Merge remote-tracking branch 'origin/staging-next' into staging

.git-blame-ignore-revs

@@ -212,3 +212,6 @@ ce21e97a1f20dee15da85c084f9d1148d84f853b
 
 # format files with nixfmt (#347275)
 adb9714bd909df283c66bbd641bd631ff50a4260
+
+# treewide: incus packages
+9ab59bb5fb943ad6740f64f5a79eae9642fb8211

CONTRIBUTING.md

@@ -345,7 +345,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
 Here's a brief overview of the main Git branches and what channels they're used for:
 
 - `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
-- `release-YY.MM` (e.g. `release-24.11`): The NixOS release branches, used for the stable channels such as `nixos-24.11`, `nixos-24.11-small` and `nixpkgs-24.11-darwin`.
+- `release-YY.MM` (e.g. `release-25.05`): The NixOS release branches, used for the stable channels such as `nixos-25.05`, `nixos-25.05-small` and `nixpkgs-25.05-darwin`.
 
 When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
 So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).

README.md

@@ -52,9 +52,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 24.05 release](https://hydra.nixos.org/jobset/nixos/release-24.05)
+* [Continuous package builds for the NixOS 24.11 release](https://hydra.nixos.org/jobset/nixos/release-24.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 24.05 release](https://hydra.nixos.org/job/nixos/release-24.05/tested#tabs-constituents)
+* [Tests for the NixOS 24.11 release](https://hydra.nixos.org/job/nixos/release-24.11/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are

maintainers/maintainer-list.nix

@@ -16805,6 +16805,11 @@
     githubId = 33826198;
     name = "Philipp Arras";
   };
+  parth = {
+    github = "parth";
+    githubId = 821972;
+    name = "Parth Mehrotra";
+  };
   pashashocky = {
     email = "pashashocky@gmail.com";
     github = "pashashocky";

nixos/doc/manual/installation/upgrading.chapter.md

@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:
 
--   *Stable channels*, such as [`nixos-24.05`](https://channels.nixos.org/nixos-24.05).
+-   *Stable channels*, such as [`nixos-24.11`](https://channels.nixos.org/nixos-24.11).
     These only get conservative bug fixes and package upgrades. For
     instance, a channel update may cause the Linux kernel on your system
     to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -19,7 +19,7 @@ passed and all packages have been built. These channels are:
     radical changes between channel updates. It's not recommended for
     production systems.
 
--   *Small channels*, such as [`nixos-24.05-small`](https://channels.nixos.org/nixos-24.05-small)
+-   *Small channels*, such as [`nixos-24.11-small`](https://channels.nixos.org/nixos-24.11-small)
     or [`nixos-unstable-small`](https://channels.nixos.org/nixos-unstable-small).
     These are identical to the stable and unstable channels described above,
     except that they contain fewer binary packages. This means they get updated
@@ -38,8 +38,8 @@ supported stable release.
 
 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 24.05 ISO, you will be subscribed to
-the `nixos-24.05` channel. To see which NixOS channel you're subscribed
+instance, if you installed from a 24.11 ISO, you will be subscribed to
+the `nixos-24.11` channel. To see which NixOS channel you're subscribed
 to, run the following as root:
 
 ```ShellSession
@@ -54,16 +54,16 @@ To switch to a different NixOS channel, do
 ```
 
 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 24.05 stable channel:
+use the NixOS 24.11 stable channel:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-24.05 nixos
+# nix-channel --add https://channels.nixos.org/nixos-24.11 nixos
 ```
 
 If you have a server, you may want to use the "small" channel instead:
 
 ```ShellSession
-# nix-channel --add https://channels.nixos.org/nixos-24.05-small nixos
+# nix-channel --add https://channels.nixos.org/nixos-24.11-small nixos
 ```
 
 And if you want to live on the bleeding edge:
@@ -117,6 +117,6 @@ modules. You can also specify a channel explicitly, e.g.
 
