v3.0.2
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
+          github_token: ${{ steps.app-token.outputs.token }}
           pull_description: |-
             Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
 

.github/workflows/eval.yml

@@ -86,6 +86,24 @@ jobs:
           name: paths
           path: result/*
 
+  eval-aliases:
+    name: Eval nixpkgs with aliases enabled
+    runs-on: ubuntu-latest
+    needs: attrs
+    steps:
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.attrs.outputs.mergedSha }}
+          path: nixpkgs
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
+        run: |
+          time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
+
   outpaths:
     name: Outpaths
     runs-on: ubuntu-latest

lib/modules.nix

@@ -751,47 +751,17 @@ let
           t' = opt.options.type;
           mergedType = t.typeMerge t'.functor;
           typesMergeable = mergedType != null;
-
-          # TODO: Remove this when all downstream reliances of internals: 'functor.wrapped' are sufficiently migrated.
-          # A function that adds the deprecated wrapped message to a type.
-          addDeprecatedWrapped = t:
-            t // {
-              functor = t.functor // {
-                wrapped = t.functor.wrappedDeprecationMessage {
-                  inherit loc;
-                };
-              };
-            };
-
-          typeSet =
-            if opt.options ? type then
-              if res ? type then
-                if typesMergeable then
-                  {
-                    type =
-                      if mergedType ? functor.wrappedDeprecationMessage then
-                        addDeprecatedWrapped mergedType
-                      else
-                        mergedType;
-                  }
-                else
-                  # Keep in sync with the same error below!
-                  throw "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
-              else if opt.options.type ? functor.wrappedDeprecationMessage then
-                { type = addDeprecatedWrapped opt.options.type; }
-              else
-                {}
-            else
-              {};
-
+          typeSet = if (bothHave "type") && typesMergeable
+                       then { type = mergedType; }
+                       else {};
           bothHave = k: opt.options ? ${k} && res ? ${k};
       in
       if bothHave "default" ||
          bothHave "example" ||
          bothHave "description" ||
-         bothHave "apply"
+         bothHave "apply" ||
+         (bothHave "type" && (! typesMergeable))
       then
-        # Keep in sync with the same error above!
         throw "The option `${showOption loc}' in `${opt._file}' is already declared in ${showFiles res.declarations}."
       else
         let

lib/tests/modules.sh

@@ -386,14 +386,6 @@ checkConfigOutput '^true$' config.conditionalWorks ./declare-attrsOf.nix ./attrs
 checkConfigOutput '^false$' config.conditionalWorks ./declare-lazyAttrsOf.nix ./attrsOf-conditional-check.nix
 checkConfigOutput '^"empty"$' config.value.foo ./declare-lazyAttrsOf.nix ./attrsOf-conditional-check.nix
 
-# Check attrsWith type merging
-checkConfigError 'The option `mergedLazyNonLazy'\'' in `.*'\'' is already declared in `.*'\''\.' options.mergedLazyNonLazy ./lazy-attrsWith.nix
-checkConfigOutput '^11$' config.lazyResult ./lazy-attrsWith.nix
-checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-attrsWith.nix
-
-# Test the attrsOf functor.wrapped warning
-# shellcheck disable=2016
-NIX_ABORT_ON_WARN=1 checkConfigError 'The deprecated `type.functor.wrapped` attribute of the option `mergedLazyLazy` is accessed, use `nestedTypes.elemType` instead.' options.mergedLazyLazy.type.functor.wrapped ./lazy-attrsWith.nix
 
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
@@ -583,7 +575,6 @@ checkConfigOutput '^38|27$' options.submoduleLine38.declarationPositions.1.line
 # nested options work
 checkConfigOutput '^34$' options.nested.nestedLine34.declarationPositions.0.line ./declaration-positions.nix
 
-
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/lazy-attrsWith.nix

@@ -1,57 +0,0 @@
-# Check that AttrsWith { lazy = true; } is lazy
-{ lib, ... }:
-let
-  inherit (lib) types mkOption;
-
-  lazyAttrsOf = mkOption {
-    # Same as lazyAttrsOf
-    type = types.attrsWith {
-      lazy = true;
-      elemType = types.int;
-    };
-  };
-
-  attrsOf = mkOption {
-    # Same as lazyAttrsOf
-    type = types.attrsWith {
-      elemType = types.int;
-    };
-  };
-in
-{
-  imports = [
-    #  Module A
-    (
-      { ... }:
-      {
-        options.mergedLazyLazy = lazyAttrsOf;
-        options.mergedLazyNonLazy = lazyAttrsOf;
-        options.mergedNonLazyNonLazy = attrsOf;
-      }
-    )
-    # Module B
-    (
-      { ... }:
-      {
-        options.mergedLazyLazy = lazyAttrsOf;
-        options.mergedLazyNonLazy = attrsOf;
-        options.mergedNonLazyNonLazy = attrsOf;
-      }
-    )
-    # Result
-    (
-      { config, ... }:
-      {
-        # Can only evaluate if lazy
-        config.mergedLazyLazy.bar = config.mergedLazyLazy.baz + 1;
-        config.mergedLazyLazy.baz = 10;
-        options.lazyResult = mkOption { default = config.mergedLazyLazy.bar; };
-
-        # Can not only evaluate if not lazy
-        config.mergedNonLazyNonLazy.bar = config.mergedNonLazyNonLazy.baz + 1;
-        config.mergedNonLazyNonLazy.baz = 10;
-        options.nonLazyResult = mkOption { default = config.mergedNonLazyNonLazy.bar; };
-      }
-    )
-  ];
-}

lib/types.nix

@@ -83,15 +83,11 @@ rec {
   # Default type merging function
   # takes two type functors and return the merged type
   defaultTypeMerge = f: f':
-    let
-      mergedWrapped = f.wrapped.typeMerge f'.wrapped.functor;
-      mergedPayload = f.binOp f.payload f'.payload;
+    let mergedWrapped = f.wrapped.typeMerge f'.wrapped.functor;
+        mergedPayload = f.binOp f.payload f'.payload;
 
-      hasPayload = assert (f'.payload != null) == (f.payload != null); f.payload != null;
-      hasWrapped = assert (f'.wrapped != null) == (f.wrapped != null); f.wrapped != null;
-
-      typeFromPayload = if mergedPayload == null then null else f.type mergedPayload;
-      typeFromWrapped = if mergedWrapped == null then null else f.type mergedWrapped;
+        hasPayload = assert (f'.payload != null) == (f.payload != null); f.payload != null;
+        hasWrapped = assert (f'.wrapped != null) == (f.wrapped != null); f.wrapped != null;
     in
     # Abort early: cannot merge different types
     if f.name != f'.name
@@ -99,23 +95,23 @@ rec {
     else
 
     if hasPayload then
-      # Just return the payload if returning wrapped is deprecated
-      if f ? wrappedDeprecationMessage then
-        typeFromPayload
-      else if hasWrapped then
+      if hasWrapped then
         # Has both wrapped and payload
         throw ''
           Type ${f.name} defines both `functor.payload` and `functor.wrapped` at the same time, which is not supported.
 
           Use either `functor.payload` or `functor.wrapped` but not both.
 
-          If your code worked before remove either `functor.wrapped` or `functor.payload` from the type definition.
+          If your code worked before remove `functor.payload` from the type definition.
         ''
       else
-        typeFromPayload
+        # Has payload
+        if mergedPayload == null then null else f.type mergedPayload
     else
       if hasWrapped then
-        typeFromWrapped
+        # Has wrapped
+        # TODO(@hsjobeki): This could also be a warning and removed in the future
+        if mergedWrapped == null then null else f.type mergedWrapped
       else
         f.type;
 
@@ -586,78 +582,48 @@ rec {
         substSubModules = m: nonEmptyListOf (elemType.substSubModules m);
       };
 
-    attrsOf = elemType: attrsWith { inherit elemType; };
+    attrsOf = elemType: mkOptionType rec {
+      name = "attrsOf";
+      description = "attribute set of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
+      descriptionClass = "composite";
+      check = isAttrs;
+      merge = loc: defs:
+        mapAttrs (n: v: v.value) (filterAttrs (n: v: v ? value) (zipAttrsWith (name: defs:
+            (mergeDefinitions (loc ++ [name]) elemType defs).optionalValue
+          )
+          # Push down position info.
+          (map (def: mapAttrs (n: v: { inherit (def) file; value = v; }) def.value) defs)));
+      emptyValue = { value = {}; };
+      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name>"]);
+      getSubModules = elemType.getSubModules;
+      substSubModules = m: attrsOf (elemType.substSubModules m);
+      functor = (defaultFunctor name) // { wrapped = elemType; };
+      nestedTypes.elemType = elemType;
+    };
 
