From 1400a718678fe9eb28bae99b3871993478027a4c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 22 Jun 2025 19:15:56 +0000 Subject: [PATCH 01/42] ocamlPackages.ocaml_pcre: 8.0.3 -> 8.0.4 --- pkgs/development/ocaml-modules/pcre/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/pcre/default.nix b/pkgs/development/ocaml-modules/pcre/default.nix index 3524446c5cb1..ec1527ceb20d 100644 --- a/pkgs/development/ocaml-modules/pcre/default.nix +++ b/pkgs/development/ocaml-modules/pcre/default.nix @@ -8,7 +8,7 @@ buildDunePackage rec { pname = "pcre"; - version = "8.0.3"; + version = "8.0.4"; useDune2 = true; @@ -16,7 +16,7 @@ buildDunePackage rec { src = fetchurl { url = "https://github.com/mmottl/pcre-ocaml/releases/download/${version}/pcre-${version}.tbz"; - sha256 = "sha256-FIgCeBEAHKz7/6bNsUoqbH2c3eMq62gphVdEa+kNf3k="; + sha256 = "sha256-CIoy3Co4YnVZ5AkEjkUarqV0u08ZAqU0IQsaL1SnuCA="; }; buildInputs = [ dune-configurator ]; From 2fa1151e544454140bf72b5304c7b443dd6fb5ca Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 24 Jun 2025 12:40:22 +0200 Subject: [PATCH 02/42] workflows/labels: label stale issues By re-organizing the flow in `handle()` we can start labeling both issues and pull requests, and only make the relevant API requests for the PR-case. At first glance, we might think that we only need to label the big batch list of issues and not those recently updated: But that's wrong, for recently updated issues it's important to label quickly, because the stale label needs to be *removed*, too. --- .github/stale.yml | 9 -- .github/workflows/labels.yml | 300 ++++++++++++++++++----------------- 2 files changed, 156 insertions(+), 153 deletions(-) delete mode 100644 .github/stale.yml diff --git a/.github/stale.yml b/.github/stale.yml deleted file mode 100644 index d6134c7ce112..000000000000 --- a/.github/stale.yml +++ /dev/null @@ -1,9 +0,0 @@ -# Configuration for probot-stale - https://github.com/probot/stale -daysUntilStale: 180 -daysUntilClose: false -exemptLabels: - - "1.severity: security" - - "2.status: never-stale" -staleLabel: "2.status: stale" -markComment: false -closeComment: false diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index d84f49b5895c..e61615091486 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -27,10 +27,8 @@ concurrency: # This is used as fallback without app only. # This happens when testing in forks without setting up that app. -# Labels will most likely not exist in forks, yet. For this case, -# we add the issues permission only here. permissions: - issues: write # needed to create *new* labels + issues: write pull-requests: write defaults: @@ -52,8 +50,7 @@ jobs: with: app-id: ${{ vars.NIXPKGS_CI_APP_ID }} private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }} - # No issues: write permission here, because labels in Nixpkgs should - # be created explicitly via the UI with color and description. + permission-issues: write permission-pull-requests: write - name: Log current API rate limits @@ -75,6 +72,7 @@ jobs: const artifactClient = new DefaultArtifactClient() const stats = { + issues: 0, prs: 0, requests: 0, artifacts: 0 @@ -123,6 +121,125 @@ jobs: // Update remaining requests every minute to account for other jobs running in parallel. const reservoirUpdater = setInterval(updateReservoir, 60 * 1000) + async function handlePullRequest(item) { + const log = (k,v) => core.info(`PR #${item.number} - ${k}: ${v}`) + + const pull_number = item.number + + // This API request is important for the merge-conflict label, because it triggers the + // creation of a new test merge commit. This is needed to actually determine the state of a PR. + const pull_request = (await github.rest.pulls.get({ + ...context.repo, + pull_number + })).data + + const approvals = new Set( + (await github.paginate(github.rest.pulls.listReviews, { + ...context.repo, + pull_number + })) + .filter(review => review.state == 'APPROVED') + .map(review => review.user?.id) + ) + + // After creation of a Pull Request, `merge_commit_sha` will be null initially: + // The very first merge commit will only be calculated after a little while. + // To avoid labeling the PR as conflicted before that, we wait a few minutes. + // This is intentionally less than the time that Eval takes, so that the label job + // running after Eval can indeed label the PR as conflicted if that is the case. + const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000 + + const prLabels = { + // We intentionally don't use the mergeable or mergeable_state attributes. + // Those have an intermediate state while the test merge commit is created. + // This doesn't work well for us, because we might have just triggered another + // test merge commit creation by request the pull request via API at the start + // of this function. + // The attribute merge_commit_sha keeps the old value of null or the hash *until* + // the new test merge commit has either successfully been created or failed so. + // This essentially means we are updating the merge conflict label in two steps: + // On the first pass of the day, we just fetch the pull request, which triggers + // the creation. At this stage, the label is likely not updated, yet. + // The second pass will then read the result from the first pass and set the label. + '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha, + '12.approvals: 1': approvals.size == 1, + '12.approvals: 2': approvals.size == 2, + '12.approvals: 3+': approvals.size >= 3, + '12.first-time contribution': + [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association), + } + + const run_id = (await github.rest.actions.listWorkflowRuns({ + ...context.repo, + workflow_id: 'pr.yml', + event: 'pull_request_target', + exclude_pull_requests: true, + head_sha: pull_request.head.sha + })).data.workflow_runs[0]?.id ?? + // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired. + (await github.rest.actions.listWorkflowRuns({ + ...context.repo, + // In older PRs, we need eval.yml instead of pr.yml. + workflow_id: 'eval.yml', + event: 'pull_request_target', + status: 'success', + exclude_pull_requests: true, + head_sha: pull_request.head.sha + })).data.workflow_runs[0]?.id + + // Newer PRs might not have run Eval to completion, yet. + // Older PRs might not have an eval.yml workflow, yet. + // In either case we continue without fetching an artifact on a best-effort basis. + log('Last eval run', run_id ?? '') + + const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({ + ...context.repo, + run_id, + name: 'comparison' + })).data.artifacts[0] + + // Instead of checking the boolean artifact.expired, we will give us a minute to + // actually download the artifact in the next step and avoid that race condition. + // Older PRs, where the workflow run was already eval.yml, but the artifact was not + // called "comparison", yet, will skip the download. + const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000) + log('Artifact expires at', artifact?.expires_at ?? '') + if (!expired) { + stats.artifacts++ + + await artifactClient.downloadArtifact(artifact.id, { + findBy: { + repositoryName: context.repo.repo, + repositoryOwner: context.repo.owner, + token: core.getInput('github-token') + }, + path: path.resolve(pull_number.toString()), + expectedHash: artifact.digest + }) + + const maintainers = new Set(Object.keys( + JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8')) + ).map(m => Number.parseInt(m, 10))) + + const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels + + Object.assign( + prLabels, + // Ignore `evalLabels` if it's an array. + // This can happen for older eval runs, before we switched to objects. + // The old eval labels would have been set by the eval run, + // so now they'll be present in `before`. + // TODO: Simplify once old eval results have expired (~2025-10) + (Array.isArray(evalLabels) ? undefined : evalLabels), + { + '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)), + } + ) + } + + return prLabels + } + async function handle(item) { try { const log = (k,v,skip) => { @@ -131,87 +248,19 @@ jobs: } log('Last updated at', item.updated_at) - stats.prs++ log('URL', item.html_url) - const pull_number = item.number const issue_number = item.number - // This API request is important for the merge-conflict label, because it triggers the - // creation of a new test merge commit. This is needed to actually determine the state of a PR. - const pull_request = (await github.rest.pulls.get({ - ...context.repo, - pull_number - })).data + const itemLabels = {} - const run_id = (await github.rest.actions.listWorkflowRuns({ - ...context.repo, - workflow_id: 'pr.yml', - event: 'pull_request_target', - exclude_pull_requests: true, - head_sha: pull_request.head.sha - })).data.workflow_runs[0]?.id ?? - // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired. - (await github.rest.actions.listWorkflowRuns({ - ...context.repo, - // In older PRs, we need eval.yml instead of pr.yml. - workflow_id: 'eval.yml', - event: 'pull_request_target', - status: 'success', - exclude_pull_requests: true, - head_sha: pull_request.head.sha - })).data.workflow_runs[0]?.id - - // Newer PRs might not have run Eval to completion, yet. - // Older PRs might not have an eval.yml workflow, yet. - // In either case we continue without fetching an artifact on a best-effort basis. - log('Last eval run', run_id ?? '') - - const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({ - ...context.repo, - run_id, - name: 'comparison' - })).data.artifacts[0] - - // Instead of checking the boolean artifact.expired, we will give us a minute to - // actually download the artifact in the next step and avoid that race condition. - // Older PRs, where the workflow run was