 ```nix
 {
-  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-24.05";
+  system.autoUpgrade.channel = "https://channels.nixos.org/nixos-24.11";
 }
 ```

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -1,4 +1,4 @@
-# Release 24.11 (“Vicuña”, 2024.11/??) {#sec-release-24.11}
+# Release 24.11 (“Vicuña”, 2024.11/28) {#sec-release-24.11}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 

nixos/modules/programs/java.nix

@@ -67,7 +67,7 @@ in
     environment.systemPackages = [ cfg.package ];
 
     environment.shellInit = ''
-      test -e ${cfg.package}/nix-support/setup-hook && source ${cfg.package}/nix-support/setup-hook
+      test -e ${cfg.package}/nix-support/setup-hook && . ${cfg.package}/nix-support/setup-hook
     '';
 
   };

nixos/modules/services/networking/zapret.nix

@@ -8,14 +8,16 @@ let
   cfg = config.services.zapret;
 
   whitelist = lib.optionalString (
-    cfg.whitelist != null
+    (builtins.length cfg.whitelist) != 0
   ) "--hostlist ${pkgs.writeText "zapret-whitelist" (lib.concatStringsSep "\n" cfg.whitelist)}";
 
   blacklist =
-    lib.optionalString (cfg.blacklist != null)
+    lib.optionalString ((builtins.length cfg.blacklist) != 0)
       "--hostlist-exclude ${pkgs.writeText "zapret-blacklist" (lib.concatStringsSep "\n" cfg.blacklist)}";
 
-  ports = if cfg.httpSupport then "80,443" else "443";
+  params = lib.concatStringsSep " " cfg.params;
+
+  qnum = toString cfg.qnum;
 in
 {
   options.services.zapret = {
@@ -29,7 +31,7 @@ in
           "--dpi-desync=fake,disorder2"
           "--dpi-desync-ttl=1"
           "--dpi-desync-autottl=2"
-        ];
+        ]
       '';
       description = ''
         Specify the bypass parameters for Zapret binary.
@@ -40,8 +42,8 @@ in
       '';
     };
     whitelist = lib.mkOption {
-      default = null;
-      type = with lib.types; nullOr (listOf str);
+      default = [ ];
+      type = with lib.types; listOf str;
       example = ''
         [
           "youtube.com"
@@ -59,8 +61,8 @@ in
       '';
     };
     blacklist = lib.mkOption {
-      default = null;
-      type = with lib.types; nullOr (listOf str);
+      default = [ ];
+      type = with lib.types; listOf str;
       example = ''
         [
           "example.com"
@@ -96,6 +98,43 @@ in
         Http bypass rarely works and you might want to disable it if you don't utilise http connections.
       '';
     };
+    httpMode = lib.mkOption {
+      default = "first";
+      type = lib.types.enum [
+        "first"
+        "full"
+      ];
+      example = "full";
+      description = ''
+        By default this service only changes the first packet sent, which is enough in most cases.
+        But there are DPIs that monitor the whole traffic within a session.
+        That requires full processing of every packet, which increases the CPU usage.
+
+        Set the mode to `full` if http doesn't work.
+      '';
+    };
+    udpSupport = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Enable UDP routing.
+        This requires you to specify `udpPorts` and `--dpi-desync-any-protocol` parameter.
+      '';
+    };
+    udpPorts = lib.mkOption {
+      default = [ ];
+      type = with lib.types; listOf str;
+      example = ''
+        [
+          "50000:50099"
+          "1234"
+        ]
+      '';
+      description = ''
+        List of UDP ports to route.
+        Port ranges are delimited with a colon like this "50000:50099".
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable (
@@ -103,13 +142,21 @@ in
       {
         assertions = [
           {
-            assertion = (cfg.whitelist == null) || (cfg.blacklist == null);
+            assertion = (builtins.length cfg.whitelist) == 0 || (builtins.length cfg.blacklist) == 0;
             message = "Can't specify both whitelist and blacklist.";
           }
           {
             assertion = (builtins.length cfg.params) != 0;
             message = "You have to specify zapret parameters. See the params option's description.";
           }
+          {
+            assertion = cfg.udpSupport -> (builtins.length cfg.udpPorts) != 0;
+            message = "You have to specify UDP ports or disable UDP support.";
+          }
+          {
+            assertion = !cfg.configureFirewall || !config.networking.nftables.enable;
+            message = "You need to manually configure you firewall for Zapret service when using nftables.";
+          }
         ];
 
         systemd.services.zapret = {
@@ -117,13 +164,13 @@ in
           wantedBy = [ "multi-user.target" ];
           after = [ "network.target" ];
           serviceConfig = {
-            ExecStart = "${cfg.package}/bin/nfqws --pidfile=/run/nfqws.pid ${lib.concatStringsSep " " cfg.params} ${whitelist} ${blacklist} --qnum=${toString cfg.qnum}";
+            ExecStart = "${cfg.package}/bin/nfqws --pidfile=/run/nfqws.pid ${params} ${whitelist} ${blacklist} --qnum=${qnum}";
             Type = "simple";
             PIDFile = "/run/nfqws.pid";
             Restart = "always";
-            RuntimeMaxSec = "1h"; # This service loves to crash silently or cause network slowdowns. It also restarts instantly. In my experience restarting it hourly provided the best experience.
+            RuntimeMaxSec = "1h"; # This service loves to crash silently or cause network slowdowns. It also restarts instantly. Restarting it at least hourly provided the best experience.
 
-            # hardening
+            # Hardening.
             DevicePolicy = "closed";
             KeyringMode = "private";
             PrivateTmp = true;
@@ -145,9 +192,23 @@ in
 
       # Route system traffic via service for specified ports.
       (lib.mkIf cfg.configureFirewall {
-        networking.firewall.extraCommands = ''
-          iptables -t mangle -I POSTROUTING -p tcp -m multiport --dports ${ports} -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${toString cfg.qnum} --queue-bypass
-        '';
+        networking.firewall.extraCommands =
+          let
+            httpParams = lib.optionalString (
+              cfg.httpMode == "first"
+            ) "-m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6";
+
+            udpPorts = lib.concatStringsSep "," cfg.udpPorts;
+          in
+          ''
+            ip46tables -t mangle -I POSTROUTING -p tcp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:6 -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+          ''
+          + lib.optionalString (cfg.httpSupport) ''
+            ip46tables -t mangle -I POSTROUTING -p tcp --dport 80 ${httpParams} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+          ''
+          + lib.optionalString (cfg.udpSupport) ''
+            ip46tables -t mangle -A POSTROUTING -p udp -m multiport --dports ${udpPorts} -m mark ! --mark 0x40000000/0x40000000 -j NFQUEUE --queue-num ${qnum} --queue-bypass
+          '';
       })
     ]
   );

nixos/modules/services/web-apps/moodle.nix

@@ -56,7 +56,7 @@ let
   mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
   pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
 
-  phpExt = pkgs.php81.buildEnv {
+  phpExt = pkgs.php83.buildEnv {
     extensions = { all, ... }: with all; [ iconv mbstring curl openssl tokenizer soap ctype zip gd simplexml dom intl sqlite3 pgsql pdo_sqlite pdo_pgsql pdo_odbc pdo_mysql pdo mysqli session zlib xmlreader fileinfo filter opcache exif sodium ];
     extraConfig = "max_input_vars = 5000";
   };

nixos/modules/virtualisation/lxc-image-metadata.nix

@@ -1,51 +1,71 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 let
-  templateSubmodule = {...}: {
-    options = {
-      enable = lib.mkEnableOption "this template";
+  templateSubmodule =
+    { ... }:
+    {
+      options = {
+        enable = lib.mkEnableOption "this template";
 
-      target = lib.mkOption {
-        description = "Path in the container";
-        type = lib.types.path;
-      };
-      template = lib.mkOption {
-        description = ".tpl file for rendering the target";
-        type = lib.types.path;
-      };
-      when = lib.mkOption {
-        description = "Events which trigger a rewrite (create, copy)";
-        type = lib.types.listOf (lib.types.str);
-      };
-      properties = lib.mkOption {
-        description = "Additional properties";
-        type = lib.types.attrs;
-        default = {};
+        target = lib.mkOption {
+          description = "Path in the container";
+          type = lib.types.path;
+        };
+        template = lib.mkOption {
+          description = ".tpl file for rendering the target";
+          type = lib.types.path;
+        };
+        when = lib.mkOption {
+          description = "Events which trigger a rewrite (create, copy)";
+          type = lib.types.listOf (lib.types.str);
+        };
+        properties = lib.mkOption {
+          description = "Additional properties";
+          type = lib.types.attrs;
+          default = { };
+        };
       };
     };
-  };
 
-  toYAML = name: data: pkgs.writeText name (lib.generators.toYAML {} data);
+  toYAML = name: data: pkgs.writeText name (lib.generators.toYAML { } data);
 
   cfg = config.virtualisation.lxc;
-  templates = if cfg.templates != {} then let
-    list = lib.mapAttrsToList (name: value: { inherit name; } // value)
-      (lib.filterAttrs (name: value: value.enable) cfg.templates);
-  in
-    {
-      files = map (tpl: {
-        source = tpl.template;
-        target = "/templates/${tpl.name}.tpl";
-      }) list;
-      properties = lib.listToAttrs (map (tpl: lib.nameValuePair tpl.target {
-        when = tpl.when;
-        template = "${tpl.name}.tpl";
-        properties = tpl.properties;
-      }) list);
-    }
-  else { files = []; properties = {}; };
+  templates =
+    if cfg.templates != { } then
+      let
+        list = lib.mapAttrsToList (name: value: { inherit name; } // value) (
+          lib.filterAttrs (name: value: value.enable) cfg.templates
+        );
+      in
+      {
+        files = map (tpl: {
+          source = tpl.template;
+          target = "/templates/${tpl.name}.tpl";
+        }) list;
+        properties = lib.listToAttrs (
+          map (
+            tpl:
+            lib.nameValuePair tpl.target {
+              when = tpl.when;
+              template = "${tpl.name}.tpl";
+              properties = tpl.properties;
+            }
+          ) list
+        );
+      }
+    else
+      {
+        files = [ ];
+        properties = { };
+      };
 
-in {
+in
+{
   imports = [
     ../image/file-options.nix
   ];
@@ -59,7 +79,7 @@ in {
       templates = lib.mkOption {
         description = "Templates for LXD";
         type = lib.types.attrsOf (lib.types.submodule templateSubmodule);
-        default = {};
+        default = { };
         example = lib.literalExpression ''
           {
             # create /etc/hostname on container creation
@@ -91,7 +111,10 @@ in {
   };
 
   config = {
-    system.nixos.tags = [ "lxc" "metadata" ];
+    system.nixos.tags = [
+      "lxc"
+      "metadata"
+    ];
     image.extension = "tar.xz";
     image.filePath = "tarball/${config.image.fileName}";
     system.build.image = config.system.build.metadata;
@@ -100,7 +123,9 @@ in {
       contents = [
         {
           source = toYAML "metadata.yaml" {
-            architecture = builtins.elemAt (builtins.match "^([a-z0-9_]+).+" (toString pkgs.stdenv.hostPlatform.system)) 0;
+            architecture = builtins.elemAt (builtins.match "^([a-z0-9_]+).+" (
+              toString pkgs.stdenv.hostPlatform.system
+            )) 0;
             creation_date = 1;
             properties = {
               description = "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} ${pkgs.stdenv.hostPlatform.system}";

nixos/modules/virtualisation/lxc-instance-common.nix

@@ -1,4 +1,4 @@
-{lib, ...}:
+{ lib, ... }:
 
 {
   meta = {

nixos/modules/virtualisation/lxc.nix

@@ -1,6 +1,11 @@
 # LXC Configuration
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.virtualisation.lxc;
@@ -12,58 +17,53 @@ in
   };
 
   options.virtualisation.lxc = {
-    enable =
-      lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-            This enables Linux Containers (LXC), which provides tools
-            for creating and managing system or application containers
-            on Linux.
-          '';
-      };
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        This enables Linux Containers (LXC), which provides tools
+        for creating and managing system or application containers
+        on Linux.
+      '';
+    };
 
     unprivilegedContainers = lib.mkEnableOption "support for unprivileged users to launch containers";
 
-    systemConfig =
-      lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        description = ''
-            This is the system-wide LXC config. See
-            {manpage}`lxc.system.conf(5)`.
-          '';
-      };
+    systemConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        This is the system-wide LXC config. See
+        {manpage}`lxc.system.conf(5)`.
+      '';
+    };
     package = lib.mkPackageOption pkgs "lxc" { };
 
-    defaultConfig =
-      lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        description = ''
-            Default config (default.conf) for new containers, i.e. for
-            network config. See {manpage}`lxc.container.conf(5)`.
-          '';
-      };
+    defaultConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        Default config (default.conf) for new containers, i.e. for
+        network config. See {manpage}`lxc.container.conf(5)`.
+      '';
+    };
 
-    usernetConfig =
-      lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        description = ''
-            This is the config file for managing unprivileged user network
-            administration access in LXC. See {manpage}`lxc-usernet(5)`.
-          '';
-      };
+    usernetConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        This is the config file for managing unprivileged user network
+        administration access in LXC. See {manpage}`lxc-usernet(5)`.
+      '';
+    };
 
-      bridgeConfig =
-        lib.mkOption {
-          type = lib.types.lines;
-          default = "";
-          description = ''
-              This is the config file for override lxc-net bridge default settings.
-            '';
-        };
+    bridgeConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = ''
+        This is the config file for override lxc-net bridge default settings.
+      '';
+    };
   };
 
   ###### implementation
@@ -88,7 +88,7 @@ in
     };
 
     # We don't need the `lxc-user` group, unless the unprivileged containers are enabled.
-    users.groups = lib.mkIf cfg.unprivilegedContainers { lxc-user = {}; };
+    users.groups = lib.mkIf cfg.unprivilegedContainers { lxc-user = { }; };
 
     # `lxc-user-nic` needs suid to attach to bridge for unpriv containers.
     security.wrappers = lib.mkIf cfg.unprivilegedContainers {
@@ -108,7 +108,12 @@ in
       lxc-net = {
         enable = true;
         wantedBy = [ "multi-user.target" ];
-        path = [ pkgs.iproute2 pkgs.iptables pkgs.getent pkgs.dnsmasq ];
+        path = [
+          pkgs.iproute2
+          pkgs.iptables
+          pkgs.getent
+          pkgs.dnsmasq
+        ];
       };
     };
   };

nixos/modules/virtualisation/lxcfs.nix

@@ -1,29 +1,34 @@
 # LXC Configuration
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.virtualisation.lxc.lxcfs;
-in {
+in
+{
   meta = {
     maintainers = lib.teams.lxc.members;
   };
 
   ###### interface
   options.virtualisation.lxc.lxcfs = {
-    enable =
-      lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          This enables LXCFS, a FUSE filesystem for LXC.
-          To use lxcfs in include the following configuration in your
-          container configuration:
-          ```
-          virtualisation.lxc.defaultConfig = "lxc.include = ''${pkgs.lxcfs}/share/lxc/config/common.conf.d/00-lxcfs.conf";
-          ```
-        '';
-      };
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        This enables LXCFS, a FUSE filesystem for LXC.
+        To use lxcfs in include the following configuration in your
+        container configuration:
+        ```