     # A version of attrsOf that's lazy in its values at the expense of
     # conditional definitions not working properly. E.g. defining a value with
     # `foo.attr = mkIf false 10`, then `foo ? attr == true`, whereas with
     # attrsOf it would correctly be `false`. Accessing `foo.attr` would throw an
     # error that it's not defined. Use only if conditional definitions don't make sense.
-    lazyAttrsOf = elemType: attrsWith { inherit elemType; lazy = true; };
-
-    # base type for lazyAttrsOf and attrsOf
-    attrsWith =
-    let
-      # Push down position info.
-      pushPositions = map (def: mapAttrs (n: v: { inherit (def) file; value = v; }) def.value);
-      binOp = lhs: rhs:
-        let
-          elemType = lhs.elemType.typeMerge rhs.elemType.functor;
-          lazy =
-            if lhs.lazy == rhs.lazy then
-              lhs.lazy
-            else
-              null;
-        in
-        if elemType == null || lazy == null then
-          null
-        else
-          {
-            inherit elemType lazy;
-          };
-    in
-    {
-      elemType,
-      lazy ? false,
-    }:
-    mkOptionType {
-      name = if lazy then "lazyAttrsOf" else "attrsOf";
-      description = (if lazy then "lazy attribute set" else "attribute set") + " of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
+    lazyAttrsOf = elemType: mkOptionType rec {
+      name = "lazyAttrsOf";
+      description = "lazy attribute set of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
       descriptionClass = "composite";
       check = isAttrs;
-      merge = if lazy then (
-        # Lazy merge Function
-        loc: defs:
-          zipAttrsWith (name: defs:
-            let merged = mergeDefinitions (loc ++ [name]) elemType defs;
-            # mergedValue will trigger an appropriate error when accessed
-            in merged.optionalValue.value or elemType.emptyValue.value or merged.mergedValue
-          )
-          # Push down position info.
-          (pushPositions defs)
-      ) else (
-        # Non-lazy merge Function
-        loc: defs:
-          mapAttrs (n: v: v.value) (filterAttrs (n: v: v ? value) (zipAttrsWith (name: defs:
-              (mergeDefinitions (loc ++ [name]) elemType (defs)).optionalValue
-            )
-          # Push down position info.
-          (pushPositions defs)))
-      );
+      merge = loc: defs:
+        zipAttrsWith (name: defs:
+          let merged = mergeDefinitions (loc ++ [name]) elemType defs;
+          # mergedValue will trigger an appropriate error when accessed
+          in merged.optionalValue.value or elemType.emptyValue.value or merged.mergedValue
+        )
+        # Push down position info.
+        (map (def: mapAttrs (n: v: { inherit (def) file; value = v; }) def.value) defs);
       emptyValue = { value = {}; };
       getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name>"]);
       getSubModules = elemType.getSubModules;
-      substSubModules = m: attrsWith { elemType = elemType.substSubModules m; inherit lazy; };
-      functor = defaultFunctor "attrsWith" // {
-        wrappedDeprecationMessage = { loc }: lib.warn ''
-          The deprecated `type.functor.wrapped` attribute of the option `${showOption loc}` is accessed, use `type.nestedTypes.elemType` instead.
-        '' elemType;
-        payload = {
-          # Important!: Add new function attributes here in case of future changes
-          inherit elemType lazy;
-        };
-        inherit binOp;
-      };
+      substSubModules = m: lazyAttrsOf (elemType.substSubModules m);
+      functor = (defaultFunctor name) // { wrapped = elemType; };
       nestedTypes.elemType = elemType;
     };
 

maintainers/maintainer-list.nix

@@ -493,6 +493,12 @@
     github = "acesyde";
     githubId = 958435;
   };
+  AchmadFathoni = {
+    name = "Achmad Fathoni";
+    email = "fathoni.id@gmail.com";
+    github = "AchmadFathoni";
+    githubId = 26775746;
+  };
   aciceri = {
     name = "Andrea Ciceri";
     email = "andrea.ciceri@autistici.org";

nixos/modules/module-list.nix

@@ -896,6 +896,7 @@
   ./services/monitoring/do-agent.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix
+  ./services/monitoring/gitwatch.nix
   ./services/monitoring/glances.nix
   ./services/monitoring/goss.nix
   ./services/monitoring/grafana-agent.nix

nixos/modules/services/misc/ananicy.nix

@@ -22,7 +22,7 @@ let
   # Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382
   finalPackage =
     if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then
-      (cfg.package { withBpf = false; })
+      (cfg.package.override { withBpf = false; })
     else
       cfg.package;
 in

nixos/modules/services/monitoring/gitwatch.nix

@@ -5,11 +5,20 @@
   ...
 }:
 let
+  inherit (lib)
+    maintainers
+    mapAttrs'
+    mkEnableOption
+    mkOption
+    nameValuePair
+    optionalString
+    types
+    ;
   mkSystemdService =
     name: cfg:
-    lib.nameValuePair "gitwatch-${name}" (
+    nameValuePair "gitwatch-${name}" (
       let
-        getvar = flag: var: lib.optionalString (cfg."${var}" != null) "${flag} ${cfg."${var}"}";
+        getvar = flag: var: optionalString (cfg."${var}" != null) "${flag} ${cfg."${var}"}";
         branch = getvar "-b" "branch";
         remote = getvar "-r" "remote";
       in
@@ -35,7 +44,7 @@ let
     );
 in
 {
-  options.services.gitwatch = lib.mkOption {
+  options.services.gitwatch = mkOption {
     description = ''
       A set of git repositories to watch for. See
       [gitwatch](https://github.com/gitwatch/gitwatch) for more.
@@ -57,25 +66,25 @@ in
       };
     };
     type =
-      with lib.types;
+      with types;
       attrsOf (submodule {
         options = {
-          enable = lib.mkEnableOption "watching for repo";
-          path = lib.mkOption {
+          enable = mkEnableOption "watching for repo";
+          path = mkOption {
             description = "The path to repo in local machine";
             type = str;
           };
-          user = lib.mkOption {
+          user = mkOption {
             description = "The name of services's user";
             type = str;
             default = "root";
           };
-          remote = lib.mkOption {
+          remote = mkOption {
             description = "Optional url of remote repository";
             type = nullOr str;
             default = null;
           };
-          branch = lib.mkOption {
+          branch = mkOption {
             description = "Optional branch in remote repository";
             type = nullOr str;
             default = null;
@@ -83,5 +92,6 @@ in
         };
       });
   };
-  config.systemd.services = lib.mapAttrs' mkSystemdService config.services.gitwatch;
+  config.systemd.services = mapAttrs' mkSystemdService config.services.gitwatch;
+  meta.maintainers = with maintainers; [ shved ];
 }

nixos/modules/services/system/localtimed.nix

@@ -24,7 +24,7 @@ in {
         '';
       };
       package = mkPackageOption pkgs "localtime" { };
-      geoclue2Package = mkPackageOption pkgs "geoclue2-with-demo-agent" { };
+      geoclue2Package = mkPackageOption pkgs "Geoclue2" { default = "geoclue2-with-demo-agent"; };
     };
   };
 