already eval.yml, but the artifact was not - // called "comparison", yet, will skip the download. - const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000) - log('Artifact expires at', artifact?.expires_at ?? '') - if (!expired) { - stats.artifacts++ - - await artifactClient.downloadArtifact(artifact.id, { - findBy: { - repositoryName: context.repo.repo, - repositoryOwner: context.repo.owner, - token: core.getInput('github-token') - }, - path: path.resolve(pull_number.toString()), - expectedHash: artifact.digest - }) + if (item.pull_request) { + stats.prs++ + Object.assign(itemLabels, await handlePullRequest(item)) + } else { + stats.issues++ } - // Create a map (Label -> Boolean) of all currently set labels. - // Each label is set to True and can be disabled later. - const before = Object.fromEntries( - (await github.paginate(github.rest.issues.listLabelsOnIssue, { - ...context.repo, - issue_number - })) - .map(({ name }) => [name, true]) - ) - - const approvals = new Set( - (await github.paginate(github.rest.pulls.listReviews, { - ...context.repo, - pull_number - })) - .filter(review => review.state == 'APPROVED') - .map(review => review.user?.id) - ) - const latest_event_at = new Date( (await github.paginate( github.rest.issues.listEventsForTimeline, @@ -250,60 +299,21 @@ jobs: const stale_at = new Date(new Date().setDate(new Date().getDate() - 180)) - // After creation of a Pull Request, `merge_commit_sha` will be null initially: - // The very first merge commit will only be calculated after a little while. - // To avoid labeling the PR as conflicted before that, we wait a few minutes. - // This is intentionally less than the time that Eval takes, so that the label job - // running after Eval can indeed label the PR as conflicted if that is the case. - const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000 - - // Manage most of the labels, without eval results - const after = Object.assign( - {}, - before, - { - // We intentionally don't use the mergeable or mergeable_state attributes. - // Those have an intermediate state while the test merge commit is created. - // This doesn't work well for us, because we might have just triggered another - // test merge commit creation by request the pull request via API at the start - // of this function. - // The attribute merge_commit_sha keeps the old value of null or the hash *until* - // the new test merge commit has either successfully been created or failed so. - // This essentially means we are updating the merge conflict label in two steps: - // On the first pass of the day, we just fetch the pull request, which triggers - // the creation. At this stage, the label is likely not updated, yet. - // The second pass will then read the result from the first pass and set the label. - '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha, - '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at, - '12.approvals: 1': approvals.size == 1, - '12.approvals: 2': approvals.size == 2, - '12.approvals: 3+': approvals.size >= 3, - '12.first-time contribution': - [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association), - } + // Create a map (Label -> Boolean) of all currently set labels. + // Each label is set to True and can be disabled later. + const before = Object.fromEntries( + (await github.paginate(github.rest.issues.listLabelsOnIssue, { + ...context.repo, + issue_number + })) + .map(({ name }) => [name, true]) ) - // Manage labels based on eval results - if (!expired) { - const maintainers = new Set(Object.keys( - JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8')) - ).map(m => Number.parseInt(m, 10))) + Object.assign(itemLabels, { + '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at, + }) - const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels - - Object.assign( - after, - // Ignore `evalLabels` if it's an array. - // This can happen for older eval runs, before we switched to objects. - // The old eval labels would have been set by the eval run, - // so now they'll be present in `before`. - // TODO: Simplify once old eval results have expired (~2025-10) - (Array.isArray(evalLabels) ? undefined : evalLabels), - { - '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)), - } - ) - } + const after = Object.assign({}, before, itemLabels) // No need for an API request, if all labels are the same. const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name]) @@ -349,7 +359,6 @@ jobs: { q: [ `repo:"${process.env.GITHUB_REPOSITORY}"`, - 'type:pr', 'is:open', `updated:>=${cutoff.toISOString()}` ].join(' AND '), @@ -359,13 +368,11 @@ jobs: ) // The search endpoint only allows fetching the first 1000 records, but the - // pull request list endpoint does not support counting the total number - // of results. - // Thus, we use /search for counting and /pulls for reading the response. - const { total_count: total_pulls } = (await github.rest.search.issuesAndPullRequests({ + // list endpoints do not support counting the total number of results. + // Thus, we use /search for counting and /issues for reading the response. + const { total_count: total_items } = (await github.rest.search.issuesAndPullRequests({ q: [ `repo:"${process.env.GITHUB_REPOSITORY}"`, - 'type:pr', 'is:open' ].join(' AND '), sort: 'created', @@ -376,32 +383,37 @@ jobs: })).data const { total_count: total_runs } = workflowData - const allPulls = (await github.rest.pulls.list({ + // From GitHub's API docs: + // GitHub's REST API considers every pull request an issue, but not every issue is a pull request. + // For this reason, "Issues" endpoints may return both issues and pull requests in the response. + // You can identify pull requests by the pull_request key. + const allItems = (await github.rest.issues.listForRepo({ ...context.repo, state: 'open', sort: 'created', direction: 'asc', per_page: 100, - // We iterate through pages of 100 items across scheduled runs. With currently ~7000 open PRs and - // up to 6*24=144 scheduled runs per day, we hit every PR twice each day. - // We might not hit every PR on one iteration, because the pages will shift slightly when - // PRs are closed or merged. We assume this to be OK on the bigger scale, because a PR which was + // We iterate through pages of 100 items across scheduled runs. With currently ~7000 open PRs, + // 10000 open Issues and up to 6*24=144 scheduled runs per day, we hit every items a little less + // than once a day. + // We might not hit every item on one iteration, because the pages will shift slightly when + // items are closed or merged. We assume this to be OK on the bigger scale, because an item which was // missed once, would have to move through the whole page to be missed again. This is very unlikely, // so it should certainly be hit on the next iteration. // TODO: Evaluate after a while, whether the above holds still true and potentially implement // an overlap between runs. - page: (total_runs % Math.ceil(total_pulls / 100)) + 1 + page: (total_runs % Math.ceil(total_items / 100)) + 1 })).data // Some items might be in both search results, so filtering out duplicates as well. - const items = [].concat(updatedItems, allPulls) + const items = [].concat(updatedItems, allItems) .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number)) ;(await Promise.allSettled(items.map(handle))) .filter(({ status }) => status == 'rejected') .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`)) - core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`) + core.notice(`Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`) } } finally { clearInterval(reservoirUpdater) From 40785b6dd06ad5627733f4d0bcfec87044ff5db3 Mon Sep 17 00:00:00 2001 From: Samuel Ainsworth Date: Fri, 27 Jun 2025 18:15:02 -0400 Subject: [PATCH 03/42] python3Packages.hatch-docstring-description: init at 1.1.1 --- .../hatch-docstring-description/default.nix | 45 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 4 ++ 2 files changed, 49 insertions(+) create mode 100644 pkgs/development/python-modules/hatch-docstring-description/default.nix diff --git a/pkgs/development/python-modules/hatch-docstring-description/default.nix b/pkgs/development/python-modules/hatch-docstring-description/default.nix new file mode 100644 index 000000000000..b591db9cd797 --- /dev/null +++ b/pkgs/development/python-modules/hatch-docstring-description/default.nix @@ -0,0 +1,45 @@ +{ + buildPythonPackage, + fetchFromGitHub, + hatch-vcs, + hatchling, + lib, + pytestCheckHook, +}: + +buildPythonPackage rec { + pname = "hatch-docstring-description"; + version = "1.1.1"; + pyproject = true; + + src = fetchFromGitHub { + owner = "flying-sheep"; + repo = "hatch-docstring-description"; + tag = "v${version}"; + hash = "sha256-ouor0FV3qdXYJx5EWFUWSKp8Cc/EuD1WXrtLvbYG+XI="; + }; + + build-system = [ + hatchling + hatch-vcs + ]; + + nativeCheckInputs = [ pytestCheckHook ]; + + disabledTests = [ + # See https://github.com/flying-sheep/hatch-docstring-description/issues/107 + "test_e2e[.]" + "test_e2e[src]" + ]; + + pythonImportsCheck = [ "hatch_docstring_description" ]; + + meta = { + description = "Derive PyPI package description from Python package docstring"; + homepage = "https://github.com/flying-sheep/hatch-docstring-description"; + license = lib.licenses.gpl3; + maintainers = with lib.maintainers; [ + samuela + ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 56ce5f4d779d..98f26f4200dc 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -6355,6 +6355,10 @@ self: super: with self; { hatch-babel = callPackage ../development/python-modules/hatch-babel { }; + hatch-docstring-description = + callPackage ../development/python-modules/hatch-docstring-description + { }; + hatch-fancy-pypi-readme = callPackage ../development/python-modules/hatch-fancy-pypi-readme { }; hatch-jupyter-builder = callPackage ../development/python-modules/hatch-jupyter-builder { }; From baee59130a67e422998afa2fe3679c656ee472fb Mon Sep 17 00:00:00 2001 From: Samuel Ainsworth Date: Fri, 27 Jun 2025 18:15:13 -0400 Subject: [PATCH 04/42] python3Packages.hatch-min-requirements: init at 0.1.0 --- .../hatch-min-requirements/default.nix | 39 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 41 insertions(+) create mode 100644 pkgs/development/python-modules/hatch-min-requirements/default.nix diff --git a/pkgs/development/python-modules/hatch-min-requirements/default.nix b/pkgs/development/python-modules/hatch-min-requirements/default.nix new file mode 100644 index 000000000000..57a4d3dcb248 --- /dev/null +++ b/pkgs/development/python-modules/hatch-min-requirements/default.nix @@ -0,0 +1,39 @@ +{ + buildPythonPackage, + fetchFromGitHub, + hatch-vcs, + hatchling, + lib, +}: + +buildPythonPackage rec { + pname = "hatch-min-requirements"; + version = "0.1.