+        virtualisation.lxc.defaultConfig = "lxc.include = ''${pkgs.lxcfs}/share/lxc/config/common.conf.d/00-lxcfs.conf";
+        ```
+      '';
+    };
   };
 
   ###### implementation
@@ -34,11 +39,11 @@ in {
       before = [ "lxc.service" ];
       restartIfChanged = false;
       serviceConfig = {
-        ExecStartPre="${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
-        ExecStart="${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
-        ExecStopPost="-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
-        KillMode="process";
-        Restart="on-failure";
+        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
+        ExecStart = "${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
+        ExecStopPost = "-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
+        KillMode = "process";
+        Restart = "on-failure";
       };
     };
   };

nixos/tests/incus/container.nix

@@ -1,140 +1,154 @@
-import ../make-test-python.nix ({ pkgs, lib, extra ? {}, name ? "incus-container", incus ? pkgs.incus-lts, ... } :
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    extra ? { },
+    name ? "incus-container",
+    incus ? pkgs.incus-lts,
+    ...
+  }:
 
-let
-  releases = import ../../release.nix {
-    configuration = lib.recursiveUpdate {
+  let
+    releases = import ../../release.nix {
+      configuration = lib.recursiveUpdate {
         # Building documentation makes the test unnecessarily take a longer time:
         documentation.enable = lib.mkForce false;
 
         boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-    }
-    extra;
-  };
-
-  container-image-metadata = "${releases.incusContainerMeta.${pkgs.stdenv.hostPlatform.system}}/tarball/nixos-system-${pkgs.stdenv.hostPlatform.system}.tar.xz";
-  container-image-rootfs = "${releases.incusContainerImage.${pkgs.stdenv.hostPlatform.system}}/nixos-lxc-image-${pkgs.stdenv.hostPlatform.system}.squashfs";
-in
-{
-  inherit name;
-
-  meta = {
-    maintainers = lib.teams.lxc.members;
-  };
-
-  nodes.machine = { ... }: {
-    virtualisation = {
-      # Ensure test VM has enough resources for creating and managing guests
-      cores = 2;
-      memorySize = 1024;
-      diskSize = 4096;
-
-      incus = {
-        enable = true;
-        package = incus;
-      };
+      } extra;
     };
-    networking.nftables.enable = true;
-  };
 
-  testScript = # python
-  ''
-    def instance_is_up(_) -> bool:
-        status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
-        return status == 0
+    container-image-metadata = "${
+      releases.incusContainerMeta.${pkgs.stdenv.hostPlatform.system}
+    }/tarball/nixos-image-lxc-*-${pkgs.stdenv.hostPlatform.system}.tar.xz";
+    container-image-rootfs = "${
+      releases.incusContainerImage.${pkgs.stdenv.hostPlatform.system}
+    }/nixos-lxc-image-${pkgs.stdenv.hostPlatform.system}.squashfs";
+  in
+  {
+    inherit name;
 
-    def set_container(config):
-        machine.succeed(f"incus config set container {config}")
-        machine.succeed("incus restart container")
-        with machine.nested("Waiting for instance to start and be usable"):
-          retry(instance_is_up)
+    meta = {
+      maintainers = lib.teams.lxc.members;
+    };
 
-    def check_sysctl(instance):
-        with subtest("systemd sysctl settings are applied"):
-            machine.succeed(f"incus exec {instance} -- systemctl status systemd-sysctl")
-            sysctl = machine.succeed(f"incus exec {instance} -- sysctl net.ipv4.ip_forward").strip().split(" ")[-1]
-            assert "1" == sysctl, f"systemd-sysctl configuration not correctly applied, {sysctl} != 1"
+    nodes.machine =
+      { ... }:
+      {
+        virtualisation = {
+          # Ensure test VM has enough resources for creating and managing guests
+          cores = 2;
+          memorySize = 1024;
+          diskSize = 4096;
 
-    machine.wait_for_unit("incus.service")
+          incus = {
+            enable = true;
+            package = incus;
+          };
+        };
+        networking.nftables.enable = true;
+      };
 
-    # no preseed should mean no service
-    machine.fail("systemctl status incus-preseed.service")
+    testScript = # python
+      ''
+        def instance_is_up(_) -> bool:
+            status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
+            return status == 0
 
-    machine.succeed("incus admin init --minimal")
-
-    with subtest("Container image can be imported"):
-        machine.succeed("incus image import ${container-image-metadata} ${container-image-rootfs} --alias nixos")
-
-    with subtest("Container can be launched and managed"):
-        machine.succeed("incus launch nixos container")
-        with machine.nested("Waiting for instance to start and be usable"):
-          retry(instance_is_up)
-        machine.succeed("echo true | incus exec container /run/current-system/sw/bin/bash -")
-
-    with subtest("Container mounts lxcfs overlays"):
-        machine.succeed("incus exec container mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
-        machine.succeed("incus exec container mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
-
-    with subtest("resource limits"):
-        with subtest("Container CPU limits can be managed"):
-            set_container("limits.cpu 1")
-            cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
-            assert cpuinfo == "1", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 1, got: {cpuinfo}"
-
-            set_container("limits.cpu 2")
-            cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
-            assert cpuinfo == "2", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 2, got: {cpuinfo}"
-
-        with subtest("Container memory limits can be managed"):
-            set_container("limits.memory 64MB")
-            meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
-            meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
-            assert meminfo_bytes == "62500 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '62500 kB', got: '{meminfo_bytes}'"
-
-            set_container("limits.memory 128MB")
-            meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
-            meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
-            assert meminfo_bytes == "125000 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '125000 kB', got: '{meminfo_bytes}'"
-
-    with subtest("virtual tpm can be configured"):
-        machine.succeed("incus config device add container vtpm tpm path=/dev/tpm0 pathrm=/dev/tpmrm0")
-        machine.succeed("incus exec container -- test -e /dev/tpm0")
-        machine.succeed("incus exec container -- test -e /dev/tpmrm0")
-        machine.succeed("incus config device remove container vtpm")
-        machine.fail("incus exec container -- test -e /dev/tpm0")
-
-    with subtest("lxc-generator"):
-        with subtest("lxc-container generator configures plain container"):
-            # reuse the existing container to save some time
-            machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
-            check_sysctl("container")
-
-        with subtest("lxc-container generator configures nested container"):
-            machine.execute("incus delete --force container")
-            machine.succeed("incus launch nixos container --config security.nesting=true")
+        def set_container(config):
+            machine.succeed(f"incus config set container {config}")
+            machine.succeed("incus restart container")
             with machine.nested("Waiting for instance to start and be usable"):
               retry(instance_is_up)
 
-            machine.fail("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
-            target = machine.succeed("incus exec container readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
-            assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
+        def check_sysctl(instance):
+            with subtest("systemd sysctl settings are applied"):
+                machine.succeed(f"incus exec {instance} -- systemctl status systemd-sysctl")
+                sysctl = machine.succeed(f"incus exec {instance} -- sysctl net.ipv4.ip_forward").strip().split(" ")[-1]
+                assert "1" == sysctl, f"systemd-sysctl configuration not correctly applied, {sysctl} != 1"
 
-            check_sysctl("container")
+        machine.wait_for_unit("incus.service")
 
-        with subtest("lxc-container generator configures privileged container"):
-            machine.execute("incus delete --force container")
-            machine.succeed("incus launch nixos container --config security.privileged=true")
+        # no preseed should mean no service
+        machine.fail("systemctl status incus-preseed.service")
+
+        machine.succeed("incus admin init --minimal")
+
+        with subtest("Container image can be imported"):
+            machine.succeed("incus image import ${container-image-metadata} ${container-image-rootfs} --alias nixos")
+
+        with subtest("Container can be launched and managed"):
+            machine.succeed("incus launch nixos container")
             with machine.nested("Waiting for instance to start and be usable"):
               retry(instance_is_up)
+            machine.succeed("echo true | incus exec container /run/current-system/sw/bin/bash -")
 
-            machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+        with subtest("Container mounts lxcfs overlays"):
+            machine.succeed("incus exec container mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
+            machine.succeed("incus exec container mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
 
-            check_sysctl("container")
+        with subtest("resource limits"):
+            with subtest("Container CPU limits can be managed"):
+                set_container("limits.cpu 1")
+                cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
+                assert cpuinfo == "1", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 1, got: {cpuinfo}"
 
-    with subtest("softDaemonRestart"):
-        with subtest("Instance remains running when softDaemonRestart is enabled and services is stopped"):
-            pid = machine.succeed("incus info container | grep 'PID'").split(":")[1].strip()
-            machine.succeed(f"ps {pid}")
-            machine.succeed("systemctl stop incus")
-            machine.succeed(f"ps {pid}")
-  '';
-})
+                set_container("limits.cpu 2")
+                cpuinfo = machine.succeed("incus exec container grep -- -c ^processor /proc/cpuinfo").strip()
+                assert cpuinfo == "2", f"Wrong number of CPUs reported from /proc/cpuinfo, want: 2, got: {cpuinfo}"
+
+            with subtest("Container memory limits can be managed"):
+                set_container("limits.memory 64MB")
+                meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
+                meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
+                assert meminfo_bytes == "62500 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '62500 kB', got: '{meminfo_bytes}'"
+
+                set_container("limits.memory 128MB")
+                meminfo = machine.succeed("incus exec container grep -- MemTotal /proc/meminfo").strip()
+                meminfo_bytes = " ".join(meminfo.split(' ')[-2:])
+                assert meminfo_bytes == "125000 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '125000 kB', got: '{meminfo_bytes}'"
+
+        with subtest("virtual tpm can be configured"):
+            machine.succeed("incus config device add container vtpm tpm path=/dev/tpm0 pathrm=/dev/tpmrm0")
+            machine.succeed("incus exec container -- test -e /dev/tpm0")
+            machine.succeed("incus exec container -- test -e /dev/tpmrm0")
+            machine.succeed("incus config device remove container vtpm")
+            machine.fail("incus exec container -- test -e /dev/tpm0")
+
+        with subtest("lxc-generator"):
+            with subtest("lxc-container generator configures plain container"):
+                # reuse the existing container to save some time
+                machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                check_sysctl("container")
+
+            with subtest("lxc-container generator configures nested container"):
+                machine.execute("incus delete --force container")
+                machine.succeed("incus launch nixos container --config security.nesting=true")
+                with machine.nested("Waiting for instance to start and be usable"):
+                  retry(instance_is_up)
+
+                machine.fail("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+                target = machine.succeed("incus exec container readlink -- -f /run/systemd/system/systemd-binfmt.service").strip()
+                assert target == "/dev/null", "lxc generator did not correctly mask /run/systemd/system/systemd-binfmt.service"
+
+                check_sysctl("container")
+
+            with subtest("lxc-container generator configures privileged container"):
+                machine.execute("incus delete --force container")
+                machine.succeed("incus launch nixos container --config security.privileged=true")
+                with machine.nested("Waiting for instance to start and be usable"):
+                  retry(instance_is_up)
+
+                machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
+
+                check_sysctl("container")
+
+        with subtest("softDaemonRestart"):
+            with subtest("Instance remains running when softDaemonRestart is enabled and services is stopped"):
+                pid = machine.succeed("incus info container | grep 'PID'").split(":")[1].strip()
+                machine.succeed(f"ps {pid}")
+                machine.succeed("systemctl stop incus")
+                machine.succeed(f"ps {pid}")
+      '';
+  }
+)

nixos/tests/incus/openvswitch.nix

@@ -1,69 +1,78 @@
-import ../make-test-python.nix ({ pkgs, lib, incus ? pkgs.incus-lts, ... } :
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    incus ? pkgs.incus-lts,
+    ...
+  }:
 
-{
-  name = "incus-openvswitch";
+  {
+    name = "incus-openvswitch";
 
-  meta = {
-    maintainers = lib.teams.lxc.members;
-  };
-
-  nodes.machine = { lib, ... }: {
-    virtualisation = {
-      incus = {
-        enable = true;
-        package = incus;
-      };
-
-      vswitch.enable = true;
-      incus.preseed = {
-        networks = [
-          {
-            name = "nixostestbr0";
-            type = "bridge";
-            config = {
-              "bridge.driver" = "openvswitch";
-              "ipv4.address" = "10.0.100.1/24";
-              "ipv4.nat" = "true";
-            };
-          }
-        ];
-        profiles = [
-          {
-            name = "nixostest_default";
-            devices = {
-              eth0 = {
-                name = "eth0";
-                network = "nixostestbr0";
-                type = "nic";
-              };
-              root = {
-                path = "/";
-                pool = "default";
-                size = "35GiB";
-                type = "disk";
-              };
-            };
-          }
-        ];
-        storage_pools = [
-          {
-            name = "nixostest_pool";
-            driver = "dir";
-          }
-        ];
-      };
+    meta = {
+      maintainers = lib.teams.lxc.members;
     };
-    networking.nftables.enable = true;
-  };
 
-  testScript = ''
-    machine.wait_for_unit("incus.service")
-    machine.wait_for_unit("incus-preseed.service")
+    nodes.machine =
+      { lib, ... }:
+      {
+        virtualisation = {
+          incus = {
+            enable = true;
+            package = incus;
+          };
 
-    with subtest("Verify openvswitch bridge"):
-      machine.succeed("incus network info nixostestbr0")
+          vswitch.enable = true;
+          incus.preseed = {
+            networks = [
+              {
+                name = "nixostestbr0";
+                type = "bridge";
+                config = {
+                  "bridge.driver" = "openvswitch";
+                  "ipv4.address" = "10.0.100.1/24";
+                  "ipv4.nat" = "true";
+                };
+              }