nixos/modules/services/web-apps/filesender.md

@@ -9,6 +9,9 @@ FileSender uses [SimpleSAMLphp](https://simplesamlphp.org/) for authentication,
 Minimal working instance of FileSender that uses password-authentication would look like this:
 
 ```nix
+let
+  format = pkgs.formats.php {};
+in
 {
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   services.filesender = {

nixos/modules/services/web-apps/peertube.nix

@@ -355,19 +355,20 @@ in {
           tmp_persistent = lib.mkDefault "/var/lib/peertube/storage/tmp_persistent/";
           bin = lib.mkDefault "/var/lib/peertube/storage/bin/";
           avatars = lib.mkDefault "/var/lib/peertube/storage/avatars/";
+          logs = lib.mkDefault "/var/lib/peertube/storage/logs/";
           web_videos = lib.mkDefault "/var/lib/peertube/storage/web-videos/";
           streaming_playlists = lib.mkDefault "/var/lib/peertube/storage/streaming-playlists/";
+          original_video_files = lib.mkDefault "/var/lib/peertube/storage/original-video-files/";
           redundancy = lib.mkDefault "/var/lib/peertube/storage/redundancy/";
-          logs = lib.mkDefault "/var/lib/peertube/storage/logs/";
-          previews = lib.mkDefault "/var/lib/peertube/storage/previews/";
           thumbnails = lib.mkDefault "/var/lib/peertube/storage/thumbnails/";
           storyboards = lib.mkDefault "/var/lib/peertube/storage/storyboards/";
-          torrents = lib.mkDefault "/var/lib/peertube/storage/torrents/";
+          previews = lib.mkDefault "/var/lib/peertube/storage/previews/";
           captions = lib.mkDefault "/var/lib/peertube/storage/captions/";
+          torrents = lib.mkDefault "/var/lib/peertube/storage/torrents/";
           cache = lib.mkDefault "/var/lib/peertube/storage/cache/";
           plugins = lib.mkDefault "/var/lib/peertube/storage/plugins/";
-          well_known = lib.mkDefault "/var/lib/peertube/storage/well_known/";
           client_overrides = lib.mkDefault "/var/lib/peertube/storage/client-overrides/";
+          well_known = lib.mkDefault "/var/lib/peertube/storage/well_known/";
         };
         import = {
           videos = {
@@ -510,10 +511,20 @@ in {
           '' + nginxCommonHeaders;
         };
 
+        locations."~ ^/api/v1/users/[^/]+/imports/import-resumable$" = {
+          tryFiles = "/dev/null @api";
+          priority = 1130;
+
+          extraConfig = ''
+            client_max_body_size 0;
+            proxy_request_buffering off;
+          '' + nginxCommonHeaders;
+        };
+
         locations."~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$" = {
           tryFiles = "/dev/null @api";
           root = cfg.settings.storage.tmp;
-          priority = 1130;
+          priority = 1140;
 
           extraConfig = ''
             limit_except POST HEAD { deny all; }
@@ -526,7 +537,7 @@ in {
         locations."~ ^/api/v1/runners/jobs/[^/]+/(update|success)$" = {
           tryFiles = "/dev/null @api";
           root = cfg.settings.storage.tmp;
-          priority = 1135;
+          priority = 1150;
 
           extraConfig = ''
             client_max_body_size 12G;
@@ -536,7 +547,7 @@ in {
 
         locations."~ ^/api/v1/(videos|video-playlists|video-channels|users/me)" = {
           tryFiles = "/dev/null @api";
-          priority = 1140;
+          priority = 1160;
 
           extraConfig = ''
             client_max_body_size 6M;
@@ -546,7 +557,7 @@ in {
 
         locations."@api" = {
           proxyPass = "http://peertube";
-          priority = 1150;
+          priority = 1170;
 
           extraConfig = ''
             proxy_set_header Host $host;
@@ -684,8 +695,6 @@ in {
             if ($request_method = 'GET') {
               ${nginxCommonHeaders}
               ${nginxCommonHeadersExtra}
-
-              access_log off;
             }
 
             aio threads;
@@ -721,8 +730,6 @@ in {
             if ($request_method = 'GET') {
               ${nginxCommonHeaders}
               ${nginxCommonHeadersExtra}
-
-              access_log off;
             }
 
             aio threads;
@@ -758,8 +765,6 @@ in {
             if ($request_method = 'GET') {
               ${nginxCommonHeaders}
               ${nginxCommonHeadersExtra}
-
-              access_log off;
             }
 
             aio threads;
@@ -795,8 +800,6 @@ in {
             if ($request_method = 'GET') {
               ${nginxCommonHeaders}
               ${nginxCommonHeadersExtra}
-
-              access_log off;
             }
 
             aio threads;

nixos/modules/services/x11/desktop-managers/deepin.nix

@@ -52,7 +52,6 @@ in
       services.deepin.dde-daemon.enable = mkForce true;
       services.deepin.dde-api.enable = mkForce true;
       services.deepin.app-services.enable = mkForce true;
-      services.deepin.deepin-anything.enable = mkDefault true;
 
       services.colord.enable = mkDefault true;
       services.accounts-daemon.enable = mkDefault true;
@@ -161,37 +160,28 @@ in
             dde-control-center
             dde-network-core
             dde-clipboard
-            dde-calendar
             dde-polkit-agent
             dpa-ext-gnomekeyring
             deepin-desktop-schemas
-            deepin-terminal
             deepin-kwin
             dde-session
             dde-widgets
             dde-appearance
             dde-application-manager
             deepin-service-manager
-            dde-grand-search
             dde-api-proxy
             dde-tray-loader
           ];
           optionalPackages = [
+            dde-calendar
+            dde-grand-search
+            deepin-terminal
             onboard # dde-dock plugin
             deepin-calculator
             deepin-compressor
             deepin-editor
-            deepin-picker
-            deepin-draw
-            deepin-music
-            deepin-movie-reborn
             deepin-system-monitor
             deepin-shortcut-viewer
-            # freeimage has knownVulnerabilties, don't install packages using freeiamge by default
-            # deepin-album
-            # deepin-camera
-            # deepin-image-viewer
-            # deepin-screen-recorder
           ];
         in
         requiredPackages

pkgs/applications/editors/notepadqq/default.nix

@@ -23,6 +23,12 @@ mkDerivation rec {
     sha256 = "sha256-XA9Ay9kJApY+bDeOf0iPv+BWYFuTmIuqsLEPgRTCZCE=";
   };
 
+  patches = [
+    # Fix: chmod in the Makefile fails randomly
+    # Move it to preFixup instead
+    ./fix-configure.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     which
@@ -37,6 +43,8 @@ mkDerivation rec {
     qtwebsockets
   ];
 
+  strictDeps = false; # breaks qmake
+
   preConfigure = ''
     export LRELEASE="lrelease"
   '';
@@ -44,6 +52,7 @@ mkDerivation rec {
   dontWrapQtApps = true;
 
   preFixup = ''
+    chmod +x $out/bin/notepadqq
     wrapQtApp $out/bin/notepadqq
   '';
 

pkgs/applications/editors/notepadqq/fix-configure.patch

@@ -0,0 +1,22 @@
+diff --git a/src/ui/ui.pro b/src/ui/ui.pro
+index a1346eb..f8052a2 100644
+--- a/src/ui/ui.pro
++++ b/src/ui/ui.pro
+@@ -293,16 +293,9 @@ unix:!macx {
+     appstream.path = "$$INSTALL_ROOT$$PREFIX/share/metainfo/"
+     appstream.files += "$$INSTALLFILESDIR/notepadqq.appdata.xml"
+ 
+-    # == Dummy target used to fix permissions at the end of the install ==
+-    # A random path. Without one, qmake refuses to create the rule.
+-    set_permissions.path = "$$INSTALL_ROOT$$PREFIX/bin/"
+-    # We want to keep $$INSTALL_ROOT as a variable in the makefile, so we use $(INSTALL_ROOT)
+-    unix:set_permissions.extra = chmod 755 $(INSTALL_ROOT)\"$$PREFIX/bin/notepadqq\"
+-
+     # MAKE INSTALL
+     INSTALLS += target \
+          icon_h16 icon_h22 icon_h24 icon_h32 icon_h48 icon_h64 icon_h96 icon_h128 icon_h256 icon_h512 icon_hscalable \
+-         misc_data launch shortcuts appstream \
+-         set_permissions
++         misc_data launch shortcuts appstream
+ 
+ }

pkgs/applications/editors/vim/plugins/blink-cmp/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   stdenv,
