Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -3639,6 +3639,11 @@
     githubId = 200617;
     name = "Ben Sima";
   };
+  bstanderline = {
+    name = "bstanderline";
+    github = "bstanderline";
+    githubId = 153822813;
+  };
   btlvr = {
     email = "btlvr@protonmail.com";
     github = "btlvr";
@@ -17378,6 +17383,12 @@
     githubId = 7191115;
     name = "Nova Leary";
   };
+  novmar = {
+    email = "novotny@marnov.cz";
+    github = "novmar";
+    githubId = 26750149;
+    name = "Marcel Novotny";
+  };
   novoxd = {
     email = "radnovox@gmail.com";
     github = "novoxd";

maintainers/team-list.nix

@@ -597,6 +597,7 @@ with lib.maintainers;
   jitsi = {
     members = [
       cleeyv
+      novmar
       ryantm
       lassulus
       yayayayaka

nixos/modules/services/web-apps/agorakit.nix

@@ -13,6 +13,7 @@ let
 
   user = cfg.user;
   group = cfg.group;
+  php = lib.getExe pkgs.php82;
 
   # shell script for local administration
   artisan = pkgs.writeScriptBin "agorakit" ''
@@ -25,7 +26,7 @@ let
         exec "$@"
       fi
     }
-    sudo ${lib.getExe pkgs.php} artisan "$@"
+    sudo ${php} artisan "$@"
   '';
 
   tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
@@ -447,9 +448,9 @@ in
           fi
 
           # migrate & seed db
-          ${pkgs.php}/bin/php artisan key:generate --force
-          ${pkgs.php}/bin/php artisan migrate --force
-          ${pkgs.php}/bin/php artisan config:cache
+          ${php} artisan key:generate --force
+          ${php} artisan migrate --force
+          ${php} artisan config:cache
         '';
     };
 

nixos/modules/services/web-apps/calibre-web.nix

@@ -4,7 +4,7 @@ let
   cfg = config.services.calibre-web;
   dataDir = if lib.hasPrefix "/" cfg.dataDir then cfg.dataDir else "/var/lib/${cfg.dataDir}";
 
-  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption optional optionalString types;
+  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption optional optionals optionalString types;
 in
 {
   options = {
@@ -129,7 +129,10 @@ in
           "config_reverse_proxy_login_header_name = '${cfg.options.reverseProxyAuth.header}'"
         ]
         ++ optional (cfg.options.calibreLibrary != null) "config_calibre_dir = '${cfg.options.calibreLibrary}'"
-        ++ optional cfg.options.enableBookConversion "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
+        ++ optionals cfg.options.enableBookConversion [
+          "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
+          "config_binariesdir = '${pkgs.calibre}/bin/'"
+        ]
         ++ optional cfg.options.enableKepubify "config_kepubifypath = '${pkgs.kepubify}/bin/kepubify'"
       );
     in

nixos/modules/services/web-apps/dolibarr.nix

@@ -312,7 +312,7 @@ in
       systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
       services.phpfpm.pools.dolibarr = {
         inherit (cfg) user group;
-        phpPackage = pkgs.php.buildEnv {
+        phpPackage = pkgs.php83.buildEnv {
           extensions = { enabled, all }: enabled ++ [ all.calendar ];
           # recommended by dolibarr web application
           extraConfig = ''
@@ -339,13 +339,17 @@ in
         description = "dolibarr configuration file management via NixOS";
         wantedBy = [ "multi-user.target" ];
 
-        script = ''
-          # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
-          ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+        script =
+          let
+            php = lib.getExe config.services.phpfpm.pools.dolibarr.phpPackage;
+          in
+          ''
+            # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+            ${php} -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
 
-          # replace configuration file generated by installer with the NixOS generated configuration file
-          install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
-        '';
+            # replace configuration file generated by installer with the NixOS generated configuration file
+            install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+          '';
 
         serviceConfig = {
           Type = "oneshot";

nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix

@@ -192,7 +192,7 @@ in
             )
           );
         };
-        phpPackage = pkgs.php.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
+        phpPackage = pkgs.php83.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
         phpOptions = ''
           date.timezone = "${cfg.timezone}"
         '';

nixos/modules/services/web-apps/monica.nix

@@ -15,6 +15,8 @@ with lib; let
   user = cfg.user;
   group = cfg.group;
 
+  php = lib.getExe pkgs.php83;
+
   # shell script for local administration
   artisan = pkgs.writeScriptBin "monica" ''
     #! ${pkgs.runtimeShell}
@@ -26,7 +28,7 @@ with lib; let
         exec "$@"
       fi
     }
-    sudo ${pkgs.php}/bin/php artisan "$@"
+    sudo ${php} artisan "$@"
   '';
 
   tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
@@ -419,8 +421,8 @@ in {
         fi
 
         # migrate & seed db
-        ${pkgs.php}/bin/php artisan key:generate --force
-        ${pkgs.php}/bin/php artisan setup:production -v --force
+        ${php} artisan key:generate --force
+        ${php} artisan setup:production -v --force
       '';
     };
 
@@ -432,7 +434,7 @@ in {
         Type = "oneshot";
         User = user;
         WorkingDirectory = "${monica}";
-        ExecStart = "${pkgs.php}/bin/php ${monica}/artisan schedule:run -v";
+        ExecStart = "${php} ${monica}/artisan schedule:run -v";
       };
     };
 
@@ -465,4 +467,3 @@ in {
     };
   };
 }
-

nixos/modules/services/web-apps/nextcloud.nix

@@ -130,10 +130,17 @@ let
           --quiet \
           ${command}
       elif [[ "$USER" != nextcloud ]]; then
-        exec /run/wrappers/bin/sudo \
-          --preserve-env=CREDENTIALS_DIRECTORY \
-          --user=nextcloud \
-          ${command}
+        if [[ -x /run/wrappers/bin/sudo ]]; then
+          exec /run/wrappers/bin/sudo \
+            --preserve-env=CREDENTIALS_DIRECTORY \
+            --user=nextcloud \
+            ${command}
+        else
+          exec ${lib.getExe' pkgs.util-linux "runuser"} \
+            --whitelist-environment=CREDENTIALS_DIRECTORY \
+            --user=nextcloud \
+            ${command}
+        fi
       else
         exec ${command}
       fi

nixos/modules/services/web-apps/rutorrent.nix

@@ -211,7 +211,7 @@ in
                   $throttleMaxSpeed = 327625*1024;
 
                   $pathToExternals = array(
-                    "php" 	=> "${pkgs.php}/bin/php",			// Something like /usr/bin/php. If empty, will be found in PATH.
+                    "php" 	=> "${pkgs.php82}/bin/php",			// Something like /usr/bin/php. If empty, will be found in PATH.
                     "curl"	=> "${pkgs.curl}/bin/curl",			// Something like /usr/bin/curl. If empty, will be found in PATH.
                     "gzip"	=> "${pkgs.gzip}/bin/gzip",			// Something like /usr/bin/gzip. If empty, will be found in PATH.
                     "id"	=> "${pkgs.coreutils}/bin/id",			// Something like /usr/bin/id. If empty, will be found in PATH.

nixos/tests/all-tests.nix

@@ -342,7 +342,7 @@ in {
   documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
   doh-proxy-rust = handleTest ./doh-proxy-rust.nix {};
   dokuwiki = runTest ./dokuwiki.nix;
-  dolibarr = handleTest ./dolibarr.nix {};
+  dolibarr = runTest ./dolibarr.nix;
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
   drawterm = discoverTests (import ./drawterm.nix);
@@ -557,7 +557,7 @@ in {
   hub = handleTest ./git/hub.nix {};
   hydra = handleTest ./hydra {};
   i3wm = handleTest ./i3wm.nix {};
-  icingaweb2 = handleTest ./icingaweb2.nix {};
+  icingaweb2 = runTest ./icingaweb2.nix;
   ifm = handleTest ./ifm.nix {};
   iftop = handleTest ./iftop.nix {};
   immich = handleTest ./web-apps/immich.nix {};
@@ -725,7 +725,7 @@ in {
   mollysocket = handleTest ./mollysocket.nix { };
   monado = handleTest ./monado.nix {};
   monetdb = handleTest ./monetdb.nix {};
-  monica = handleTest ./web-apps/monica.nix {};
+  monica = runTest ./web-apps/monica.nix;
   mongodb = runTest ./mongodb.nix;
   mongodb-ce = runTest ({ config, ... }: {
     imports = [ ./mongodb.nix ];
@@ -797,15 +797,15 @@ in {
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };
   nghttpx = handleTest ./nghttpx.nix {};
-  nginx = handleTest ./nginx.nix {};
-  nginx-auth = handleTest ./nginx-auth.nix {};
-  nginx-etag = handleTest ./nginx-etag.nix {};
-  nginx-etag-compression = handleTest ./nginx-etag-compression.nix {};
-  nginx-globalredirect = handleTest ./nginx-globalredirect.nix {};
+  nginx = runTest ./nginx.nix;
+  nginx-auth = runTest ./nginx-auth.nix;
+  nginx-etag = runTest ./nginx-etag.nix;
+  nginx-etag-compression = runTest ./nginx-etag-compression.nix;
+  nginx-globalredirect = runTest ./nginx-globalredirect.nix;
   nginx-http3 = handleTest ./nginx-http3.nix {};
-  nginx-mime = handleTest ./nginx-mime.nix {};
-  nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
-  nginx-moreheaders = handleTest ./nginx-moreheaders.nix {};
+  nginx-mime = runTest ./nginx-mime.nix;
+  nginx-modsecurity = runTest ./nginx-modsecurity.nix;
+  nginx-moreheaders = runTest ./nginx-moreheaders.nix;
   nginx-njs = handleTest ./nginx-njs.nix {};
   nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
@@ -1258,7 +1258,7 @@ in {
   umurmur = handleTest ./umurmur.nix {};
   unbound = handleTest ./unbound.nix {};
   unifi = handleTest ./unifi.nix {};
-  unit-php = handleTest ./web-servers/unit-php.nix {};
+  unit-php = runTest ./web-servers/unit-php.nix;
   unit-perl = handleTest ./web-servers/unit-perl.nix {};
   upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
   upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
@@ -1307,7 +1307,7 @@ in {
   weblate = handleTest ./web-apps/weblate.nix {};
   whisparr = handleTest ./whisparr.nix {};
   whoogle-search = handleTest ./whoogle-search.nix {};
-  wiki-js = handleTest ./wiki-js.nix {};
+  wiki-js = runTest ./wiki-js.nix;
   wine = handleTest ./wine.nix {};
   wireguard = handleTest ./wireguard {};
   wg-access-server = handleTest ./wg-access-server.nix {};
@@ -1315,7 +1315,7 @@ in {
   wmderland = handleTest ./wmderland.nix {};
   workout-tracker = handleTest ./workout-tracker.nix {};
   wpa_supplicant = import ./wpa_supplicant.nix { inherit pkgs runTest; };
-  wordpress = handleTest ./wordpress.nix {};
+  wordpress = runTest ./wordpress.nix;
   wrappers = handleTest ./wrappers.nix {};
   writefreely = handleTest ./web-apps/writefreely.nix {};
   wstunnel = runTest ./wstunnel.nix;

nixos/tests/dolibarr.nix

@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "dolibarr";
-    meta.maintainers = [ ];
+{ ... }:
+{
+  name = "dolibarr";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.dolibarr = {
-          enable = true;
-          domain = "localhost";
-          nginx = {
-            forceSSL = false;
-            enableACME = false;
-          };
+  nodes.machine =
+    { ... }:
+    {
+      services.dolibarr = {
+        enable = true;
+        domain = "localhost";
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
         };
-
-        networking.firewall.allowedTCPPorts = [ 80 ];
       };
 
-    testScript = ''
-      from html.parser import HTMLParser
-      start_all()
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
 
-      csrf_token = None
-      class TokenParser(HTMLParser):
-        def handle_starttag(self, tag, attrs):
-          attrs = dict(attrs) # attrs is an assoc list originally
-          if tag == 'input' and attrs.get('name') == 'token':
-              csrf_token = attrs.get('value')
-              print(f'[+] Caught CSRF token: {csrf_token}')
-        def handle_endtag(self, tag): pass
-        def handle_data(self, data): pass
+  testScript = ''
+    from html.parser import HTMLParser
+    start_all()
 