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "tlambert03"; + repo = "hatch-min-requirements"; + tag = "v${version}"; + hash = "sha256-7/6Es0DHDJ8jZ76kVbWkQjWFd8hWuB+PwCbOmIjzK5o="; + }; + + build-system = [ + hatchling + hatch-vcs + ]; + + # As of v0.1.0 all tests attempt to use the network + doCheck = false; + + pythonImportsCheck = [ "hatch_min_requirements" ]; + + meta = { + description = "Hatchling plugin to create optional-dependencies pinned to minimum versions"; + homepage = "https://github.com/tlambert03/hatch-min-requirements"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ + samuela + ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 98f26f4200dc..2c545f9d9fa2 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -6363,6 +6363,8 @@ self: super: with self; { hatch-jupyter-builder = callPackage ../development/python-modules/hatch-jupyter-builder { }; + hatch-min-requirements = callPackage ../development/python-modules/hatch-min-requirements { }; + hatch-nodejs-version = callPackage ../development/python-modules/hatch-nodejs-version { }; hatch-odoo = callPackage ../development/python-modules/hatch-odoo { }; From 6c71eef5ff15ed8f2bea48b707808ba43e320fb6 Mon Sep 17 00:00:00 2001 From: Samuel Ainsworth Date: Fri, 27 Jun 2025 18:15:36 -0400 Subject: [PATCH 05/42] python3Packages.fast-array-utils: init at 1.2.1 --- .../fast-array-utils/default.nix | 70 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 72 insertions(+) create mode 100644 pkgs/development/python-modules/fast-array-utils/default.nix diff --git a/pkgs/development/python-modules/fast-array-utils/default.nix b/pkgs/development/python-modules/fast-array-utils/default.nix new file mode 100644 index 000000000000..fb541592bcdc --- /dev/null +++ b/pkgs/development/python-modules/fast-array-utils/default.nix @@ -0,0 +1,70 @@ +{ + buildPythonPackage, + dask, + fetchFromGitHub, + hatch-docstring-description, + hatch-fancy-pypi-readme, + hatch-min-requirements, + hatch-vcs, + hatchling, + lib, + numba, + numpy, + pytest-codspeed, + pytest-doctestplus, + pytestCheckHook, + scipy, +}: + +buildPythonPackage rec { + pname = "fast-array-utils"; + version = "1.2.1"; + pyproject = true; + + src = fetchFromGitHub { + owner = "scverse"; + repo = "fast-array-utils"; + tag = "v${version}"; + hash = "sha256-SQaumXgjFn2+/MqllEs0zRnl2t7m2JZyOd+39vZPU2U="; + }; + + # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables. + env.MIN_REQS_OFFLINE = "1"; + + build-system = [ + hatch-docstring-description + hatch-fancy-pypi-readme + hatch-min-requirements + hatch-vcs + hatchling + ]; + + dependencies = [ + numpy + ]; + + nativeCheckInputs = [ + dask + numba + pytest-codspeed + pytest-doctestplus + pytestCheckHook + scipy + ]; + + pythonImportsCheck = [ + "fast_array_utils.conv" + "fast_array_utils.types" + "fast_array_utils.typing" + "fast_array_utils" + ]; + + meta = { + description = "Fast array utilities"; + homepage = "https://icb-fast-array-utils.readthedocs-hosted.com"; + license = lib.licenses.mpl20; + maintainers = with lib.maintainers; [ + samuela + ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 2c545f9d9fa2..ffcb5598eb9f 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4882,6 +4882,8 @@ self: super: with self; { farama-notifications = callPackage ../development/python-modules/farama-notifications { }; + fast-array-utils = callPackage ../development/python-modules/fast-array-utils { }; + fast-histogram = callPackage ../development/python-modules/fast-histogram { }; fastai = callPackage ../development/python-modules/fastai { }; From b3cd82673bbe1331050e3d06100e14ec0a152678 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 29 Jun 2025 05:29:37 +0000 Subject: [PATCH 06/42] vscode-extensions.eamodio.gitlens: 17.2.0 -> 17.2.1 --- pkgs/applications/editors/vscode/extensions/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index 8ede4c33ab43..091a25327eb3 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1591,8 +1591,8 @@ let # semver scheme, contrary to preview versions which are listed on # the VSCode Marketplace and use a calver scheme. We should avoid # using preview versions, because they expire after two weeks. - version = "17.2.0"; - hash = "sha256-jruhqXJfCACYBFUbPCL22nhqCSrm1QFSMIpsPguQ6J8="; + version = "17.2.1"; + hash = "sha256-1p4DDZEFFOIFHV6bkduXmrUGhjMDwrqf5/U2tO00iD0="; }; meta = { changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog"; From d7ebb03b7b4b3908e48ed83b8276d6532c172491 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Sun, 29 Jun 2025 12:24:44 +0200 Subject: [PATCH 07/42] html2text: fix build with gettext 0.25 --- pkgs/by-name/ht/html2text/gettext-0.25.patch | 29 ++++++++++++++++++++ pkgs/by-name/ht/html2text/package.nix | 11 +++++++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/ht/html2text/gettext-0.25.patch diff --git a/pkgs/by-name/ht/html2text/gettext-0.25.patch b/pkgs/by-name/ht/html2text/gettext-0.25.patch new file mode 100644 index 000000000000..e0cbf73095a3 --- /dev/null +++ b/pkgs/by-name/ht/html2text/gettext-0.25.patch @@ -0,0 +1,29 @@ +diff --git a/Makefile.am b/Makefile.am +index af28077..e746147 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -13,6 +13,8 @@ + AUTOMAKE_OPTIONS = foreign + ACLOCAL_AMFLAGS = -I m4 + ++SUBDIRS = ++ + AM_YFLAGS = -d -Wno-yacc + + bin_PROGRAMS = html2text +diff --git a/configure.ac b/configure.ac +index af3ce8e..a80d1fd 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -15,8 +15,11 @@ + + AC_PREREQ([2.71]) + AC_INIT([html2text], [2.2.3], [BUG-REPORT-ADDRESS]) ++AC_CONFIG_MACRO_DIRS([m4]) + AM_INIT_AUTOMAKE + AM_MAINTAINER_MODE([disable]) ++AM_GNU_GETTEXT_VERSION([0.20]) ++AM_GNU_GETTEXT([external]) + AM_ICONV + #AC_CONFIG_SRCDIR([html.h]) + #AC_CONFIG_HEADERS([config.h]) diff --git a/pkgs/by-name/ht/html2text/package.nix b/pkgs/by-name/ht/html2text/package.nix index 7e6e46d6033f..f4aa4e61ee84 100644 --- a/pkgs/by-name/ht/html2text/package.nix +++ b/pkgs/by-name/ht/html2text/package.nix @@ -3,6 +3,7 @@ stdenv, fetchFromGitLab, autoreconfHook, + gettext, libiconv, }: @@ -17,7 +18,15 @@ stdenv.mkDerivation rec { hash = "sha256-7Ch51nJ5BeRqs4PEIPnjCGk+Nm2ydgJQCtkcpihXun8="; }; - nativeBuildInputs = [ autoreconfHook ]; + nativeBuildInputs = [ + autoreconfHook + gettext + ]; + + # These changes have all been made in HEAD, across several commits + # amongst other changes. + # See https://gitlab.com/grobian/html2text/-/merge_requests/57 + patches = [ ./gettext-0.25.patch ]; buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv; From f779a712c2416be14838db1188071616ac0362f8 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Sun, 29 Jun 2025 12:36:57 +0200 Subject: [PATCH 08/42] html2text: 2.2.3 -> 2.3.0 --- pkgs/by-name/ht/html2text/gettext-0.25.patch | 4 ++-- pkgs/by-name/ht/html2text/package.nix | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ht/html2text/gettext-0.25.patch b/pkgs/by-name/ht/html2text/gettext-0.25.patch index e0cbf73095a3..ebc2aa9a0188 100644 --- a/pkgs/by-name/ht/html2text/gettext-0.25.patch +++ b/pkgs/by-name/ht/html2text/gettext-0.25.patch @@ -12,13 +12,13 @@ index af28077..e746147 100644 bin_PROGRAMS = html2text diff --git a/configure.ac b/configure.ac -index af3ce8e..a80d1fd 100644 +index 999c6fe..30c2536 100644 --- a/configure.ac +++ b/configure.ac @@ -15,8 +15,11 @@ AC_PREREQ([2.71]) - AC_INIT([html2text], [2.2.3], [BUG-REPORT-ADDRESS]) + AC_INIT([html2text], [2.3.0], [BUG-REPORT-ADDRESS]) +AC_CONFIG_MACRO_DIRS([m4]) AM_INIT_AUTOMAKE AM_MAINTAINER_MODE([disable]) diff --git a/pkgs/by-name/ht/html2text/package.nix b/pkgs/by-name/ht/html2text/package.nix index f4aa4e61ee84..80969c8e34a4 100644 --- a/pkgs/by-name/ht/html2text/package.nix +++ b/pkgs/by-name/ht/html2text/package.nix @@ -2,24 +2,28 @@ lib, stdenv, fetchFromGitLab, + autoconf-archive, autoreconfHook, + bison, gettext, libiconv, }: stdenv.mkDerivation rec { pname = "html2text"; - version = "2.2.3"; + version = "2.3.0"; src = fetchFromGitLab { owner = "grobian"; repo = "html2text"; rev = "v${version}"; - hash = "sha256-7Ch51nJ5BeRqs4PEIPnjCGk+Nm2ydgJQCtkcpihXun8="; + hash = "sha256-e/KWyc7lOdWhtFC7ZAD7sYgCsO3JzGkLUThVI7edqIQ="; }; nativeBuildInputs = [ + autoconf-archive autoreconfHook + bison gettext ]; From 704946d221d19d1bc309fb6644479035745a0583 Mon Sep 17 00:00:00 2001 From: natsukium Date: Sun, 29 Jun 2025 22:56:53 +0900 Subject: [PATCH 09/42] neovim: add backward compatibility for luaRcContent in makeNeovimConfig The makeNeovimConfig function now preserves luaRcContent when passed as an attribute, with a deprecation warning. This fixes the breaking change from commit 24df1ab44ac6 where luaRcContent would be overwritten by the new customLuaRC