   vimUtils,
+  nix-update-script,
 }:
 let
   version = "0.6.2";
@@ -17,12 +18,14 @@ let
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
+
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-XXI2jEoD6XbFNk3O8B6+aLzl1ZcJq1VinQXb+AOw8Rw=";
+
     env = {
       # TODO: remove this if plugin stops using nightly rust
       RUSTC_BOOTSTRAP = true;
     };
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-XXI2jEoD6XbFNk3O8B6+aLzl1ZcJq1VinQXb+AOw8Rw=";
   };
 in
 vimUtils.buildVimPlugin {
@@ -32,6 +35,16 @@ vimUtils.buildVimPlugin {
     mkdir -p target/release
     ln -s ${blink-fuzzy-lib}/lib/libblink_cmp_fuzzy.${libExt} target/release/libblink_cmp_fuzzy.${libExt}
   '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "vimPlugins.blink-cmp.blink-fuzzy-lib";
+    };
+
+    # needed for the update script
+    inherit blink-fuzzy-lib;
+  };
+
   meta = {
     description = "Performant, batteries-included completion plugin for Neovim";
     homepage = "https://github.com/saghen/blink.cmp";

pkgs/applications/misc/survex/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "survex";
-  version = "1.4.11";
+  version = "1.4.13";
 
   src = fetchurl {
     url = "https://survex.com/software/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-Q+86sDfU3zYhRhnnO2rfzwmF3CmWPYcIf2VeQctIZ7Y=";
+    hash = "sha256-4ejaOv0rwJRrV8f616D24IjIv5DXVJfY3fSTueiJG3M=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -25,7 +25,7 @@
 , libpcap
 , libsmi
 , libssh
-, lua5
+, lua5_4
 , lz4
 , makeWrapper
 , minizip
@@ -44,7 +44,7 @@
 , speexdsp
 , SystemConfiguration
 , wrapGAppsHook3
-, zlib
+, zlib-ng
 , zstd
 
 , withQt ? true
@@ -57,7 +57,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.2.8";
+  version = "4.4.2";
 
   outputs = [ "out" "dev" ];
 
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-QnBETFkYoeBTQFV8g2c/dZjgCXaMtFi1MQUgmkOool8=";
+    hash = "sha256-qeMaj8kRGG1NlDb5j4M/Za2M2Ohh2qhXbzBtQGjrCSo=";
   };
 
   patches = [
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     libpcap
     libsmi
     libssh
-    lua5
+    lua5_4
     lz4
     minizip
     nghttp2
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
     snappy
     spandsp3
     speexdsp
-    zlib
+    zlib-ng
     zstd
   ] ++ lib.optionals withQt (with qt6; [
     qt5compat

pkgs/applications/networking/sniffers/wireshark/patches/lookup-dumpcap-in-path.patch

@@ -19,19 +19,21 @@ EDITED by esclear for wireshark 4.0
 
 EDITED by paveloom for wireshark 4.2
 
+EDITED by pabloaul for wireshark 4.4
+
 Signed-off-by: Franz Pletz <fpletz@fnordicwalking.de>
 ---
  capture/capture_sync.c | 13 ++++++++++---
  1 file changed, 10 insertions(+), 3 deletions(-)
 
 diff --git a/capture/capture_sync.c b/capture/capture_sync.c
-index 01e9510a27..e439098298 100644
+index 946dc810db..ef0b6e12cd 100644
 --- a/capture/capture_sync.c
 +++ b/capture/capture_sync.c
-@@ -225,8 +225,15 @@ init_pipe_args(int *argc) {
+@@ -243,8 +243,15 @@ init_pipe_args(int *argc) {
      char *exename;
      char **argv;
-
+ 
 -    /* Find the absolute path of the dumpcap executable. */
 -    exename = get_executable_path("dumpcap");
 +    /* NixOS patch: Look for dumpcap in PATH first, because there may be a
@@ -46,14 +48,12 @@ index 01e9510a27..e439098298 100644
      if (exename == NULL) {
          return NULL;
      }
-@@ -533,7 +540,7 @@ sync_pipe_open_command(char* const argv[], int *data_read_fd,
-         dup2(sync_pipe[PIPE_WRITE], 2);
-         ws_close(sync_pipe[PIPE_READ]);
-         ws_close(sync_pipe[PIPE_WRITE]);
+@@ -596,7 +603,7 @@ sync_pipe_open_command(char **argv, int *data_read_fd,
+         snprintf(sync_id, ARGV_NUMBER_LEN, "%d", sync_pipe[PIPE_WRITE]);
+         argv = sync_pipe_add_arg(argv, &argc, sync_id);
+ #endif
 -        execv(argv[0], argv);
 +        execvp(argv[0], argv);
-         sync_pipe_write_int_msg(2, SP_EXEC_FAILED, errno);
-
-         /* Exit with "_exit()", so that we don't close the connection
---
-2.42.0
+         sync_pipe_write_int_msg(sync_pipe[PIPE_WRITE], SP_EXEC_FAILED, errno);
+ 
+         /* Exit with "_exit()", so that we don't close the connection

pkgs/applications/virtualization/virt-manager/default.nix

@@ -21,6 +21,7 @@
   xorriso,
   spiceSupport ? true,
   spice-gtk ? null,
+  gst_all_1 ? null,
 }:
 
 let
@@ -57,18 +58,23 @@ stdenv.mkDerivation rec {
     pkg-config
   ] ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
 
-  buildInputs = [
-    python3
-    libvirt-glib
-    vte
-    dconf
-    gtk-vnc
-    adwaita-icon-theme
-    gsettings-desktop-schemas
-    libosinfo
-    gtksourceview4
-  ] ++ lib.optional spiceSupport spice-gtk;
-
+  buildInputs =
+    [
+      python3
+      libvirt-glib
+      vte
+      dconf
+      gtk-vnc
+      adwaita-icon-theme
+      gsettings-desktop-schemas
+      libosinfo
+      gtksourceview4
+    ]
+    ++ lib.optionals spiceSupport [
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-good
+      spice-gtk
+    ];
   preFixup = ''
     glib-compile-schemas $out/share/gsettings-schemas/${pname}-${version}/glib-2.0/schemas
 

pkgs/build-support/rust/build-rust-package/default.nix

@@ -30,6 +30,7 @@
 , cargoPatches ? []
 , patches ? []
 , sourceRoot ? null
+, cargoRoot ? null
 , logLevel ? ""
 , buildInputs ? []
 , nativeBuildInputs ? []
@@ -72,13 +73,13 @@ let
     else if cargoDeps != null then cargoDeps
     else if cargoLock != null then importCargoLock cargoLock
     else if useFetchCargoVendor then fetchCargoVendor ({
-      inherit src srcs sourceRoot preUnpack unpackPhase postUnpack;
+      inherit src srcs sourceRoot cargoRoot preUnpack unpackPhase postUnpack;
       name = cargoDepsName;
       patches = cargoPatches;
       hash = args.cargoHash;
     } // depsExtraArgs)
     else fetchCargoTarball ({
-      inherit src srcs sourceRoot preUnpack unpackPhase postUnpack cargoUpdateHook;
+      inherit src srcs sourceRoot cargoRoot preUnpack unpackPhase postUnpack cargoUpdateHook;
       name = cargoDepsName;
       patches = cargoPatches;
     } // lib.optionalAttrs (args ? cargoHash) {

pkgs/build-support/rust/fetch-cargo-tarball/default.nix

@@ -85,6 +85,10 @@ stdenv.mkDerivation (
       # Ensure deterministic Cargo vendor builds
       export SOURCE_DATE_EPOCH=1
 
+      if [ -n "''${cargoRoot-}" ]; then
+        cd "$cargoRoot"
+      fi
+
       if [[ ! -f Cargo.lock ]]; then
           echo
           echo "ERROR: The Cargo.lock file doesn't exist"

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -62,6 +62,10 @@ let
       buildPhase = ''
         runHook preBuild
 
+        if [ -n "''${cargoRoot-}" ]; then
+          cd "$cargoRoot"
+        fi
+
         fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild

pkgs/by-name/as/asnmap/package.nix

@@ -1,6 +1,7 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {
@@ -26,10 +27,10 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Tool to gather network ranges using ASN information";
-    mainProgram = "asnmap";
     homepage = "https://github.com/projectdiscovery/asnmap";
     changelog = "https://github.com/projectdiscovery/asnmap/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "asnmap";
   };
 }

pkgs/by-name/bd/bdf2psf/package.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.230";
+  version = "1.232";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "sha256-W7eFrzuDcjm9P2hAP7+u9YPIhCqF3pbWb9+ynmKjs5M=";
+    sha256 = "sha256-+C3t/W/mXJacF0d5Yk325TpZm8A3Qhno0ZyJUGjhU8U=";
   };
 
   nativeBuildInputs = [ dpkg ];

pkgs/by-name/ch/check-jsonschema/package.nix

@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.29.2";
+  version = "0.29.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -13,7 +13,7 @@ buildPythonApplication rec {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z/v/a0zENH8K1NHCZViLBbc8gma5rTMBm8hatHhu878=";
+    hash = "sha256-JSz8zwiOnX3nuKypffe0wZ7YoZ7uHH/lAoUgdKfkEO8=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/co/conda/package.nix

@@ -64,7 +64,8 @@ let
         '');
 in
   buildFHSEnv {
-    name = "conda-shell";