-      machine.wait_for_unit("phpfpm-dolibarr.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_open_port(80)
-      # Sanity checks on URLs.
-      # machine.succeed("curl -fL http://localhost/index.php")
-      # machine.succeed("curl -fL http://localhost/")
-      # Perform installation.
-      machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
-      machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
-      # First time is to write the configuration file correctly.
-      machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
-      # Now, we have a proper conf.php in $stateDir.
-      assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
-      machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
-      machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
-      machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
-      # Now, we have installed the machine, let's verify we still have the right configuration.
-      assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
-      # We do not want any redirect now as we have installed the machine.
-      machine.succeed('curl -f -X GET http://localhost')
-      # Test authentication to the webservice.
-      parser = TokenParser()
-      parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
-      machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
-    '';
-  }
-)
+    csrf_token = None
+    class TokenParser(HTMLParser):
+      def handle_starttag(self, tag, attrs):
+        attrs = dict(attrs) # attrs is an assoc list originally
+        if tag == 'input' and attrs.get('name') == 'token':
+            csrf_token = attrs.get('value')
+            print(f'[+] Caught CSRF token: {csrf_token}')
+      def handle_endtag(self, tag): pass
+      def handle_data(self, data): pass
+
+    machine.wait_for_unit("phpfpm-dolibarr.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    # Sanity checks on URLs.
+    # machine.succeed("curl -fL http://localhost/index.php")
+    # machine.succeed("curl -fL http://localhost/")
+    # Perform installation.
+    machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
+    machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
+    # First time is to write the configuration file correctly.
+    machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
+    # Now, we have a proper conf.php in $stateDir.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
+    # Now, we have installed the machine, let's verify we still have the right configuration.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    # We do not want any redirect now as we have installed the machine.
+    machine.succeed('curl -f -X GET http://localhost')
+    # Test authentication to the webservice.
+    parser = TokenParser()
+    parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
+    machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
+  '';
+}

nixos/tests/icingaweb2.nix

@@ -1,76 +1,74 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "icingaweb2";
-    meta = {
-      maintainers = pkgs.lib.teams.helsinki-systems.members;
-    };
+{ pkgs, ... }:
+{
+  name = "icingaweb2";
+  meta = {
+    maintainers = pkgs.lib.teams.helsinki-systems.members;
+  };
 
-    nodes = {
-      icingaweb2 =
-        { config, pkgs, ... }:
-        {
-          services.icingaweb2 = {
-            enable = true;
+  nodes = {
+    icingaweb2 =
+      { config, pkgs, ... }:
+      {
+        services.icingaweb2 = {
+          enable = true;
 
-            modulePackages = with pkgs.icingaweb2Modules; {
-              particles = theme-particles;
-              spring = theme-spring;
+          modulePackages = with pkgs.icingaweb2Modules; {
+            particles = theme-particles;
+            spring = theme-spring;
+          };
+
+          modules = {
+            doc.enable = true;
+            migrate.enable = true;
+            setup.enable = true;
+            test.enable = true;
+            translation.enable = true;
+          };
+
+          generalConfig = {
+            global = {
+              module_path = "${pkgs.icingaweb2}/modules";
             };
+          };
 
-            modules = {
-              doc.enable = true;
-              migrate.enable = true;
-              setup.enable = true;
-              test.enable = true;
-              translation.enable = true;
+          authentications = {
+            icingaweb = {
+              backend = "external";
             };
+          };
 
-            generalConfig = {
-              global = {
-                module_path = "${pkgs.icingaweb2}/modules";
-              };
+          groupBackends = {
+            icingaweb = {
+              backend = "db";
+              resource = "icingaweb_db";
             };
+          };
 
-            authentications = {
-              icingaweb = {
-                backend = "external";
-              };
+          resources = {
+            # Not used, so no DB server needed
+            icingaweb_db = {
+              type = "db";
+              db = "mysql";
+              host = "localhost";
+              username = "icingaweb2";
+              password = "icingaweb2";
+              dbname = "icingaweb2";
             };
+          };
 
-            groupBackends = {
-              icingaweb = {
-                backend = "db";
-                resource = "icingaweb_db";
-              };
-            };
-
-            resources = {
-              # Not used, so no DB server needed
-              icingaweb_db = {
-                type = "db";
-                db = "mysql";
-                host = "localhost";
-                username = "icingaweb2";
-                password = "icingaweb2";
-                dbname = "icingaweb2";
-              };
-            };
-
-            roles = {
-              Administrators = {
-                users = "*";
-                permissions = "*";
-              };
+          roles = {
+            Administrators = {
+              users = "*";
+              permissions = "*";
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      icingaweb2.wait_for_unit("multi-user.target")
-      icingaweb2.succeed("curl -sSf http://icingaweb2/authentication/login")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    icingaweb2.wait_for_unit("multi-user.target")
+    icingaweb2.succeed("curl -sSf http://icingaweb2/authentication/login")
+  '';
+}

nixos/tests/nginx-auth.nix

@@ -1,54 +1,52 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-auth";
+{ pkgs, ... }:
+{
+  name = "nginx-auth";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx =
-            let
-              root = pkgs.runCommand "testdir" { } ''
-                mkdir "$out"
-                echo hello world > "$out/index.html"
-              '';
-            in
-            {
-              enable = true;
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx =
+          let
+            root = pkgs.runCommand "testdir" { } ''
+              mkdir "$out"
+              echo hello world > "$out/index.html"
+            '';
+          in
+          {
+            enable = true;
 
-              virtualHosts.lockedroot = {
-                inherit root;
-                basicAuth.alice = "pwofa";
-              };
+            virtualHosts.lockedroot = {
+              inherit root;
+              basicAuth.alice = "pwofa";
+            };
 
-              virtualHosts.lockedsubdir = {
-                inherit root;
-                locations."/sublocation/" = {
-                  alias = "${root}/";
-                  basicAuth.bob = "pwofb";
-                };
+            virtualHosts.lockedsubdir = {
+              inherit root;
+              locations."/sublocation/" = {
+                alias = "${root}/";
+                basicAuth.bob = "pwofb";
               };
             };
-        };
-    };
+          };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_port(80)
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
 
-      webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
-      webserver.succeed(
-          "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
-      )
+    webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
+    webserver.succeed(
+        "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
+    )
 
-      webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
-      webserver.fail(
-          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
-      )
-      webserver.succeed(
-          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
-      )
-    '';
-  }
-)
+    webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
+    webserver.fail(
+        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
+    )
+    webserver.succeed(
+        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
+    )
+  '';
+}

nixos/tests/nginx-etag-compression.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-etag-compression";
 
   nodes.machine =

nixos/tests/nginx-etag.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-etag";
 
   nodes = {
@@ -85,7 +86,7 @@ import ./make-test-python.nix {
   testScript =
     { nodes, ... }:
     let
-      inherit (nodes.server.config.system.build) toplevel;
+      inherit (nodes.server.system.build) toplevel;
       newSystem = "${toplevel}/specialisation/pass-checks";
     in
     ''

nixos/tests/nginx-globalredirect.nix

@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-globalredirect";
+{ ... }:
+{
+  name = "nginx-globalredirect";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts.localhost = {
-              globalRedirect = "other.example.com";
-              # Add an exception
-              locations."/noredirect".return = "200 'foo'";
-            };
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts.localhost = {
+            globalRedirect = "other.example.com";
+            # Add an exception
+            locations."/noredirect".return = "200 'foo'";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_port(80)
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
 
-      webserver.succeed("curl --fail -si http://localhost/alf | grep '^Location:.*/alf'")
-      webserver.fail("curl --fail -si http://localhost/noredirect | grep '^Location:'")
-    '';
-  }
-)
+    webserver.succeed("curl --fail -si http://localhost/alf | grep '^Location:.*/alf'")
+    webserver.fail("curl --fail -si http://localhost/noredirect | grep '^Location:'")
+  '';
+}

nixos/tests/nginx-mime.nix

@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "nginx-mime";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+{ lib, pkgs, ... }:
+{
+  name = "nginx-mime";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts."localhost" = { };
-          };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts."localhost" = { };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      server.start()
-      server.wait_for_unit("nginx")
-      # Check optimal size of types_hash
-      server.fail("journalctl --unit nginx --grep 'could not build optimal types_hash'")
-      server.shutdown()
-    '';
-  }
-)
+  testScript = ''
+    server.start()
+    server.wait_for_unit("nginx")
+    # Check optimal size of types_hash
+    server.fail("journalctl --unit nginx --grep 'could not build optimal types_hash'")
+    server.shutdown()
+  '';
+}

nixos/tests/nginx-modsecurity.nix

@@ -1,51 +1,49 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nginx-modsecurity";
+{ ... }:
+{
+  name = "nginx-modsecurity";
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.nginx = {
-          enable = true;
-          additionalModules = [ pkgs.nginxModules.modsecurity ];
-          virtualHosts.localhost =
-            let
-              modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
-                SecRuleEngine On
-                SecDefaultAction "phase:1,log,auditlog,deny,status:403"
-                SecDefaultAction "phase:2,log,auditlog,deny,status:403"
-                SecRule REQUEST_METHOD   "HEAD"        "id:100, phase:1, block"
-                SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
-              '';
-              testroot = pkgs.runCommand "testroot" { } ''
-                mkdir -p $out
-                echo "<html><body>Hello World!</body></html>" > $out/index.html
-                echo "s3cret" > $out/secret.html
-              '';
-            in
-            {
-              root = testroot;
-              extraConfig = ''
-                modsecurity on;
-                modsecurity_rules_file ${modsecurity_conf};
-              '';
-            };
-        };
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.nginx = {
+        enable = true;
+        additionalModules = [ pkgs.nginxModules.modsecurity ];
+        virtualHosts.localhost =
+          let
+            modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
+              SecRuleEngine On
+              SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+              SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+              SecRule REQUEST_METHOD   "HEAD"        "id:100, phase:1, block"
+              SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
+            '';
+            testroot = pkgs.runCommand "testroot" { } ''
+              mkdir -p $out
+              echo "<html><body>Hello World!</body></html>" > $out/index.html
+              echo "s3cret" > $out/secret.html
+            '';
+          in
+          {
+            root = testroot;
+            extraConfig = ''
+              modsecurity on;
+              modsecurity_rules_file ${modsecurity_conf};
+            '';
+          };
       };
-    testScript = ''
-      machine.wait_for_unit("nginx")
+    };
+  testScript = ''
+    machine.wait_for_unit("nginx")
 
-      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
-      assert "Hello World!" in response
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    assert "Hello World!" in response
 
-      machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
-      machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
-    '';
-  }
-)
+    machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
+    machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
+  '';
+}

nixos/tests/nginx-moreheaders.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-more-headers";
 
   nodes = {

nixos/tests/nginx.nix

@@ -4,134 +4,150 @@
 #   2. whether the ETag header is properly generated whenever we're serving
 #      files in Nix store paths
 #   3. nginx doesn't restart on configuration changes (only reloads)
-import ./make-test-python.nix ({ pkgs, ... }: {
+{ pkgs, ... }:
+{
   name = "nginx";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ mbbx6spp danbst ];
+    maintainers = [
+      mbbx6spp
+      danbst
+    ];
   };
 
   nodes = {
-    webserver = { pkgs, lib, ... }: {
-      services.nginx.enable = true;
-      services.nginx.commonHttpConfig = ''
-        log_format ceeformat '@cee: {"status":"$status",'
-          '"request_time":$request_time,'
-          '"upstream_response_time":$upstream_response_time,'
-          '"pipe":"$pipe","bytes_sent":$bytes_sent,'
-          '"connection":"$connection",'
-          '"remote_addr":"$remote_addr",'
-          '"host":"$host",'
-          '"timestamp":"$time_iso8601",'
-          '"request":"$request",'
-          '"http_referer":"$http_referer",'
-          '"upstream_addr":"$upstream_addr"}';
-      '';
-      services.nginx.virtualHosts."0.my.test" = {
-        extraConfig = ''
-          access_log syslog:server=unix:/dev/log,facility=user,tag=mytag,severity=info ceeformat;
-          location /favicon.ico { allow all; access_log off; log_not_found off; }
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx.enable = true;
+        services.nginx.commonHttpConfig = ''
+          log_format ceeformat '@cee: {"status":"$status",'
+            '"request_time":$request_time,'
+            '"upstream_response_time":$upstream_response_time,'
+            '"pipe":"$pipe","bytes_sent":$bytes_sent,'
+            '"connection":"$connection",'
+            '"remote_addr":"$remote_addr",'
+            '"host":"$host",'
+            '"timestamp":"$time_iso8601",'
+            '"request":"$request",'
+            '"http_referer":"$http_referer",'
+            '"upstream_addr":"$upstream_addr"}';
         '';
-      };
+        services.nginx.virtualHosts."0.my.test" = {
+          extraConfig = ''
+            access_log syslog:server=unix:/dev/log,facility=user,tag=mytag,severity=info ceeformat;
+            location /favicon.ico { allow all; access_log off; log_not_found off; }
+          '';
+        };
 