+            ];
+            profiles = [
+              {
+                name = "nixostest_default";
+                devices = {
+                  eth0 = {
+                    name = "eth0";
+                    network = "nixostestbr0";
+                    type = "nic";
+                  };
+                  root = {
+                    path = "/";
+                    pool = "default";
+                    size = "35GiB";
+                    type = "disk";
+                  };
+                };
+              }
+            ];
+            storage_pools = [
+              {
+                name = "nixostest_pool";
+                driver = "dir";
+              }
+            ];
+          };
+        };
+        networking.nftables.enable = true;
+      };
 
-    with subtest("Verify openvswitch bridge"):
-      machine.succeed("ovs-vsctl br-exists nixostestbr0")
-  '';
-})
+    testScript = ''
+      machine.wait_for_unit("incus.service")
+      machine.wait_for_unit("incus-preseed.service")
+
+      with subtest("Verify openvswitch bridge"):
+        machine.succeed("incus network info nixostestbr0")
+
+      with subtest("Verify openvswitch bridge"):
+        machine.succeed("ovs-vsctl br-exists nixostestbr0")
+    '';
+  }
+)

nixos/tests/incus/socket-activated.nix

@@ -1,32 +1,41 @@
-import ../make-test-python.nix ({ pkgs, lib, incus ? pkgs.incus-lts, ... } :
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    incus ? pkgs.incus-lts,
+    ...
+  }:
 
-{
-  name = "incus-socket-activated";
+  {
+    name = "incus-socket-activated";
 
-  meta = {
-    maintainers = lib.teams.lxc.members;
-  };
-
-  nodes.machine = { lib, ... }: {
-    virtualisation = {
-      incus = {
-        enable = true;
-        package = incus;
-        socketActivation = true;
-      };
+    meta = {
+      maintainers = lib.teams.lxc.members;
     };
-    networking.nftables.enable = true;
-  };
 
-  testScript = ''
-    machine.wait_for_unit("incus.socket")
+    nodes.machine =
+      { lib, ... }:
+      {
+        virtualisation = {
+          incus = {
+            enable = true;
+            package = incus;
+            socketActivation = true;
+          };
+        };
+        networking.nftables.enable = true;
+      };
 
-    # ensure service is not running by default
-    machine.fail("systemctl is-active incus.service")
-    machine.fail("systemctl is-active incus-preseed.service")
+    testScript = ''
+      machine.wait_for_unit("incus.socket")
 
-    # access the socket and ensure the service starts
-    machine.succeed("incus list")
-    machine.wait_for_unit("incus.service")
-  '';
-})
+      # ensure service is not running by default
+      machine.fail("systemctl is-active incus.service")
+      machine.fail("systemctl is-active incus-preseed.service")
+
+      # access the socket and ensure the service starts
+      machine.succeed("incus list")
+      machine.wait_for_unit("incus.service")
+    '';
+  }
+)

nixos/tests/incus/ui.nix

@@ -1,67 +1,84 @@
-import ../make-test-python.nix ({ pkgs, lib, incus ? pkgs.incus-lts, ... }: {
-  name = "incus-ui";
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    incus ? pkgs.incus-lts,
+    ...
+  }:
+  {
+    name = "incus-ui";
 
-  meta = {
-    maintainers = lib.teams.lxc.members;
-  };
-
-  nodes.machine = { lib, ... }: {
-    virtualisation = {
-      incus = {
-        enable = true;
-        package = incus;
-      };
-      incus.ui.enable = true;
+    meta = {
+      maintainers = lib.teams.lxc.members;
     };
-    networking.nftables.enable = true;
 
-    environment.systemPackages =
-      let
-        seleniumScript = pkgs.writers.writePython3Bin "selenium-script"
-          {
-            libraries = with pkgs.python3Packages; [ selenium ];
-          } ''
-          from selenium import webdriver
-          from selenium.webdriver.common.by import By
-          from selenium.webdriver.firefox.options import Options
-          from selenium.webdriver.support.ui import WebDriverWait
+    nodes.machine =
+      { lib, ... }:
+      {
+        virtualisation = {
+          incus = {
+            enable = true;
+            package = incus;
+          };
+          incus.ui.enable = true;
+        };
+        networking.nftables.enable = true;
 
-          options = Options()
-          options.add_argument("--headless")
-          service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+        environment.systemPackages =
+          let
+            seleniumScript =
+              pkgs.writers.writePython3Bin "selenium-script"
+                {
+                  libraries = with pkgs.python3Packages; [ selenium ];
+                }
+                ''
+                  from selenium import webdriver
+                  from selenium.webdriver.common.by import By
+                  from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.support.ui import WebDriverWait
 
-          driver = webdriver.Firefox(options=options, service=service)
-          driver.implicitly_wait(10)
-          driver.get("https://localhost:8443/ui")
+                  options = Options()
+                  options.add_argument("--headless")
+                  service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
 
-          wait = WebDriverWait(driver, 60)
+                  driver = webdriver.Firefox(options=options, service=service)
+                  driver.implicitly_wait(10)
+                  driver.get("https://localhost:8443/ui")
 
-          assert len(driver.find_elements(By.CLASS_NAME, "l-application")) > 0
-          assert len(driver.find_elements(By.CLASS_NAME, "l-navigation__drawer")) > 0
+                  wait = WebDriverWait(driver, 60)
 
-          driver.close()
-        '';
-      in
-      with pkgs; [ curl firefox-unwrapped geckodriver seleniumScript ];
-  };
+                  assert len(driver.find_elements(By.CLASS_NAME, "l-application")) > 0
+                  assert len(driver.find_elements(By.CLASS_NAME, "l-navigation__drawer")) > 0
 
+                  driver.close()
+                '';
+          in
+          with pkgs;
+          [
+            curl
+            firefox-unwrapped
+            geckodriver
+            seleniumScript
+          ];
+      };
 
-  testScript = ''
-    machine.wait_for_unit("sockets.target")
-    machine.wait_for_unit("incus.service")
-    machine.wait_for_file("/var/lib/incus/unix.socket")
+    testScript = ''
+      machine.wait_for_unit("sockets.target")
+      machine.wait_for_unit("incus.service")
+      machine.wait_for_file("/var/lib/incus/unix.socket")
 
-    # Configure incus listen address
-    machine.succeed("incus config set core.https_address :8443")
-    machine.succeed("systemctl restart incus")
+      # Configure incus listen address
+      machine.succeed("incus config set core.https_address :8443")
+      machine.succeed("systemctl restart incus")
 
-    # Check that the INCUS_UI environment variable is populated in the systemd unit
-    machine.succeed("cat /etc/systemd/system/incus.service | grep 'INCUS_UI'")
+      # Check that the INCUS_UI environment variable is populated in the systemd unit
+      machine.succeed("cat /etc/systemd/system/incus.service | grep 'INCUS_UI'")
 
-    # Ensure the endpoint returns an HTML page with 'Incus UI' in the title
-    machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>Incus UI</title>'")
+      # Ensure the endpoint returns an HTML page with 'Incus UI' in the title
+      machine.succeed("curl -kLs https://localhost:8443/ui | grep '<title>Incus UI</title>'")
 
-    # Ensure the application is actually rendered by the Javascript
-    machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
-  '';
-})
+      # Ensure the application is actually rendered by the Javascript
+      machine.succeed("PYTHONUNBUFFERED=1 selenium-script")
+    '';
+  }
+)

nixos/tests/incus/virtual-machine.nix

@@ -1,86 +1,95 @@
-import ../make-test-python.nix ({ pkgs, lib, incus ? pkgs.incus-lts, ... }:
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    incus ? pkgs.incus-lts,
+    ...
+  }:
 
-let
-  releases = import ../../release.nix {
-    configuration = {
-      # Building documentation makes the test unnecessarily take a longer time:
-      documentation.enable = lib.mkForce false;
+  let
+    releases = import ../../release.nix {
+      configuration = {
+        # Building documentation makes the test unnecessarily take a longer time:
+        documentation.enable = lib.mkForce false;
 
-      # Our tests require `grep` & friends:
-      environment.systemPackages = with pkgs; [busybox];
-    };
-  };
-
-  vm-image-metadata = releases.incusVirtualMachineImageMeta.${pkgs.stdenv.hostPlatform.system};
-  vm-image-disk = releases.incusVirtualMachineImage.${pkgs.stdenv.hostPlatform.system};
-
-  instance-name = "instance1";
-in
-{
-  name = "incus-virtual-machine";
-
-  meta = {
-    maintainers = lib.teams.lxc.members;
-  };
-
-  nodes.machine = {...}: {
-    virtualisation = {
-      # Ensure test VM has enough resources for creating and managing guests
-      cores = 2;
-      memorySize = 1024;
-      diskSize = 4096;
-
-      incus = {
-        enable = true;
-        package = incus;
+        # Our tests require `grep` & friends:
+        environment.systemPackages = with pkgs; [ busybox ];
       };
     };
-    networking.nftables.enable = true;
-  };
 
-  testScript = # python
-  ''
-    def instance_is_up(_) -> bool:
-      status, _ = machine.execute("incus exec ${instance-name} --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
-      return status == 0
+    vm-image-metadata = releases.incusVirtualMachineImageMeta.${pkgs.stdenv.hostPlatform.system};
+    vm-image-disk = releases.incusVirtualMachineImage.${pkgs.stdenv.hostPlatform.system};
 
-    machine.wait_for_unit("incus.service")
+    instance-name = "instance1";
+  in
+  {
+    name = "incus-virtual-machine";
 
-    machine.succeed("incus admin init --minimal")
+    meta = {
+      maintainers = lib.teams.lxc.members;
+    };
 
-    with subtest("virtual-machine image can be imported"):
-        machine.succeed("incus image import ${vm-image-metadata}/*/*.tar.xz ${vm-image-disk}/nixos.qcow2 --alias nixos")
+    nodes.machine =
+      { ... }:
+      {
+        virtualisation = {
+          # Ensure test VM has enough resources for creating and managing guests
+          cores = 2;
+          memorySize = 1024;
+          diskSize = 4096;
 
-    with subtest("virtual-machine can be created"):
-        machine.succeed("incus create nixos ${instance-name} --vm --config limits.memory=512MB --config security.secureboot=false")
+          incus = {
+            enable = true;
+            package = incus;
+          };
+        };
+        networking.nftables.enable = true;
+      };
 
-    with subtest("virtual tpm can be configured"):
-        machine.succeed("incus config device add ${instance-name} vtpm tpm path=/dev/tpm0")
+    testScript = # python
+      ''
+        def instance_is_up(_) -> bool:
+          status, _ = machine.execute("incus exec ${instance-name} --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
+          return status == 0
 
-    with subtest("virtual-machine can be launched and become available"):
-        machine.succeed("incus start ${instance-name}")
-        with machine.nested("Waiting for instance to start and be usable"):
-          retry(instance_is_up)
+        machine.wait_for_unit("incus.service")
 
-    with subtest("incus-agent is started"):
-        machine.succeed("incus exec ${instance-name} systemctl is-active incus-agent")
+        machine.succeed("incus admin init --minimal")
 
-    with subtest("incus-agent has a valid path"):
-        machine.succeed("incus exec ${instance-name} -- bash -c 'true'")
+        with subtest("virtual-machine image can be imported"):
+            machine.succeed("incus image import ${vm-image-metadata}/*/*.tar.xz ${vm-image-disk}/nixos.qcow2 --alias nixos")
 
-    with subtest("guest supports cpu hotplug"):
-        machine.succeed("incus config set ${instance-name} limits.cpu=1")
-        count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
-        assert count == 1, f"Wrong number of CPUs reported, want: 1, got: {count}"
+        with subtest("virtual-machine can be created"):
+            machine.succeed("incus create nixos ${instance-name} --vm --config limits.memory=512MB --config security.secureboot=false")
 
-        machine.succeed("incus config set ${instance-name} limits.cpu=2")
-        count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
-        assert count == 2, f"Wrong number of CPUs reported, want: 2, got: {count}"
+        with subtest("virtual tpm can be configured"):
+            machine.succeed("incus config device add ${instance-name} vtpm tpm path=/dev/tpm0")
 
-    with subtest("Instance remains running when softDaemonRestart is enabled and services is stopped"):
-        pid = machine.succeed("incus info ${instance-name} | grep 'PID'").split(":")[1].strip()
-        machine.succeed(f"ps {pid}")
-        machine.succeed("systemctl stop incus")
-        machine.succeed(f"ps {pid}")
-  '';
-})
+        with subtest("virtual-machine can be launched and become available"):
+            machine.succeed("incus start ${instance-name}")
+            with machine.nested("Waiting for instance to start and be usable"):
+              retry(instance_is_up)
+
+        with subtest("incus-agent is started"):
+            machine.succeed("incus exec ${instance-name} systemctl is-active incus-agent")
+
+        with subtest("incus-agent has a valid path"):
+            machine.succeed("incus exec ${instance-name} -- bash -c 'true'")
+
+        with subtest("guest supports cpu hotplug"):
+            machine.succeed("incus config set ${instance-name} limits.cpu=1")
+            count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
+            assert count == 1, f"Wrong number of CPUs reported, want: 1, got: {count}"
+
+            machine.succeed("incus config set ${instance-name} limits.cpu=2")
+            count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
+            assert count == 2, f"Wrong number of CPUs reported, want: 2, got: {count}"
+
+        with subtest("Instance remains running when softDaemonRestart is enabled and services is stopped"):
+            pid = machine.succeed("incus info ${instance-name} | grep 'PID'").split(":")[1].strip()
+            machine.succeed(f"ps {pid}")
+            machine.succeed("systemctl stop incus")
+            machine.succeed(f"ps {pid}")
+      '';
+  }
+)

nixos/tests/networking/networkd-and-scripted.nix

@@ -462,6 +462,7 @@ let
               };
               bridges.bridge.interfaces = [ "greTunnel" "eth1" ];
               interfaces.eth1.ipv4.addresses = lib.mkOverride 0 [];
+              interfaces.eth1.ipv6.addresses = lib.mkOverride 0 [];
               interfaces.bridge.ipv4.addresses = lib.mkOverride 0 [
                 { address = "192.168.1.1"; prefixLength = 24; }
               ];
@@ -498,6 +499,7 @@ let
               };
               bridges.bridge.interfaces = [ "greTunnel" "eth2" ];
               interfaces.eth2.ipv4.addresses = lib.mkOverride 0 [];
+              interfaces.eth2.ipv6.addresses = lib.mkOverride 0 [];
               interfaces.bridge.ipv4.addresses = lib.mkOverride 0 [
                 { address = "192.168.1.2"; prefixLength = 24; }
               ];

nixos/tests/vscodium.nix

@@ -3,7 +3,8 @@ let
     wayland = { pkgs, ... }: {
       imports = [ ./common/wayland-cage.nix ];
 
-      services.cage.program = "${pkgs.vscodium}/bin/codium";
+      # We scale vscodium to help OCR find the small "Untitled" text.
+      services.cage.program = "${pkgs.vscodium}/bin/codium --force-device-scale-factor=2";
 
       environment.variables.NIXOS_OZONE_WL = "1";
       environment.variables.DISPLAY = "do not use";
@@ -16,7 +17,7 @@ let
       virtualisation.memorySize = 2047;
       services.xserver.enable = true;
       services.xserver.displayManager.sessionCommands = ''
-        ${pkgs.vscodium}/bin/codium
+        ${pkgs.vscodium}/bin/codium --force-device-scale-factor=2
       '';
       test-support.displayManager.auto.user = "alice";
     };
@@ -46,7 +47,7 @@ let