parameter. --- doc/release-notes/rl-2511.section.md | 2 ++ pkgs/applications/editors/neovim/utils.nix | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md index 13a690ad5eb7..38cade794c15 100644 --- a/doc/release-notes/rl-2511.section.md +++ b/doc/release-notes/rl-2511.section.md @@ -26,6 +26,8 @@ - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input. +- `neovimUtils.makeNeovimConfig` now uses `customLuaRC` parameter instead of accepting `luaRcContent`. The old usage is deprecated but still works with a warning. + - `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms. - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatable due to major api changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`. diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix index d008ba2c76d7..f82fb523d318 100644 --- a/pkgs/applications/editors/neovim/utils.nix +++ b/pkgs/applications/editors/neovim/utils.nix @@ -84,7 +84,11 @@ let attrs // { neovimRcContent = customRC; - luaRcContent = customLuaRC; + luaRcContent = + if attrs ? luaRcContent then + lib.warn "makeNeovimConfig: luaRcContent parameter is deprecated. Please use customLuaRC instead." attrs.luaRcContent + else + customLuaRC; wrapperArgs = lib.optionals (luaEnv != null) [ "--prefix" "LUA_PATH" From b2c793fa16072a604e77836a02f072d0b3ebcfa9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 29 Jun 2025 23:44:24 +0000 Subject: [PATCH 10/42] ps3-disc-dumper: 4.3.6 -> 4.3.9 --- pkgs/by-name/ps/ps3-disc-dumper/deps.json | 96 ++++++++++----------- pkgs/by-name/ps/ps3-disc-dumper/package.nix | 4 +- 2 files changed, 50 insertions(+), 50 deletions(-) diff --git a/pkgs/by-name/ps/ps3-disc-dumper/deps.json b/pkgs/by-name/ps/ps3-disc-dumper/deps.json index 84caefc4a739..a24d6e42bd38 100644 --- a/pkgs/by-name/ps/ps3-disc-dumper/deps.json +++ b/pkgs/by-name/ps/ps3-disc-dumper/deps.json @@ -1,13 +1,13 @@ [ { "pname": "Avalonia", - "version": "11.3.0", - "hash": "sha256-Hot4dWkrP5x+JzaP2/7E1QOOiXfPGhkvK1nzBacHvzg=" + "version": "11.3.1", + "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE=" }, { "pname": "Avalonia.Angle.Windows.Natives", - "version": "2.1.22045.20230930", - "hash": "sha256-RxPcWUT3b/+R3Tu5E5ftpr5ppCLZrhm+OTsi0SwW3pc=" + "version": "2.1.25547.20250602", + "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M=" }, { "pname": "Avalonia.BuildServices", @@ -16,48 +16,48 @@ }, { "pname": "Avalonia.Desktop", - "version": "11.3.0", - "hash": "sha256-XZXmsKrYCOEWzFUbnwNKvEz5OCD/1lAPi+wM4BiMB7I=" + "version": "11.3.1", + "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90=" }, { "pname": "Avalonia.Fonts.Inter", - "version": "11.3.0", - "hash": "sha256-/ObA3b0iPpPFcXBUiD8TmdCXFVqZKToK7YRuU3QUWtg=" + "version": "11.3.1", + "hash": "sha256-LfNYF+SywrIzUw4T+GRE/Mr8E7GQskQQTTfK3Kc5YVQ=" }, { "pname": "Avalonia.FreeDesktop", - "version": "11.3.0", - "hash": "sha256-nWIW3aDPI/00/k52BNU4n43sS3ymuw+e97EBSsjjtU4=" + "version": "11.3.1", + "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ=" }, { "pname": "Avalonia.Native", - "version": "11.3.0", - "hash": "sha256-l6gcCeGd422mLQgVLp2sxh4/+vZxOPoMrxyfjGyhYLs=" + "version": "11.3.1", + "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs=" }, { "pname": "Avalonia.Remote.Protocol", - "version": "11.3.0", - "hash": "sha256-7ytabxzTbPLR3vBCCb7Z6dYRZZVvqiDpvxweOYAqi7I=" + "version": "11.3.1", + "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM=" }, { "pname": "Avalonia.Skia", - "version": "11.3.0", - "hash": "sha256-p+mWsyrYsC9PPhNjOxPZwarGuwmIjxaQ4Ml/2XiEuEc=" + "version": "11.3.1", + "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI=" }, { "pname": "Avalonia.Themes.Fluent", - "version": "11.3.0", - "hash": "sha256-o5scZcwaflLKXQD6VLGZYe4vvQ322Xzgh7F3IvriMfk=" + "version": "11.3.1", + "hash": "sha256-PApWHwIoLzbzrnyXJQLVy85Rbxag7NFEKMXOs2iVVaA=" }, { "pname": "Avalonia.Win32", - "version": "11.3.0", - "hash": "sha256-Ltf6EuL6aIG+YSqOqD/ecdqUDsuwhNuh+XilIn7pmlE=" + "version": "11.3.1", + "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04=" }, { "pname": "Avalonia.X11", - "version": "11.3.0", - "hash": "sha256-QOprHb0HjsggEMWOW7/U8pqlD8M4m97FeTMWlriYHaU=" + "version": "11.3.1", + "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ=" }, { "pname": "CommunityToolkit.Mvvm", @@ -66,53 +66,53 @@ }, { "pname": "HarfBuzzSharp", - "version": "7.3.0.3", - "hash": "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM=" + "version": "8.3.1.1", + "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0=" }, { "pname": "HarfBuzzSharp.NativeAssets.Linux", - "version": "7.3.0.3", - "hash": "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM=" + "version": "8.3.1.1", + "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU=" }, { "pname": "HarfBuzzSharp.NativeAssets.macOS", - "version": "7.3.0.3", - "hash": "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w=" + "version": "8.3.1.1", + "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q=" }, { "pname": "HarfBuzzSharp.NativeAssets.WebAssembly", - "version": "7.3.0.3", - "hash": "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I=" + "version": "8.3.1.1", + "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw=" }, { "pname": "HarfBuzzSharp.NativeAssets.Win32", - "version": "7.3.0.3", - "hash": "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I=" + "version": "8.3.1.1", + "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo=" }, { "pname": "LTRData.DiscUtils.Core", - "version": "1.0.54", - "hash": "sha256-6n68/HVei6xzPvjTxP8utmHWUYWQ8bA6j19LT7hxCHc=" + "version": "1.0.57", + "hash": "sha256-W3MWde/i+/AjEnVrddhcBiuyHmujVAxq+NpJudgoIpc=" }, { "pname": "LTRData.DiscUtils.Iso9660", - "version": "1.0.54", - "hash": "sha256-pW2wKBlMeqNFHXI58p2yR9uEkf3B5MqhRNfIjDt2JYE=" + "version": "1.0.57", + "hash": "sha256-h1LEAyKcrLB/QY77HH2eLAPtdFQccVeycwkVPr7x9/U=" }, { "pname": "LTRData.DiscUtils.OpticalDisk", - "version": "1.0.54", - "hash": "sha256-k8DJcb6m2aEFd2SWICAjsZ+8IK4bPX7UP/od3ddI2eY=" + "version": "1.0.57", + "hash": "sha256-SD26HhU4622oUBWU+iK2yTj025RQh+P8ZJybJsZyUSs=" }, { "pname": "LTRData.DiscUtils.Streams", - "version": "1.0.54", - "hash": "sha256-e0QWGFOAYFMCp/FDi/0kQ8Rd1hF3oWZ3pwrQX9sCFZg=" + "version": "1.0.57", + "hash": "sha256-00o7vHJGU0yNzFp9FlKBH+gCHVie4VBcx2PnTdW5XZQ=" }, { "pname": "LTRData.DiscUtils.Udf", - "version": "1.0.54", - "hash": "sha256-K9Fs4SzQjW+ESuvvVqr9+fTs1hvGv571WCRc2Nl5jfo=" + "version": "1.0.57", + "hash": "sha256-HHCfCaW7SUpOiYBXARnXeAq0yKfPLudVL8HwLrmhL0g=" }, { "pname": "LTRData.Extensions", @@ -366,8 +366,8 @@ }, { "pname": "System.IO.Hashing", - "version": "9.0.4", - "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU=" + "version": "9.0.6", + "hash": "sha256-QhOlqpeQsqJ2Lly8xV0lzSaNBmkGPEgtyTe9xSvkyAw=" }, { "pname": "System.IO.Pipelines", @@ -456,8 +456,8 @@ }, { "pname": "System.Text.Encoding.CodePages", - "version": "9.0.4", - "hash": "sha256-gW3nGw3ElYCYTEuYxZOk1oyHsj3wBenr6uwJGK0u+IQ=" + "version": "9.0.5", + "hash": "sha256-trMfhFwGMnM60+UUqud7gFLL2YF5pCdhleKSonkkd84=" }, { "pname": "System.Threading", @@ -486,7 +486,7 @@ }, { "pname": "WmiLight", - "version": "6.13.0", - "hash": "sha256-dliebNR45yj1Gvyv4WE7dMnWcdHx94PLjBv3AWhdS5I=" + "version": "6.14.0", + "hash": "sha256-MmfXmWsLonyTKNXqmszFbvyaDjPexgH5UoCGI8h2JlA=" } ] diff --git a/pkgs/by-name/ps/ps3-disc-dumper/package.nix b/pkgs/by-name/ps/ps3-disc-dumper/package.nix index 6599b30bfc92..061b16f2f411 100644 --- a/pkgs/by-name/ps/ps3-disc-dumper/package.nix +++ b/pkgs/by-name/ps/ps3-disc-dumper/package.nix @@ -10,13 +10,13 @@ buildDotnetModule rec { pname = "ps3-disc-dumper"; - version = "4.3.6"; + version = "4.3.9"; src = fetchFromGitHub { owner = "13xforever"; repo = "ps3-disc-dumper"; tag = "v${version}"; - hash = "sha256-dHd5pAWvol4TQBXcbb1E71TTxEWvLogvj0K4VL9huNs="; + hash = "sha256-F+FyCuxzg7oTF2iRxWygXeGnspHrZ3Za8HhCSKNgoR4="; }; dotnet-sdk = dotnetCorePackages.sdk_9_0; From e7da11c8e203d5dd37fde969b8ea568bfa905b8c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 30 Jun 2025 07:43:20 +0000 Subject: [PATCH 11/42] vscode-extensions.ms-toolsai.jupyter: 2025.4.1 -> 2025.5.0 --- .../editors/vscode/extensions/ms-toolsai.jupyter/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix index ea93d2c11368..cedc09c8260d 100644 --- a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix +++ b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix @@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension { mktplcRef = { name = "jupyter"; publisher = "ms-toolsai"; - version = "2025.4.1"; - hash = "sha256-RLkelWU5chIpGS6dToQ+/jNeEbZYGi2JxeZTqqHAdVA="; + version = "2025.5.0"; + hash = "sha256-3tMuPAyTjvryiHOk0ozIQ8KqIqBV/kxJM01fgC5ZMWE="; }; nativeBuildInputs = [ From 5e44878981b496b56a15e89f6e3499fb1cd71dbf Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 30 Jun 2025 13:24:44 +0000 Subject: [PATCH 12/42] open-policy-agent: 1.5.1 -> 1.6.0 --- pkgs/by-name/op/open-policy-agent/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix index 4fba049379bc..85afcd84b7e9 100644 --- a/pkgs/by-name/op/open-policy-agent/package.nix +++ b/pkgs/by-name/op/open-policy-agent/package.nix @@ -14,13 +14,13 @@ assert buildGoModule (finalAttrs: { pname = "open-policy-agent"; - version = "1.5.1"; + version = "1.6.0"; src = fetchFromGitHub { owner = "open-policy-agent"; repo = "opa"; tag = "v${finalAttrs.version}"; - hash = "sha256-gIwi+38oUBEVK5DiTU8Avt+lQtXaIf/udyVi4LLvTu8="; + hash = "sha256-p03yjLPphS4jp0dK3hlREKzAzCKRPOpvUnmGaGzrwww="; }; vendorHash = null; From 0dc4b8e99b1f8474798fdb5fc0fe62036af79461 Mon Sep 17 00:00:00 2001 From: Florian Brandes Date: Mon, 30 Jun 2025 21:32:09 +0200 Subject: [PATCH 13/42] pgadmin: 9.4 -> 9.5 Signed-off-by: Florian Brandes --- pkgs/tools/admin/pgadmin/default.nix | 20 ++++++------- pkgs/tools/admin/pgadmin/mozjpeg.patch | 41 +++++++++++++------------- pkgs/tools/admin/pgadmin/update.sh | 2 +- 3 files changed, 31 insertions(+), 32 deletions(-) diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix index 1bd7de472492..fa7478ad0db7 100644 --- a/pkgs/tools/admin/pgadmin/default.nix +++ b/pkgs/tools/admin/pgadmin/default.nix @@ -6,7 +6,7 @@ nixosTests, postgresqlTestHook, postgresql, - yarn-berry_3, + yarn-berry_4, nodejs, autoconf, automake, @@ -22,14 +22,14 @@ let pname = "pgadmin"; - version = "9.4"; - yarnHash = "sha256-AlAyHtadjmKZb0rHNIlaPtEcGFQ15Fc6rExMsNFGwDc="; + version = "9.5"; + yarnHash = "sha256-i3WCEpcZepB7K0A4QgjoLfkO7icew/8usJCo4DkWT6I="; src = fetchFromGitHub { owner = "pgadmin-org"; repo = "pgadmin4"; rev = "REL-${lib.versions.major version}_${lib.versions.minor version}"; - hash = "sha256-oslp9g63mYeP9CmpCzF80nlyqF1ftGbMRIsp6goJOx4="; + hash = "sha256-5FwYkdhpg/2Cidi2qiFhhsQYbIwsp80K3MNxw5rp4ww="; }; mozjpeg-bin = fetchFromGitHub { @@ -59,7 +59,7 @@ in pythonPackages.buildPythonApplication rec { inherit pname version src; - offlineCache = yarn-berry_3.fetchYarnBerryDeps { + offlineCache = yarn-berry_4.fetchYarnBerryDeps { # mozjpeg fails to build on darwin due to a hardocded path # this has been fixed upstream on master but no new version # has been released. We therefore point yarn to upstream @@ -154,11 +154,11 @@ pythonPackages.buildPythonApplication rec { export LD=$CC export HOME=$(mktemp -d) export YARN_ENABLE_SCRIPTS=1 - YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn config set enableTelemetry false - YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn config set enableGlobalCache false + YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn config set enableTelemetry false + YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn config set enableGlobalCache false export npm_config_nodedir="${srcOnly nodejs}" export npm_config_node_gyp="${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" - YARN_IGNORE_PATH=1 ${yarn-berry_3.yarn-berry-offline}/bin/yarn install --inline-builds + YARN_IGNORE_PATH=1 ${yarn-berry_4.yarn-berry-offline}/bin/yarn install --inline-builds ) yarn webpacker cp -r * ../pip-build/pgadmin4 @@ -185,8 +185,8 @@ pythonPackages.buildPythonApplication rec { cython pip sphinx - yarn-berry_3 - yarn-berry_3.yarnBerryConfigHook + yarn-berry_4 + yarn-berry_4.yarnBerryConfigHook nodejs # for building mozjpeg2 diff --git a/pkgs/tools/admin/pgadmin/mozjpeg.patch b/pkgs/tools/admin/pgadmin/mozjpeg.patch index dc73c7b4957a..71b6f42eb409 100644 --- a/pkgs/tools/admin/pgadmin/mozjpeg.patch +++ b/pkgs/tools/admin/pgadmin/mozjpeg.patch @@ -1,45 +1,44 @@ diff --git a/yarn.lock b/yarn.lock -index fa189ef..54066a6 100644 +index 8bfff31..0f12f87 100644 --- a/yarn.lock +++ b/yarn.lock -@@ -7299,6 +7299,23 @@ __metadata: +@@ -7347,6 +7347,23 @@ __metadata: languageName: node linkType: hard - + +"execa@npm:^7.1.1": + version: 7.1.1 + resolution: "execa@npm:7.1.1" + dependencies: -+ cross-spawn: ^7.0.3 -+ get-stream: ^6.0.1 -+ human-signals: ^3.0.1 -+ is-stream: ^3.0.0 -+ merge-stream: ^2.0.0 -+ npm-run-path: ^5.1.0 -+ onetime: ^6.0.0 -+ signal-exit: ^3.0.7 -+ strip-final-newline: ^3.0.0 -+ checksum: 21fa46fc69314ace4068cf820142bdde5b643a5d89831c2c9349479c1555bff137a291b8e749e7efca36535e4e0a8c772c11008ca2e84d2cbd6ca141a3c8f937 ++ cross-spawn: "npm:^7.0.3" ++ get-stream: "npm:^6.0.1" ++ human-signals: "npm:^3.0.1" ++ is-stream: "npm:^3.0.0" ++ merge-stream: "npm:^2.0.0" ++ npm-run-path: "npm:^5.1.0" ++ onetime: "npm:^6.0.0" ++ signal-exit: "npm:^3.0.7" ++ strip-final-newline: "npm:^3.0.0" ++ checksum: 0da5ee1c895b62142bc3d1567d1974711c28c2cfa6bae96e1923379bd597e476d762a13f282f92815d8ebfa33407949634fa32a0d6db8334a20e625fe11d4351 + languageName: node + linkType: hard + "executable@npm:^4.1.0": version: 4.1.1 resolution: "executable@npm:4.1.1" -@@ -11027,13 +11044,14 @@ __metadata: - +@@ -11120,13 +11137,14 @@ __metadata: + "mozjpeg@npm:^8.0.0": version: 8.0.0 - resolution: "mozjpeg@npm:8.0.0" + resolution: "mozjpeg@https://github.com/imagemin/mozjpeg-bin.git#commit=c0587fbc00b21ed8cad8bae499a0827baeaf7ffa" dependencies: - bin-build: ^3.0.0 - bin-wrapper: ^4.0.0 -+ execa: ^7.1.1 + bin-build: "npm:^3.0.0" + bin-wrapper: "npm:^4.0.0" ++ execa: "npm:^7.1.1" bin: mozjpeg: cli.js -- checksum: cba27c2efbc21a48434da1c6c8d6886988432430f958315fc59ef9b52bc2d6ee597e19f1cf6aae0fd611d5b2a113561fe2e85ec30a1ccd55c007340c638eb557 +- checksum: 10c0/e91294c15bb31dcaa5eb0780e772214052aa8cb1efc35f74a5c4fe85c9af9d3d6e2f3dc64d3379a86a63b5cbc86a2618c23e350c9131e55ac76726647537b7e8 + checksum: cba27c2efbc21a48434da1c6c8d6886988432430f958315fc59ef9b52bc2d6ee597e19f1cf6aae0fd611d5b2a113561fe2e85ec30a1ccd55c007340c638eb556 languageName: node - linkType: hard - + linkType: hard \ No newline at end of file diff --git a/pkgs/tools/admin/pgadmin/update.sh b/pkgs/tools/admin/pgadmin/update.sh index ef09e7250f75..068afec737de 100755 --- a/pkgs/tools/admin/pgadmin/update.sh +++ b/pkgs/tools/admin/pgadmin/update.sh @@ -1,5 +1,5 @@ #!/usr/bin/env nix-shell -#!nix-shell -i bash -p curl wget jq common-updater-scripts yarn-berry_3 yarn-berry_3.yarn-berry-fetcher +#!nix-shell -i bash -p curl wget jq common-updater-scripts yarn-berry_4 yarn-berry_4.yarn-berry-fetcher set -eu -o pipefail From 99ed3aeed2c54451c6df5ebd581f082f38037617 Mon Sep 17 00:00:00 2001 From: Sarah Clark Date: Mon, 30 Jun 2025 11:51:13 -0700 Subject: [PATCH 14/42] python3Packages.wandb: disable broken/flaky tests --- pkgs/development/python-modules/wandb/default.nix | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix index 2459a04d7ad9..40cb21f02372 100644 --- a/pkgs/development/python-modules/wandb/default.nix +++ b/pkgs/development/python-modules/wandb/default.nix @@ -285,6 +285,12 @@ buildPythonPackage rec { # broke somewhere between sentry-sdk 2.15.0 and 2.22.0 "tests/unit_tests/test_analytics/test_sentry.py" + + # Server connection times out under load + "tests/unit_tests/test_wandb_login.py" + + # PermissionError: unable to write to .cache/wandb/artifacts + "tests/unit_tests/test_artifacts/test_wandb_artifacts.py" ]; disabledTests = @@ -359,6 +365,12 @@ buildPythonPackage rec { "test_log_media_prefixed_with_multiple_slashes" "test_log_media_saves_to_run_directory" "test_log_media_with_path_traversal" + + # HandleAbandonedError / SystemExit when run in sandbox + "test_makedirs_raises_oserror__uses_temp_dir" + + # AssertionError: Not all requests have been executed + "test_image_refs" ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ # AssertionError: assert not copy2_mock.called @@ -378,9 +390,6 @@ buildPythonPackage rec { # RuntimeError: *** -[__NSPlaceholderArray initWithObjects:count:]: attempt to insert nil object from objects[1] "test_wandb_image_with_matplotlib_figure" - - # HandleAbandonedError / SystemExit when run in sandbox - "test_makedirs_raises_oserror__uses_temp_dir" ]; pythonImportsCheck = [ "wandb" ]; From a8502f891cbcee904ca7f2e353e2b0943e50603a Mon Sep 17 00:00:00 2001 From: Gliczy <129636582+Gliczy@users.noreply.github.com> Date: Tue, 1 Jul 2025 07:39:10 +0200 Subject: [PATCH 15/42] proton-ge-bin: GE-Proton10-4 -> GE-Proton10-7 --- pkgs/by-name/pr/proton-ge-bin/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix index d5bf56c940f4..e0108e5c3f2f 100644 --- a/pkgs/by-name/pr/proton-ge-bin/package.nix +++ b/pkgs/by-name/pr/proton-ge-bin/package.nix @@ -9,11 +9,11 @@ }: stdenvNoCC.mkDerivation (finalAttrs: { pname = "proton-ge-bin"; - version = "GE-Proton10-4"; + version = "GE-Proton10-7"; src = fetchzip { url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz"; - hash = "sha256-Si/CQ2PINfhmsC+uW3iFBUoSczZdkqwCZ8FAFuipu68="; + hash = "sha256-XlZVQ+xYgg1H1xAHBcXZmF5//7k6w9NNspXJ/1KhzX8="; }; dontUnpack = true; From 2828cacf28b256a55e5f361f3da1a5a8318686e2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 07:27:04 +0000 Subject: [PATCH 16/42] python3Packages.slepc4py: 3.23.1 -> 3.23.2 --- pkgs/by-name/sl/slepc/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sl/slepc/package.nix b/pkgs/by-name/sl/slepc/package.nix index f4fc8afd9593..6d77fbdbe134 100644 --- a/pkgs/by-name/sl/slepc/package.nix +++ b/pkgs/by-name/sl/slepc/package.nix @@ -16,13 +16,13 @@ assert petsc.mpiSupport; assert pythonSupport -> petsc.pythonSupport; stdenv.mkDerivation (finalAttrs: { pname = "slepc"; - version = "3.23.1"; + version = "3.23.2"; src = fetchFromGitLab { owner = "slepc"; repo = "slepc"; tag = "v${finalAttrs.version}"; - hash = "sha256-K38/QH4AG8/SksrRLc+jIs1WO8FKFFTNkuHFbBER/tg="; + hash = "sha256-nRY8ARc31Q2Qi8Tf7921vBf5nPpI4evSjmpTYUTUigQ="; }; postPatch = '' From 567bf4b742adc070c14c4ad82b61147b06692974 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 07:38:47 +0000 Subject: [PATCH 17/42] sheldon: 0.8.2 -> 0.8.3 --- pkgs/by-name/sh/sheldon/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/sh/sheldon/package.nix b/pkgs/by-name/sh/sheldon/package.nix index 490f8e338dd1..87ecc05bbc28 100644 --- a/pkgs/by-name/sh/sheldon/package.nix +++ b/pkgs/by-name/sh/sheldon/package.nix @@ -11,17 +11,17 @@ rustPlatform.buildRustPackage rec { pname = "sheldon"; - version = "0.8.2"; + version = "0.8.3"; src = fetchFromGitHub { owner = "rossmacarthur"; repo = "sheldon"; rev = version; - hash = "sha256-4tI/D9Z5+BAH7K9mA/sU/qPKWcPvZqpY5v4dDA0qfr0="; + hash = "sha256-+NtiscyNlrXNNj3njvdZQB8dHs/PBYpEo9VwodEOtDs="; }; useFetchCargoVendor = true; - cargoHash = "sha256-MHQbCsZng7YRvY5K+l9u90M/zyyfz2nl01RN46EUSXk="; + cargoHash = "sha256-O9v77mwOeTnT4LetcrzQjdd3MDXDbpptUODMAVBwZv8="; buildInputs = [ openssl ] From 51143e2b5f9ae7d6276c729b58c8fe4954ee6220 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 07:59:43 +0000 Subject: [PATCH 18/42] patch2pr: 0.35.0 -> 0.36.0 --- pkgs/by-name/pa/patch2pr/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pa/patch2pr/package.nix b/pkgs/by-name/pa/patch2pr/package.nix index 8269b2c3105c..5cb7ae1ff519 100644 --- a/pkgs/by-name/pa/patch2pr/package.nix +++ b/pkgs/by-name/pa/patch2pr/package.nix @@ -8,16 +8,16 @@ buildGoModule rec { pname = "patch2pr"; - version = "0.35.0"; + version = "0.36.0"; src = fetchFromGitHub { owner = "bluekeyes"; repo = "patch2pr"; rev = "v${version}"; - hash = "sha256-dj8xDTl7S1XETJqDI61rdRvQebJ4xgit+xc1xRyaV4M="; + hash = "sha256-KaU77UYJJqcTJZrFPiqcdzYIVoih6oSeaPWiQdDiZ2s="; }; - vendorHash = "sha256-pn2x6f+N9VYncc490VtPzXkJxwC0nZgj4pDNB+no2Lo="; + vendorHash = "sha256-MO6LrUvSu7pYidtjaDgjIEAxoIKM/U9hcePZr336Mbw="; ldflags = [ "-X main.version=${version}" From 501ab4ff9ed3163fd0d948bf1e2dc10e4996717b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 08:49:09 +0000 Subject: [PATCH 19/42] fishPlugins.forgit: 25.06.0 -> 25.07.0 --- pkgs/shells/fish/plugins/forgit.