-      services.nginx.virtualHosts.localhost = {
-        root = pkgs.runCommand "testdir" {} ''
-          mkdir "$out"
-          echo hello world > "$out/index.html"
-        '';
-      };
-
-      services.nginx.enableReload = true;
-
-      specialisation.etagSystem.configuration = {
         services.nginx.virtualHosts.localhost = {
-          root = lib.mkForce (pkgs.runCommand "testdir2" {} ''
+          root = pkgs.runCommand "testdir" { } ''
             mkdir "$out"
-            echo content changed > "$out/index.html"
-          '');
+            echo hello world > "$out/index.html"
+          '';
+        };
+
+        services.nginx.enableReload = true;
+
+        specialisation.etagSystem.configuration = {
+          services.nginx.virtualHosts.localhost = {
+            root = lib.mkForce (
+              pkgs.runCommand "testdir2" { } ''
+                mkdir "$out"
+                echo content changed > "$out/index.html"
+              ''
+            );
+          };
+        };
+
+        specialisation.justReloadSystem.configuration = {
+          services.nginx.virtualHosts."1.my.test".listen = [
+            {
+              addr = "127.0.0.1";
+              port = 8080;
+            }
+          ];
+        };
+
+        specialisation.reloadRestartSystem.configuration = {
+          services.nginx.package = pkgs.nginxMainline;
+        };
+
+        specialisation.reloadWithErrorsSystem.configuration = {
+          services.nginx.package = pkgs.nginxMainline;
+          services.nginx.virtualHosts."!@$$(#*%".locations."~@#*$*!)".proxyPass = ";;;";
         };
       };
-
-      specialisation.justReloadSystem.configuration = {
-        services.nginx.virtualHosts."1.my.test".listen = [ { addr = "127.0.0.1"; port = 8080; }];
-      };
-
-      specialisation.reloadRestartSystem.configuration = {
-        services.nginx.package = pkgs.nginxMainline;
-      };
-
-      specialisation.reloadWithErrorsSystem.configuration = {
-        services.nginx.package = pkgs.nginxMainline;
-        services.nginx.virtualHosts."!@$$(#*%".locations."~@#*$*!)".proxyPass = ";;;";
-      };
-    };
   };
 
-  testScript = { nodes, ... }: let
-    etagSystem = "${nodes.webserver.system.build.toplevel}/specialisation/etagSystem";
-    justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/justReloadSystem";
-    reloadRestartSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadRestartSystem";
-    reloadWithErrorsSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadWithErrorsSystem";
-  in ''
-    url = "http://localhost/index.html"
+  testScript =
+    { nodes, ... }:
+    let
+      etagSystem = "${nodes.webserver.system.build.toplevel}/specialisation/etagSystem";
+      justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/justReloadSystem";
+      reloadRestartSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadRestartSystem";
+      reloadWithErrorsSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadWithErrorsSystem";
+    in
+    ''
+      url = "http://localhost/index.html"
 
 
-    def check_etag():
-        etag = webserver.succeed(
-            f'curl -v {url} 2>&1 | sed -n -e "s/^< etag: *//ip"'
-        ).rstrip()
-        http_code = webserver.succeed(
-            f"curl -w '%{{http_code}}' --head --fail -H 'If-None-Match: {etag}' {url}"
-        )
-        assert http_code.split("\n")[-1] == "304"
+      def check_etag():
+          etag = webserver.succeed(
+              f'curl -v {url} 2>&1 | sed -n -e "s/^< etag: *//ip"'
+          ).rstrip()
+          http_code = webserver.succeed(
+              f"curl -w '%{{http_code}}' --head --fail -H 'If-None-Match: {etag}' {url}"
+          )
+          assert http_code.split("\n")[-1] == "304"
 
-        return etag
+          return etag
 
 
-    def wait_for_nginx_on_port(port):
-        webserver.wait_for_unit("nginx")
-        webserver.wait_for_open_port(port)
+      def wait_for_nginx_on_port(port):
+          webserver.wait_for_unit("nginx")
+          webserver.wait_for_open_port(port)
 
 
-    # nginx can be ready before multi-user.target, in which case switching to
-    # a different configuration might not realize it needs to restart nginx.
-    webserver.wait_for_unit("multi-user.target")
+      # nginx can be ready before multi-user.target, in which case switching to
+      # a different configuration might not realize it needs to restart nginx.
+      webserver.wait_for_unit("multi-user.target")
 
-    wait_for_nginx_on_port(80)
+      wait_for_nginx_on_port(80)
 
-    with subtest("check ETag if serving Nix store paths"):
-        old_etag = check_etag()
-        webserver.succeed(
-            "${etagSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(80)
-        new_etag = check_etag()
-        assert old_etag != new_etag
+      with subtest("check ETag if serving Nix store paths"):
+          old_etag = check_etag()
+          webserver.succeed(
+              "${etagSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(80)
+          new_etag = check_etag()
+          assert old_etag != new_etag
 
-    with subtest("config is reloaded on nixos-rebuild switch"):
-        webserver.succeed(
-            "${justReloadSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(8080)
-        webserver.fail("journalctl -u nginx | grep -q -i stopped")
-        webserver.succeed("journalctl -u nginx | grep -q -i reloaded")
+      with subtest("config is reloaded on nixos-rebuild switch"):
+          webserver.succeed(
+              "${justReloadSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(8080)
+          webserver.fail("journalctl -u nginx | grep -q -i stopped")
+          webserver.succeed("journalctl -u nginx | grep -q -i reloaded")
 
-    with subtest("restart when nginx package changes"):
-        webserver.succeed(
-            "${reloadRestartSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(80)
-        webserver.succeed("journalctl -u nginx | grep -q -i stopped")
+      with subtest("restart when nginx package changes"):
+          webserver.succeed(
+              "${reloadRestartSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(80)
+          webserver.succeed("journalctl -u nginx | grep -q -i stopped")
 
-    with subtest("nixos-rebuild --switch should fail when there are configuration errors"):
-        webserver.fail(
-            "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.succeed("[[ $(systemctl is-failed nginx-config-reload) == failed ]]")
-        webserver.succeed("[[ $(systemctl is-failed nginx) == active ]]")
-        # just to make sure operation is idempotent. During development I had a situation
-        # when first time it shows error, but stops showing it on subsequent rebuilds
-        webserver.fail(
-            "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
-        )
-  '';
-})
+      with subtest("nixos-rebuild --switch should fail when there are configuration errors"):
+          webserver.fail(
+              "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
+          )
+          webserver.succeed("[[ $(systemctl is-failed nginx-config-reload) == failed ]]")
+          webserver.succeed("[[ $(systemctl is-failed nginx) == active ]]")
+          # just to make sure operation is idempotent. During development I had a situation
+          # when first time it shows error, but stops showing it on subsequent rebuilds
+          webserver.fail(
+              "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
+          )
+    '';
+}

nixos/tests/web-apps/monica.nix

@@ -1,37 +1,35 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
-      openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
-      mkdir -p $out
-      cp key.pem cert.pem $out
-    '';
-  in
-  {
-    name = "monica";
+{ pkgs, ... }:
+let
+  cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "monica";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.monica = {
-            enable = true;
-            hostname = "localhost";
-            appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
-            nginx = {
-              forceSSL = true;
-              sslCertificate = "${cert}/cert.pem";
-              sslCertificateKey = "${cert}/key.pem";
-            };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.monica = {
+          enable = true;
+          hostname = "localhost";
+          appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
+          nginx = {
+            forceSSL = true;
+            sslCertificate = "${cert}/cert.pem";
+            sslCertificateKey = "${cert}/key.pem";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("monica-setup.service")
-      machine.wait_for_open_port(443)
-      machine.succeed("curl -k --fail https://localhost", timeout=10)
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("monica-setup.service")
+    machine.wait_for_open_port(443)
+    machine.succeed("curl -k --fail https://localhost", timeout=10)
+  '';
+}

nixos/tests/web-servers/unit-php.nix

@@ -1,62 +1,60 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testdir = pkgs.writeTextDir "www/info.php" "<?php phpinfo();";
+{ pkgs, ... }:
+let
+  testdir = pkgs.writeTextDir "www/info.php" "<?php phpinfo();";
 
-  in
-  {
-    name = "unit-php-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+in
+{
+  name = "unit-php-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.unit = {
-          enable = true;
-          config = pkgs.lib.strings.toJSON {
-            listeners."*:9081".application = "php_81";
-            applications.php_81 = {
-              type = "php 8.1";
-              processes = 1;
-              user = "testuser";
-              group = "testgroup";
-              root = "${testdir}/www";
-              index = "info.php";
-              options.file = "${pkgs.unit.usedPhp81}/lib/php.ini";
-            };
-          };
-        };
-        users = {
-          users.testuser = {
-            isSystemUser = true;
-            uid = 1080;
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.unit = {
+        enable = true;
+        config = pkgs.lib.strings.toJSON {
+          listeners."*:9081".application = "php_81";
+          applications.php_81 = {
+            type = "php 8.1";
+            processes = 1;
+            user = "testuser";
             group = "testgroup";
-          };
-          groups.testgroup = {
-            gid = 1080;
+            root = "${testdir}/www";
+            index = "info.php";
+            options.file = "${pkgs.unit.usedPhp81}/lib/php.ini";
           };
         };
       };
-    testScript = ''
-      machine.start()
+      users = {
+        users.testuser = {
+          isSystemUser = true;
+          uid = 1080;
+          group = "testgroup";
+        };
+        groups.testgroup = {
+          gid = 1080;
+        };
+      };
+    };
+  testScript = ''
+    machine.start()
 
-      machine.wait_for_unit("unit.service")
-      machine.wait_for_open_port(9081)
+    machine.wait_for_unit("unit.service")
+    machine.wait_for_open_port(9081)
 
-      # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -f -vvv -s http://127.0.0.1:9081/")
-      assert "PHP Version ${pkgs.unit.usedPhp81.version}" in response, "PHP version not detected"
+    # Check so we get an evaluated PHP back
+    response = machine.succeed("curl -f -vvv -s http://127.0.0.1:9081/")
+    assert "PHP Version ${pkgs.unit.usedPhp81.version}" in response, "PHP version not detected"
 
-      # Check so we have database and some other extensions loaded
-      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
-          assert ext in response, f"Missing {ext} extension"
+    # Check so we have database and some other extensions loaded
+    for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
+        assert ext in response, f"Missing {ext} extension"
 