         codium_running.wait() # type: ignore[union-attr]
         with codium_running: # type: ignore[union-attr]
             # Wait until vscodium is visible. "File" is in the menu bar.
-            machine.wait_for_text('Welcome')
+            machine.wait_for_text('Get Started with')
             machine.screenshot('start_screen')
 
             test_string = 'testfile'

pkgs/applications/editors/vim/plugins/generated.nix

@@ -2898,6 +2898,18 @@ final: prev:
     meta.homepage = "https://github.com/chrisbra/csv.vim/";
   };
 
+  csvview-nvim = buildVimPlugin {
+    pname = "csvview.nvim";
+    version = "2024-11-18";
+    src = fetchFromGitHub {
+      owner = "hat0uma";
+      repo = "csvview.nvim";
+      rev = "63b6585fc22bba2060e6dd4600bd2dd0b77dd446";
+      sha256 = "0615vjdiwij5j6qxa5hfvylq9swp0z6lm5xc38yk6yxhjrkcdvyg";
+    };
+    meta.homepage = "https://github.com/hat0uma/csvview.nvim/";
+  };
+
   ctrlp-cmatcher = buildVimPlugin {
     pname = "ctrlp-cmatcher";
     version = "2015-10-15";
@@ -3572,6 +3584,18 @@ final: prev:
     meta.homepage = "https://github.com/NTBBloodbath/doom-one.nvim/";
   };
 
+  dotnet-nvim = buildVimPlugin {
+    pname = "dotnet.nvim";
+    version = "2024-10-21";
+    src = fetchFromGitHub {
+      owner = "MoaidHathot";
+      repo = "dotnet.nvim";
+      rev = "f5c52f9f52a3d8ca8dff6916c2228fb41a075274";
+      sha256 = "1ysqh2aj3iy2q0cl7i642c03jb7cakqhgbqslcfd7dfvibidd2a2";
+    };
+    meta.homepage = "https://github.com/MoaidHathot/dotnet.nvim/";
+  };
+
   dracula-nvim = buildVimPlugin {
     pname = "dracula.nvim";
     version = "2024-11-11";
@@ -8766,6 +8790,18 @@ final: prev:
     meta.homepage = "https://github.com/leoluz/nvim-dap-go/";
   };
 
+  nvim-dap-lldb = buildVimPlugin {
+    pname = "nvim-dap-lldb";
+    version = "2024-06-09";
+    src = fetchFromGitHub {
+      owner = "julianolf";
+      repo = "nvim-dap-lldb";
+      rev = "81273514fdb5107b79090364b57a3ff5570bea21";
+      sha256 = "18ds6kkrip0m2zanmzfqcr31qnw1whara1mvsnmx30z6iwgdp92w";
+    };
+    meta.homepage = "https://github.com/julianolf/nvim-dap-lldb/";
+  };
+
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
     version = "2024-10-24";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -884,6 +884,13 @@ in
       '';
   });
 
+  dotnet-nvim = super.dotnet-nvim.overrideAttrs {
+    dependencies = with self; [
+      telescope-nvim
+      plenary-nvim
+    ];
+  };
+
   efmls-configs-nvim = super.efmls-configs-nvim.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
   };
@@ -1853,6 +1860,10 @@ in
     dependencies = [ self.nvim-fzf ];
   };
 
+  nvim-dap-lldb = super.nvim-dap-lldb.overrideAttrs {
+    dependencies = [ self.nvim-dap ];
+  };
+
   nvim-dap-python = super.nvim-dap-python.overrideAttrs {
     dependencies = [ self.nvim-dap ];
     nvimRequireCheck = "dap-python";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -240,6 +240,7 @@ https://github.com/saecki/crates.nvim/,,
 https://github.com/godlygeek/csapprox/,,
 https://github.com/Decodetalkers/csharpls-extended-lsp.nvim/,HEAD,
 https://github.com/chrisbra/csv.vim/,,
+https://github.com/hat0uma/csvview.nvim/,HEAD,
 https://github.com/JazzCore/ctrlp-cmatcher/,,
 https://github.com/FelikZ/ctrlp-py-matcher/,,
 https://github.com/amiorin/ctrlp-z/,,
@@ -296,6 +297,7 @@ https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,HEAD,
 https://github.com/doki-theme/doki-theme-vim/,,
 https://github.com/NTBBloodbath/doom-one.nvim/,,
+https://github.com/MoaidHathot/dotnet.nvim/,HEAD,
 https://github.com/dracula/vim/,,dracula-vim
 https://github.com/Mofiqul/dracula.nvim/,HEAD,
 https://github.com/stevearc/dressing.nvim/,,
@@ -728,6 +730,7 @@ https://github.com/andythigpen/nvim-coverage/,HEAD,
 https://github.com/yamatsum/nvim-cursorline/,,
 https://github.com/mfussenegger/nvim-dap/,,
 https://github.com/leoluz/nvim-dap-go/,HEAD,
+https://github.com/julianolf/nvim-dap-lldb/,HEAD,
 https://github.com/mfussenegger/nvim-dap-python/,HEAD,
 https://github.com/rinx/nvim-dap-rego/,HEAD,
 https://github.com/jonboh/nvim-dap-rr/,HEAD,

pkgs/applications/radio/gqrx/default.nix

@@ -27,13 +27,13 @@ assert !(pulseaudioSupport && portaudioSupport);
 
 gnuradioMinimal.pkgs.mkDerivation rec {
   pname = "gqrx";
-  version = "2.17.5";
+  version = "2.17.6";
 
   src = fetchFromGitHub {
     owner = "gqrx-sdr";
     repo = "gqrx";
     rev = "v${version}";
-    hash = "sha256-9VePsl/vaSTZ1TMyIeaGoZNrZv+O/7BxQ3ubD5S2EjY=";
+    hash = "sha256-/ykKcwOotu8kn+EpJI+EUeqSkHZ2IrSh+o7lBGeHrZ0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix

@@ -10,12 +10,12 @@ let
     let
       self = {
         inherit pname;
-        version = "0-unstable-2023-03-03";
+        version = "0-unstable-2024-11-23";
         src = fetchFromGitHub {
           owner = "occivink";
           repo = "mpv-image-viewer";
-          rev = "efc82147cba4809f22e9afae6ed7a41ad9794ffd";
-          hash = "sha256-H7uBwrIb5uNEr3m+rHED/hO2CHypGu7hbcRpC30am2Q=";
+          rev = "128b498e3e57a14deea5ca9bbf662f8c1ca79e8d";
+          hash = "sha256-VwIL1529CW9MLK4N9jHHddSSZD5RsJ5bWGWqGJ751C0=";
         };
 
         sourceRoot = "source/scripts";

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -174,7 +174,7 @@ let
 
   allPaths = paths ++ paths32;
 
-  rootfs-builder = pkgs.rustPlatform.buildRustPackage {
+  rootfs-builder = pkgs.buildPackages.rustPlatform.buildRustPackage {
     name = "fhs-rootfs-bulder";
     src = ./rootfs-builder;
     cargoLock.lockFile = ./rootfs-builder/Cargo.lock;

pkgs/build-support/vm/default.nix

@@ -88,10 +88,6 @@ rec {
           set -- $(IFS==; echo $o)
           command=$2
           ;;
-        out=*)
-          set -- $(IFS==; echo $o)
-          export out=$2
-          ;;
       esac
     done
 
@@ -129,15 +125,15 @@ rec {
     mkdir -p /fs${storeDir}
     mount -t 9p store /fs${storeDir} -o trans=virtio,version=9p2000.L,cache=loose,msize=131072
 
-    echo "mounting host's build directory..."
-    mkdir -p /fs/build
-    mount -t 9p sa /fs/build -o trans=virtio,version=9p2000.L,cache=loose,msize=131072
-
     mkdir -p /fs/tmp /fs/run /fs/var
     mount -t tmpfs -o "mode=1777" none /fs/tmp
     mount -t tmpfs -o "mode=755" none /fs/run
     ln -sfn /run /fs/var/run
 
+    echo "mounting host's temporary directory..."
+    mkdir -p /fs/tmp/xchg
+    mount -t 9p xchg /fs/tmp/xchg -o trans=virtio,version=9p2000.L,msize=131072
+
     mkdir -p /fs/proc
     mount -t proc none /fs/proc
 
@@ -153,7 +149,7 @@ rec {
     fi
 
     echo "starting stage 2 ($command)"
-    exec switch_root /fs $command $out
+    exec switch_root /fs $command
   '';
 
 
@@ -169,11 +165,12 @@ rec {
   stage2Init = writeScript "vm-run-stage2" ''
     #! ${bash}/bin/sh
     set -euo pipefail
-    source /build/xchg/saved-env
-    if [ -f "''${NIX_ATTRS_SH_FILE-}" ]; then
-      source "$NIX_ATTRS_SH_FILE"
+    source /tmp/xchg/saved-env
+    if [ -f /tmp/xchg/.attrs.sh ]; then
+      source /tmp/xchg/.attrs.sh
+      export NIX_ATTRS_JSON_FILE=/tmp/xchg/.attrs.json
+      export NIX_ATTRS_SH_FILE=/tmp/xchg/.attrs.sh
     fi
-    source $stdenv/setup
 
     export NIX_STORE=${storeDir}
     export NIX_BUILD_TOP=/tmp
@@ -181,6 +178,8 @@ rec {
     export PATH=/empty
     cd "$NIX_BUILD_TOP"
 
+    source $stdenv/setup
+
     if ! test -e /bin/sh; then
       ${coreutils}/bin/mkdir -p /bin
       ${coreutils}/bin/ln -s ${bash}/bin/sh /bin/sh
@@ -205,7 +204,7 @@ rec {
       declare -a argsArray=()
       concatTo argsArray origArgs
       "$origBuilder" "''${argsArray[@]}"
-      echo $? > /build/xchg/in-vm-exit
+      echo $? > /tmp/xchg/in-vm-exit
 
       ${busybox}/bin/mount -o remount,ro dummy /
 
@@ -224,8 +223,7 @@ rec {
       -nographic -no-reboot \
       -device virtio-rng-pci \
       -virtfs local,path=${storeDir},security_model=none,mount_tag=store \
-      -virtfs local,path=/build,security_model=none,mount_tag=sa \
-      -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
+      -virtfs local,path=xchg,security_model=none,mount_tag=xchg \
       ''${diskImage:+-drive file=$diskImage,if=virtio,cache=unsafe,werror=report} \
       -kernel ${kernel}/${img} \
       -initrd ${initrd}/initrd \
@@ -235,15 +233,15 @@ rec {
 
 
   vmRunCommand = qemuCommand: writeText "vm-run" ''
+    ${coreutils}/bin/mkdir xchg
+    export > xchg/saved-env
+    PATH=${coreutils}/bin
+
     if [ -f "''${NIX_ATTRS_SH_FILE-}" ]; then
+      cp $NIX_ATTRS_JSON_FILE $NIX_ATTRS_SH_FILE xchg
       source "$NIX_ATTRS_SH_FILE"
     fi
     source $stdenv/setup
-    export > saved-env
-
-    PATH=${coreutils}/bin
-    mkdir xchg
-    mv saved-env xchg/
 
     eval "$preVM"
 
@@ -261,8 +259,6 @@ rec {
     cat > ./run-vm <<EOF
     #! ${bash}/bin/sh
     ''${diskImage:+diskImage=$diskImage}
-    TMPDIR=$TMPDIR
-    cd $TMPDIR
     ${qemuCommand}
     EOF
 

pkgs/build-support/vm/test.nix

@@ -24,6 +24,7 @@ in
   buildPatchelfInVM = runInLinuxVM patchelf;
 
   buildHelloInVM = runInLinuxVM hello;
+  buildStructuredAttrsHelloInVM = runInLinuxVM (hello.overrideAttrs { __structuredAttrs = true; });
 
   buildPcmanrmInVM = runInLinuxVM (pcmanfm.overrideAttrs (old: {
     # goes out-of-memory with many cores

pkgs/by-name/ap/apt/package.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.9.8";
+  version = "2.9.16";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-VPt7NL25PqIIESOrNfiTwm/g8+gApU6Onsy18+LslxA=";
+    hash = "sha256-9ncx162Jm4WZBYFPvtO03ic8/rhcGEUEPxR4x1LsnvQ=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/at/atop/package.nix

@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-m5TGZmAu//e/QC7M5wbDR/OMOctjSY+dOWJoYeVkbiA=";
   };
 
-  nativeBuildInputs = lib.optionals withAtopgpu [
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals withAtopgpu [
     python3.pkgs.wrapPython
   ];
 
@@ -30,7 +32,6 @@ stdenv.mkDerivation rec {
     glib
     zlib
     ncurses
-    pkg-config
   ] ++ lib.optionals withAtopgpu [
     python3
   ];

pkgs/by-name/bo/bombsquad/package.nix

@@ -22,11 +22,11 @@ let
     {
       x86_64-linux = {
         name = "BombSquad_Linux_x86_64";
-        hash = "sha256-jrExsqaM6uhnKMGPkJJTsKt2Imek+YDI2soSP/kfPj0=";
+        hash = "sha256-aujLYzFcKaW0ff7sRdyJ6SvSQowafWVbmwycQfDQUYY=";
       };
       aarch-64-linux = {
         name = "BombSquad_Linux_Arm64";
-        hash = "sha256-o1Yg0C5k07NZzc9jQrHXR+kkQl8HZ55U9/fqcpe3Iyw=";
+        hash = "sha256-pPP7QZzToTOQtSxzF7Q3ZzlDjUjQWMBM/y79d6Yf38I=";
       };
     }
     .${stdenv.targetPlatform.system} or (throw "${stdenv.targetPlatform.system} is unsupported.");

pkgs/by-name/ca/caligula/package.nix

@@ -1,9 +1,6 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, llvmPackages
-, stdenv
-, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,19 +16,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-ma7JVbWSiKfkCXCDwA8DFm2+KPrWR+8nSdgGSqehNg8=";
 
-  env = {
-     LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
-   };
-
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks; [
-      Cocoa
-      IOKit
-      Foundation
-      DiskArbitration
-    ]
-  );
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+  ];
 
   RUSTFLAGS = "--cfg tracing_unstable";
 

pkgs/by-name/ch/chainsaw/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "chainsaw";
-  version = "2.9.2";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oKlLFKCZNBcHURVvT0i8Hfym6r30ikndV30uuxjYgDM=";
+    hash = "sha256-ErDIfLhzCiFm3dZzr6ThjYCplfDKbALAqcu8c0gREH4=";
   };
 
-  cargoHash = "sha256-1w3DYP69aOphoqbsZIF9aX56Lftg2niKClmImLTa5DE=";
+  cargoHash = "sha256-WuPfYxI61wsQyOKqPF7/a3Hx9vMBCkTkoXsZczgeKpg=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation

pkgs/by-name/di/distrobuilder/generator.nix

@@ -1,4 +1,14 @@
-{ stdenvNoCC, lib, src, version, makeWrapper, coreutils, findutils, gnugrep, systemd }:
+{
+  stdenvNoCC,
+  lib,
+  src,
+  version,
+  makeWrapper,
+  coreutils,
+  findutils,
+  gnugrep,
+  systemd,
+}:
 
 stdenvNoCC.mkDerivation {
   name = "distrobuilder-nixos-generator";
@@ -14,6 +24,13 @@ stdenvNoCC.mkDerivation {
 
   installPhase = ''
     install -D -m 0555 distrobuilder/lxc.generator $out/lib/systemd/system-generators/lxc
-    wrapProgram $out/lib/systemd/system-generators/lxc --prefix PATH : ${lib.makeBinPath [coreutils findutils gnugrep systemd]}:${systemd}/lib/systemd
+    wrapProgram $out/lib/systemd/system-generators/lxc --prefix PATH : ${
+      lib.makeBinPath [
+        coreutils
+        findutils
+        gnugrep
+        systemd
+      ]
+    }:${systemd}/lib/systemd
   '';
 }

pkgs/by-name/di/distrobuilder/package.nix

@@ -1,34 +1,37 @@
-{ lib
-, buildGoModule
-, callPackage
-, cdrkit
-, coreutils
-, debootstrap
-, fetchFromGitHub
-, gnupg
-, gnutar
-, hivex
-, makeWrapper
-, nixosTests
-, pkg-config
-, squashfsTools
-, stdenv
-, wimlib
+{
+  lib,
+  buildGoModule,
+  callPackage,
+  cdrkit,
+  coreutils,
+  debootstrap,
+  fetchFromGitHub,
+  gnupg,
+  gnutar,
+  hivex,
+  makeWrapper,
+  nixosTests,
+  pkg-config,
+  squashfsTools,
+  stdenv,
+  wimlib,
 }:
 
 let
-  bins = [
-    coreutils
-    debootstrap
-    gnupg
-    gnutar
-    squashfsTools
-  ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    # repack-windows deps
-    cdrkit
-    hivex
-    wimlib
-  ];
+  bins =
+    [
+      coreutils
+      debootstrap
+      gnupg
+      gnutar
+      squashfsTools
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isx86_64 [
+      # repack-windows deps
+      cdrkit
+      hivex
+      wimlib
+    ];
 in
 buildGoModule rec {
   pname = "distrobuilder";
@@ -46,7 +49,6 @@ buildGoModule rec {
 
   buildInputs = bins;
 
-
   # tests require a local keyserver (mkg20001/nixpkgs branch distrobuilder-with-tests) but gpg is currently broken in tests
   doCheck = false;
 

pkgs/by-name/dm/dmarc-metrics-exporter/package.nix

@@ -7,7 +7,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dmarc-metrics-exporter";
-  version = "1.1.0";
+  version = "1.2.0";
 
   pyproject = true;
 
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "jgosmann";
     repo = "dmarc-metrics-exporter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xzIYlOZ1HeW+jbVDVlUPTIooFraQ0cJltsDoCzVMNsA=";
+    hash = "sha256-cIsI4TNYuLK0fpUg9lnbl5KSBtzQoT/pTByI9hiy/7o=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/et/etesync-dav/package.nix

@@ -3,7 +3,7 @@
 , nixosTests
 , python3
 , fetchFromGitHub
-, radicale3
+, radicale
 }:
 
 python3.pkgs.buildPythonApplication {
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication {
     flask-wtf
     msgpack
     setuptools
-    (python.pkgs.toPythonModule (radicale3.override { python3 = python; }))
+    (python.pkgs.toPythonModule (radicale.override { python3 = python; }))
     requests
     types-setuptools
   ] ++ requests.optional-dependencies.socks;

pkgs/by-name/et/etlegacy-assets/package.nix

@@ -5,7 +5,7 @@
 
 stdenv.mkDerivation {
   pname = "etlegacy-assets";
-  version = "2.82.0";
+  version = "2.83.1";
 
   srcs = let
     fetchAsset = { asset, hash }: fetchurl {

pkgs/by-name/et/etlegacy-unwrapped/package.nix

@@ -22,7 +22,7 @@
 , zlib
 }:
 let
-  version = "2.82.1";
+  version = "2.83.1";
   fakeGit = writeShellApplication {
     name = "git";
 
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     owner = "etlegacy";
     repo = "etlegacy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DA5tudbehXIU+4hX3ggcxWZ7AAOa8LUkIvUHbgMgDY8=";
+    hash = "sha256-k1H3irA9UVOICY3keKGVJMtBczW/b5ObyNvB7fGAcFA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/et/etlegacy/package.nix

@@ -7,7 +7,7 @@
 
 symlinkJoin {
   name = "etlegacy";
-  version = "2.82.1";
+  version = "2.83.1";
   paths = [
     etlegacy-assets
     etlegacy-unwrapped

pkgs/by-name/ev/evcc/package.nix

@@ -16,20 +16,20 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.131.6";
+  version = "0.131.8";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     rev = version;
-    hash = "sha256-r9GaihxC9ZQtTzKqfJ3LLDMzDEXeud7vTFEMOf0whFU=";
+    hash = "sha256-W04iXqABwp5fDesOZf633mS6caEsGv0lHEyCzqEv1WA=";
   };
 
   vendorHash = "sha256-x0EWFsR/O2Ztg39DL+yZx2ZDzJHADo2aPAeg/i+5KqM=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-4pQYv5UKoz3Gu5OS0zoYrjrFYD796MDb7ofWbTv3HlU=";
+    hash = "sha256-MjmqVyIj/foI6FFMydpbZA3wL09qs02eAq7Tk872JKM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fe/fedimint/package.nix