+    pname = "conda-shell";
+    inherit version;
     targetPkgs = pkgs: (builtins.concatLists [ [ conda ] condaDeps extraPkgs]);
     profile = ''
       # Add conda to PATH

pkgs/by-name/cr/credslayer/package.nix

@@ -55,5 +55,8 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/ShellCode33/CredSLayer";
     license = with licenses; [ gpl3Only ];
     maintainers = with maintainers; [ fab ];
+    # broken due to wireshark 4.4 bump
+    # see: https://github.com/NixOS/nixpkgs/pull/344914
+    broken = true;
   };
 }

pkgs/by-name/dn/dnsx/package.nix

@@ -1,6 +1,8 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
@@ -16,9 +18,22 @@ buildGoModule rec {
 
   vendorHash = "sha256-WbFkBTPy4N+mAVSkq1q9XcNs1jk6YuBcYxiEmQV/TsM=";
 
+  subPackages = [ "cmd/dnsx" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
   # Tests require network access
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-version" ];
+
   meta = with lib; {
     description = "Fast and multi-purpose DNS toolkit";
     longDescription = ''
@@ -31,5 +46,6 @@ buildGoModule rec {
     changelog = "https://github.com/projectdiscovery/dnsx/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "dnsx";
   };
 }

pkgs/by-name/en/en-croissant/package.nix

@@ -34,16 +34,11 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tauri-plugin-log-0.0.0" = "sha256-t+zmMMSnD9ASZZvqlhu1ah2OjCUtRXdk/xaI37uI49c=";
-      "vampirc-uci-0.11.1" = "sha256-g2JjHZoAmmZ7xsw4YnkUPRXJxsYmBqflWxCFkFEvMXQ=";
-    };
-  };
-
   cargoRoot = "src-tauri";
 
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-6cBGOdJ7jz+mOl2EEXxoLNeX9meW+ybQxAxnnHAplIc=";
+
   buildAndTestSubdir = cargoRoot;
 
   nativeBuildInputs =

pkgs/by-name/fd/fdroidserver/package.nix

@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "2.3a2";
+  version = "2.3.1";
 in
 python3Packages.buildPythonApplication {
   pname = "fdroidserver";
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication {
     owner = "fdroid";
     repo = "fdroidserver";
     rev = version;
-    hash = "sha256-nsAFBZqxo4XVWU6nBjo2T6VhU8U4I8h/FRXd1L240rk=";
+    hash = "sha256-1jJwKvxm33Hge35dhqy5HgXzyokj8a2XhWvCmScj5bA=";
   };
 
   pythonRelaxDeps = [
@@ -30,6 +30,10 @@ python3Packages.buildPythonApplication {
     "pyasn1-modules"
   ];
 
+  pythonRemoveDeps = [
+    "puremagic" # Only used as a fallback when magic is not installed
+  ];
+
   postPatch = ''
     substituteInPlace fdroidserver/common.py \
       --replace-fail "FDROID_PATH = os.path.realpath(os.path.join(os.path.dirname(__file__), '..'))" "FDROID_PATH = '$out/bin'"
@@ -55,16 +59,18 @@ python3Packages.buildPythonApplication {
 
   dependencies = with python3Packages; [
     androguard
-    platformdirs
+    biplist
     clint
     defusedxml
     gitpython
     libcloud
     libvirt
+    magic
     mwclient
     oscrypto
     paramiko
     pillow
+    platformdirs
     pyasn1
     pyasn1-modules
     pycountry

pkgs/by-name/gr/grpcurl/package.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "grpcurl";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = "grpcurl";
     rev = "v${version}";
-    sha256 = "sha256-OVlFOZD4+ZXRKl0Q0Dh5Etij/zeB1jTGoY8n13AyLa4=";
+    sha256 = "sha256-0AnQxEe9jo8R++ALamTkgpaauvDaH4CaHgmwLyBTr3w=";
   };
 
   subPackages = [ "cmd/grpcurl" ];
 
-  vendorHash = "sha256-KsPrJC4hGrGEny8wVWE1EG00qn+b1Rrvh4qK27VzgLU=";
+  vendorHash = "sha256-e/V6MMYGqhZ2Ei7+2XhSsCXJNiwsTPa2Q43rdkns45o=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 

pkgs/by-name/ha/handheld-daemon/package.nix

@@ -5,17 +5,18 @@
   lib,
   python3,
   toybox,
+  lsof
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "handheld-daemon";
-  version = "3.4.1";
+  version = "3.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hhd-dev";
     repo = "hhd";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hup9G4pTlTl68zLzhaDmH7nV8fp/I94Nuis68B8K2wY=";
+    hash = "sha256-IdpSRb66G+WzTv/BC29r2OjO1b4VdWbV6OSzOoiFAO0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -27,6 +28,8 @@ python3.pkgs.buildPythonApplication rec {
     setuptools
     toybox
     xlib
+    pyserial
+    lsof
   ];
 
   # This package doesn't have upstream tests.
@@ -46,6 +49,7 @@ python3.pkgs.buildPythonApplication rec {
 
   postInstall = ''
     install -Dm644 $src/usr/lib/udev/rules.d/83-hhd.rules -t $out/lib/udev/rules.d/
+    install -Dm644 $src/usr/lib/udev/hwdb.d/83-hhd.hwdb -t $out/lib/udev/hwdb.d/
   '';
 
   meta = with lib; {

pkgs/by-name/ht/httpx/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
@@ -19,6 +20,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/httpx" ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   ldflags = [
     "-s"
     "-w"
@@ -27,6 +30,10 @@ buildGoModule rec {
   # Tests require network access
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-version" ];
+
   meta = with lib; {
     description = "Fast and multi-purpose HTTP toolkit";
     longDescription = ''

pkgs/by-name/ku/kubescape/package.nix

@@ -4,28 +4,30 @@
   fetchFromGitHub,
   git,
   installShellFiles,
-  kubescape,
-  testers,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "3.0.19";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kEbCBXefnQO2gJ3kCxP1wLVmQl73E5mXGBza/iR4ioM=";
+    hash = "sha256-8Reg49X+3wzE2FJVkTA8T3VN0Ph3ToSXAeMAc2b5rYk=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-sywkDpqEHozqcmUOQuxYpM1YJfJKInpEcrysp8eB9Bw=";
+  vendorHash = "sha256-+DmElfOZcSnGaxEj4Ca1ysIb1M7N0kxtJx8+TXFOREY=";
 
   subPackages = [ "." ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ];
 
   nativeCheckInputs = [ git ];
 
@@ -62,11 +64,9 @@ buildGoModule rec {
       --zsh <($out/bin/kubescape completion zsh)
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = kubescape;
-    command = "kubescape version";
-    version = "v${version}";
-  };
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "version" ];
 
   meta = with lib; {
     description = "Tool for testing if Kubernetes is deployed securely";

pkgs/by-name/me/mediawriter/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawriter";
-  version = "5.2.0";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "MediaWriter";
     rev = "refs/tags/${version}";
-    hash = "sha256-IUV6rOVPcJ65xVg/BajAJzK3cskK1cuGTHSl+RJV6ic=";
+    hash = "sha256-L0rdZrCwgIULkcDacs3mwJ8Blccfxw/atFvJQt2z5r4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/mouse-actions-gui/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
 
   npmHooks,
@@ -8,8 +7,6 @@
   nodejs,
 
   rustPlatform,
-  cargo,
-  rustc,
   cargo-tauri_1,
 
   pkg-config,
@@ -21,25 +18,22 @@
   webkitgtk_4_0,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage rec {
   pname = "mouse-actions-gui";
   version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "jersou";
     repo = "mouse-actions";
-    rev = "refs/tags/v${finalAttrs.version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-44F4CdsDHuN2FuijnpfmoFy4a/eAbYOoBYijl9mOctg=";
   };
 
-  sourceRoot = "${finalAttrs.src.name}/config-editor";
+  sourceRoot = "${src.name}/config-editor";
 
   nativeBuildInputs = [
     npmHooks.npmConfigHook
     nodejs
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
     cargo-tauri_1.hook
     pkg-config
     wrapGAppsHook3
@@ -57,25 +51,21 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) src sourceRoot;
+    inherit src sourceRoot;
     hash = "sha256-amDTYAvEoDHb7+dg39+lUne0dv0M9vVe1vHoXk2agZA=";
   };
 
   cargoRoot = "src-tauri";
-  buildAndTestSubdir = finalAttrs.cargoRoot;
+  buildAndTestSubdir = cargoRoot;
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit (finalAttrs) pname version src;
-    sourceRoot = "${finalAttrs.sourceRoot}/${finalAttrs.cargoRoot}";
-    hash = "sha256-H8TMpYFJWp227jPA5H2ZhSqTMiT/U6pT6eLyjibuoLU=";
-  };
+  cargoHash = "sha256-H8TMpYFJWp227jPA5H2ZhSqTMiT/U6pT6eLyjibuoLU=";
 
   postInstall = ''
     install -Dm644 ${./80-mouse-actions.rules} $out/etc/udev/rules.d/80-mouse-actions.rules
   '';
 
   meta = {