-      machine.shutdown()
-    '';
-  }
-)
+    machine.shutdown()
+  '';
+}

nixos/tests/wiki-js.nix

@@ -1,171 +1,169 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "wiki-js";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ma27 ];
+{ pkgs, ... }:
+{
+  name = "wiki-js";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ma27 ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 2047;
+      services.wiki-js = {
+        enable = true;
+        settings.db.host = "/run/postgresql";
+        settings.db.user = "wiki-js";
+        settings.db.db = "wiki-js";
+        settings.logLevel = "debug";
+      };
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "wiki-js" ];
+        ensureUsers = [
+          {
+            name = "wiki-js";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+      systemd.services.wiki-js = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+      };
+      environment.systemPackages = with pkgs; [ jq ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.memorySize = 2047;
-        services.wiki-js = {
-          enable = true;
-          settings.db.host = "/run/postgresql";
-          settings.db.user = "wiki-js";
-          settings.db.db = "wiki-js";
-          settings.logLevel = "debug";
-        };
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ "wiki-js" ];
-          ensureUsers = [
-            {
-              name = "wiki-js";
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-        systemd.services.wiki-js = {
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-        environment.systemPackages = with pkgs; [ jq ];
-      };
-
-    testScript =
-      let
-        payloads.finalize = pkgs.writeText "finalize.json" (
-          builtins.toJSON {
-            adminEmail = "webmaster@example.com";
-            adminPassword = "notapassword";
-            adminPasswordConfirm = "notapassword";
-            siteUrl = "http://localhost:3000";
-            telemetry = false;
+  testScript =
+    let
+      payloads.finalize = pkgs.writeText "finalize.json" (
+        builtins.toJSON {
+          adminEmail = "webmaster@example.com";
+          adminPassword = "notapassword";
+          adminPasswordConfirm = "notapassword";
+          siteUrl = "http://localhost:3000";
+          telemetry = false;
+        }
+      );
+      payloads.login = pkgs.writeText "login.json" (
+        builtins.toJSON [
+          {
+            operationName = null;
+            extensions = { };
+            query = ''
+              mutation ($username: String!, $password: String!, $strategy: String!) {
+                authentication {
+                  login(username: $username, password: $password, strategy: $strategy) {
+                    responseResult {
+                      succeeded
+                      errorCode
+                      slug
+                      message
+                      __typename
+                    }
+                    jwt
+                    mustChangePwd
+                    mustProvideTFA
+                    mustSetupTFA
+                    continuationToken
+                    redirect
+                    tfaQRImage
+                    __typename
+                  }
+                  __typename
+                }
+              }
+            '';
+            variables = {
+              password = "notapassword";
+              strategy = "local";
+              username = "webmaster@example.com";
+            };
           }
-        );
-        payloads.login = pkgs.writeText "login.json" (
-          builtins.toJSON [
-            {
-              operationName = null;
-              extensions = { };
-              query = ''
-                mutation ($username: String!, $password: String!, $strategy: String!) {
-                  authentication {
-                    login(username: $username, password: $password, strategy: $strategy) {
-                      responseResult {
-                        succeeded
-                        errorCode
-                        slug
-                        message
-                        __typename
-                      }
-                      jwt
-                      mustChangePwd
-                      mustProvideTFA
-                      mustSetupTFA
-                      continuationToken
-                      redirect
-                      tfaQRImage
+        ]
+      );
+      payloads.content = pkgs.writeText "content.json" (
+        builtins.toJSON [
+          {
+            extensions = { };
+            operationName = null;
+            query = ''
+              mutation ($content: String!, $description: String!, $editor: String!, $isPrivate: Boolean!, $isPublished: Boolean!, $locale: String!, $path: String!, $publishEndDate: Date, $publishStartDate: Date, $scriptCss: String, $scriptJs: String, $tags: [String]!, $title: String!) {
+                pages {
+                  create(content: $content, description: $description, editor: $editor, isPrivate: $isPrivate, isPublished: $isPublished, locale: $locale, path: $path, publishEndDate: $publishEndDate, publishStartDate: $publishStartDate, scriptCss: $scriptCss, scriptJs: $scriptJs, tags: $tags, title: $title) {
+                    responseResult {
+                      succeeded
+                      errorCode
+                      slug
+                      message
+                      __typename
+                    }
+                    page {
+                      id
+                      updatedAt
                       __typename
                     }
                     __typename
                   }
+                  __typename
                 }
-              '';
-              variables = {
-                password = "notapassword";
-                strategy = "local";
-                username = "webmaster@example.com";
-              };
-            }
-          ]
-        );
-        payloads.content = pkgs.writeText "content.json" (
-          builtins.toJSON [
-            {
-              extensions = { };
-              operationName = null;
-              query = ''
-                mutation ($content: String!, $description: String!, $editor: String!, $isPrivate: Boolean!, $isPublished: Boolean!, $locale: String!, $path: String!, $publishEndDate: Date, $publishStartDate: Date, $scriptCss: String, $scriptJs: String, $tags: [String]!, $title: String!) {
-                  pages {
-                    create(content: $content, description: $description, editor: $editor, isPrivate: $isPrivate, isPublished: $isPublished, locale: $locale, path: $path, publishEndDate: $publishEndDate, publishStartDate: $publishStartDate, scriptCss: $scriptCss, scriptJs: $scriptJs, tags: $tags, title: $title) {
-                      responseResult {
-                        succeeded
-                        errorCode
-                        slug
-                        message
-                        __typename
-                      }
-                      page {
-                        id
-                        updatedAt
-                        __typename
-                      }
-                      __typename
-                    }
-                    __typename
-                  }
-                }
-              '';
-              variables = {
-                content = "# Header\n\nHello world!";
-                description = "";
-                editor = "markdown";
-                isPrivate = false;
-                isPublished = true;
-                locale = "en";
-                path = "home";
-                publishEndDate = "";
-                publishStartDate = "";
-                scriptCss = "";
-                scriptJs = "";
-                tags = [ ];
-                title = "Hello world";
-              };
-            }
-          ]
-        );
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_for_open_port(3000)
+              }
+            '';
+            variables = {
+              content = "# Header\n\nHello world!";
+              description = "";
+              editor = "markdown";
+              isPrivate = false;
+              isPublished = true;
+              locale = "en";
+              path = "home";
+              publishEndDate = "";
+              publishStartDate = "";
+              scriptCss = "";
+              scriptJs = "";
+              tags = [ ];
+              title = "Hello world";
+            };
+          }
+        ]
+      );
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_open_port(3000)
 
-        machine.succeed("curl -sSf localhost:3000")
+      machine.succeed("curl -sSf localhost:3000")
 
-        with subtest("Setup"):
-            result = machine.succeed(
-                "curl -sSf localhost:3000/finalize -X POST -d "
-                + "@${payloads.finalize} -H 'Content-Type: application/json' "
-                + "| jq .ok | xargs echo"
-            )
-            assert result.strip() == "true", f"Expected true, got {result}"
+      with subtest("Setup"):
+          result = machine.succeed(
+              "curl -sSf localhost:3000/finalize -X POST -d "
+              + "@${payloads.finalize} -H 'Content-Type: application/json' "
+              + "| jq .ok | xargs echo"
+          )
+          assert result.strip() == "true", f"Expected true, got {result}"
 
-            # During the setup the service gets restarted, so we use this
-            # to check if the setup is done.
-            machine.wait_until_fails("curl -sSf localhost:3000")
-            machine.wait_until_succeeds("curl -sSf localhost:3000")
+          # During the setup the service gets restarted, so we use this
+          # to check if the setup is done.
+          machine.wait_until_fails("curl -sSf localhost:3000")
+          machine.wait_until_succeeds("curl -sSf localhost:3000")
 
-        with subtest("Base functionality"):
-            auth = machine.succeed(
-                "curl -sSf localhost:3000/graphql -X POST "
-                + "-d @${payloads.login} -H 'Content-Type: application/json' "
-                + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
-            ).strip()
+      with subtest("Base functionality"):
+          auth = machine.succeed(
+              "curl -sSf localhost:3000/graphql -X POST "
+              + "-d @${payloads.login} -H 'Content-Type: application/json' "
+              + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
+          ).strip()
 
-            assert auth
+          assert auth
 
-            create = machine.succeed(
-                "curl -sSf localhost:3000/graphql -X POST "
-                + "-d @${payloads.content} -H 'Content-Type: application/json' "
-                + f"-H 'Authorization: Bearer {auth}' "
-                + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"
-            )
-            assert create.strip() == "true", f"Expected true, got {create}"
+          create = machine.succeed(
+              "curl -sSf localhost:3000/graphql -X POST "
+              + "-d @${payloads.content} -H 'Content-Type: application/json' "
+              + f"-H 'Authorization: Bearer {auth}' "
+              + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"
+          )
+          assert create.strip() == "true", f"Expected true, got {create}"
 
-        machine.shutdown()
-      '';
-  }
-)
+      machine.shutdown()
+    '';
+}

nixos/tests/wordpress.nix

@@ -1,123 +1,121 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, config, ... }:
 
-  rec {
-    name = "wordpress";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        flokli
-        grahamc # under duress!
-        mmilata
+rec {
+  name = "wordpress";
+  meta = with lib.maintainers; {
+    maintainers = [
+      flokli
+      grahamc # under duress!
+      mmilata
+    ];
+  };
+
+  nodes =
+    lib.foldl
+      (
+        a: version:
+        let
+          package = config.node.pkgs."wordpress_${version}";
+        in
+        a
+        // {
+          "wp${version}_httpd" = _: {
+            services.httpd.adminAddr = "webmaster@site.local";
+            services.httpd.logPerVirtualHost = true;
+
+            services.wordpress.webserver = "httpd";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+
+          "wp${version}_nginx" = _: {
+            services.wordpress.webserver = "nginx";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+
+          "wp${version}_caddy" = _: {
+            services.wordpress.webserver = "caddy";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+        }
+      )
+      { }
+      [
+        "6_7"
       ];
-    };
 
-    nodes =
-      lib.foldl
-        (
-          a: version:
-          let
-            package = pkgs."wordpress_${version}";
-          in
-          a
-          // {
-            "wp${version}_httpd" = _: {
-              services.httpd.adminAddr = "webmaster@site.local";
-              services.httpd.logPerVirtualHost = true;
+  testScript = ''
+    import re
 
-              services.wordpress.webserver = "httpd";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+    start_all()
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
+    ${lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''
+        ${name}.wait_for_unit("${(value null).services.wordpress.webserver}")
+      '') nodes
+    )}
 
-            "wp${version}_nginx" = _: {
-              services.wordpress.webserver = "nginx";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+    site_names = ["site1.local", "site2.local"]
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
+    for machine in (${lib.concatStringsSep ", " (builtins.attrNames nodes)}):
+        for site_name in site_names:
+            machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
 
-            "wp${version}_caddy" = _: {
-              services.wordpress.webserver = "caddy";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+            with subtest("website returns welcome screen"):
+                assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
-          }
-        )
-        { }
-        [
-          "6_7"
-        ];
+            with subtest("wordpress-init went through"):
+                info = machine.get_unit_info(f"wordpress-init-{site_name}")
+                assert info["Result"] == "success"
 
-    testScript = ''
-      import re
-
-      start_all()
-
-      ${lib.concatStrings (
-        lib.mapAttrsToList (name: value: ''
-          ${name}.wait_for_unit("${(value null).services.wordpress.webserver}")
-        '') nodes
-      )}
-
-      site_names = ["site1.local", "site2.local"]
-
-      for machine in (${lib.concatStringsSep ", " (builtins.attrNames nodes)}):
-          for site_name in site_names:
-              machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
-
-              with subtest("website returns welcome screen"):
-                  assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
-
-              with subtest("wordpress-init went through"):
-                  info = machine.get_unit_info(f"wordpress-init-{site_name}")
-                  assert info["Result"] == "success"
-
-              with subtest("secret keys are set"):
-                  pattern = re.compile(r"^define.*NONCE_SALT.{64,};$", re.MULTILINE)
-                  assert pattern.search(
-                      machine.succeed(f"cat /var/lib/wordpress/{site_name}/secret-keys.php")
-                  )
-    '';
-  }
-)
+            with subtest("secret keys are set"):
+                pattern = re.compile(r"^define.*NONCE_SALT.{64,};$", re.MULTILINE)
+                assert pattern.search(
+                    machine.succeed(f"cat /var/lib/wordpress/{site_name}/secret-keys.php")
+                )
+  '';
+}

pkgs/applications/networking/firehol/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "firehol";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "firehol";
     repo = "firehol";
     rev = "v${version}";
-    sha256 = "sha256-gq7l7QoUsK+j5DUn84kD9hlUTC4hz3ds3gNJc1tRygs=";
+    sha256 = "sha256-6O3AoQs7Qzcin8VXQgJfCVsNOI74H6fE1DgqdY+e4bA=";
   };
 
   patches = [

pkgs/applications/science/chemistry/siesta/default.nix

@@ -8,48 +8,56 @@
   useMpi ? false,
   mpi,
   fetchFromGitLab,
+  cmake,
+  pkg-config,
+  readline,
+  ninja,
+  elpa,
 }:
 
-stdenv.mkDerivation rec {
-  version = "4.1.5";
+stdenv.mkDerivation (finalAttrs: {
   pname = "siesta";
+  version = "5.2.2";
 
   src = fetchFromGitLab {
     owner = "siesta-project";
     repo = "siesta";
-    rev = "v${version}";
-    sha256 = "0lz8rfl5xwdj17zn7a30ipi7cgjwqki21a7wg9rdg7iwx27bpnmg";
+    tag = finalAttrs.version;
+    hash = "sha256-pud8RlJAT+0TwyPRsbf5D/8FfLjZvPYPf84Xb7UH6os=";
+    fetchSubmodules = true;
   };
 
-  postPatch = ''
-    substituteInPlace Src/siesta_init.F --replace '/bin/rm' 'rm'
-  '';
-
   passthru = {
     inherit mpi;
   };
 
-  nativeBuildInputs = [ gfortran ];
+  nativeBuildInputs = [
+    ninja
+    gfortran
+    cmake
+    pkg-config
+  ];
 
   buildInputs =
     [
       blas
       lapack
+      readline
+      elpa
     ]
     ++ lib.optionals useMpi [
       mpi
       scalapack
     ];
 
-  enableParallelBuilding = false; # Started making trouble with gcc-11
+  NIX_LDFLAGS = "-lm";
 