@@ -1,28 +1,13 @@
 { lib
 , buildPackages
-, clang
 , fetchFromGitHub
-, libclang
-, libiconv
-, llvmPackages_12
 , openssl
 , pkg-config
 , protobuf
 , rustPlatform
-, stdenv
-, Security
-, SystemConfiguration
 }:
-let
-  # Rust rocksdb bindings have C++ compilation/linking errors on Darwin when using newer clang
-  # Forcing it to clang 12 fixes the issue.
-  buildRustPackage =
-    if stdenv.hostPlatform.isDarwin then
-      rustPlatform.buildRustPackage.override { stdenv = llvmPackages_12.stdenv; }
-    else
-      rustPlatform.buildRustPackage;
-in
-buildRustPackage rec {
+
+rustPlatform.buildRustPackage rec {
   pname = "fedimint";
   version = "0.4.4";
 
@@ -38,17 +23,11 @@ buildRustPackage rec {
   nativeBuildInputs = [
     protobuf
     pkg-config
-    clang
-    (lib.getLib libclang)
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    libiconv
-    Security
-    SystemConfiguration
   ];
 
   outputs = [ "out" "fedimintCli" "fedimint" "gateway" "gatewayCli" "devimint" ];
@@ -79,7 +58,6 @@ buildRustPackage rec {
   PROTOC = "${buildPackages.protobuf}/bin/protoc";
   PROTOC_INCLUDE = "${protobuf}/include";
   OPENSSL_DIR = openssl.dev;
-  LIBCLANG_PATH = "${lib.getLib libclang}/lib";
 
   FEDIMINT_BUILD_FORCE_GIT_HASH = "0000000000000000000000000000000000000000";
 

pkgs/by-name/ga/gapless/package.nix

@@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gapless";
-  version = "4.0";
+  version = "4.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "neithern";
     repo = "g4music";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t9YthW8HZz2kXYPvidVRy7GVB2cRGEOCrXZtIpW65MA=";
+    hash = "sha256-lH3bogDbUjfNC6rC1UG2MiLRmc8YDaP0+STNKzg54dQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gc/gcov2lcov/package.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gcov2lcov";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "jandelgado";
     repo = "gcov2lcov";
     rev = "v${version}";
-    hash = "sha256-E8TPxaKJTd+5OP9e5S1FD5aZP42nJvjiqqNs4xP9gm4=";
+    hash = "sha256-ifXpT5jGNaStqvzP5Rq6Hf6PFhpiKMRC+eSYOZfzt+s=";
   };
 
   vendorHash = "sha256-/2OIBWXbNch6lmw0C1jkyJfNefJXOVG9/jNW8CYHTsc=";

pkgs/by-name/ge/gerrit/package.nix

@@ -1,12 +1,17 @@
-{ lib, stdenv, fetchurl, nixosTests }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nixosTests,
+}:
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.10.2";
+  version = "3.10.3";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-jsyL7j4ENzHVi07Uii0ouWXF3hkoGrq3NJi8fB1kj8o=";
+    hash = "sha256-pVI5YZihvJNuaboh2dLe/Aw371rNPiGbaLUd0ALpANQ=";
   };
 
   buildCommand = ''
@@ -40,7 +45,10 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     description = "Web based code review and repository management for the git version control system";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    maintainers = with maintainers; [ flokli zimbatm ];
+    maintainers = with maintainers; [
+      flokli
+      zimbatm
+    ];
     platforms = platforms.unix;
   };
 }

pkgs/by-name/gl/glab/package.nix

@@ -8,16 +8,16 @@
 
 buildGo123Module rec {
   pname = "glab";
-  version = "1.49.0";
+  version = "1.50.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-G9z9lISalj3ZXlvDY+qA+0NB6F7flBd1cTcGfxrM91U=";
+    hash = "sha256-WQO+9Fmlzj21UPJ9cdFc6JC8mbkzOWxz077JR+11BXA=";
   };
 
-  vendorHash = "sha256-SsWZO77KqDPzyEK57WaK4NpnDWUtZPP0qur2EvEoiL0=";
+  vendorHash = "sha256-nwHY0221nacHk4M+RKA8BEJLCoJJdIKwP0ZPjhYxc7Q=";
 
   ldflags = [
     "-s"

pkgs/by-name/go/goodvibes/package.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -18,21 +17,14 @@
 
 stdenv.mkDerivation rec {
   pname = "goodvibes";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KflLEc6BFA3pBY9HukEm5NluGi2igFNP6joOMdmZ0Ds=";
+    hash = "sha256-zqJbtCqdwKXy13WWoAwSRYVhAOJsHqOF0DriSDEigbI=";
   };
-  patches = [
-    # Fixes a compilation error
-    (fetchpatch {
-      url = "https://gitlab.com/goodvibes/goodvibes/-/commit/e332f831b91ee068a1a58846d7607b30ab010116.patch";
-      hash = "sha256-PzbTltbD0xWJAytCGg1TAwBLrICP+9QZbCbG1QQ8Qmw=";
-    })
-  ];
 
   nativeBuildInputs = [
     meson

pkgs/by-name/gr/grpcui/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpcui";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-OIwfLuWY7Y0t85v+P/0F55vEe0hNohlqMl16Omr8AF0=";
+    sha256 = "sha256-yk9SgQMUga7htP7XTKFk2JGzixxBV3y3PrnkzsiAMbw=";
   };
 
-  vendorHash = "sha256-dEek7q8OjFgCn+f/qyiQL/5qu8RJp38vZk3OrBREHx4=";
+  vendorHash = "sha256-uP5jtFji2E6GqpzjD7X5p59TXu7KQVBgEX+Gh0BIclM=";
 
   doCheck = false;
 

pkgs/by-name/in/incus/ui.nix

@@ -1,12 +1,13 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchYarnDeps
-, nodejs
-, fixup-yarn-lock
-, yarn
-, nixosTests
-, git
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  fixup-yarn-lock,
+  yarn,
+  nixosTests,
+  git,
 }:
 
 stdenv.mkDerivation rec {

pkgs/by-name/ko/komikku/package.nix

@@ -23,7 +23,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.63.0";
+  version = "1.64.0";
 
   format = "other";
 
@@ -32,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-+p5iTB98jpCqodvSEZ9Y8SM9W3M57Lpoh9jAzN3OmRs=";
+    hash = "sha256-EpKLez5gTHCSJYGvDqmzj6YO1dIugZKrEP4zE2G5TxA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ku/kube-bench/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-bench";
-  version = "0.9.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-x6xCrxePB/TR7BP1kLiVFjv4pLUJu9JVh5/Y0ebOjvY=";
+    hash = "sha256-wRY40yNXTcixCUYWFMQsfkI7MPE4RuxCEHBoedDpW9Y=";
   };
 
-  vendorHash = "sha256-d6GhZBHDSRgMVeglw8rhq5QF7gRH4hQOzTn0DZjvhiA=";
+  vendorHash = "sha256-bTpE8zJ6dCMimTowexehxnWPq3tXd0H9ZduJvCVqAlI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ku/kubecfg/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubecfg";
-  version = "0.35.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "kubecfg";
     repo = "kubecfg";
     rev = "v${version}";
-    hash = "sha256-/xfZcykOGYOnCkKQDUJ9k4xh+bwrDmy2iSNFPVLkjew=";
+    hash = "sha256-5xs9iE6sfFzoTq24DTNKOj4D+A5ezBKN1lfIdJCt+pk=";
   };
 
   vendorHash = "sha256-K2IyljE5QS/SZ6EXV42q/a5ru+0UXZ69oLNi94XKxw4=";

pkgs/by-name/la/lact/package.nix

@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = {
-    description = "Linux AMDGPU Controller";
+    description = "Linux GPU Configuration Tool for AMD and NVIDIA";
     homepage = "https://github.com/ilya-zlobintsev/LACT";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ figsoda atemu ];

pkgs/by-name/le/legcord/package.nix

@@ -11,20 +11,20 @@
 }:
 stdenv.mkDerivation rec {
   pname = "legcord";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "Legcord";
     repo = "Legcord";
     rev = "v${version}";
-    hash = "sha256-1nM0v8cjLcctvRcGHGtbyGxaqonIY8wM9s413NxTo+I=";
+    hash = "sha256-9CicqDZDetxElD36OLizyVNxkqz3rQOjAtUNTGWVwss=";
   };
 
   nativeBuildInputs = [ pnpm.configHook nodejs makeWrapper copyDesktopItems ];
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-E1kT3WiCYkLwrfHa11P1Z6e0fVnZSpXEQStr1NPjEJU=";
+    hash = "sha256-5GE/I2xLmu2Wu9mjzZMk1YZvtS5PgpwgXnxuY+4nimQ=";
   };
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

pkgs/by-name/li/libkrun/package.nix

@@ -11,7 +11,6 @@
 , pipewire
 , virglrenderer
 , libkrunfw
-, llvmPackages
 , rustc
 , withGpu ? false
 , withSound ? false
@@ -38,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    llvmPackages.clang
     rustPlatform.cargoSetupHook
+    rustPlatform.bindgenHook
     cargo
     rustc
   ] ++ lib.optional (sevVariant || withGpu) pkg-config;
@@ -52,8 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withSound pipewire
     ++ lib.optional sevVariant openssl;
 
-  env.LIBCLANG_PATH = "${lib.getLib llvmPackages.clang-unwrapped}/lib/libclang.so";
-
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ] ++ lib.optional withGpu "GPU=1"

pkgs/by-name/lo/lockbook/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "lockbook";
+  version = "0.9.15";
+
+  src = fetchFromGitHub {
+    owner = "lockbook";
+    repo = "lockbook";
+    rev = "refs/tags/${version}";
+    hash = "sha256-hqBjA/6MWlhVjV4m+cIcnoRTApHuzbPzivMsaQHfRcc=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-+M+wL26KDbLKhcujPyWAsTlXwLrQVCUbTnnu/7sXul4=";
+
+  doCheck = false; # there are no cli tests
+  cargoBuildFlags = [
+    "--package"
+    "lockbook-cli"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --bash --name lockbook.bash <($out/bin/lockbook completions bash)
+    installShellCompletion --zsh --name _lockbook <($out/bin/lockbook completions zsh)
+    installShellCompletion --fish --name lockbook.fish <($out/bin/lockbook completions fish)
+  '';
+
+  meta = {
+    description = "Private, polished note-taking platform";
+    longDescription = ''
+      Write notes, sketch ideas, and store files in one secure place.
+      Share seamlessly, keep data synced, and access it on any
+      platform—even offline. Lockbook encrypts files so even we
+      can’t see them, but don’t take our word for it:
+      Lockbook is 100% open-source.
+    '';
+    homepage = "https://lockbook.net";
+    license = lib.licenses.unlicense;
+    platforms = lib.platforms.all;
+    changelog = "https://github.com/lockbook/lockbook/releases";
+    maintainers = [ lib.maintainers.parth ];
+  };
+}

pkgs/by-name/lx/lxcfs/package.nix

@@ -53,7 +53,12 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # `mount` hook requires access to the `mount` command from `util-linux` and `readlink` from `coreutils`:
-    wrapProgram "$out/share/lxcfs/lxc.mount.hook" --prefix PATH : ${lib.makeBinPath [ coreutils util-linux ]}
+    wrapProgram "$out/share/lxcfs/lxc.mount.hook" --prefix PATH : ${
+      lib.makeBinPath [
+        coreutils
+        util-linux
+      ]
+    }
   '';
 
   postFixup = ''

pkgs/by-name/mi/microsoft-identity-broker/package.nix

@@ -1,14 +1,15 @@
-{ stdenv
-, lib
-, fetchurl
-, dpkg
-, openjdk11
-, jnr-posix
-, makeWrapper
-, openjfx17
-, zip
-, nixosTests
-, bash
+{
+  stdenv,
+  lib,
+  fetchurl,
+  dpkg,
+  openjdk11,
+  jnr-posix,
+  makeWrapper,
+  openjfx17,
+  zip,
+  nixosTests,
+  bash,
 }:
 stdenv.mkDerivation rec {
   pname = "microsoft-identity-broker";
@@ -16,10 +17,15 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/microsoft-identity-broker/microsoft-identity-broker_${version}_amd64.deb";
-    hash = "sha256-I4Q6ucT6ps8/QGiQTNbMXcKxq6UMcuwJ0Prcqvov56M=";
+    hash = "sha256-v/FxtdvRaUHYqvFSkJIZyicIdcyxQ8lPpY5rb9smnqA=";
   };
 
-  nativeBuildInputs = [ dpkg makeWrapper openjdk11 zip ];
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+    openjdk11
+    zip
+  ];
 
   buildPhase = ''
     runHook preBuild
@@ -93,11 +99,11 @@ stdenv.mkDerivation rec {
     tests = { inherit (nixosTests) intune; };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Microsoft Authentication Broker for Linux";
     homepage = "https://www.microsoft.com/";
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ rhysmdnz ];
   };

pkgs/by-name/ml/mlx42/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mlx42";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "codam-coding-college";
     repo = "MLX42";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-jYcBvvx0Xfc/wDWSUROfQeRvn+tWvSS0ymKO1iuzg8w=";
+    hash = "sha256-/HCP6F7N+J97n4orlLxg/4agEoq4+rJdpeW/3q+DI1I=";
   };
 
   postPatch =

pkgs/by-name/mo/morf/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "morf";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "amrudesh1";
+    repo = "morf";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3PJ+YtKSH6HHAXBSHO8iMP2HFiuW1RQ0N8iUjQD7NBw=";
+  };
+
+  vendorHash = "sha256-tK58UGCI7CuJsFSM7htRQT98tzunAOXyYAxhCkdTJdU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Offensive mobile security tool designed to identify and address sensitive information";
+    homepage = "https://github.com/amrudesh1/morf";
+    changelog = "https://github.com/amrudesh1/morf/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "morf";
+  };
+}

pkgs/by-name/mq/mqtt-randompub/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mqtt-randompub";
-  version = "0.2.2";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabaff";
     repo = "mqtt-randompub";
     rev = "refs/tags/${version}";
-    hash = "sha256-vAFEVlw9reRP+4Qwywv+cP27SU1c3seL3Z+b/YfUdl8=";
+    hash = "sha256-X9gITmzyUNtYW8IMTcBiubPscBEO5OGjdxot9wRD/BY=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/mu/mullvad-vpn/package.nix

@@ -1,32 +1,35 @@
-{ stdenv
-, lib
-, fetchurl
-, dpkg
-, alsa-lib
-, atk
-, cairo
-, cups
-, dbus
-, expat
-, fontconfig
-, freetype
-, gdk-pixbuf
-, glib
-, pango
-, nspr
-, nss
-, gtk3
-, mesa
-, libGL
-, wayland
-, xorg
-, autoPatchelfHook
-, systemd
-, libnotify
-, libappindicator
-, makeWrapper
-, coreutils
-, gnugrep
+{
+  stdenv,
+  lib,
+  fetchurl,
+  dpkg,
+  alsa-lib,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  expat,
+  fontconfig,
+  freetype,
+  gdk-pixbuf,
+  glib,
+  pango,
+  nspr,
+  nss,
+  gtk3,
+  mesa,
+  libGL,
+  wayland,
+  xorg,
+  autoPatchelfHook,
+  systemd,
+  libnotify,
+  libappindicator,
+  makeWrapper,
+  coreutils,
+  gnugrep,
+
+  versionCheckHook,
 }:
 
 let
@@ -64,9 +67,11 @@ let
     systemd
   ];
 
-  version = "2024.6";
+  version = "2024.7";
 
-  selectSystem = attrs: attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  selectSystem =
+    attrs:
+    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   platform = selectSystem {
     x86_64-linux = "amd64";
@@ -74,8 +79,8 @@ let
   };
 
   hash = selectSystem {
-    x86_64-linux = "sha256-paP9W23AbA9O4MiTdF5r7N50GgT4xu2vb9ktfBdPqDM=";
-    aarch64-linux = "sha256-5FRPjiLyWDe7RNlhkiF4NUaCxVkfXZbxeoQxNAAls/I=";
+    x86_64-linux = "sha256-l6uWrOzMzn8bF5iZzfa/xffLIvAPsCaLwzcRPRW3t0o=";
+    aarch64-linux = "sha256-/RLTjhkiH9WdYO56njnxQyJ0nSaAq/awrkm0NhctFZY=";
   };
 in
 
@@ -99,7 +104,13 @@ stdenv.mkDerivation {
   dontBuild = true;
   dontConfigure = true;
 
-  runtimeDependencies = [ (lib.getLib systemd) libGL libnotify libappindicator wayland ];
+  runtimeDependencies = [
+    (lib.getLib systemd)
+    libGL
+    libnotify
+    libappindicator
+    wayland
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -115,7 +126,12 @@ stdenv.mkDerivation {
 
     wrapProgram $out/bin/mullvad-vpn \
       --set MULLVAD_DISABLE_UPDATE_NOTIFICATION 1 \
-      --prefix PATH : ${lib.makeBinPath [ coreutils gnugrep ]}
+      --prefix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          gnugrep
+        ]
+      }
 
     wrapProgram $out/bin/mullvad-daemon \
         --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad/resources"
@@ -128,16 +144,26 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
   passthru.updateScript = ./update.sh;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/mullvad/mullvadvpn-app";
     description = "Client for Mullvad VPN";
     changelog = "https://github.com/mullvad/mullvadvpn-app/blob/${version}/CHANGELOG.md";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.gpl3Only;
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ Br1ght0ne ymarkus ataraxiasjel ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    badPlatforms = [ lib.systems.inspect.patterns.isDarwin ];
+    maintainers = with lib.maintainers; [
+      Br1ght0ne
+      ymarkus
+      ataraxiasjel
+    ];
   };
-
 }

pkgs/by-name/mx/mxt-app/package.nix

@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, libtool }:
 
 stdenv.mkDerivation rec {
-  version="1.40";
+  version="1.41";
   pname = "mxt-app";
 
   src = fetchFromGitHub {
     owner = "atmel-maxtouch";
     repo = "mxt-app";
     rev = "v${version}";
-    sha256 = "sha256-ZquD1aZu/TJQdr7QwKHTbCwSCFxt4drVBm4D1FLlzF0=";
+    sha256 = "sha256-Sn83k04ctwyVH90wnPIFuH91epPgLt1mWY+07r5eKpk=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/by-name/nc/nchat/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nchat";
-  version = "5.2.11";
+  version = "5.3.5";
 
   src = fetchFromGitHub {
     owner = "d99kris";
     repo = "nchat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LcTVftLKlzHstSaJjdtqoEmQ7kiqft9dbXRXoYjbaus=";
+    hash = "sha256-Nnu2Bk11Crk2vhvQqlDFo42duDqkNRCwDq4xCKIXwLQ=";
   };
 
   postPatch = ''

pkgs/by-name/ne/neothesia/package.nix

@@ -6,7 +6,6 @@
 , alsa-lib
 , wayland
 , makeWrapper
-, llvmPackages
 , libxkbcommon
 , vulkan-loader
 , xorg