-    changelog = "https://github.com/jersou/mouse-actions/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/jersou/mouse-actions/blob/${src.rev}/CHANGELOG.md";
     description = "Mouse event based command executor, a mix between Easystroke and Comiz edge commands";
     homepage = "https://github.com/jersou/mouse-actions";
     license = lib.licenses.mit;
@@ -83,4 +73,4 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ tomasajt ];
     platforms = lib.platforms.linux;
   };
-})
+}

pkgs/by-name/mu/mujoco/package.nix

@@ -23,8 +23,8 @@ let
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "7c8ed6b082aa3c7a3402f18e50da4480421d08fd";
-      hash = "sha256-xX3o4wX7RUvw1x2gOlT6sGhutDYLBZ/JzFnv68qN6E8=";
+      rev = "24e0bd827a8bec8121b128b0634cb34402fb3259";
+      hash = "sha256-h3QllJC/tiUzl5UlGCTIoDuDcKG6J538MCY2Pqe2IOE=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -35,8 +35,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "b396a6fbb2e173f52edb3360485dedf3389ef830";
-      hash = "sha256-UroGjERR5TW9KbyLwR/NBpytXrW1tHfu6ZvQPngROq4=";
+      rev = "d34b100c137ac931379ae5e1b888f16a9c8d6c72";
+      hash = "sha256-GYjENtobSWCJqRw2GJbxAJDZSdyBNqWkobn2Vm5H53Q=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -131,7 +131,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mujoco";
-  version = "3.2.5";
+  version = "3.2.6";
 
   # Bumping version? Make sure to look though the MuJoCo's commit
   # history for bumped dependency pins!
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
     owner = "google-deepmind";
     repo = "mujoco";
     rev = "refs/tags/${version}";
-    hash = "sha256-MyQL/WV8ehH7nYNlB/H5DgSrOrd252I6GFV2KLeef5g=";
+    hash = "sha256-n1H9e+GMqHYsimypF7AiVzHC2dXkL+4FWDEHB5B2ZIE=";
   };
 
   patches = [ ./mujoco-system-deps-dont-fetch.patch ];

pkgs/by-name/na/naabu/package.nix

@@ -1,40 +1,41 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, libpcap
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  libpcap,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zGZpXnMQ8KvY4oBn0729WmG80AQ4748Gz6UO/+O8i3o=";
+    hash = "sha256-ffE/PlLUH2qO4QJpSGHmEh7/ghputTCnTYplzP+Umw0=";
   };
 
-  vendorHash = "sha256-Mcp3sfaCNTsBOiDYn3iVolSd9cK2LAGNscoUtYhsRkA=";
+  vendorHash = "sha256-YSE6WQkq47A+D9ff3UHbc0Kdik9b4KjRpwYWkXDD5zA=";
 
-  buildInputs = [
-    libpcap
-  ];
+  buildInputs = [ libpcap ];
 
-  modRoot = "./v2";
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
-  subPackages = [
-    "cmd/naabu/"
-  ];
+  subPackages = [ "cmd/naabu/" ];
 
   ldflags = [
     "-w"
     "-s"
   ];
 
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-version" ];
+
   meta = with lib; {
     description = "Fast SYN/CONNECT port scanner";
-    mainProgram = "naabu";
     longDescription = ''
       Naabu is a port scanning tool written in Go that allows you to enumerate
       valid ports for hosts in a fast and reliable manner. It is a really simple
@@ -45,5 +46,6 @@ buildGoModule rec {
     changelog = "https://github.com/projectdiscovery/naabu/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "naabu";
   };
 }

pkgs/by-name/nu/nuclei/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
@@ -16,10 +17,13 @@ buildGoModule rec {
   };
 
   vendorHash = "sha256-lxqVNhA8/iMx31Bbp4rIHVrh3nUARlxY2KDcCxOtO+I=";
+
   proxyVendor = true; # hash mismatch between Linux and Darwin
 
   subPackages = [ "cmd/nuclei/" ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   ldflags = [
     "-w"
     "-s"
@@ -28,6 +32,10 @@ buildGoModule rec {
   # Test files are not part of the release tarball
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-version" ];
+
   meta = with lib; {
     description = "Tool for configurable targeted scanning";
     longDescription = ''

pkgs/by-name/op/open-webui/package.nix

@@ -81,6 +81,7 @@ python312.pkgs.buildPythonApplication rec {
     docx2txt
     duckduckgo-search
     einops
+    emoji # This dependency is missing in upstream's pyproject.toml
     extract-msg
     fake-useragent
     fastapi

pkgs/by-name/os/osm2pgsql/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osm2pgsql";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "osm2pgsql-dev";
     repo = "osm2pgsql";
     rev = finalAttrs.version;
-    hash = "sha256-YtG/cwEyCIsNjoEhDikMoI/SUqx8fEtPuolpNkLGTlE=";
+    hash = "sha256-+EFvYloLm/cDOflqj6ZIgjFoljKhYBVIKxD8L9j2Hj4=";
   };
 
   postPatch = ''
@@ -64,17 +64,15 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_LUAJIT" withLuaJIT)
   ];
 
-  installFlags = [ "install-gen" ];
-
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;
   };
 
-  meta = with lib; {
+  meta = {
     description = "OpenStreetMap data to PostgreSQL converter";
     homepage = "https://osm2pgsql.org";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; teams.geospatial.members ++ [ jglukasik das-g ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = lib.teams.geospatial.members ++ (with lib.maintainers; [ jglukasik das-g ]);
   };
 })

pkgs/by-name/pi/pizauth/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pizauth";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "ltratt";
     repo = "pizauth";
     rev = "refs/tags/pizauth-${version}";
-    hash = "sha256-9NezG644oCLTWHTdUaUpJbuwkJu3at/IGNH3FSxl/DI=";
+    hash = "sha256-x3LdutVrQFrkXvbGPVzBV7Y8P9okKgv2rh2YdnDXvsc=";
   };
 
-  cargoHash = "sha256-Lp5ovkQKShgT7EFvQ+5KE3eQWJEQAL68Bk1d+wUo+bc=";
+  cargoHash = "sha256-moRr8usrFHE8YPQnsmeKoDZPAk94qRm9cHzHBLXtGFM=";
 
   # pizauth cannot be built with default apple-sdk_10 on x86_64-darwin, pin to 11
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;

pkgs/by-name/tk/tkrzw/package.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "tkrzw";
-  version = "1.0.31";
+  version = "1.0.32";
   # TODO: defeat multi-output reference cycles
 
   src = fetchurl {
     url = "https://dbmx.net/tkrzw/pkg/tkrzw-${version}.tar.gz";
-    hash = "sha256-7FdHglIBTHGKRt66WNTGEe5qUcrIyTYPrnuVrUc8l08=";
+    hash = "sha256-00BN+saJhjK2l4DA8JlMX2upYhkaYcmw9LU7qLsncxw=";
   };
 
   postPatch = ''

pkgs/by-name/tl/tlsx/package.nix

@@ -1,6 +1,7 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
 
 buildGoModule rec {

pkgs/by-name/un/uncover/package.nix

@@ -1,6 +1,8 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
@@ -9,13 +11,26 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
-    repo = pname;
+    repo = "uncover";
     rev = "refs/tags/v${version}";
     hash = "sha256-avGbawIeh7ZUtacRLo/tLz4D6U7JAlu9BXDYu/xvoa0=";
   };
 
   vendorHash = "sha256-93iXho+WCQyhw9DoLgo9ZKiPrd88D2ibgp1M9uP7bUU=";
 
+  subPackages = [ "cmd/uncover" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-version" ];
+
   meta = with lib; {
     description = "API wrapper to search for exposed hosts";
     longDescription = ''
@@ -28,5 +43,6 @@ buildGoModule rec {
     changelog = "https://github.com/projectdiscovery/uncover/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "uncover";
   };
 }

pkgs/by-name/un/unison-ucm/package.nix

@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unison-code-manager";
-  version = "0.5.28";
+  version = "0.5.29";
 
   src = {
     aarch64-darwin = fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-arm64.tar.gz";
-      hash = "sha256-kU+DqYUYQKbsi5P26rLkf8eYEXJAlw+kKd4OwZ2OO0A=";
+      hash = "sha256-iSyhPCn8+u/kKW1NVorUaRXaP0Q771m6G1ICsHp1/Rs=";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-x64.tar.gz";
-      hash = "sha256-la1xu8FUHg//3o0w+ihdkrqC4+TWeCBfZQs3uKI+ytA=";
+      hash = "sha256-Rukx1I67jq78xvDB7eYP6TvZZBZtWisOv2WZe6/KlHE=";
     };
     x86_64-linux = fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux-x64.tar.gz";
-      hash = "sha256-Axw1qgnZ3ypQfpw7ftH/LzB1SbTx+xL56hq3AtsGqko=";
+      hash = "sha256-fVsKPTi9j+LVWDPhuHYb7NKD2JXJz7nRE6yuE7rQ3e0=";
     };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
 

pkgs/by-name/vi/visual-hexdiff/package.nix

@@ -0,0 +1,57 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchpatch,
+  ncurses,
+}:
+stdenv.mkDerivation {
+  pname = "visual-hexdiff";
+  version = "0.0.53";
+