-  # Must do manually because siesta does not do the regular
-  # ./configure; make; make install
-  configurePhase = ''
-    cd Obj
-    sh ../Src/obj_setup.sh
-    cp gfortran.make arch.make
-  '';
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
+  enableParallelBuilding = false; # Started making trouble with gcc-11
 
   preBuild =
     ''
@@ -76,12 +84,7 @@ stdenv.mkDerivation rec {
         ''
     );
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -a siesta $out/bin
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "First-principles materials simulation code using DFT";
     mainProgram = "siesta";
     longDescription = ''
@@ -98,8 +101,8 @@ stdenv.mkDerivation rec {
       and all-electron methods.
     '';
     homepage = "https://siesta-project.org/siesta/";
-    license = licenses.gpl2;
+    license = lib.licenses.gpl2;
     platforms = [ "x86_64-linux" ];
-    maintainers = [ maintainers.costrouc ];
+    maintainers = [ lib.maintainers.costrouc ];
   };
-}
+})

pkgs/applications/science/programming/fdr/default.nix

@@ -1,80 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  qtbase,
-  qtx11extras,
-  ncurses5,
-  xorg,
-  zlib,
-  python27Packages,
-}:
-stdenv.mkDerivation {
-  pname = "fdr";
-  version = "4.2.7";
-  src = fetchurl {
-    url = "https://dl.cocotec.io/fdr/fdr-3814-linux-x86_64.tar.gz";
-    sha256 = "0cajz1gz4slq9nfhm8dqdgxl0kc950838n0lrf8jw4vl54gv6chh";
-  };
-
-  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    python27Packages.python
-    qtbase
-    qtx11extras
-    ncurses5
-    xorg.libX11
-    xorg.libXft
-    zlib
-  ];
-
-  dontConfigure = true;
-  installPhase = ''
-    mkdir -p "$out"
-
-    # shipped Qt is buggy
-    rm lib/libQt*
-    rm -r lib/qt_plugins
-
-    cp -r * "$out"
-    ln -s ${ncurses5.out}/lib/libtinfo.so.5 $out/lib/libtinfo.so.5
-    ln -s ${qtbase.bin}/${qtbase.qtPluginPrefix} $out/lib/qt_plugins
-    ln -s ${zlib.out}/lib/libz.so.1 $out/lib/libz.so.1
-
-    for b in fdr4 _fdr4 refines _refines cspmprofiler cspmexplorerprof
-    do
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-        --set-rpath "$libPath:$out/lib" \
-        "$out/bin/$b"
-    done
-
-    for l in corei7/librefines.so \
-      libcspm_process_compiler.so \
-      libcsp_operators.so \
-      _fdr.so \
-      libfdr.so \
-      libfdr_java.so \
-      libprocess_compiler.so \
-      librefines_gui.so \
-      librefines_licensing.so  \
-      libboost_date_time.so.1.60.0 \
-      libboost_filesystem.so.1.60.0 \
-      libboost_iostreams.so.1.60.0 \
-      libboost_program_options.so.1.60.0 \
-      libboost_serialization.so.1.60.0 \
-      libboost_system.so.1.60.0
-    do
-      patchelf --set-rpath "$libPath:$out/lib" \
-        "$out/lib/$l"
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "https://cocotec.io/fdr/";
-    description = "CSP refinement checker";
-    license = licenses.unfreeRedistributable;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ nickhu ];
-  };
-}

pkgs/applications/video/bino3d/default.nix

@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bino";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchgit {
     url = "https://git.marlam.de/git/bino.git";
     rev = "bino-${finalAttrs.version}";
-    hash = "sha256-h7sS+5he8dKl9ipdM1Vs1WC6U+Pi/QMVSdTbT9E59lU=";
+    hash = "sha256-vGPbSYTfRy414xVcLIvOnN4Te36HWVz7DQegNhYb3u4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-tuna/default.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-tuna";
-  version = "1.9.9";
+  version = "1.9.10";
 
   nativeBuildInputs = [
     cmake
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "univrsal";
     repo = "tuna";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qwOAidnCGZSwTahgbyf1K0KgoDvYpqDAQXM3l1lfZXg=";
+    hash = "sha256-Y4ny8XJIk4KtmRTWdO6tHevT4Ivr1TqkNMNhua499sY=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ag/agorakit/package.nix

@@ -1,11 +1,11 @@
 {
   lib,
   fetchFromGitHub,
-  php,
+  php82,
   dataDir ? "/var/lib/agorakit",
 }:
 
-php.buildComposerProject2 (finalAttrs: {
+php82.buildComposerProject2 (finalAttrs: {
   pname = "agorakit";
   version = "1.9.3";
 

pkgs/by-name/an/android-udev-rules/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20241109";
+  version = "20250314";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    hash = "sha256-WHAm9hDpXsn+Isrc5nNgw7G5DKBJb7X0ILx6lG5Y7YQ=";
+    hash = "sha256-QADyZ3FHVuxX/PfsRt2ijwJRCksQb1Hz5lSgYJlyb1Q=";
   };
 
   installPhase = ''

pkgs/by-name/aw/aws-sam-cli/package.nix

@@ -11,14 +11,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.134.0";
+  version = "1.135.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sam-cli";
     tag = "v${version}";
-    hash = "sha256-CuXJHKHFE1HOs3fQPofWPJI1/+mtkXBGEmO7bIQD5lA=";
+    hash = "sha256-ccYpEznuU6d7gDyrDiuUmvdCJutXI7SAH2PH9Vdq8Fs=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -16,9 +16,9 @@
 {
   application-insights = mkAzExtension rec {
     pname = "application-insights";
-    version = "1.2.2";
+    version = "1.2.3";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
-    hash = "sha256-ijmPj8jG+s+855jly3m5wEz5myS8pxU/Scf7lRP2VvI=";
+    hash = "sha256-yUHCMtBDZmNuE1TP4AcIUhAT+IpbHnR0DYBH7EbZBZk=";
     description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
     propagatedBuildInputs = with python3Packages; [ isodate ];
     meta.maintainers = with lib.maintainers; [ andreasvoss ];
@@ -140,9 +140,9 @@
 
   vm-repair = mkAzExtension rec {
     pname = "vm-repair";
-    version = "2.0.3";
+    version = "2.1.1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl";
-    hash = "sha256-ynbq8XyoC6LR7N/x6Ztl74Gu4otTN+QiWLmvy7OfGA0=";
+    hash = "sha256-3Pgwppp4IssNYhJ+USQNwMEp91XdZDwNlnNWzVWrHFM=";
     description = "Support for repairing Azure Virtual Machines";
     propagatedBuildInputs = with python3Packages; [ opencensus ];
     meta.maintainers = with lib.maintainers; [ ];

pkgs/by-name/cc/ccid/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ccid";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://ccid.apdu.fr/files/${pname}-${version}.tar.xz";
-    hash = "sha256-LsqPsH6P58DTna6sp7l81zxA7Ztyc4okrT3L38kY4eo=";
+    hash = "sha256-QZWEEJUBV+Yi+dkcnnjHtwjbdOIvcRkMWB0k0gVk1Ek=";
   };
 
   postPatch = ''

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -14,25 +14,25 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.1.2";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-rsl3hBywToemthNrG80Mv+JagA4g4S7HukOaRpMKJi8=";
+    hash = "sha256-CiVwFSCbCxFm8naogpL73gUp8HNHwcIiygSVon4WNZk=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "bfd7d597b13d49cf49b64676c2719f1ed9599d22"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-LdM0VIVsDPGnHEGwbRFh4/ACTdpVyDnu6dYLLvVbwpc=";
+    rev = "ffcccc6095e052534980230f9e0ca97db2675062"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-AbUflPcuSuUigRQB0i52mfVu5sIep1vMZGVMZyznwXY=";
   };
 
-  service-cargo-hash = "sha256-mJEk4OAEcuTk5NCzPcWwSlvysqR/9s8p9OGiXWBZvdg=";
-  npm-hash = "sha256-1OT9Iv9AF4svaOnWNQfOUdo8EUkG0+PU+y8nprc6YjU=";
-  vendor-hash = "sha256-myvFXaS+QdBRHPpcLEmhg1wgheWb4uXv+QXQf5HA51M=";
+  service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8=";
+  npm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
+  vendor-hash = "sha256-nU3bIxD5zggTScNGH3HmnnXUGkLMwnQbIBVI1DmIpFs=";
 
   service = callPackage ./service.nix {
     inherit

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

@@ -4,6 +4,7 @@
   src,
   libayatana-appindicator,
   vendor-hash,
+  fetchpatch,
   glib,
   webui,
   pkg-config,
@@ -29,7 +30,20 @@ rustPlatform.buildRustPackage {
     OPENSSL_NO_VENDOR = 1;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-service-mode-mihomo-check.patch";
+      url = "https://github.com/clash-verge-rev/clash-verge-rev/commit/16d4f9fe7ee95b7312a10bf216c818c3e144dea7.patch";
+      hash = "sha256-FQHm1jjo0W1IokMDJGWVMVV9DWItG1prX+TIysL12DA=";
+    })
+  ];
+
+  prePatch = ''
+    cd ..
+  '';
+
   postPatch = ''
+    cd src-tauri
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
       --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
 

pkgs/by-name/ei/eigenmath/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "337-unstable-2025-03-16";
+  version = "338-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "622740aa22d11d08016d0ac962aa920f5e38f223";
-    hash = "sha256-sFiCYvp+SC8CnkMfoUXpAPFySd5nxiqLRVGiWsZ4FcY=";
+    rev = "2e4f6f099e7a9984e3d34430f63bc0606f364dd9";
+    hash = "sha256-Bp7+0ykgUqELF3KE678pkGneZCDcIfqlZo2g12Nb+Qc=";
   };
 
   checkPhase =

pkgs/by-name/el/elasticsearch-curator/package.nix

@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "elasticsearch-curator";
-  version = "8.0.18";
+  version = "8.0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "curator";
     tag = "v${version}";
-    hash = "sha256-J0RHCWr0l1Vm/rcmcH3w0E0U+S9AvM0XMO89rnG38mY=";
+    hash = "sha256-oeQ36CvR/v0Mvo+aGL+dYHTgEsq9TesZoBMdoePmgnI=";
   };
 
   pythonRelaxDeps = [ "es-client" ];

pkgs/by-name/ex/exportarr/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "exportarr";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "onedr0p";
     repo = "exportarr";
     rev = "v${version}";
-    hash = "sha256-A6G1b9hTGp35ZHsDaMAZdH0LkkEyXCWoV6e5Bo3UqI4=";
+    hash = "sha256-iNcdD2zigBZ2phtCkHRV0GZPrEjopV0K+vin1Zkb3Oo=";
   };
 
-  vendorHash = "sha256-8MrS/BMSjyWbBM8jVQYDsvLLaolgbP22Vp2PRX33Kfw=";
+  vendorHash = "sha256-F5WOSsjeOzMaj4Yze11OnqpgL1l87wpgl3OQEGya//M=";
 
   subPackages = [ "cmd/exportarr" ];
 

pkgs/by-name/fl/fluidd/package.nix

@@ -8,13 +8,13 @@
 
 buildNpmPackage rec {
   pname = "fluidd";
-  version = "1.32.4";
+  version = "1.33.0";
 
   src = fetchFromGitHub {
     owner = "fluidd-core";
     repo = "fluidd";
     tag = "v${version}";
-    hash = "sha256-5siU1BunQ1tcF8pg0trKkynJXmLdCS1rFo7J0WX8V30=";
+    hash = "sha256-z1qb3n+BlvQhw6fKvfZ6s/uSdWbXAJ8xqvQRdLPnD+M=";
   };
 
   patches = [
@@ -23,7 +23,7 @@ buildNpmPackage rec {
     })
   ];
 
-  npmDepsHash = "sha256-+MfqmMZ2fiijr4X2S2TQfo25mVGpnZtZYOxCfPH4gFY=";
+  npmDepsHash = "sha256-RpnZLJzxMmwo/XsXOWshw8xCpXG6GuhsaTb4rnXt/D0=";
 
   installPhase = ''
     mkdir -p $out/share/fluidd

pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix

@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-amjfreJq/GC/Xou39i2IIIGI1ukpiWRx3bddxVQB6dk=";
+    hash = "sha256-pvKCiv7hUgetTXXp+NCs04Qo9xWaLUE2T1yHENhTGl4=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zRiyLFDRqhi6TUt/UfWvgJ2hqWdUz8jxUCvN5RDp1Bk=";
+  cargoHash = "sha256-efMA8VJaQlqClAmjJ3zIYLUfnuj62vEIBKsz0l3CWxA=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 

pkgs/by-name/fr/freetube/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-P0ENx8PDWbqfiBEsWv11R3Q/FE+rAFhhk49VyQgXIz4=";
+    hash = "sha256-EpcYNUtGbEFvetroo1zAyfKxW70vD1Lk0aJKWcaV39I=";
   };
 