@@ -33,8 +32,8 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [
     pkg-config
-    llvmPackages.clang
     makeWrapper
+    rustPlatform.bindgenHook
   ];
 
   cargoLock = {
@@ -54,10 +53,6 @@ rustPlatform.buildRustPackage {
     install -Dm 644 flatpak/com.github.polymeilex.neothesia.png $out/share/icons/hicolor/256x256/apps/com.github.polymeilex.neothesia.png
   '';
 
-  env = {
-    LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
-  };
-
   meta = {
     description = "Flashy Synthesia Like Software For Linux, Windows and macOS";
     homepage = "https://github.com/PolyMeilex/Neothesia";

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py

@@ -238,7 +238,6 @@ def execute(argv: list[str]) -> None:
                 path_to_config = nix.nixos_build_flake(
                     "toplevel",
                     flake,
-                    keep_going=True,
                     dry_run=dry_run,
                     **flake_build_flags,
                 )
@@ -247,7 +246,6 @@ def execute(argv: list[str]) -> None:
                     "system",
                     args.attr,
                     args.file,
-                    keep_going=True,
                     dry_run=dry_run,
                     **build_flags,
                 )
@@ -266,7 +264,6 @@ def execute(argv: list[str]) -> None:
                 path_to_config = nix.nixos_build_flake(
                     attr,
                     flake,
-                    keep_going=True,
                     **flake_build_flags,
                 )
             else:
@@ -274,7 +271,6 @@ def execute(argv: list[str]) -> None:
                     attr,
                     args.attr,
                     args.file,
-                    keep_going=True,
                     **build_flags,
                 )
             vm_path = next(path_to_config.glob("bin/run-*-vm"), "./result/bin/run-*-vm")

pkgs/by-name/nu/nufmt/package.nix

@@ -4,28 +4,29 @@
   fetchFromGitHub,
   rustPlatform,
   apple-sdk_11,
-  llvmPackages,
   nix-update-script,
-  ...
 }:
+
 rustPlatform.buildRustPackage {
   pname = "nufmt";
-  version = "0-unstable-2024-10-20";
+  version = "0-unstable-2024-11-21";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nufmt";
-    rev = "decc88ef8e11a14081c2dd86c6ea0c94d6d2861d";
-    hash = "sha256-AurQGIZDYOkMMyAEXP01QziISQcSME3GFtvqjCDoeiw=";
+    rev = "628a3b73ea637c96f2c191ae066cf1cecadeafa3";
+    hash = "sha256-ideILLOawU6BNawmr4lqt2LGkf29wvlwQe9gqgdYRiI=";
   };
 
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+  ];
+
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_11
   ];
 
-  env.LIBCLANG_PATH = lib.optionalString stdenv.cc.isClang "${lib.getLib llvmPackages.libclang}/lib";
-
-  cargoHash = "sha256-5DS6pTYGOQ4qay6+YiUstInRX17n3RViNxKXtFZ6J3k=";
+  cargoHash = "sha256-MHZlXmHAYIiaB6Isutqjrh45jppRzTZRSE3VqzpFBBA=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/op/opentabletdriver/package.nix

@@ -1,44 +1,51 @@
-{ lib
-, buildDotnetModule
-, fetchFromGitHub
-, gtk3
-, libX11
-, libXrandr
-, libappindicator
-, libevdev
-, libnotify
-, udev
-, copyDesktopItems
-, makeDesktopItem
-, nixosTests
-, wrapGAppsHook3
-, jq
-, coreutils
-, dotnetCorePackages
+{
+  lib,
+  buildDotnetModule,
+  copyDesktopItems,
+  coreutils,
+  dotnetCorePackages,
+  fetchFromGitHub,
+  gtk3,
+  jq,
+  libappindicator,
+  libevdev,
+  libnotify,
+  libX11,
+  libXrandr,
+  makeDesktopItem,
+  nixosTests,
+  udev,
+  wrapGAppsHook3,
 }:
 
 buildDotnetModule rec {
   pname = "OpenTabletDriver";
-  version = "0.6.4.0";
+  version = "0.6.4.0-unstable-2024-11-25";
 
   src = fetchFromGitHub {
     owner = "OpenTabletDriver";
     repo = "OpenTabletDriver";
-    rev = "v${version}";
-    hash = "sha256-zK+feU96JOXjmkTndM9VyUid3z+MZFxJGH+MXaB6kzk=";
+    rev = "8b88b8bdc5144391f10eb61ee77803ba0ee83718"; # 0.6.x branch
+    hash = "sha256-5JKkSqV9owkHgWXfjiyv5QRh86apDCPzpA6qha1i4D4=";
   };
 
-  patches = [
-    ./remove-git-from-generate-rules.patch
+  dotnetInstallFlags = [ "--framework=net8.0" ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+
+  projectFile = [
+    "OpenTabletDriver.Console"
+    "OpenTabletDriver.Daemon"
+    "OpenTabletDriver.UX.Gtk"
   ];
-
-  dotnetInstallFlags = [ "--framework=net6.0" ];
-
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
-  projectFile = [ "OpenTabletDriver.Console" "OpenTabletDriver.Daemon" "OpenTabletDriver.UX.Gtk" ];
   nugetDeps = ./deps.nix;
 
-  executables = [ "OpenTabletDriver.Console" "OpenTabletDriver.Daemon" "OpenTabletDriver.UX.Gtk" ];
+  executables = [
+    "OpenTabletDriver.Console"
+    "OpenTabletDriver.Daemon"
+    "OpenTabletDriver.UX.Gtk"
+  ];
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -49,11 +56,11 @@ buildDotnetModule rec {
 
   runtimeDeps = [
     gtk3
-    libX11
-    libXrandr
     libappindicator
     libevdev
     libnotify
+    libX11
+    libXrandr
     udev
   ];
 
@@ -84,6 +91,8 @@ buildDotnetModule rec {
 
   preBuild = ''
     patchShebangs generate-rules.sh
+    substituteInPlace generate-rules.sh \
+      --replace-fail '/usr/bin/env rm' '${lib.getExe' coreutils "rm"}'
   '';
 
   postFixup = ''
@@ -94,10 +103,10 @@ buildDotnetModule rec {
 
     install -Dm644 $src/OpenTabletDriver.UX/Assets/otd.png -t $out/share/pixmaps
 
+    # Generate udev rules from source
+    export OTD_CONFIGURATIONS="$src/OpenTabletDriver.Configurations/Configurations"
     mkdir -p $out/lib/udev/rules.d
-    ./generate-rules.sh \
-      | sed 's@/usr/bin/env rm@${lib.getExe' coreutils "rm"}@' \
-      > $out/lib/udev/rules.d/70-opentabletdriver.rules
+    ./generate-rules.sh > $out/lib/udev/rules.d/70-opentabletdriver.rules
   '';
 
   desktopItems = [
@@ -106,7 +115,7 @@ buildDotnetModule rec {
       name = "OpenTabletDriver";
       exec = "otd-gui";
       icon = "otd";
-      comment = meta.description;
+      comment = "Open source, cross-platform, user-mode tablet driver";
       categories = [ "Utility" ];
     })
   ];
@@ -118,12 +127,18 @@ buildDotnetModule rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Open source, cross-platform, user-mode tablet driver";
     homepage = "https://github.com/OpenTabletDriver/OpenTabletDriver";
-    license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ gepbird thiagokokada ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [
+      gepbird
+      thiagokokada
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "otd";
   };
 }

pkgs/by-name/op/opentabletdriver/update.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts nixfmt-rfc-style
+set -eo pipefail
+
+verlte() {
+    printf '%s\n' "$1" "$2" | sort -C -V
+}
+
+new_version="$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/OpenTabletDriver/OpenTabletDriver/releases" |
+    jq -r  'map(select(.prerelease == false)) | .[0].tag_name' |
+    cut -c2-)"
+old_version="$(nix --extra-experimental-features 'nix-command' eval --file default.nix opentabletdriver.version --raw)"
+
+if verlte "$new_version" "$old_version"; then
+  echo "Already up to date!"
+  [[ "${1}" != "--force" ]] && exit 0
+fi
+
+update-source-version opentabletdriver "$new_version"
+eval "$(nix-build -A opentabletdriver.fetch-deps --no-out-link)"
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+nixfmt deps.nix

pkgs/by-name/ox/ox/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ox";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "curlpipe";
     repo = pname;
     rev = version;
-    hash = "sha256-7rP/h3MlrMZl9yd655uRrnv1aUB57LzdyKs66wHp33Y=";
+    hash = "sha256-yAToibHhvHAry7WVZ5uD84CbUTp06RyZ9J12/2deM1I=";
   };
 
-  cargoHash = "sha256-z9pyMnYQZfCCVdVEakj3q27SFLahMDWRuAopYye6RIY=";
+  cargoHash = "sha256-YAy5vCxcHUL0wM9+Y3GDqV/V1utL3V05heT92/zQ/X8=";
 
   passthru = {
     tests.version = testers.testVersion {

pkgs/by-name/pa/parca-agent/package.nix

@@ -0,0 +1,47 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+}:
+
+buildGoModule rec {
+  pname = "parca-agent";
+  version = "0.35.0";
+
+  src = fetchFromGitHub {
+    owner = "parca-dev";
+    repo = "parca-agent";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5MoHX47uUtQgszNuu9ImLJPYnaN2NKZKOPa60PMHDL0=";
+    fetchSubmodules = true;
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-v2OnCuOI9inZ4WiU/3PbBwK6ZcvZX21MNsLhRWZ6sGY=";
+
+  buildInputs = [
+    stdenv.cc.libc.static
+  ];
+
+  ldflags = [
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+    "-extldflags=-static"
+  ];
+
+  tags = [
+    "osusergo"
+    "netgo"
+  ];
+
+  meta = {
+    description = "eBPF based, always-on profiling agent";
+    homepage = "https://github.com/parca-dev/parca-agent";
+    changelog = "https://github.com/parca-dev/parca-agent/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+    mainProgram = "parca-agent";
+  };
+}

pkgs/by-name/pa/parca-debuginfo/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "parca-debuginfo";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "parca-dev";
+    repo = "parca-debuginfo";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gL1BgDtEf2Q7yxzpoiTJY+nsRlsWv3zYzLVvaVijMDM=";
+  };
+
+  vendorHash = "sha256-xtKkKhKQmZcCIFTOH+oM5a2cPlAWlJPRNQWfrAl2948=";
+
+  ldflags = [
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+  ];
+
+  meta = {
+    description = "Command line utility for handling debuginfos";
+    changelog = "https://github.com/parca-dev/parca-debuginfo/releases/tag/v${version}";
+    homepage = "https://github.com/parca-dev/parca-debuginfo";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.unix;
+    mainProgram = "parca-debuginfo";
+  };
+}

pkgs/by-name/pg/pg_top/package.nix

@@ -1,30 +1,47 @@
-{ lib, stdenv, fetchurl, ncurses, postgresql }:
+{
+  cmake,
+  fetchurl,
+  lib,
+  libbsd,
+  libelf,
+  ncurses,
+  postgresql,
+  stdenv,
+}:
 
 stdenv.mkDerivation rec {
   pname = "pg_top";
-  version = "3.7.0";
+  version = "4.1.0";
 
   src = fetchurl {
-    url = "https://pgfoundry.org/frs/download.php/1781/pg_top-${version}.tar.gz";
-    sha256 = "17xrv0l58rv3an06gkajzw0gg6v810xx6vl137an1iykmhvfh7h2";
+    url = "https://pg_top.gitlab.io/source/pg_top-${version}.tar.xz";
+    sha256 = "sha256-WdSiQURJgtBCYoS/maImppcyM8wzUIJzLWmiSZPlx1Q=";
   };
 
-  buildInputs = [ ncurses postgresql ];
+  buildInputs = [
+    libbsd
+    libelf
+    ncurses
+    postgresql
+  ];
+
+  nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
     description = "'top' like tool for PostgreSQL";
     longDescription = ''
       pg_top allows you to:
        * View currently running SQL statement of a process.
-       * View query plan of a currently running SQL statement.
+       * View query plan of a currently running SELECT statement.
        * View locks held by a process.
-       * View user table statistics.
-       * View user index statistics.
+       * View I/O statistics per process.
+       * View replication statistics for downstream nodes.
     '';
 
-    homepage = "http://ptop.projects.postgresql.org/";
+    homepage = "https://pg_top.gitlab.io";
+    changelog = "https://gitlab.com/pg_top/pg_top/-/blob/main/HISTORY.rst";
     platforms = platforms.linux;
-    license = licenses.free; # see commands.c
+    license = licenses.bsd3;
     mainProgram = "pg_top";
   };
 }

pkgs/by-name/pr/pragtical/package.nix

@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pragtical";
-  version = "3.5.0";
+  version = "3.5.1";
   pluginManagerVersion = "1.2.9";
 
   src = fetchFromGitHub {
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
       find subprojects -type d -name .git -prune -execdir rm -r {} +
     '';
 
-    hash = "sha256-a9LnLKtJ33YHtlnhWmKBeW5dOjjwa7PmaZjYh0+Nx9g=";
+    hash = "sha256-o19akSgsWLRTyHT+dvmTeTS4HtNfzEyNXBhVot92OD4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/readarr/package.nix

@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-VI0mdNGPyT45GUrp3hpBQVe1xx/BBbMWz7iJQvvrg9E=";
-    arm64-linux_hash = "sha256-4ahiRo13qOEUSzrwXFVRj26U0l5GblXfw7sjY8sCLxQ=";
-    x64-osx_hash = "sha256-1HtarF+eAU2d3dQiw3n/DCIFCbgN4GEUFMlYxy8uglA=";
+    x64-linux_hash = "sha256-48ZlBTr/lO1AAsYInu48fDB77RXH+b2hXjDPwWdeZW4=";
+    arm64-linux_hash = "sha256-vyNoI1ffqWyYCfH+3rRNtaECkku3pF3pD+2RBchD+6o=";
+    x64-osx_hash = "sha256-VeGq+kVuBLGqERcWyvPfcygAG0/262J9/RPr49X4jtE=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.4.3.2665";
+  version = "0.4.4.2686";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";

pkgs/by-name/re/restinio/package.nix

@@ -21,13 +21,13 @@ assert !with_boost_asio -> asio != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "restinio";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Stiffstream";
     repo = "restinio";
     rev = "v.${finalAttrs.version}";
-    hash = "sha256-Nv/VVdHciCv+DsVu3MqfXeAa8Ef+qi6c1OaTAVrYUg0=";
+    hash = "sha256-heVdo0MtsWi/r9yse+/FZ55lhiunyEdwB3UkOOY5Vj0=";
   };
 
   strictDeps = true;

pkgs/by-name/rf/rfc/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rfc";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "bfontaine";
     repo = "rfc";
     rev = "v${version}";
-    hash = "sha256-zN+MQtHh69PkzbrfceHFpBYCPmTg9qrOf/ML2efq6Xk=";
+    hash = "sha256-bCqgLkbZGQFcxhLwekVw+rUGinXTc7QJHlVRGtNf6Jc=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];

pkgs/by-name/ru/rustls-ffi/package.nix

@@ -15,19 +15,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rustls-ffi";
-  version = "0.13.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "rustls";
     repo = "rustls-ffi";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Bc9bVZ2pDsG118l/SlElZpgh9F1JEgPF8LzBX7d4mhE=";
+    hash = "sha256-ZKAyKcKwhnPE6PrfBFjLJKkTlGbdLcmW1EP/xSv2cpM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     src = finalAttrs.src;
     name = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-gDQ9AFrJuV7SrzKCAHQBkKj6clXuPLO0DHhnvcBqRLs=";
+    hash = "sha256-IaOhQfDEgLhGmes0xzhLVym29aP691TY0EXdOIgXEMA=";
   };
 
   propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
@@ -54,7 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = {
     curl = curl.override { opensslSupport = false; rustlsSupport = true; rustls-ffi = finalAttrs.finalPackage; };
-    apacheHttpd = apacheHttpd.override { modTlsSupport = true; rustls-ffi = finalAttrs.finalPackage; };
     pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 

pkgs/by-name/se/servo/package.nix

@@ -110,6 +110,7 @@ rustPlatform.buildRustPackage {
     perl
     pkg-config
     python3
+    rustPlatform.bindgenHook
     taplo
     which
     yasm
@@ -142,8 +143,6 @@ rustPlatform.buildRustPackage {
       --prefix LD_LIBRARY_PATH : ${runtimePaths}
   '';
 
-  LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";
-
   meta = {
     description = "The embeddable, independent, memory-safe, modular, parallel web rendering engine";
     homepage = "https://servo.org";

pkgs/by-name/sv/svd2rust/package.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svd2rust";
-  version = "0.33.5";
+  version = "0.35.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-wZfCk8jzTmltpmrp7QWU1uS5ct10iltNFdUCJvnrv98=";
+    hash = "sha256-KLwIwJtPBQ8Sa94/IEJhIGTx/n3oYQKINmNV5L5TJV0=";
   };
 
-  cargoHash = "sha256-5m3/5zwjDeDgPuUsTIknXwEMjQs0gtVoksQn4EdPnwM=";
+  cargoHash = "sha256-4a89Do57KFKu/RDTB4BxUxVlO46HL5aEhhHmnzLuZGo=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''

pkgs/by-name/tb/tbls/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.78.0";
+  version = "1.79.4";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-vqt4IlVvqlUjDqvcdiRctt/VuEkZ5YzCXYHvHfc87Ew=";
+    hash = "sha256-o/ZhXoenK3xlflRMXS9NtnW23VBiDmDPSGlHtE3cNiM=";
   };
 
-  vendorHash = "sha256-cnACY+NIjsVe6BU7AjTO+yLDn0f1HO1gHnw5SgqKuy4=";
+  vendorHash = "sha256-SkddF8ZxvGRQ+/tWnmlcoaTs3MRfVgQWX4MZ05nZ9XA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/te/terraform-backend-git/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terraform-backend-git";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "plumber-cd";
     repo = "terraform-backend-git";
     rev = "v${version}";
-    hash = "sha256-mLgUA7f4enlVuQx4VM3QbNuaAq7FgDaRyiG0sbT31ng=";
+    hash = "sha256-mZbGMv5b9wK/gWqQB75sDJIVURrS6t/L7WBhTonaatQ=";
   };
 
   vendorHash = "sha256-vFx59dIdniLRP0xHcD3c22GidZOPdGZvmvg/BvxFBGI=";

pkgs/by-name/up/updatecli/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "updatecli";