+  src = fetchurl {
+    url = "mirror://ubuntu/pool/universe/h/hexdiff/hexdiff_0.0.53.orig.tar.gz";
+    hash = "sha256-M1bmkW63pHlfl9zNWEq0EGN1rpVGo+BTUKM9ot4HWqo=";
+  };
+
+  patches = [
+    # Some changes the debian/ubuntu developers made over the original source code
+    # See https://changelogs.ubuntu.com/changelogs/pool/universe/h/hexdiff/hexdiff_0.0.53-0ubuntu4/changelog
+    (fetchpatch {
+      url = "mirror://ubuntu/pool/universe/h/hexdiff/hexdiff_0.0.53-0ubuntu4.diff.gz";
+      sha256 = "sha256-X5ONNp9jeACxsulyowDQJ6REX6bty6L4in0/+rq8Wz4=";
+      decode = "gunzip --stdout";
+      name = "hexdiff_0.0.53-0ubuntu4.diff";
+      stripLen = 1;
+    })
+  ];
+
+  postPatch =
+    ''
+      # Fix compiler error that wants a string literal as format string for `wprintw`
+      substituteInPlace sel_file.c \
+        --replace-fail 'wprintw(win, txt_aide_fs[foo]);' 'wprintw(win, "%s", txt_aide_fs[foo]);'
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Fix compiler error on Darwin: conflicting types for 'strdup'
+      substituteInPlace sel_file.c \
+        --replace-fail 'char *strdup(char *);' ' '
+    '';
+
+  buildInputs = [ ncurses ];
+
+  preInstall = ''
+    mkdir -p $out/bin/
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "Visual hexadecimal difference editor";
+    homepage = "http://tboudet.free.fr/hexdiff/";
+    license = licenses.wtfpl;
+    maintainers = with maintainers; [ erictapen ];
+    mainProgram = "hexdiff";
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/wa/wapiti/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "wapiti";
-  version = "3.2.1";
+  version = "3.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wapiti-scanner";
     repo = "wapiti";
     rev = "refs/tags/${version}";
-    hash = "sha256-28PGdaOhFz9onw3yFHtCbAxLmh7q0VLGNuyI1wcKLRQ=";
+    hash = "sha256-sa4bXZiY5yd0wynUjdLnuuX7Ee0w4APd1G/oGy5AUDk=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/ze/zed-editor/package.nix

@@ -90,13 +90,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "zed-editor";
-  version = "0.163.2";
+  version = "0.163.3";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bt6xbtkBYBuZW7hQ40UZwOjZJ7tqc9xL6XTvaD3KQjs=";
+    hash = "sha256-AkfMAGkxo4ZQVqR+8T9IgBMXvSyFd15jU5hCoAWDk0A=";
   };
 
   patches =
@@ -118,7 +118,7 @@ rustPlatform.buildRustPackage rec {
     ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QvvuVyPc+8Km8psdLQFc4PnSWFZsfkKuxzRK17HjEvE=";
+  cargoHash = "sha256-Ol7GPWACb8jGhki3rlLxNw3486+LOR2fyh7qVXWkGJ0=";
 
   nativeBuildInputs =
     [

pkgs/development/libraries/hunspell/dictionaries.nix

@@ -846,6 +846,18 @@ rec {
     };
   };
 
+  /* INDONESIA */
+
+  id_ID = id_id;
+  id_id = mkDictFromLibreOffice {
+    shortName = "id-id";
+    dictFileName = "id_ID";
+    sourceRoot = "id";
+    shortDescription = "Bahasa Indonesia (Indonesia)";
+    readmeFile = "README-dict.md";
+    license = with lib.licenses; [ lgpl21Only lgpl3Only ];
+  };
+
   /* CROATIAN */
 
   hr_HR = hr-hr;

pkgs/development/python-modules/aioopenexchangerates/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioopenexchangerates";
-  version = "0.6.16";
+  version = "0.6.17";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0uVOvUrBSfvD6ZU3vyuJlF3Ek9nMhvVLR5vDVyq5jbg=";
+    hash = "sha256-TxYmj5OS9x50QxAOwsFMbM15bhrHTmBTEsRlFoG3Kyc=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];

pkgs/development/python-modules/aiortm/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.9.37";
+  version = "0.9.38";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiortm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZjpuUjUNcAw9G911q3koYB17iFhsylA+RuqpOGUSAEQ=";
+    hash = "sha256-Qc972Pl+XdgWukgEpTBhsidPvbcPPPWOkqQk24x2ugo=";
   };
 
   pythonRelaxDeps = [ "typer" ];

pkgs/development/python-modules/bc-detect-secrets/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.27";
+  version = "1.5.28";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     rev = "refs/tags/${version}";
-    hash = "sha256-nfqJTiQpyX3qsmhGXgE91895P+eGBZApDL7EKT/36hQ=";
+    hash = "sha256-lj99lcvrbBTfOu87D6LhG7Kos8SIH06tHlTuM6t1kaE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.35.71";
+  version = "1.35.72";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-UOIPp0JIyWs+NJiy2BOIWFWD44ufBgnS+lglfknJhqU=";
+    hash = "sha256-mKCERaYFYGUNjV0etGTuvACfTOTcdhPU4HKjS6uXNgw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.35.71";
+  version = "1.35.72";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-xfcgiyCuGUAPpz61aQF/HjcpkPelUFpyEW7WQgkE9mY=";
+    hash = "sha256-bdIERxT6J4JNSbSejnjNlR9Eo8w8vcSBFNgac7e+DTI=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/dbus-next/default.nix

@@ -33,6 +33,9 @@ buildPythonPackage rec {
     pytest-timeout
   ];
 
+  # Tests are flaky and upstream is no longer active
+  doCheck = false;
+
   # test_peer_interface hits a timeout
   # test_tcp_connection_with_forwarding fails due to dbus
   # creating unix socket anyway on v1.14.4
@@ -49,6 +52,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/altdesktop/python-dbus-next";
     changelog = "https://github.com/altdesktop/python-dbus-next/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ sfrijters ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/dvc/default.nix

@@ -57,7 +57,7 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.57.0";
+  version = "3.58.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -66,7 +66,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-2d/soNyOkeNdv4aXrvtfDFCdedT74kkWUlrp0k5skEM=";
+    hash = "sha256-ljrQV+Ca0EooCdoEU1B2mnN62bpKV0ZGnX8W1yZWyjM=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/holidays/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.61";
+  version = "0.62";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F4oVSGHfts/ETyGax2tEdi35QjUt5g8HGCt2iw6Csvk=";
+    hash = "sha256-t0+kphN1pWmy0F9XzV/d5GVswcEu+a0R0gJIVrdj3qU=";
   };
 
   build-system = [

pkgs/development/python-modules/mujoco/default.nix

@@ -37,7 +37,7 @@ buildPythonPackage rec {
   # in the project's CI.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CJHREBSY5zft9UsKmniB0P4sGKSls1cUDdl1TZE2rUM=";
+    hash = "sha256-kl7+5cMvaAaILEARKs5KPtdLE7Kv8J7NddZnj6oLwk8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/mypy-boto3-builder/default.nix

@@ -13,24 +13,27 @@
   pip,
   poetry-core,
   pyparsing,
+  pytest-mock,
   pytestCheckHook,
   pythonOlder,
+  requests-mock,
+  ruff,
   setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.26.1";
+  version = "8.5.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-BuJ94E9GFGOD7gD5T1Sxchxye3REr2n3wzI0+jGMPuA=";
+    hash = "sha256-ipi31Kbh7GdKQl7PzvR4tSWzjjHogrpHPPgzn8V/RTc=";
   };
 
   build-system = [ poetry-core ];
@@ -46,11 +49,16 @@ buildPythonPackage rec {
     newversion
     pip
     pyparsing
+    ruff
     setuptools
     typing-extensions
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytest-mock
+    requests-mock
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "mypy_boto3_builder" ];
 

pkgs/development/python-modules/netdata/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "netdata";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "home-assistant-ecosystem";
     repo = "python-netdata";
     rev = "refs/tags/${version}";
-    hash = "sha256-ViiGh5CsRpMJ6zvPmje+eB5LuO6t47bjObaYh5a2Kw8=";
+    hash = "sha256-Et9T/+xonHSXjGQabgizW4pVBIYpTz0flud+vlfBNQE=";
   };
 
   nativeBuildInputs = [ poetry-core ];

pkgs/development/python-modules/policy-sentry/default.nix

@@ -15,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "policy-sentry";
-  version = "0.13.1";
+  version = "0.13.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "salesforce";
     repo = "policy_sentry";
     rev = "refs/tags/${version}";
-    hash = "sha256-OUe6NAz4w9/OXWQg4W+TmEI5qiSdEp+/tspQnIISTnc=";
+    hash = "sha256-J6dLKmfZJSU9k64PzOAOTgYvRf9NCpWtYuFEUxrfT5M=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyexploitdb/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.56";