   # Darwin requires writable Electron dist
@@ -49,7 +49,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-U6H4TMKR+khs5fQtMtIBnHpAzJvHcvMeSD1XUqaov/M=";
+    hash = "sha256-xiJGzvmfrvvB6/rdwALOxhWSWAZ31cbySYygtG8+QpQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ga/gallery-dl/package.nix

@@ -8,7 +8,7 @@
 
 let
   pname = "gallery-dl";
-  version = "1.29.2";
+  version = "1.29.3";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-vr+qvztNtFMnDzi0GGX10eZCj5EqXj03OnIXudvrumU=";
+    hash = "sha256-LzMiJxMl6IWtUloWxBAMLvkhnTQpHkz/gjWl5gW2sZ0=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/ip/ipxe/package.nix

@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-02-28";
+  version = "1.21.1-unstable-2025-03-27";
 
   nativeBuildInputs = [
     mtools
@@ -65,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "be3a78eaf804a2c437aa055d5c1e2f4a1310a0c1";
-    hash = "sha256-W1nLhFc3OttPbDyf8e7OM+kHQajamvNJ550YdTwlOHA=";
+    rev = "09fbebc084bddcb5bc7277f1644154ab35e6a334";
+    hash = "sha256-7F7SYSvSiY23xZbiJdzjiSDMnfeB4gWNodlHVgm9MyE=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/ku/kubelogin/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "0.1.9";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-u9Fj2YkHVbFHpxrrxdYrRBvbGsLvxQQlsPHf4++L0g0=";
+    sha256 = "sha256-upToPltob3P8EwDUbl9F3COGCxnz6NZNrZ/wxv5pBQU=";
   };
 
-  vendorHash = "sha256-HYUI0x4fCA8nhIHPguGCJ+F36fxb7m97bgyigwiXWd8=";
+  vendorHash = "sha256-d4zXjMr34DUXHNBe8jGhlQ/gdsaR2hGWxZEfUKXvKCQ=";
 
   ldflags = [
     "-X main.gitTag=v${version}"

pkgs/by-name/li/libppd/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libppd";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "OpenPrinting";
     repo = "libppd";
     rev = version;
-    hash = "sha256-vT4h3dnMu4yHNk0ExGZjuChdu0kAcxsla7vJupZpLaY=";
+    hash = "sha256-8ofCv+tKgBk9GoGD4lmBPB/S4ABZ6cWGOk/KqDsEzNk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/lu/luau/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.664";
+  version = "0.666";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     rev = version;
-    hash = "sha256-VmeUO7zkBG0NojzpnfR+eVzoRhNpJh+7HwEunL/Ylqw=";
+    hash = "sha256-++4PwlCxNq31T0UQUHcvrUnY/ADdnQCtekGiGTPRmv0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ma/mandown/package.nix

@@ -2,28 +2,30 @@
   lib,
   rustPlatform,
   fetchCrate,
+  nix-update-script,
 }:
-
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mandown";
   version = "1.1.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-a+1tm9YlBuroTtgCL0nTjASaPiJHif89pRH0CWw7RjM=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-ZyjoAvsqUyHgfEsG3+CvJatmBt0AJ2ga6HRJ8Y7her0=";
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Markdown to groff (man page) converter";
     homepage = "https://gitlab.com/kornelski/mandown";
-    license = with licenses; [
+    license = with lib.licenses; [
       asl20 # or
       mit
     ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.awwpotato ];
     mainProgram = "mandown";
   };
-}
+})

pkgs/by-name/me/metacubexd/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "metacubexd";
-  version = "1.176.2";
+  version = "1.186.1";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "metacubexd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pvVtTN3hMwQJEV1a83Hb7KDnzEPSoxDCxIgAIvFrm88=";
+    hash = "sha256-AcqtDdEdtkxwm99CQzLGtDE9PSdRHJIO2gAUextqtSs=";
   };
 
   nativeBuildInputs = [
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xDcqGvM8J6miDwiwNQODnPVq63flitva6/nPLYa9cgY=";
+    hash = "sha256-PmVMNSYOffo8ExNIoTkDllRXF+Kau/6QBNkYQn1DKXE=";
   };
 
   buildPhase = ''

pkgs/by-name/mi/mirrord/manifest.json

@@ -1,21 +1,21 @@
 {
-  "version": "3.134.2",
+  "version": "3.136.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.134.2/mirrord_linux_x86_64",
-      "hash": "sha256-RrHB4/FLcIK1C0U0d6Vs2UxNTKCmcZT1ubBhqL1+rCQ="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.136.0/mirrord_linux_x86_64",
+      "hash": "sha256-MV6S23Ly0g2FPAhp2+RIMSC8D+s6NakVbMqLSwEr/2o="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.134.2/mirrord_linux_aarch64",
-      "hash": "sha256-pohyE3VHFvkJ1YR1VkDrkrbqS4V10feFPNFfSpGZ2Ro="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.136.0/mirrord_linux_aarch64",
+      "hash": "sha256-zwistetfQCucaQ3yE1XHNChDhVCnSUq2ttl4XMnAQJU="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.134.2/mirrord_mac_universal",
-      "hash": "sha256-BFCQ/QrzMGhB0y422by9L7/nmLv4mDzxMkhtQGSQBwg="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.136.0/mirrord_mac_universal",
+      "hash": "sha256-eSHJvtbCBxegYUjfplyBND2kinEqr5LlXJs9mm2U9wI="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.134.2/mirrord_mac_universal",
-      "hash": "sha256-BFCQ/QrzMGhB0y422by9L7/nmLv4mDzxMkhtQGSQBwg="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.136.0/mirrord_mac_universal",
+      "hash": "sha256-eSHJvtbCBxegYUjfplyBND2kinEqr5LlXJs9mm2U9wI="
     }
   }
 }

pkgs/by-name/my/myks/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-qtBE0kNNhCQ4o3NY/ylhA/AKCoIpCMXlWReONV1klm0=";
+    hash = "sha256-xHWiE0SCv5LbObAa4Ha/U1uTFe9z11nhpB/eMj5qYoA=";
   };
 
-  vendorHash = "sha256-U4mHGkbl5nygQfakIRmyS5z85bulO7+MjKhbQmv9ZB8=";
+  vendorHash = "sha256-tgshaSrh5o28uiSMF7sv4AP57xYkaHq6B8sQTrnteqQ=";
 
   subPackages = ".";
 

pkgs/by-name/ne/networkmanager_dmenu/package.nix

@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager_dmenu";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "networkmanager-dmenu";
     rev = "v${version}";
-    sha256 = "sha256-aw6TwRtlb9x/JOuJqPZTZB2+srlnteEOmYiOPS1tAbM=";
+    sha256 = "sha256-Iy8Bi6aXtNXFfuQmRhLo50cs7pMx1l+OIv019Dqj6ow=";
   };
 
   nativeBuildInputs = [ gobject-introspection ];

pkgs/by-name/on/onedrive/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "onedrive";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = "onedrive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KJ+6Yo5tod36yMihBamdzCGzVOTItN9OgUd05pAyTxc=";
+    hash = "sha256-SoTkphmxWVAeSfqO7Vqm8bdPAP1hK57zFNR6N5elEOM=";
   };
 
   outputs = [

pkgs/by-name/or/orca-slicer/package.nix

@@ -145,27 +145,32 @@ stdenv.mkDerivation (finalAttrs: {
 
   NLOPT = nlopt;
 
-  NIX_CFLAGS_COMPILE = toString [
-    "-Wno-ignored-attributes"
-    "-I${opencv.out}/include/opencv4"
-    "-Wno-error=template-id-cdtor"
-    "-Wno-error=incompatible-pointer-types"
-    "-Wno-template-id-cdtor"
-    "-Wno-uninitialized"
-    "-Wno-unused-result"
-    "-Wno-deprecated-declarations"
-    "-Wno-use-after-free"
-    "-Wno-format-overflow"
-    "-Wno-stringop-overflow"
-    "-DBOOST_ALLOW_DEPRECATED_HEADERS"
-    "-DBOOST_MATH_DISABLE_STD_FPCLASSIFY"
-    "-DBOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS"
-    "-DBOOST_MATH_DISABLE_FLOAT128"
-    "-DBOOST_MATH_NO_QUAD_SUPPORT"
-    "-DBOOST_MATH_MAX_FLOAT128_DIGITS=0"
-    "-DBOOST_CSTDFLOAT_NO_LIBQUADMATH_SUPPORT"
-    "-DBOOST_MATH_DISABLE_FLOAT128_BUILTIN_FPCLASSIFY"
-  ];
+  NIX_CFLAGS_COMPILE = toString (
+    [
+      "-Wno-ignored-attributes"
+      "-I${opencv.out}/include/opencv4"
+      "-Wno-error=incompatible-pointer-types"
+      "-Wno-template-id-cdtor"
+      "-Wno-uninitialized"
+      "-Wno-unused-result"
+      "-Wno-deprecated-declarations"
+      "-Wno-use-after-free"
+      "-Wno-format-overflow"
+      "-Wno-stringop-overflow"
+      "-DBOOST_ALLOW_DEPRECATED_HEADERS"
+      "-DBOOST_MATH_DISABLE_STD_FPCLASSIFY"
+      "-DBOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS"
+      "-DBOOST_MATH_DISABLE_FLOAT128"
+      "-DBOOST_MATH_NO_QUAD_SUPPORT"
+      "-DBOOST_MATH_MAX_FLOAT128_DIGITS=0"
+      "-DBOOST_CSTDFLOAT_NO_LIBQUADMATH_SUPPORT"
+      "-DBOOST_MATH_DISABLE_FLOAT128_BUILTIN_FPCLASSIFY"
+    ]
+    # Making it compatible with GCC 14+, see https://github.com/SoftFever/OrcaSlicer/pull/7710
+    ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "14") [
+      "-Wno-error=template-id-cdtor"
+    ]
+  );
 
   NIX_LDFLAGS = toString [
     (lib.optionalString withSystemd "-ludev")

pkgs/by-name/os/osquery/update.py

@@ -9,7 +9,7 @@ OWNER = 'osquery'
 REPO = 'osquery'
 OPENSSL_VERSION_PAT = re.compile(r'^set\(OPENSSL_VERSION "(.*)"\)')
 OPENSSL_SHA256_PAT = re.compile(r'^set\(OPENSSL_ARCHIVE_SHA256 "(.*)"\)')
-INFO_PATH = 'pkgs/tools/system/osquery/info.json'
+INFO_PATH = 'pkgs/by-name/os/osquery/info.json'
 
 
 def download_str(url):

pkgs/by-name/os/osv-scanner/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "osv-scanner";
-  version = "1.9.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "osv-scanner";
     tag = "v${version}";
-    hash = "sha256-Db5AgFvyrUOlW+1rcw8jPUzTBwQcFelLk5Rqk9HsbCo=";
+    hash = "sha256-iYbCCGZDTUbyW1XvQIpLZEtuzwUhTBAf3EfAwRX9qYU=";
   };
 
-  vendorHash = "sha256-4e+aEOo/hu2lC0c1sT8XJXdjrlcsqmPjpgvvdakHnmc=";
+  vendorHash = "sha256-saD4RehZrKSC5V3A5r5prlq+080BFbhEp1Jo1rCbSHI=";
 
   subPackages = [
     "cmd/osv-scanner"

pkgs/by-name/pa/passt/package.nix

@@ -5,15 +5,16 @@
 , getconf
 , gitUpdater
 , testers
+, unixtools
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passt";
-  version = "2024_12_11.09478d5";
+  version = "2025_03_20.32f6212";
 
   src = fetchurl {
     url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-IE0BMM24lrl5NHeQGkAZZVwmAsvkhDN64pARdEiOM6s=";
+    hash = "sha256-TRtFwBUUOnRwcLtB3vwU5nG/ufi9D36waXW5Yuboowk=";
   };
 
   postPatch = ''
@@ -30,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     tests.version = testers.testVersion {
       package = finalAttrs.finalPackage;
+      command = "${unixtools.script}/bin/script -c 'passt --version'";
     };
 
     updateScript = gitUpdater {

pkgs/by-name/ph/photoprism/backend.nix

@@ -33,7 +33,7 @@ buildGoModule rec {
     substituteInPlace internal/commands/passwd.go --replace '/bin/stty' "${coreutils}/bin/stty"
   '';
 