-  version = "0.82.0";
+  version = "0.88.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${version}";
-    hash = "sha256-kNc+Z+v4fvuWO/Ibr9VOekMDT39YEwA/fReP+e3C74U=";
+    hash = "sha256-qWggdLNF6iWrbcKgdR3Tr19bwK5wS5ffadS3kMFGp5E=";
   };
 
-  vendorHash = "sha256-fnx0EAGxau0+ktnuUb8ljolNAlwu2595FMjsDbM2MiY=";
+  vendorHash = "sha256-feBmzBrV6yoepU8CiqKaB/bCWIhuiDNhMTem0y1Lynw=";
 
   # tests require network access
   doCheck = false;

pkgs/by-name/ve/vencord/package.nix

@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.10.7";
+  version = "1.10.8";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/CZzRIXD0shEok9H+Vx7s9BmzXTI6ly957jvS+nU2fI=";
+    hash = "sha256-2UOz8o+3jWppk6lWatbG0avcqBFpxHYSMEspCpFWWOk=";
   };
 
   pnpmDeps = pnpm.fetchDeps {

pkgs/by-name/xa/xautocfg/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libX11,
+  libXi,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xautocfg";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "SFTtech";
+    repo = "xautocfg";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-NxfuBknNRicmEAPBeMaNb57gpM0y0t+JmNMKpSNzlQM=";
+  };
+
+  buildInputs = [
+    libX11
+    libXi
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "MANPREFIX=${placeholder "out"}"
+  ];
+
+  meta = {
+    homepage = "https://github.com/SFTtech/xautocfg";
+    description = "Automatic keyboard repeat rate configuration for new keyboards";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jceb ];
+    mainProgram = "xautocfg";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/development/compilers/binaryen/default.nix

@@ -1,53 +1,61 @@
 { lib, stdenv, cmake, python3, fetchFromGitHub, emscripten,
   gtest, lit, nodejs, filecheck
 }:
-
-stdenv.mkDerivation rec {
-  pname = "binaryen";
-  version = "118";
-
-  src = fetchFromGitHub {
+let
+  testsuite = fetchFromGitHub {
     owner = "WebAssembly";
-    repo = "binaryen";
-    rev = "version_${version}";
-    hash = "sha256-akMW3S2/qUyLK8F77EtnaXPDXvIMpkGfNB2jOD6hQho=";
+    repo = "testsuite";
+    rev = "e05365077e13a1d86ffe77acfb1a835b7aa78422";
+    hash = "sha256-yvZ5AZTPUA6nsD3xpFC0VLthiu2CxVto66RTXBXXeJM=";
   };
+in
+  stdenv.mkDerivation rec {
+    pname = "binaryen";
+    version = "119";
 
-  nativeBuildInputs = [ cmake python3 ];
+    src = fetchFromGitHub {
+      owner = "WebAssembly";
+      repo = "binaryen";
+      rev = "version_${version}";
+      hash = "sha256-JYXtN3CW4qm/nnjGRvv3GxQ0x9O9wHtNYQLqHIYTTOA=";
+    };
 
-  preConfigure = ''
-    if [ $doCheck -eq 1 ]; then
-      sed -i '/googletest/d' third_party/CMakeLists.txt
-    else
-      cmakeFlagsArray=($cmakeFlagsArray -DBUILD_TESTS=0)
-    fi
-  '';
+    nativeBuildInputs = [ cmake python3 ];
 
-  nativeCheckInputs = [ gtest lit nodejs filecheck ];
-  checkPhase = ''
-    LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib python3 ../check.py $tests
-  '';
+    preConfigure = ''
+      if [ $doCheck -eq 1 ]; then
+        sed -i '/googletest/d' third_party/CMakeLists.txt
+        rmdir test/spec/testsuite
+        ln -s ${testsuite} test/spec/testsuite
+      else
+        cmakeFlagsArray=($cmakeFlagsArray -DBUILD_TESTS=0)
+      fi
+    '';
 
-  tests = [
-    "version" "wasm-opt" "wasm-dis"
-    "crash" "dylink" "ctor-eval"
-    "wasm-metadce" "wasm-reduce" "spec"
-    "lld" "wasm2js" "validator"
-    "example" "unit"
-    # "binaryenjs" "binaryenjs_wasm" # not building this
-    "lit" "gtest"
-  ];
-  doCheck = stdenv.hostPlatform.isLinux;
+    nativeCheckInputs = [ gtest lit nodejs filecheck ];
+    checkPhase = ''
+      LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib python3 ../check.py $tests
+    '';
 
-  meta = with lib; {
-    homepage = "https://github.com/WebAssembly/binaryen";
-    description = "Compiler infrastructure and toolchain library for WebAssembly, in C++";
-    platforms = platforms.all;
-    maintainers = with maintainers; [ asppsa willcohen ];
-    license = licenses.asl20;
-  };
+    tests = [
+      "version" "wasm-opt" "wasm-dis"
+      "crash" "dylink" "ctor-eval"
+      "wasm-metadce" "wasm-reduce" "spec"
+      "lld" "wasm2js" "validator"
+      "example" "unit"
+      # "binaryenjs" "binaryenjs_wasm" # not building this
+      "lit" "gtest"
+    ];
+    doCheck = stdenv.isLinux;
 
-  passthru.tests = {
-    inherit emscripten;
-  };
-}
+    meta = with lib; {
+      homepage = "https://github.com/WebAssembly/binaryen";
+      description = "Compiler infrastructure and toolchain library for WebAssembly, in C++";
+      platforms = platforms.all;
+      maintainers = with maintainers; [ asppsa willcohen ];
+      license = licenses.asl20;
+    };
+    passthru.tests = {
+      inherit emscripten;
+    };
+  }

pkgs/development/compilers/emscripten/default.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.64";
+  version = "3.1.73";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-2dsIuB6P+Z3wflIsn6QaZvjHeHHGzsFAI3GcP3SfiP4=";
+    npmDepsHash = "sha256-bqxUlxpIH1IAx9RbnaMq4dZW8fy+M/Q02Q7VrW/AKNQ=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    hash = "sha256-AbO1b4pxZ7I6n1dRzxhLC7DnXIUnaCK9SbLy96Qxqr0=";
+    hash = "sha256-QlC2k2rhF3/Pz+knnrlBDV8AfHHBSlGr7b9Ae6TNsxY=";
     rev = version;
   };
 
@@ -51,6 +51,9 @@ stdenv.mkDerivation rec {
 
     patchShebangs .
 
+    # emscripten 3.1.67 requires LLVM tip-of-tree instead of LLVM 18
+    sed -i -e "s/EXPECTED_LLVM_VERSION = 20/EXPECTED_LLVM_VERSION = 19/g" tools/shared.py
+
     # fixes cmake support
     sed -i -e "s/print \('emcc (Emscript.*\)/sys.stderr.write(\1); sys.stderr.flush()/g" emcc.py
 

pkgs/development/compilers/ghc/common-hadrian.nix

@@ -169,10 +169,11 @@
 
       patches =
         let
-          # Disable haddock generating pretty source listings to stay under 3GB on aarch64-linux
           enableHyperlinkedSource =
-            lib.versionAtLeast version "9.8" ||
-            !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux);
+            # Disable haddock generating pretty source listings to stay under 3GB on aarch64-linux
+            !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux)
+            # 9.8 and 9.10 don't run into this problem for some reason
+            || (lib.versionAtLeast version "9.8" && lib.versionOlder version "9.11");
         in
         [
           # Fix docs build with Sphinx >= 7 https://gitlab.haskell.org/ghc/ghc/-/issues/24129
@@ -207,12 +208,16 @@
            then ./Cabal-at-least-3.6-paths-fix-cycle-aarch64-darwin.patch
            else ./Cabal-3.12-paths-fix-cycle-aarch64-darwin.patch)
         ]
-        # Prevents passing --hyperlinked-source to haddock. This is a custom
-        # workaround as we wait for this to be configurable via userSettings or
-        # similar. https://gitlab.haskell.org/ghc/ghc/-/issues/23625
+        # Prevents passing --hyperlinked-source to haddock. Note that this can
+        # be configured via a user defined flavour now. Unfortunately, it is
+        # impossible to import an existing flavour in UserSettings, so patching
+        # the defaults is actually simpler and less maintenance intensive
+        # compared to keeping an entire flavour definition in sync with upstream
+        # manually. See also https://gitlab.haskell.org/ghc/ghc/-/issues/23625
         ++ lib.optionals (!enableHyperlinkedSource) [
-          # TODO(@sternenseemann): Doesn't apply for GHC >= 9.8
-          ../../tools/haskell/hadrian/disable-hyperlinked-source.patch
+          (if lib.versionOlder version "9.8"
+           then ../../tools/haskell/hadrian/disable-hyperlinked-source-pre-9.8.patch
+           else ../../tools/haskell/hadrian/disable-hyperlinked-source-extra-args.patch)
         ]
         # Incorrect bounds on Cabal in hadrian
         # https://gitlab.haskell.org/ghc/ghc/-/issues/24100

pkgs/development/haskell-modules/configuration-common.nix

@@ -102,20 +102,33 @@ self: super: {
   #######################################
 
   # All jailbreaks in this section due to: https://github.com/haskell/haskell-language-server/pull/4316#discussion_r1667684895
-  haskell-language-server = doJailbreak (dontCheck (super.haskell-language-server.overrideScope (lself: lsuper: {
-    # For most ghc versions, we overrideScope Cabal in the configuration-ghc-???.nix,
-    # because some packages, like ormolu, need a newer Cabal version.
-    # ghc-paths is special because it depends on Cabal for building
-    # its Setup.hs, and therefor declares a Cabal dependency, but does
-    # not actually use it as a build dependency.
-    # That means ghc-paths can just use the ghc included Cabal version,
-    # without causing package-db incoherence and we should do that because
-    # otherwise we have different versions of ghc-paths
-    # around which have the same abi-hash, which can lead to confusions and conflicts.
-    ghc-paths = lsuper.ghc-paths.override { Cabal = null; };
-  })));
+  haskell-language-server =
+    lib.pipe
+      (super.haskell-language-server.overrideScope (lself: lsuper: {
+        # For most ghc versions, we overrideScope Cabal in the configuration-ghc-???.nix,
+        # because some packages, like ormolu, need a newer Cabal version.
+        # ghc-paths is special because it depends on Cabal for building
+        # its Setup.hs, and therefor declares a Cabal dependency, but does
+        # not actually use it as a build dependency.
+        # That means ghc-paths can just use the ghc included Cabal version,
+        # without causing package-db incoherence and we should do that because
+        # otherwise we have different versions of ghc-paths
+        # around which have the same abi-hash, which can lead to confusions and conflicts.
+        ghc-paths = lsuper.ghc-paths.override { Cabal = null; };
+      }))
+      [
+        doJailbreak
+        dontCheck
+      ];
+
   hls-plugin-api = doJailbreak super.hls-plugin-api;
-  ghcide = doJailbreak super.ghcide;
+  ghcide = doJailbreak (appendPatch (pkgs.fetchpatch {
+    name = "ghcide-ghc-9.8.3.patch";
+    url = "https://github.com/haskell/haskell-language-server/commit/6d0a6f220226fe6c1cb5b6533177deb55e755b0b.patch";
+    sha256 = "1jwxldar9qzkg2z6vsx8f2yih3vkf4yjk9p3mryv0azn929qn3h1";
+    stripLen = 1;
+    excludes = [ "cabal.project" ];
+  }) super.ghcide);
 
   # For -f-auto see cabal.project in haskell-language-server.
   ghc-lib-parser-ex = addBuildDepend self.ghc-lib-parser (disableCabalFlag "auto" super.ghc-lib-parser-ex);

pkgs/development/haskell-modules/configuration-ghc-9.14.x.nix

@@ -0,0 +1,61 @@
+{ pkgs, haskellLib }:
+
+let
+  inherit (pkgs) lib;
+
+in
+
+self: super: {
+  llvmPackages = lib.dontRecurseIntoAttrs self.ghc.llvmPackages;
+
+  # Disable GHC core libraries
+  array = null;
+  base = null;
+  binary = null;
+  bytestring = null;
+  Cabal = null;
+  Cabal-syntax = null;
+  containers = null;
+  deepseq = null;
+  directory = null;
+  exceptions = null;
+  file-io = null;
+  filepath = null;
+  ghc-bignum = null;
+  ghc-boot = null;
+  ghc-boot-th = null;
+  ghc-compact = null;
+  ghc-experimental = null;
+  ghc-heap = null;
+  ghc-internal = null;
+  ghc-platform = null;
+  ghc-prim = null;
+  ghc-toolchain = null;
+  ghci = null;
+  haddock-api = null;
+  haddock-library = null;
+  haskeline = null;
+  hpc = null;
+  integer-gmp = null;
+  mtl = null;
+  os-string = null;
+  parsec = null;
+  pretty = null;
+  process = null;
+  rts = null;
+  semaphore-compat = null;
+  stm = null;
+  system-cxx-std-lib = null;
+  template-haskell = null;
+  # GHC only builds terminfo if it is a native compiler
+  terminfo =
+    if pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform then
+      null
+    else
+      haskellLib.doDistribute self.terminfo_0_4_1_6;
+  text = null;
+  time = null;
+  transformers = null;
+  unix = null;
+  xhtml = null;
+}

pkgs/development/julia-modules/default.nix

@@ -165,21 +165,23 @@ in
 runCommand "julia-${julia.version}-env" {
   nativeBuildInputs = [makeWrapper];
 
-  inherit julia;
-  inherit juliaWrapped;
-  meta = julia.meta;
+  passthru = {
+    inherit julia;
+    inherit juliaWrapped;
+    inherit (julia) pname version meta;
 
-  # Expose the steps we used along the way in case the user wants to use them, for example to build
-  # expressions and build them separately to avoid IFD.
-  inherit dependencies;
-  inherit closureYaml;
-  inherit dependencyUuidToInfoYaml;
-  inherit dependencyUuidToRepoYaml;
-  inherit minimalRegistry;
-  inherit artifactsNix;
-  inherit overridesJson;
-  inherit overridesToml;
-  inherit projectAndDepot;
+    # Expose the steps we used along the way in case the user wants to use them, for example to build
+    # expressions and build them separately to avoid IFD.
+    inherit dependencies;
+    inherit closureYaml;
+    inherit dependencyUuidToInfoYaml;
+    inherit dependencyUuidToRepoYaml;
+    inherit minimalRegistry;
+    inherit artifactsNix;
+    inherit overridesJson;
+    inherit overridesToml;
+    inherit projectAndDepot;
+  };
 } (''
   mkdir -p $out/bin
   makeWrapper ${juliaWrapped}/bin/julia $out/bin/julia \

pkgs/development/libraries/tk/generic.nix

@@ -24,7 +24,7 @@ tcl.mkTclDerivation {
   ''
   + lib.optionalString (stdenv.hostPlatform.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "11") ''
     substituteInPlace unix/configure* \
-      --replace " -framework UniformTypeIdentifiers" ""
+      --replace-fail " -weak_framework UniformTypeIdentifiers" ""
   '';
 
   postInstall = ''

pkgs/development/php-packages/imagick/default.nix

@@ -1,9 +1,11 @@
 {
   buildPecl,
+  fetchpatch,
   lib,
   imagemagick,
   pkg-config,
   pcre2,
+  php,
 }:
 
 buildPecl {
@@ -16,6 +18,16 @@ buildPecl {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ pcre2 ];
 
+  patches = lib.optionals (lib.versionAtLeast php.version "8.4") [
+    # PHP 8.4 compatibility patch based on https://github.com/Imagick/imagick/pull/690
+    # These is also an alternative https://github.com/Imagick/imagick/pull/704
+    # Which includes more changes but doesn't apply cleanly.
+    (fetchpatch {
+      url = "https://github.com/Imagick/imagick/commit/65e27f2bc02e7e8f1bf64e26e359e42a1331fca1.patch";
+      hash = "sha256-I0FwdqtQ/Y/QVkCl+nWPBIxsdQY6qcjdwiA/BaLNl7g=";
+    })
+  ];
+
   meta = with lib; {
     description = "Imagick is a native php extension to create and modify images using the ImageMagick API";
     license = licenses.php301;

pkgs/development/python-modules/aiovlc/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiovlc";
-  version = "0.6.2";
+  version = "0.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiovlc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tvMd7kydL4fx9JLTFQgCskBQCV0Zs/swDpPBxtSEvyM=";
+    hash = "sha256-b4QtTR/p2wmVk4LZdkWwzM1odx1cxjUF08pV/zunTx4=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/databricks-sdk/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.35.0";
+  version = "0.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CEv/+3E7KWV9LXzFPvDQIL1v8iFgbsS3/cTS/4obWas=";
+    hash = "sha256-g00NRo0FSHujN2mCLZCc1hKGsBFiN7ztEneUMziuQpk=";
   };
 
   build-system = [

pkgs/development/python-modules/dbt-snowflake/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-snowflake";
-  version = "1.8.3";
+  version = "1.8.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-snowflake";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jvhjf+Ce/oyHXFxMryz5Uy6Hq5Sx6vKgaGEJVAzqSdA=";
+    hash = "sha256-XUHXyxAoIBHXmH2xXOGrCO2+WMwwJ7oVYt4+m/fT/Ko=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/eq3btsmart/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "eq3btsmart";
-  version = "1.2.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EuleMitKeule";
     repo = "eq3btsmart";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z3GfUTh3qp5ICJAYsCO6ufw/Jd5FDjOaQE9SaD3H0IU=";
+    hash = "sha256-FRnCnSMtsiZ1AbZOMwO/I5UoFWP0xAFqRZsnrHG9WJA=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/fastcore/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.7.20";
+  version = "1.7.22";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     rev = "refs/tags/${version}";
-    hash = "sha256-UGY6iSRF8pY5frZqarxpiNkGEQtgNdXY5mMQzbzMjhA=";
+    hash = "sha256-llD7hDZStgCUfp06byGLtLPgDqiK7BAMw9kLNzOGUec=";
   };
 
   build-system = [ setuptools ];