+  version = "0.2.57";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-HyD5oh16kFcx9QUuP4ZhJmpfsfu7miPCzDouzEh7xKI=";
+    hash = "sha256-ZgwhM/UKKGkfUk1a3YcSRVS3WIWjGRWzJHqgOaQ+DK8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyezviz/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pyezviz";
-  version = "0.2.2.4";
+  version = "0.2.2.4a";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "baqs";
     repo = "pyEzviz";
     rev = "refs/tags/${version}";
-    hash = "sha256-ngQu9g0qvJ3zDaTdGqJDGRoMhnGYdp5jHDoPiuXOwGs=";
+    hash = "sha256-OgDplQ6TrK2CZbNgJpoYC8TkK1sG73HdpUyHE+2ZTLk=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyshark/default.nix

@@ -4,6 +4,7 @@
   appdirs,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   lxml,
   packaging,
   py,
@@ -30,6 +31,14 @@ buildPythonPackage rec {
   # `stripLen` does not seem to work here
   patchFlags = [ "-p2" ];
 
+  patches = [
+    # fixes capture test
+    (fetchpatch {
+      url = "https://github.com/KimiNewt/pyshark/commit/7142c5bf88abcd4c65c81052a00226d6155dda42.patch";
+      hash = "sha256-Ti7cwRyYSbF4a4pEEV9FntNevkV/JVXNqACQWzoma7g=";
+    })
+  ];
+
   sourceRoot = "${src.name}/src";
 
   # propagate wireshark, so pyshark can find it when used

pkgs/development/python-modules/pytado/default.nix

@@ -1,41 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pytestCheckHook,
-  requests,
-  pythonOlder,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "pytado";
-  version = "0.17.7";
-  pyproject = true;
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "wmalgadey";
-    repo = "PyTado";
-    rev = "refs/tags/${version}";
-    hash = "sha256-WpGznYNVpis1pM9PRXHnQVev3JW6baUT5J9iPxwd0Uk=";
-  };
-
-  nativeBuildInputs = [ setuptools ];
-
-  propagatedBuildInputs = [ requests ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "PyTado" ];
-
-  meta = with lib; {
-    description = "Python binding for Tado web API";
-    mainProgram = "pytado";
-    homepage = "https://github.com/wmalgadey/PyTado";
-    changelog = "https://github.com/wmalgadey/PyTado/releases/tag/${version}";
-    license = licenses.gpl3Only;
-    maintainers = [ ];
-  };
-}

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1274";
+  version = "3.0.1275";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-TVslzZzLzs1B3WBoJVlyNbBj03c5q0YdtGIfxZ25Z2c=";
+    hash = "sha256-Etm3SESxpQWvI3nsrch4UeAchHnJufOFdAXm+2H3Xa4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/build-managers/scala-cli/sources.json

@@ -1,21 +1,21 @@
 {
-  "version": "1.5.1",
+  "version": "1.5.4",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "0cb7g5vzwbdcyndfg6i8aavmvxis444sz5kza228cyj9w4ydffv6"
+      "sha256": "sha256-DnaNaBeNbCB5f2ul9YyJ5GCYmFX6588j04UTIeJFz6M="
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "0kmz4nxpcn7ms60d28xjx5h1af8ygibw89mip7mcbmrcapbm3kcv"
+      "sha256": "sha256-UZ7VTxfCatPsUdynohTGnxTOZiBJ07NXXULPBPT00YU="
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1v7sah8fs87vq5a10812l78prkn34bwbrywfjqsv5180hzlpck3w"
+      "sha256": "sha256-lLyfOWhrxGfUp3puwg01Cs4pIIfDCz+HGxvQ/MtnLYc="
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "0rj75q3nmh7wry7apii5yirxdsgrq1lhwmylakck1gn9wqnbc53s"
+      "sha256": "sha256-V8EqA60n7CxOlJ9FH27klfO8GCXwVw7oYtQ+Qg/zoMU="
     }
   }
 }

pkgs/os-specific/linux/busybox/sandbox-shell.nix

@@ -1,12 +1,10 @@
 { lib, stdenv, busybox, musl }:
 
 # Minimal shell for use as basic /bin/sh in sandbox builds
-busybox.override {
+busybox.override ({
   enableStatic = true;
   enableMinimal = true;
 
-  useMusl = stdenv.hostPlatform.isGnu && lib.meta.availableOn stdenv.hostPlatform musl;
-
   extraConfig = ''
     CONFIG_FEATURE_FANCY_ECHO y
     CONFIG_FEATURE_SH_MATH y
@@ -26,4 +24,6 @@ busybox.override {
     CONFIG_ASH_PRINTF y
     CONFIG_ASH_TEST y
   '';
-}
+} // lib.optionalAttrs (stdenv.hostPlatform.isGnu && lib.meta.availableOn stdenv.hostPlatform musl) {
+  useMusl = true;
+})

pkgs/servers/peertube/default.nix

@@ -46,33 +46,33 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peertube";
-  version = "6.0.4";
+  version = "6.3.3";
 
   src = fetchFromGitHub {
     owner = "Chocobozzz";
     repo = "PeerTube";
-    rev = "v${version}";
-    hash = "sha256-FxXIvibwdRcv8OaTQEXiM6CvWOIptfQXDQ1/PW910wg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kPZcCJtnoqE1g0fAuM98IhuDy1E9QBDkFNWrWIpFIDA=";
   };
 
   yarnOfflineCacheServer = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-RJX92EgEIXWB1wNFRl8FvseOqBT+7m6gs+pMyoodruk=";
+    hash = "sha256-I6TC5KO+NQ0NAtoJzYQPLelp8/hYUtIeof+UI45qpdk=";
   };
 
   yarnOfflineCacheClient = fetchYarnDeps {
     yarnLock = "${src}/client/yarn.lock";
-    hash = "sha256-vr9xn5NXwiUS59Kgl8olCtkMgxnI1TKQzibKbb8RNXA=";
+    hash = "sha256-ADck9+5TDZ3OGInZ+NYYpBg9XXHugtiwyxYCYqSIOzM=";
   };
 
   yarnOfflineCacheAppsCli = fetchYarnDeps {
     yarnLock = "${src}/apps/peertube-cli/yarn.lock";
-    hash = "sha256-xsB71bnaPn/9/f1KHyU3TTwx+Q+1dLjWmNK2aVJgoRY=";
+    hash = "sha256-t5MwysPVLbtIfDhvnwWoGocck1ntP8OP9Vf9DF6L7Cg=";
   };
 
   yarnOfflineCacheAppsRunner = fetchYarnDeps {
     yarnLock = "${src}/apps/peertube-runner/yarn.lock";
-    hash = "sha256-9w3aLuiLs7SU00YwuE0ixfiD77gCakXT4YeRpfsgGz0=";
+    hash = "sha256-x5qFCprn8q0xC88HudLV7W53X1Nkbz3F52RMp2PxIu8=";
   };
 
   outputs = [ "out" "cli" "runner" ];
@@ -134,6 +134,7 @@ stdenv.mkDerivation rec {
       ~/packages/models/dist/ \
       ~/packages/node-utils/dist/ \
       ~/packages/server-commands/dist/ \
+      ~/packages/transcription/dist/ \
       ~/packages/typescript-utils/dist/ \
       \( -name '*.d.ts' -o -name '*.d.ts.map' \) -type f -delete
   '';
@@ -144,12 +145,13 @@ stdenv.mkDerivation rec {
     mv ~/node_modules $out/node_modules
     mkdir $out/client
     mv ~/client/{dist,node_modules,package.json,yarn.lock} $out/client
-    mkdir -p $out/packages/{core-utils,ffmpeg,models,node-utils,server-commands,typescript-utils}
+    mkdir -p $out/packages/{core-utils,ffmpeg,models,node-utils,server-commands,transcription,typescript-utils}
     mv ~/packages/core-utils/{dist,package.json} $out/packages/core-utils
     mv ~/packages/ffmpeg/{dist,package.json} $out/packages/ffmpeg
     mv ~/packages/models/{dist,package.json} $out/packages/models
     mv ~/packages/node-utils/{dist,package.json} $out/packages/node-utils
     mv ~/packages/server-commands/{dist,package.json} $out/packages/server-commands
+    mv ~/packages/transcription/{dist,package.json} $out/packages/transcription
     mv ~/packages/typescript-utils/{dist,package.json} $out/packages/typescript-utils
     mv ~/{config,support,CREDITS.md,FAQ.md,LICENSE,README.md,package.json,yarn.lock} $out
 

pkgs/tools/security/pinentry/default.nix

@@ -6,6 +6,7 @@
   pkg-config,
   autoreconfHook,
   wrapGAppsHook3,
+  kdePackages,
   libgpg-error,
   libassuan,
   libsForQt5,
@@ -49,6 +50,7 @@ let
       buildInputs = [
         qt6.qtbase
         qt6.qtwayland
+        kdePackages.kguiaddons
       ];
       nativeBuildInputs = [ qt6.wrapQtAppsHook ];
     };

pkgs/top-level/python-aliases.nix

@@ -520,6 +520,7 @@ mapAliases ({
   pysparse = throw "pysparse has been abandoned upstream."; # added 2023-02-28
   pyspotify = throw "pyspotify has been removed because Spotify stopped supporting libspotify"; # added 2022-05-29
   PyStemmer = pystemmer; # added 2023-02-19
+  pytado = python-tado; # added 2024-12-02
   pytest_6 = pytest; # added 2022-02-10
   pytestcov = pytest-cov; # added 2021-01-04
   pytest-ordering = throw "pytest-ordering has been removed, since it is no longer maintained and broken"; # added 2023-06-22

pkgs/top-level/python-packages.nix

@@ -12606,8 +12606,6 @@ self: super: with self; {
 
   pytablewriter = callPackage ../development/python-modules/pytablewriter { };
 
-  pytado = callPackage ../development/python-modules/pytado { };
-
   pytaglib = callPackage ../development/python-modules/pytaglib { };
 
   pytankerkoenig = callPackage ../development/python-modules/pytankerkoenig { };