-  vendorHash = "sha256-6xE1j/Vh9ltE6TpBkvjK4rzLyXv8OJzy84vf9Iqw3yU=";
+  vendorHash = "sha256-eHdnTpcVBSvGR9ZiK6A32jfjik8VClDTkv92bD8EIgA=";
 
   subPackages = [ "cmd/photoprism" ];
 

pkgs/by-name/ph/photoprism/frontend.nix

@@ -13,7 +13,7 @@ buildNpmPackage {
     cd frontend
   '';
 
-  npmDepsHash = "sha256-y2Mj0sJP2urTDrsVPReVFi7G9fLjuKz76vDPLvkaMFA=";
+  npmDepsHash = "sha256-3cytU/QaPSsGu/984AEh3YsdV4H5cjf/br3NSc5Zd1M=";
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ph/photoprism/package.nix

@@ -17,14 +17,14 @@
 }:
 
 let
-  version = "240711-2197af848";
+  version = "250321-57590c48b";
   pname = "photoprism";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-ihDv5c5RUjDbFcAHJjzp/8qCwKfA+rlFXPziaYarzs8=";
+    hash = "sha256-tJA1Q8kcX4UYDCV+rmHyd5gfEU8WkoaqNfx1/0Iy3l8=";
   };
 
   libtensorflow = callPackage ./libtensorflow.nix { };

pkgs/by-name/sb/sby/package.nix

@@ -19,13 +19,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sby";
-  version = "0.50";
+  version = "0.51";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "sby";
     tag = "v${version}";
-    hash = "sha256-srLziLdTjKd8NC5YBbAR1iD1EcJAL3HUp6O7Z2drdsI=";
+    hash = "sha256-U9aIZ+D5BhAPWuyQgAvwO6Bu8na2KnYLVPoDHi18jj4=";
   };
 
   nativeCheckInputs = [

pkgs/by-name/se/servo/package.nix

@@ -62,13 +62,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-03-29";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "8d39d7706aee50971e848a5e31fc6bfd7ef552c1";
-    hash = "sha256-PdkES7tvECVoJWa78t/K4ab+brqCLHY47c+TnDNQ3Ps=";
+    rev = "5d1c64dba9cf3e65f770370eb17f00ad4114edce";
+    hash = "sha256-0DuS2WfgWgnxh5qDc/XNL28XxXKnYPQW7F2m4OlANck=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -79,7 +79,7 @@ rustPlatform.buildRustPackage {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mxbRqJ+ex9k1h6wOgjPHWfG8RA0vVRBAqsHtwSRI12Y=";
+  cargoHash = "sha256-m6lsXHf7SIgbIt8RyhUkJpd1/nJQMSNRS9uTJ6th9ng=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)

pkgs/by-name/sn/snakefmt/package.nix

@@ -8,14 +8,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakefmt";
-  version = "0.10.2";
+  version = "0.11.0";
   pyproject = true;
 
-  disabled = python3.pythonOlder "3.8.1";
+  disabled = python3.pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QoalkDtm2n5SdjxegYTaTtyVETt1j0RIUogE+1T5t1o=";
+    hash = "sha256-r8O5LhA8/agP/35381f2zB2rdCJy7nY0K6NC8w5yHzA=";
   };
 
   build-system = [ python3.pkgs.poetry-core ];
@@ -27,6 +27,8 @@ python3.pkgs.buildPythonApplication rec {
     toml
   ];
 
+  pythonRelaxDeps = [ "black" ];
+
   pythonImportsCheck = [ "snakefmt" ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/st/steel/package.nix

@@ -20,13 +20,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "steel";
-  version = "0.6.0-unstable-2025-03-17";
+  version = "0.6.0-unstable-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "steel";
-    rev = "8482d947369230b3af45e8775b78dad2379f7a1a";
-    hash = "sha256-/2j8olMZngr5tKmM0JfxM8oi+CYn05LY5406syq7jak=";
+    rev = "2f0fba8b16a3fbab083cedcf09974514b3a29d25";
+    hash = "sha256-i/bmZFoC3fRocO1KeCPGB9K/0yEAcKlLh56N+r1V7CI=";
   };
 
   useFetchCargoVendor = true;

pkgs/by-name/ts/tsid/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tsid";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = "tsid";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-id6OCOX01o41Z5kqzwvjYa5uoQZtzhRaFBuOBhbLcTA=";
+    hash = "sha256-SS6JhU4fuZtTzv/EY31ixwwLOzmO/dN3H5HEMh/URTA=";
   };
 
   cmakeFlags = [

pkgs/by-name/we/weaviate/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.29.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-tyztq4oXN9tPVSqQme8IG3dcba7ytblVW98jU6Nao5M=";
+    hash = "sha256-Akg0iY5M3X6ztKxhNEkhi03VnbNpNW7/Vcbv2KB6X54=";
   };
 
-  vendorHash = "sha256-WfqYmqEjgZwQgFKW97oIEaBXTKqOOFKviuYTRyqVQP0=";
+  vendorHash = "sha256-U2ean49ESKmcQ3fTtd6y9MwfWPr6tolvgioyKbQsBmU=";
 
   subPackages = [ "cmd/weaviate-server" ];
 

pkgs/by-name/we/web-ext/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-zPOXl/7v/yP1ggqSKruGli/FC8Vf7i4J3LZey4WC/Lc=";
+    hash = "sha256-RT/K/fYMys1RAvnusAMuHtfZ7gndYf3FPuHBYCklBpw=";
   };
 
-  npmDepsHash = "sha256-tU/NTeMjUyw1ftXLTP3HpLQqfzTNVwgY3oKvuIZXPxw=";
+  npmDepsHash = "sha256-O8DmeT0wRNpuPU1K6kH97D9+mxOxCchAUrvOVPq4VPc=";
 
   npmBuildFlags = [ "--production" ];
 

pkgs/by-name/zw/zwave-js-server/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-server";
-  version = "1.40.3";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-server";
     rev = version;
-    hash = "sha256-fk9UBtdbU9ZVoqCXXeeGpaiGhU9/pcR87NP1S86axSM=";
+    hash = "sha256-vY/afOza0ewOqlhbp6uMf/mw9nvQLN0lEFmHekxpJVA=";
   };
 
-  npmDepsHash = "sha256-iSrgrgepUZzlBvwMe6lmFUW4i6DVx1Bq4I4UBph/oNA=";
+  npmDepsHash = "sha256-HgXFFA1aa25vRpw4ujj6aeIX75soDYv3TaM5bQOfEv4=";
 
   # For some reason the zwave-js dependency is in devDependencies
   npmFlags = [ "--include=dev" ];

pkgs/development/beam-modules/elixir-ls/default.nix

@@ -11,12 +11,12 @@
 
 let
   pname = "elixir-ls";
-  version = "0.27.1";
+  version = "0.27.2";
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    hash = "sha256-YSu9uN0n8x1833iqvskk/47JnoXJ2Y8RCRmA12YYgDc=";
+    hash = "sha256-y1QT+wRFc+++OVFJwEheqcDIwaKHlyjbhEjhLJ2rYaI=";
   };
 in
 mixRelease {

pkgs/development/compilers/elm/packages/node/node-composition.nix

@@ -13,7 +13,6 @@ let
     inherit (pkgs)
       stdenv
       lib
-      python2
       runCommand
       writeTextFile
       writeShellScript

pkgs/development/libraries/libwpe/fdo.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wpebackend-fdo";
-  version = "1.14.3";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "https://wpewebkit.org/releases/wpebackend-fdo-${version}.tar.xz";
-    sha256 = "sha256-EBIYQllahQKR2z6C89sLmYTfB5Ai04bOQsK4UIFZ3Gw=";
+    sha256 = "sha256-vt3zISMtW9CBBsF528YA+M6I6zYgtKWaYykGO3j2RjU=";
   };
 
   depsBuildBuild = [

pkgs/development/node-packages/composition.nix

@@ -13,7 +13,6 @@ let
     inherit (pkgs)
       stdenv
       lib
-      python2
       runCommand
       writeTextFile
       writeShellScript

pkgs/development/node-packages/node-env.nix

@@ -1,9 +1,9 @@
 # This file originates from node2nix
 
-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
+{lib, stdenv, nodejs, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
 
 let
-  python = if nodejs ? python then nodejs.python else python2;
+  inherit (nodejs) python;
 
   # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
   tarWrapper = runCommand "tarWrapper" {} ''

pkgs/development/python-modules/coiled/default.nix

@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.86.0";
+  version = "1.90.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-umwAG7+ykCWLqgyQzWdrYUuslyWWP1/uKlsSci50qR4=";
+    hash = "sha256-5u33FbSB86jR9KIAhR24J0wSz9kRCaOJ0ituEzULHH8=";
   };
 
   build-system = [
@@ -79,15 +79,12 @@ buildPythonPackage rec {
     wheel
   ];
 
-  pythonImportsCheck = [
-    "coiled"
-  ];
+  pythonImportsCheck = [ "coiled" ];
 
   nativeCheckInputs = [
     versionCheckHook
   ];
-
-  versionCheckProgramArg = [ "--version" ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Python client for coiled.io dask clusters";

pkgs/development/python-modules/evernote/default.nix

@@ -1,28 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  isPy27,
-  oauth2,
-}:
-
-buildPythonPackage rec {
-  pname = "evernote";
-  version = "1.25.3";
-  format = "setuptools";
-  disabled = !isPy27; # some dependencies do not work with py3
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "796847e0b7517e729041c5187fa1665c3f6fc0491cb4d71fb95a62c4f22e64eb";
-  };
-
-  propagatedBuildInputs = [ oauth2 ];
-
-  meta = with lib; {
-    description = "Evernote SDK for Python";
-    homepage = "https://dev.evernote.com";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ hbunke ];
-  };
-}

pkgs/development/python-modules/geeknote/default.nix

@@ -1,48 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  isPy27,
-  thrift,
-  beautifulsoup4,
-  markdown2,
-  sqlalchemy,
-  html2text,
-  evernote,
-}:
-
-buildPythonPackage {
-  version = "2015-05-11";
-  format = "setuptools";
-  pname = "geeknote";
-  disabled = !isPy27;
-
-  src = fetchFromGitHub {
-    owner = "VitaliyRodnenko";
-    repo = "geeknote";
-    rev = "8489a87d044e164edb321ba9acca8d4631de3dca";
-    sha256 = "0l16v4xnyqnsf84b1pma0jmdyxvmfwcv3sm8slrv3zv7zpmcm3lf";
-  };
-
-  /*
-    build with tests fails with "Can not create application dirictory :
-    /homeless-shelter/.geeknotebuilder".
-  */
-  doCheck = false;
-
-  propagatedBuildInputs = [
-    thrift
-    beautifulsoup4
-    markdown2
-    sqlalchemy
-    html2text
-    evernote
-  ];
-
-  meta = with lib; {
-    description = "Work with Evernote from command line";
-    homepage = "http://www.geeknote.me";
-    license = licenses.gpl1Only;
-    maintainers = with maintainers; [ hbunke ];
-  };
-}

pkgs/development/python-modules/google-cloud-speech/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.31.0";
+  version = "2.31.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_speech";
     inherit version;
-    hash = "sha256-15mMJqlF9Ykzxg4tOAPtBZPrQWusnUOBwDBZ0QJy7wM=";
+    hash = "sha256-/fDTUMBke1ZpRUAr2K7vK3r9pnq7UgbrTbTtQfkjtA8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/modestmaps/default.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  pillow,
-  isPy27,
-}:
-
-buildPythonPackage rec {
-  pname = "modestmaps";
-  version = "1.4.7";
-  disabled = !isPy27;
-
-  src = fetchPypi {
-    pname = "ModestMaps";
-    inherit version;
-    sha256 = "698442a170f02923f8ea55f18526b56c17178162e44304f896a8a5fd65ab4457";
-  };
-
-  propagatedBuildInputs = [ pillow ];
-
-  meta = with lib; {
-    description = "Library for building interactive maps";
-    homepage = "http://modestmaps.com";
-    license = licenses.bsd3;
-  };
-}

pkgs/development/python-modules/nipype/default.nix

@@ -41,13 +41,13 @@
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.9.2";
+  version = "1.10.0";
   disabled = pythonOlder "3.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pQO9QbZY8ITRBCUv1yjvdfGhmYAm/quYsWOZiWVOA0M=";
+    hash = "sha256-GeXWzvpwmXGY94vGZe9NPTy1MyW1uYpy5Rrvra9rPg4=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pychart/default.nix

@@ -1,25 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  isPy27,
-}:
-
-buildPythonPackage rec {
-  pname = "pychart";
-  version = "1.39";
-  format = "setuptools";
-
-  disabled = !isPy27;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "882650928776a7ca72e67054a9e0ac98f78645f279c0cfb5910db28f03f07c2e";
-  };
-
-  meta = with lib; {
-    description = "Library for creating high quality encapsulated Postscript, PDF, PNG, or SVG charts";
-    homepage = "https://pypi.python.org/pypi/PyChart";
-    license = licenses.gpl2;
-  };
-}

pkgs/development/python-modules/pygnmi/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pygnmi";
-  version = "0.8.14";
+  version = "0.8.15";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "akarneliuk";
     repo = "pygnmi";
     tag = "v${version}";
-    sha256 = "sha256-ncp/OwELy/QOvGhLUZW2qTQZsckWI4CGrlEAZ20RtQI=";
+    sha256 = "sha256-2QPUyPGTtXlO6A05mmb/jofRidXfKq0xvH7lv1f9OQk=";
   };
 
   propagatedBuildInputs = [
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     description = "Pure Python gNMI client to manage network functions and collect telemetry";
     mainProgram = "pygnmicli";
     homepage = "https://github.com/akarneliuk/pygnmi";
-    changelog = "https://github.com/akarneliuk/pygnmi/releases/tag/v${version}";
+    changelog = "https://github.com/akarneliuk/pygnmi/releases/tag/${src.tag}";
     license = licenses.bsd3;
     maintainers = [ ];
   };

pkgs/development/python-modules/python-wifi/default.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  isPy27,
-}:
-
-buildPythonPackage rec {
-  pname = "python-wifi";
-  version = "0.6.1";
-  format = "setuptools";
-  disabled = !isPy27;
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "tar.bz2";
-    sha256 = "149c3dznb63d82143cz5hqdim0mqjysz6p3yk0zv271vq3xnmzvv";
-  };
-
-  meta = with lib; {
-    description = "Read & write wireless card capabilities using the Linux Wireless Extensions";
-    homepage = "http://pythonwifi.tuxfamily.org/";
-    # From the README: "pythonwifi is licensed under LGPLv2+, however, the
-    # examples (e.g. iwconfig.py and iwlist.py) are licensed under GPLv2+."
-    license = with licenses; [
-      lgpl2Plus
-      gpl2Plus
-    ];
-  };
-}

pkgs/development/python-modules/streamlit/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "streamlit";
-  version = "1.42.2";
+  version = "1.43.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-YgJtvctIJ5CTP2WLCW191Y+nDaicHwb7w2WLkdzU2rI=";
+    hash = "sha256-86+ir2N9ABVMakxWDS/eJW19yMwfMqU88gVwwJZ4Qbw=";
   };
 
   build-system = [

pkgs/development/python-modules/tilestache/default.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  modestmaps,
-  pillow,
-  pycairo,
-  python-mapnik,
-  simplejson,
-  werkzeug,
-  isPy27,
-}:
-
-buildPythonPackage rec {
-  pname = "tilestache";
-  version = "1.51.14";
-  format = "setuptools";
-  disabled = !isPy27;
-
-  src = fetchPypi {
-    pname = "TileStache";
-    inherit version;
-    sha256 = "1qjrabl6qr7i6yj6v647ck92abcyklb0vmb6h6kj7x8v2cj5xbvk";
-  };
-
-  propagatedBuildInputs = [
-    modestmaps
-    pillow
-    pycairo
-    python-mapnik
-    simplejson
-    werkzeug
-  ];
-
-  meta = with lib; {
-    description = "Tile server for rendered geographic data";
-    homepage = "http://tilestache.org";
-    license = licenses.bsd3;
-  };
-}

pkgs/misc/base16-builder/node-packages.nix

@@ -6,7 +6,7 @@
 
 let
   nodeEnv = import ../../development/node-packages/node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
+    inherit (pkgs) stdenv lib runCommand writeTextFile writeShellScript;
     inherit pkgs nodejs;
     libtool = if pkgs.stdenv.hostPlatform.isDarwin then pkgs.cctools or pkgs.darwin.cctools else null;
   };

pkgs/servers/http/couchdb/3.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "couchdb";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchurl {
     url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
-    hash = "sha256-0n/yoTNWAAKWqYq4hMrz0XWSfPIXJ5Y/+Q+rOnR1RM8=";
+    hash = "sha256-A1dRG2/tcOPmT051ql18wgAMsPJk7zAXArGBZCf3LyA=";
   };
 
   postPatch = ''

pkgs/servers/http/nginx/modules.nix

@@ -1,5 +1,6 @@
 { lib
 , config
+, nixosTests
 , fetchFromGitHub
 , fetchFromGitLab
 , fetchhg
@@ -509,8 +510,8 @@ let self = {
     src = fetchFromGitHub {
       owner = "nginx";
       repo = "njs";
-      rev = "0.8.7";
-      hash = "sha256-VEXzP+cN5hnDeniccwY7GIi4x460rnWO/o7ja3DyRCc=";
+      rev = "0.8.9";
+      hash = "sha256-TalS9EJP+vB1o3BKaTvXXnudjKhNOcob3kDAyeKej3c=";
     };
 
     # njs module sources have to be writable during nginx build, so we copy them
@@ -520,17 +521,19 @@ let self = {
       mkdir -p "$(dirname "$NJS_SOURCE_DIR")"
       cp --recursive "${src}" "$NJS_SOURCE_DIR"
       chmod -R u+rwX,go+rX "$NJS_SOURCE_DIR"
-      export configureFlags="''${configureFlags/"${src}"/"$NJS_SOURCE_DIR/nginx"}"
+      export configureFlags="''${configureFlags/"${src}"/"$NJS_SOURCE_DIR/nginx"} --with-ld-opt='-lz'"
       unset NJS_SOURCE_DIR
     '';
 
-    inputs = [ which ];
+    inputs = [ which zlib ];
+
+    passthru.tests = nixosTests.nginx-njs;
 
     meta = with lib; {
       description = "Subset of the JavaScript language that allows extending nginx functionality";
       homepage = "https://nginx.org/en/docs/njs/";
       license = with licenses; [ bsd2 ];
-      maintainers = [ ];
+      maintainers = with maintainers; [ jvanbruegge ];
     };
   };
 

pkgs/servers/icingaweb2/default.nix

@@ -3,7 +3,7 @@
   lib,
   fetchFromGitHub,
   makeWrapper,
-  php,
+  php83,
   nixosTests,
 }:
 
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
     cp -ra application bin etc library modules public $out
     cp -ra doc $out/share
 
-    wrapProgram $out/bin/icingacli --prefix PATH : "${lib.makeBinPath [ php ]}"
+    wrapProgram $out/bin/icingacli --prefix PATH : "${lib.makeBinPath [ php83 ]}"
   '';
 
   passthru.tests = { inherit (nixosTests) icingaweb2; };

pkgs/servers/monitoring/prometheus/pihole-exporter.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pihole-exporter";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "eko";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Sum27hjs0Jvi1UWGeQcR8z9zmZ/I40uBFpKeHgHfFrA=";
+    sha256 = "sha256-7gomafTMK8rk+QFw3Vm8KUgNFqiUDILeTwNFa7vdgAw=";
   };
 
-  vendorHash = "sha256-7f/upTF3/w40wWGdcw0h3kOPlo8ZeyRna6FapnF2X0s=";
+  vendorHash = "sha256-GB/wVB97aV+CV9Xtv0EofQQR+qOmtwrBFBogU+2S+Po=";
 
   meta = with lib; {
     description = "Prometheus exporter for PI-Hole's Raspberry PI ad blocker";

pkgs/servers/monitoring/zabbix/agent.nix

@@ -48,6 +48,7 @@ import ./versions.nix (
       license =
         if (lib.versions.major version >= "7") then lib.licenses.agpl3Only else lib.licenses.gpl2Plus;
       maintainers = with lib.maintainers; [
+        bstanderline
         mmahut
         psyanticy
       ];

pkgs/servers/monitoring/zabbix/agent2.nix

@@ -83,7 +83,10 @@ import ./versions.nix (
       homepage = "https://www.zabbix.com/";
       license =
         if (lib.versions.major version >= "7") then lib.licenses.agpl3Only else lib.licenses.gpl2Plus;
-      maintainers = with lib.maintainers; [ aanderse ];
+      maintainers = with lib.maintainers; [
+        aanderse
+        bstanderline
+      ];
       platforms = lib.platforms.unix;
     };
   }

pkgs/servers/monitoring/zabbix/proxy.nix

@@ -120,7 +120,10 @@ import ./versions.nix (
       homepage = "https://www.zabbix.com/";
       license =
         if (lib.versions.major version >= "7") then lib.licenses.agpl3Only else lib.licenses.gpl2Plus;
-      maintainers = with lib.maintainers; [ mmahut ];
+      maintainers = with lib.maintainers; [
+        bstanderline
+        mmahut
+      ];
       platforms = lib.platforms.linux;
     };
   }

pkgs/servers/monitoring/zabbix/server.nix

@@ -126,6 +126,7 @@ import ./versions.nix (
       license =
         if (lib.versions.major version >= "7") then lib.licenses.agpl3Only else lib.licenses.gpl2Plus;
       maintainers = with lib.maintainers; [
+        bstanderline
         mmahut
         psyanticy
       ];

pkgs/servers/monitoring/zabbix/versions.nix

@@ -1,7 +1,7 @@
 generic: {
   v70 = generic {
-    version = "7.0.10";
-    hash = "sha256-7tY+06QNva7EgTnBVu1SbbYLUIXbSlzJWpG08ISyGUg=";
+    version = "7.0.11";
+    hash = "sha256-r9VNy3bRuFvJAL+ZQEbKjCAS3+AvetnWAwFjLxFVuGU=";
     vendorHash = null;
   };
   v64 = generic {

pkgs/servers/monitoring/zabbix/web.nix

@@ -33,7 +33,10 @@ import ./versions.nix (
       homepage = "https://www.zabbix.com/";
       license =
         if (lib.versions.major version >= "7") then lib.licenses.agpl3Only else lib.licenses.gpl2Plus;
-      maintainers = with lib.maintainers; [ mmahut ];
+      maintainers = with lib.maintainers; [
+        bstanderline
+        mmahut
+      ];
       platforms = lib.platforms.linux;
     };
   }

pkgs/servers/mx-puppet-discord/node-composition.nix

@@ -13,7 +13,6 @@ let
     inherit (pkgs)
       stdenv
       lib
-      python2
       runCommand
       writeTextFile
       writeShellScript

pkgs/servers/web-apps/ethercalc/node-packages.nix

@@ -13,7 +13,6 @@ let
     inherit (pkgs)
       stdenv
       lib
-      python2
       runCommand
       writeTextFile
       writeShellScript

pkgs/tools/security/onlykey/onlykey.nix

@@ -13,7 +13,6 @@ let
     inherit (pkgs)
       stdenv
       lib
-      python2
       runCommand
       writeTextFile
       writeShellScript

pkgs/top-level/aliases.nix

@@ -471,6 +471,7 @@ mapAliases {
   fastnlo = throw "'fastnlo' has been renamed to/replaced by 'fastnlo-toolkit'"; # Converted to throw 2024-10-17
   fastnlo_toolkit = fastnlo-toolkit; # Added 2024-01-03
   fcitx5-catppuccin = catppuccin-fcitx5; # Added 2024-06-19
+  fdr = throw "fdr has been removed, as it cannot be built from source and depends on Python 2.x"; # Added 2025-03-19
   inherit (luaPackages) fennel; # Added 2022-09-24
   ferdi = throw "'ferdi' has been removed, upstream does not exist anymore and the package is insecure"; # Added 2024-08-22
   fetchFromGithub = throw "You meant fetchFromGitHub, with a capital H"; # preserve

pkgs/top-level/all-packages.nix

@@ -12914,8 +12914,6 @@ with pkgs;
   evolution = callPackage ../applications/networking/mailreaders/evolution/evolution { };
   evolutionWithPlugins = callPackage ../applications/networking/mailreaders/evolution/evolution/wrapper.nix { plugins = [ evolution evolution-ews ]; };
 
-  fdr = libsForQt5.callPackage ../applications/science/programming/fdr { };
-
   fetchmail = callPackage ../applications/misc/fetchmail { };
   fetchmail_7 = callPackage ../applications/misc/fetchmail/v7.nix { };