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix index 74554ba09191..fe4c20e9c27a 100644 --- a/pkgs/shells/fish/plugins/forgit.nix +++ b/pkgs/shells/fish/plugins/forgit.nix @@ -6,13 +6,13 @@ buildFishPlugin rec { pname = "forgit"; - version = "25.06.0"; + version = "25.07.0"; src = fetchFromGitHub { owner = "wfxr"; repo = "forgit"; rev = version; - hash = "sha256-D1we3pOPXNsK8KgEaRBAmD5eH1i2ud4zX1GwYbOyZvY="; + hash = "sha256-h9li2nwKG6SnOQntWZpdeBbU3RrwO4+4yO7tAwuOwhE="; }; postInstall = '' From da51e34502817f51711660a6ef7ffc4ecee1af27 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 10:01:02 +0000 Subject: [PATCH 20/42] python3Packages.petsc4py: 3.23.3 -> 3.23.4 --- pkgs/by-name/pe/petsc/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pe/petsc/package.nix b/pkgs/by-name/pe/petsc/package.nix index 450d7abff32e..93e142153a71 100644 --- a/pkgs/by-name/pe/petsc/package.nix +++ b/pkgs/by-name/pe/petsc/package.nix @@ -111,11 +111,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "petsc"; - version = "3.23.3"; + version = "3.23.4"; src = fetchzip { url = "https://web.cels.anl.gov/projects/petsc/download/release-snapshots/petsc-${finalAttrs.version}.tar.gz"; - hash = "sha256-1ycMyER09PIN5JyT5nQxUe3GnaVC6WFUUiuug9aXyKc="; + hash = "sha256-7UugWo3SzRap3Ed6NySRZOJgD+Wkb9J+QEGRUfLbOPI="; }; strictDeps = true; From b39a9d979c20a4242ee725bebdff7b773638ad21 Mon Sep 17 00:00:00 2001 From: Christoph Jabs Date: Mon, 30 Jun 2025 14:49:36 +0300 Subject: [PATCH 21/42] texlive: fix darwin build --- pkgs/tools/typesetting/tex/texlive/bin.nix | 14 ++ .../truncate-luajit-version-number.patch | 209 ++++++++++++++++++ 2 files changed, 223 insertions(+) create mode 100644 pkgs/tools/typesetting/tex/texlive/truncate-luajit-version-number.patch diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix index b2a3ee7cb2f2..8aab494c29d0 100644 --- a/pkgs/tools/typesetting/tex/texlive/bin.nix +++ b/pkgs/tools/typesetting/tex/texlive/bin.nix @@ -389,6 +389,20 @@ rec { url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=lua_fixed_hash.patch;msg=45"; sha256 = "sha256-FTu1eRd3AUU7IRs2/7e7uwHuvZsrzTBPypbcEZkU7y4="; }) + # The original LuaJIT version number used here is 2.1.1736781742. + # The patch number in this is the unix epoch timestamp of the commit used. + # TexLive already truncates the patch number to the last 5 digits (81742 + # in this case), however, this number will roll over every 1.1 days (1e5 + # seconds), making it non-monotonic. + # Furthermore, the nix-darwin linker requires version numbers to be <= + # 1023. + # We therefore opt to choose a 3-digit sequence from the unix epoch that + # gives a good tradeoff between when it will roll over, and how often it + # will actually change: digits 9-7 (counting from the right, i.e., 736 in + # this case) yields a number that changes every 11.6 days (1e6 seconds, + # it is unlikely texlive will be updated on a shorter interval), and will + # stay stable for 31.7 years (1e9 seconds). + ./truncate-luajit-version-number.patch ]; hardeningDisable = [ "format" ]; diff --git a/pkgs/tools/typesetting/tex/texlive/truncate-luajit-version-number.patch b/pkgs/tools/typesetting/tex/texlive/truncate-luajit-version-number.patch new file mode 100644 index 000000000000..3e8910889e0d --- /dev/null +++ b/pkgs/tools/typesetting/tex/texlive/truncate-luajit-version-number.patch @@ -0,0 +1,209 @@ +From 2da802031f7b7f2c9f5327b5155af9aec0d02686 Mon Sep 17 00:00:00 2001 +From: Christoph Jabs +Date: Tue, 1 Jul 2025 13:05:54 +0300 +Subject: [PATCH] truncate luajit version number + +--- + libs/luajit/configure | 24 ++++++++++++------------ + libs/luajit/native/configure | 20 ++++++++++---------- + libs/luajit/version.ac | 2 +- + 3 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/libs/luajit/configure b/libs/luajit/configure +index c1bc09c039..2ba3598fb8 100755 +--- a/libs/luajit/configure ++++ b/libs/luajit/configure +@@ -1,6 +1,6 @@ + #! /bin/sh + # Guess values for system-dependent variables and create Makefiles. +-# Generated by GNU Autoconf 2.72 for luajit for TeX Live 2.1.81742. ++# Generated by GNU Autoconf 2.72 for luajit for TeX Live 2.1.736. + # + # Report bugs to . + # +@@ -614,8 +614,8 @@ MAKEFLAGS= + # Identity of this package. + PACKAGE_NAME='luajit for TeX Live' + PACKAGE_TARNAME='luajit-for-tex-live' +-PACKAGE_VERSION='2.1.81742' +-PACKAGE_STRING='luajit for TeX Live 2.1.81742' ++PACKAGE_VERSION='2.1.736' ++PACKAGE_STRING='luajit for TeX Live 2.1.736' + PACKAGE_BUGREPORT='tex-k@tug.org' + PACKAGE_URL='' + +@@ -1385,7 +1385,7 @@ if test "$ac_init_help" = "long"; then + # Omit some internal or obsolete options to make the list less imposing. + # This message is too long to be a string in the A/UX 3.1 sh. + cat <<_ACEOF +-'configure' configures luajit for TeX Live 2.1.81742 to adapt to many kinds of systems. ++'configure' configures luajit for TeX Live 2.1.736 to adapt to many kinds of systems. + + Usage: $0 [OPTION]... [VAR=VALUE]... + +@@ -1457,7 +1457,7 @@ fi + + if test -n "$ac_init_help"; then + case $ac_init_help in +- short | recursive ) echo "Configuration of luajit for TeX Live 2.1.81742:";; ++ short | recursive ) echo "Configuration of luajit for TeX Live 2.1.736:";; + esac + cat <<\_ACEOF + +@@ -1578,7 +1578,7 @@ fi + test -n "$ac_init_help" && exit $ac_status + if $ac_init_version; then + cat <<\_ACEOF +-luajit for TeX Live configure 2.1.81742 ++luajit for TeX Live configure 2.1.736 + generated by GNU Autoconf 2.72 + + Copyright (C) 2023 Free Software Foundation, Inc. +@@ -2134,7 +2134,7 @@ cat >config.log <<_ACEOF + This file contains any messages produced by compilers while + running configure, to aid debugging if configure makes a mistake. + +-It was created by luajit for TeX Live $as_me 2.1.81742, which was ++It was created by luajit for TeX Live $as_me 2.1.736, which was + generated by GNU Autoconf 2.72. Invocation command line was + + $ $0$ac_configure_args_raw +@@ -5102,7 +5102,7 @@ fi + + # Define the identity of the package. + PACKAGE='luajit-for-tex-live' +- VERSION='2.1.81742' ++ VERSION='2.1.736' + + + printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h +@@ -6703,10 +6703,10 @@ printf "%s\n" "no, using $LN_S" >&6; } + fi + + +-LUAJITVERSION=2.1.81742 ++LUAJITVERSION=2.1.736 + + +-LUAJIT_LT_VERSINFO=3:81742:1 ++LUAJIT_LT_VERSINFO=3:736:1 + + + case `pwd` in +@@ -17377,7 +17377,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + # report actual input values of CONFIG_FILES etc. instead of their + # values after options handling. + ac_log=" +-This file was extended by luajit for TeX Live $as_me 2.1.81742, which was ++This file was extended by luajit for TeX Live $as_me 2.1.736, which was + generated by GNU Autoconf 2.72. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES +@@ -17445,7 +17445,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\ + cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + ac_cs_config='$ac_cs_config_escaped' + ac_cs_version="\\ +-luajit for TeX Live config.status 2.1.81742 ++luajit for TeX Live config.status 2.1.736 + configured by $0, generated by GNU Autoconf 2.72, + with options \\"\$ac_cs_config\\" + +diff --git a/libs/luajit/native/configure b/libs/luajit/native/configure +index 23c4d29bf0..8f9c93f8ff 100755 +--- a/libs/luajit/native/configure ++++ b/libs/luajit/native/configure +@@ -1,6 +1,6 @@ + #! /bin/sh + # Guess values for system-dependent variables and create Makefiles. +-# Generated by GNU Autoconf 2.72 for luajit native 2.1.81742. ++# Generated by GNU Autoconf 2.72 for luajit native 2.1.736. + # + # Report bugs to . + # +@@ -604,8 +604,8 @@ MAKEFLAGS= + # Identity of this package. + PACKAGE_NAME='luajit native' + PACKAGE_TARNAME='luajit-native' +-PACKAGE_VERSION='2.1.81742' +-PACKAGE_STRING='luajit native 2.1.81742' ++PACKAGE_VERSION='2.1.736' ++PACKAGE_STRING='luajit native 2.1.736' + PACKAGE_BUGREPORT='tex-k@tug.org' + PACKAGE_URL='' + +@@ -1316,7 +1316,7 @@ if test "$ac_init_help" = "long"; then + # Omit some internal or obsolete options to make the list less imposing. + # This message is too long to be a string in the A/UX 3.1 sh. + cat <<_ACEOF +-'configure' configures luajit native 2.1.81742 to adapt to many kinds of systems. ++'configure' configures luajit native 2.1.736 to adapt to many kinds of systems. + + Usage: $0 [OPTION]... [VAR=VALUE]... + +@@ -1387,7 +1387,7 @@ fi + + if test -n "$ac_init_help"; then + case $ac_init_help in +- short | recursive ) echo "Configuration of luajit native 2.1.81742:";; ++ short | recursive ) echo "Configuration of luajit native 2.1.736:";; + esac + cat <<\_ACEOF + +@@ -1484,7 +1484,7 @@ fi + test -n "$ac_init_help" && exit $ac_status + if $ac_init_version; then + cat <<\_ACEOF +-luajit native configure 2.1.81742 ++luajit native configure 2.1.736 + generated by GNU Autoconf 2.72 + + Copyright (C) 2023 Free Software Foundation, Inc. +@@ -1883,7 +1883,7 @@ cat >config.log <<_ACEOF + This file contains any messages produced by compilers while + running configure, to aid debugging if configure makes a mistake. + +-It was created by luajit native $as_me 2.1.81742, which was ++It was created by luajit native $as_me 2.1.736, which was + generated by GNU Autoconf 2.72. Invocation command line was + + $ $0$ac_configure_args_raw +@@ -4851,7 +4851,7 @@ fi + + # Define the identity of the package. + PACKAGE='luajit-native' +- VERSION='2.1.81742' ++ VERSION='2.1.736' + + + printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h +@@ -6905,7 +6905,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 + # report actual input values of CONFIG_FILES etc. instead of their + # values after options handling. + ac_log=" +-This file was extended by luajit native $as_me 2.1.81742, which was ++This file was extended by luajit native $as_me 2.1.736, which was + generated by GNU Autoconf 2.72. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES +@@ -6973,7 +6973,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\ + cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 + ac_cs_config='$ac_cs_config_escaped' + ac_cs_version="\\ +-luajit native config.status 2.1.81742 ++luajit native config.status 2.1.736 + configured by $0, generated by GNU Autoconf 2.72, + with options \\"\$ac_cs_config\\" + +diff --git a/libs/luajit/version.ac b/libs/luajit/version.ac +index 4aac6497c1..534f508733 100644 +--- a/libs/luajit/version.ac ++++ b/libs/luajit/version.ac +@@ -11,4 +11,4 @@ dnl m4-include this file to define the current luajit version + dnl m4_define([luajit_version], [2.1.1736781742]) + dnl libtool: error: REVISION '1736781742' must be a nonnegative integer + dnl libtool: error: '3:1736781742:1' is not valid version information +-m4_define([luajit_version], [2.1.81742]) ++m4_define([luajit_version], [2.1.736]) +-- +2.49.0 + From a8d0fa81089d62c4b51154a74742f794642cb3a3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 11:00:16 +0000 Subject: [PATCH 22/42] tscli: 0.0.8 -> 0.0.9 --- pkgs/by-name/ts/tscli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ts/tscli/package.nix b/pkgs/by-name/ts/tscli/package.nix index 9ea2242ba1e4..07d9b65e838d 100644 --- a/pkgs/by-name/ts/tscli/package.nix +++ b/pkgs/by-name/ts/tscli/package.nix @@ -8,13 +8,13 @@ buildGoModule rec { pname = "tscli"; - version = "0.0.8"; + version = "0.0.9"; src = fetchFromGitHub { owner = "jaxxstorm"; repo = "tscli"; tag = "v${version}"; - hash = "sha256-DlWUJukc4XSZCPtmcUwr5V7Wkn9WoG+tSHdH3YvYLaA="; + hash = "sha256-GJkFiofMO9dMFDqISzp/ewH5hxpp04o/dXJ/XNUZk74="; }; vendorHash = "sha256-a/1I1enzmtVY/js7w/cCLTts8lGmMKMiCowH0Hr+xdM="; From 158217e5f5286a06219e350e9ca50ed84291ba22 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Tue, 1 Jul 2025 12:39:50 +0000 Subject: [PATCH 23/42] sudo-rs: 0.2.6 -> 0.2.7 https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.7 --- pkgs/by-name/su/sudo-rs/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/su/sudo-rs/package.nix b/pkgs/by-name/su/sudo-rs/package.nix index 62836eac5e42..dda0dbf038a6 100644 --- a/pkgs/by-name/su/sudo-rs/package.nix +++ b/pkgs/by-name/su/sudo-rs/package.nix @@ -13,16 +13,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "sudo-rs"; - version = "0.2.6"; + version = "0.2.7"; src = fetchFromGitHub { owner = "trifectatechfoundation"; repo = "sudo-rs"; tag = "v${finalAttrs.version}"; - hash = "sha256-vZv3IVSW6N0puoWJBYQPmNntgHPt9SPV07TEuWN/bHw="; + hash = "sha256-02ODKMumYUKcmSfPAiCwpRph5+Zy+g5uqqbJ9ThRxRg="; }; useFetchCargoVendor = true; - cargoHash = "sha256-/CbU2ds2VQ2IXx7GKxRO3vePzLXJXabA1FcyIGPsngw="; + cargoHash = "sha256-o3//zJxB6CNHQl1DtfmFnSBP9npC4I9/hRuzpWrKoNs="; nativeBuildInputs = [ installShellFiles From 592d1af31404261ef8c12a1393e41ba2eb82d968 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Tue, 1 Jul 2025 11:08:04 +0000 Subject: [PATCH 24/42] =?UTF-8?q?vector:=200.47.0=20=E2=86=92=200.48.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/by-name/ve/vector/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix index 1d0c100d6100..d5009adb3ae2 100644 --- a/pkgs/by-name/ve/vector/package.nix +++ b/pkgs/by-name/ve/vector/package.nix @@ -25,7 +25,7 @@ let pname = "vector"; - version = "0.47.0"; + version = "0.48.0"; in rustPlatform.buildRustPackage { inherit pname version; @@ -34,10 +34,10 @@ rustPlatform.buildRustPackage { owner = "vectordotdev"; repo = "vector"; rev = "v${version}"; - hash = "sha256-09CjhSckptXbbTzBneo5aQ76YwLPSacRlsMpexsw54c="; + hash = "sha256-qgf3aMZc1cgPlsAzgtaXLUx99KwN5no1amdkwFVyl4Y="; }; - cargoHash = "sha256-9cCqdi65C4JCMP743nhrNmBlJsIFiNPGguyVEEJpGww="; + cargoHash = "sha256-t8mfZpLrzrxj1WUpJPqZWyfBf9XobcqZY/hAeVGzhcM="; nativeBuildInputs = [ From 680cd820a57afb71788e5eecaf7da52e3ff6e370 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Tue, 1 Jul 2025 11:08:20 +0000 Subject: [PATCH 25/42] nixos/vector: journald-clickhouse test: * Add boot_id to ORDER BY key * Add ACL configuration to ClickHouse --- nixos/tests/vector/journald-clickhouse.nix | 60 ++++++++++++++++++++-- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/nixos/tests/vector/journald-clickhouse.nix b/nixos/tests/vector/journald-clickhouse.nix index b0ca516306ea..2cef987d5676 100644 --- a/nixos/tests/vector/journald-clickhouse.nix +++ b/nixos/tests/vector/journald-clickhouse.nix @@ -10,6 +10,7 @@ let m = {} m.app = .SYSLOG_IDENTIFIER m.host = .host + m.boot_id = ._BOOT_ID m.severity = to_int(.PRIORITY) ?? 0 m.level = to_syslog_level(m.severity) ?? "" m.message = strip_ansi_escape_codes!(.message) @@ -60,6 +61,11 @@ in "vector_source" ]; endpoint = "http://localhost:8123"; + auth = { + strategy = "basic"; + user = "vector"; + password = "helloclickhouseworld"; + }; database = "journald"; table = "logs"; date_time_best_effort = true; @@ -72,6 +78,48 @@ in services.clickhouse = { enable = true; }; + + # ACL configuration for Vector + environment = { + etc."clickhouse-server/users.d/vector.xml".text = '' + + + + helloclickhouseworld + + 0 + + default + journald + + + GRANT INSERT ON journald.logs + + + + + ''; + + # ACL configuration for read-only client + etc."clickhouse-server/users.d/grafana.xml".text = '' + + + + helloclickhouseworld2 + + 0 + + default + journald + + + GRANT SELECT ON journald.logs + + + + + ''; + }; }; vector = @@ -108,11 +156,13 @@ in databaseDDL = pkgs.writeText "database.sql" "CREATE DATABASE IF NOT EXISTS journald"; # https://clickhouse.com/blog/storing-log-data-in-clickhouse-fluent-bit-vector-open-telemetry + # ORDER BY advice: https://kb.altinity.com/engines/mergetree-table-engine-family/pick-keys/ tableDDL = pkgs.writeText "table.sql" '' CREATE TABLE IF NOT EXISTS journald.logs ( timestamp DateTime64(6), - app LowCardinality(String), host LowCardinality(String), + boot_id LowCardinality(String), + app LowCardinality(String), level LowCardinality(String), severity UInt8, message String, @@ -120,7 +170,7 @@ in pid UInt32, ) ENGINE = MergeTree() - ORDER BY (host, app, timestamp) + ORDER BY (host, boot_id, toStartOfHour(timestamp), app, timestamp) PARTITION BY toYYYYMM(timestamp) ''; @@ -148,8 +198,12 @@ in "journalctl -o cat -u vector.service | grep 'Vector has started'" ) + clickhouse.fail( + "cat ${selectQuery} | clickhouse-client --user vector --password helloclickhouseworld | grep 2" + ) + clickhouse.wait_until_succeeds( - "cat ${selectQuery} | clickhouse-client | grep 2" + "cat ${selectQuery} | clickhouse-client --user grafana --password helloclickhouseworld2 | grep 2" ) ''; } From c012aca83d6c0833a5b544bec3784494f6ab3e70 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Tue, 1 Jul 2025 11:30:18 +0000 Subject: [PATCH 26/42] nixos/vector: dnstap test: * Integrate Knot DNS * Improve ORDER BY key --- nixos/tests/vector/dnstap.nix | 168 +++++++++++++++++++++++++++++++--- 1 file changed, 154 insertions(+), 14 deletions(-) diff --git a/nixos/tests/vector/dnstap.nix b/nixos/tests/vector/dnstap.nix index 02d40907f8af..894de8ebf29b 100644 --- a/nixos/tests/vector/dnstap.nix +++ b/nixos/tests/vector/dnstap.nix @@ -42,8 +42,119 @@ in services.clickhouse.enable = true; }; + knot = + { + config, + nodes, + pkgs, + ... + }: + let + exampleZone = pkgs.writeTextDir "example.com.zone" '' + @ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800 + @ NS ns1 + @ NS ns2 + ns1 A 192.168.0.1 + ns1 AAAA fd00::1 + ns2 A 192.168.0.2 + ns2 AAAA fd00::2 + www A 192.0.2.1 + www AAAA 2001:DB8::1 + sub NS ns.example.com. + ''; + + knotZonesEnv = pkgs.buildEnv { + name = "knot-zones"; + paths = [ + exampleZone + ]; + }; + in + { + networking.firewall.allowedUDPPorts = [ 53 ]; + + services.vector = { + enable = true; + + settings = { + sources = { + dnstap = { + type = "dnstap"; + multithreaded = true; + mode = "unix"; + lowercase_hostnames = true; + socket_file_mode = 504; + socket_path = "${dnstapSocket}"; + }; + }; + + sinks = { + vector_dnstap_sink = { + type = "vector"; + inputs = [ "dnstap" ]; + address = "clickhouse:6000"; + }; + }; + }; + }; + + systemd.services.vector.serviceConfig = { + RuntimeDirectory = "vector"; + RuntimeDirectoryMode = "0770"; + }; + + services.knot = { + enable = true; + settings = { + server = { + listen = [ + "0.0.0.0@53" + "::@53" + ]; + automatic-acl = true; + }; + template.default = { + storage = knotZonesEnv; + dnssec-signing = false; + # Input-only zone files + # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3 + # prevents modification of the zonefiles, since the zonefiles are immutable + zonefile-sync = -1; + zonefile-load = "difference"; + journal-content = "changes"; + global-module = "mod-dnstap/capture_all"; + }; + zone = { + "example.com".file = "example.com.zone"; + }; + + mod-dnstap = [ + { + id = "capture_all"; + sink = "unix:${dnstapSocket}"; + } + ]; + }; + }; + + systemd.services.knot = { + after = [ "vector.service" ]; + wants = [ "vector.service" ]; + serviceConfig = { + # DNSTAP access + ReadWritePaths = [ "/var/run/vector" ]; + SupplementaryGroups = [ "vector" ]; + }; + }; + }; + unbound = - { config, pkgs, ... }: + { + config, + nodes, + pkgs, + ... + }: { networking.firewall.allowedUDPPorts = [ 53 ]; @@ -110,6 +221,16 @@ in ]; }; + forward-zone = [ + { + name = "example.com."; + forward-addr = [ + nodes.knot.networking.primaryIPv6Address + nodes.knot.networking.primaryIPAddress + ]; + } + ]; + dnstap = { dnstap-enable = "yes"; dnstap-socket-path = "${dnstapSocket}"; @@ -175,7 +296,7 @@ in ) ENGINE = MergeTree() PARTITION BY toYYYYMM(timestamp) - ORDER BY (serverId, timestamp) + ORDER BY (serverId, toStartOfHour(timestamp), domain, timestamp) POPULATE AS SELECT timestamp, @@ -186,13 +307,20 @@ in WHERE messageTypeId = 5 # ClientQuery ''; - selectQuery = pkgs.writeText "select.sql" '' + selectDomainCountQuery = pkgs.writeText "select-domain-count.sql" '' SELECT domain, count(domain) FROM dnstap.domains_view GROUP BY domain ''; + + selectAuthResponseQuery = pkgs.writeText "select-auth-response.sql" '' + SELECT + * + FROM dnstap.records + WHERE messageType = 'AuthResponse' + ''; in '' clickhouse.wait_for_unit("clickhouse") @@ -205,23 +333,27 @@ in "cat ${tableView} | clickhouse-client", ) + knot.wait_for_unit("knot") unbound.wait_for_unit("unbound") - unbound.wait_for_unit("vector") - unbound.wait_until_succeeds( - "journalctl -o cat -u vector.service | grep 'Socket permissions updated to 0o770'" - ) - unbound.wait_until_succeeds( - "journalctl -o cat -u vector.service | grep 'component_type=dnstap' | grep 'Listening... path=\"${dnstapSocket}\"'" - ) + for machine in knot, unbound: + machine.wait_for_unit("vector") - unbound.wait_for_file("${dnstapSocket}") - unbound.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})") + machine.wait_until_succeeds( + "journalctl -o cat -u vector.service | grep 'Socket permissions updated to 0o770'" + ) + machine.wait_until_succeeds( + "journalctl -o cat -u vector.service | grep 'component_type=dnstap' | grep 'Listening... path=\"${dnstapSocket}\"'" + ) + + machine.wait_for_file("${dnstapSocket}") + machine.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})") dnsclient.systemctl("start network-online.target") dnsclient.wait_for_unit("network-online.target") dnsclient.succeed( - "dig @unbound test.local" + "dig @unbound test.local", + "dig @unbound www.example.com" ) unbound.wait_for_file("/var/lib/vector/logs.log") @@ -234,7 +366,15 @@ in ) clickhouse.log(clickhouse.wait_until_succeeds( - "cat ${selectQuery} | clickhouse-client | grep 'test.local.'" + "cat ${selectDomainCountQuery} | clickhouse-client | grep 'test.local.'" + )) + + clickhouse.log(clickhouse.wait_until_succeeds( + "cat ${selectDomainCountQuery} | clickhouse-client | grep 'www.example.com.'" + )) + + clickhouse.log(clickhouse.wait_until_succeeds( + "cat ${selectAuthResponseQuery} | clickhouse-client | grep 'Knot DNS ${pkgs.knot-dns.version}'" )) ''; } From d2472a4ecb7ecece22ded03008fbec61cbff2a81 Mon Sep 17 00:00:00 2001 From: rembo10 Date: Tue, 1 Jul 2025 19:25:45 +0530 Subject: [PATCH 27/42] headphones: 0.6.3 -> 0.6.4 --- pkgs/by-name/he/headphones/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/he/headphones/package.nix b/pkgs/by-name/he/headphones/package.nix index 816dee0e0d1a..0c257dfbddcd 100644 --- a/pkgs/by-name/he/headphones/package.nix +++ b/pkgs/by-name/he/headphones/package.nix @@ -7,14 +7,14 @@ python3.pkgs.buildPythonApplication rec { pname = "headphones"; - version = "0.6.3"; + version = "0.6.4"; format = "other"; src = fetchFromGitHub { owner = "rembo10"; repo = "headphones"; rev = "v${version}"; - sha256 = "195v0ylhqd49bqq3dpig5nh0kivmwgmn0977fknix9j14jpvmd3b"; + sha256 = "0gv7rasjbm4rf9izghibgf5fbjykvzv0ibqc2in1naagjivqrpq4"; }; dontBuild = true; From 2ced63f941dc13fa7ef8214d80b7a90f16939ff2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 14:28:07 +0000 Subject: [PATCH 28/42] lunatask: 2.0.22 -> 2.1.1 --- pkgs/by-name/lu/lunatask/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lu/lunatask/package.nix b/pkgs/by-name/lu/lunatask/package.nix index acc3b4c5eb78..a63ae4563c62 100644 --- a/pkgs/by-name/lu/lunatask/package.nix +++ b/pkgs/by-name/lu/lunatask/package.nix @@ -6,12 +6,12 @@ }: let - version = "2.0.22"; + version = "2.1.1"; pname = "lunatask"; src = fetchurl { url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage"; - hash = "sha256-5V4h7x9NMZPAEinWmvhcBj8WrtKXp7naacSaMOEzwl0="; + hash = "sha256-2ks5sqE0NuVa3fyJzKJ/466Ztq9M/RhDxHZCL8tSwo4="; }; appimageContents = appimageTools.extract { From 4313de08cfd0344ac4199aa9886ee268acfaa422 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 14:33:51 +0000 Subject: [PATCH 29/42] shopware-cli: 0.6.10 -> 0.6.16 --- pkgs/by-name/sh/shopware-cli/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix index 5877748ae454..fe3b26c53836 100644 --- a/pkgs/by-name/sh/shopware-cli/package.nix +++ b/pkgs/by-name/sh/shopware-cli/package.nix @@ -10,12 +10,12 @@ buildGoModule rec { pname = "shopware-cli"; - version = "0.6.10"; + version = "0.6.16"; src = fetchFromGitHub { repo = "shopware-cli"; owner = "FriendsOfShopware"; tag = version; - hash = "sha256-kzf54rPac/OYmmqEAoQPWFjtzMj0FOGOMoxdX2zlX8s="; + hash = "sha256-oEWJ51XeAOE92u6U2Cjj875mn47R8IRbZ2BHy1zLblw="; }; nativeBuildInputs = [ @@ -27,7 +27,7 @@ buildGoModule rec { dart-sass ]; - vendorHash = "sha256-gw0O9cLRkCo8FMlUSgVsL7c5xSSP7sAcwL/WUAy6MiI="; + vendorHash = "sha256-am8tGpevz5KXX+8ckhlNVtoUbG3g739O9KP6rLsF0y8="; postInstall = '' installShellCompletion --cmd shopware-cli \ From f21ea674025a6eb57a7716023e868b277dae3a86 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 17:23:31 +0000 Subject: [PATCH 30/42] tlsinfo: 0.1.47 -> 0.1.48 --- pkgs/by-name/tl/tlsinfo/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/tl/tlsinfo/package.nix b/pkgs/by-name/tl/tlsinfo/package.nix index f977279e9451..1f88b9f8cf61 100644 --- a/pkgs/by-name/tl/tlsinfo/package.nix +++ b/pkgs/by-name/tl/tlsinfo/package.nix @@ -7,16 +7,16 @@ buildGoModule rec { pname = "tlsinfo"; - version = "0.1.47"; + version = "0.1.48"; src = fetchFromGitHub { owner = "paepckehh"; repo = "tlsinfo"; tag = "v${version}"; - hash = "sha256-9YOFsUDNxZi1C59ZSQ31QXE9comFa6DGEzvRah0bruY="; + hash = "sha256-1483Y1SoAVsXIjpa1CbOvVQsOol6adoQD9PCxHgSgU4="; }; - vendorHash = "sha256-f7Rkpz6qGiJNhxlYPJo2G3ykItj+55PvGnNPNOU1ftI="; + vendorHash = "sha256-wHCHj7/DBzW0m16aXdQBjPRKjIlf2iab1345ud+ulVQ="; ldflags = [ "-s" From eff2807bc738c7dd0e4cde2630607c957a1238da Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 17:46:12 +0000 Subject: [PATCH 31/42] uwsm: 0.22.0 -> 0.23.0 --- pkgs/by-name/uw/uwsm/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix index 891f6adce484..adbe424514c0 100644 --- a/pkgs/by-name/uw/uwsm/package.nix +++ b/pkgs/by-name/uw/uwsm/package.nix @@ -28,13 +28,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "uwsm"; - version = "0.22.0"; + version = "0.23.0"; src = fetchFromGitHub { owner = "Vladimir-csp"; repo = "uwsm"; tag = "v${finalAttrs.version}"; - hash = "sha256-8MdgtfmgWVUl5YPP/91KrGNNHl60P2ID2TUMZ4V3BiI="; + hash = "sha256-VQhU88JvL7O2MP41JVuBdieIopmqrNiAWacGWvsNhSc="; }; nativeBuildInputs = [ From 8c54a012c6907600cd1cad9da363396feafe833c Mon Sep 17 00:00:00 2001 From: Christoph Hollizeck Date: Tue, 1 Jul 2025 19:54:20 +0200 Subject: [PATCH 32/42] microsoft-edge: 137.0.3296.93 -> 138.0.3351.55 --- pkgs/by-name/mi/microsoft-edge/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix index e41cc3f91326..73d2920605d1 100644 --- a/pkgs/by-name/mi/microsoft-edge/package.nix +++ b/pkgs/by-name/mi/microsoft-edge/package.nix @@ -179,11 +179,11 @@ in stdenvNoCC.mkDerivation (finalAttrs: { pname = "microsoft-edge"; - version = "137.0.3296.93"; + version = "138.0.3351.55"; src = fetchurl { url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-SC8h6UQ/ee5ZlQWAZsmC1Co5Ky4kaXuoMpvVZtTIMHQ="; + hash = "sha256-SZCtAjhzY8BqwM9IMS2081RWxRT+4gQgrjve7avM7Bo="; }; # With strictDeps on, some shebangs were not being patched correctly From 380c95f350aa155906735c5b52b1108f9bf6b463 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 17:35:03 +0000 Subject: [PATCH 33/42] vscode: 1.101.1 -> 1.101.2 --- pkgs/applications/editors/vscode/vscode.nix | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix index 1a49065fdcfb..8940d99462e4 100644 --- a/pkgs/applications/editors/vscode/vscode.nix +++ b/pkgs/applications/editors/vscode/vscode.nix @@ -36,22 +36,22 @@ let hash = { - x86_64-linux = "sha256-Rr7JNWloV4VkgGk9zDEnD/WRHSYv5su8UrOSIl3247c="; - x86_64-darwin = "sha256-hHAJVmFKwD0Z8YyqvNlM4SpWnSIniVvdMwR3fhk/mKE="; - aarch64-linux = "sha256-/pYykG/1IJU7aJ9wtO5oo3dUdCGtfxklre0SGMpgnq8="; - aarch64-darwin = "sha256-pWMCQlgxoJ4EGfycuz3H76r9Sc3x006el1ITOM6E4wE="; - armv7l-linux = "sha256-M0fK1n/HMuNQvN85I4g5GV8QAg3n6vQtR6V/B1PFAwQ="; + x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM="; + x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw="; + aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ="; + aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA="; + armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU="; } .${system} or throwSystem; in callPackage ./generic.nix rec { # Please backport all compatible updates to the stable release. # This is important for the extension ecosystem. - version = "1.101.1"; + version = "1.101.2"; pname = "vscode" + lib.optionalString isInsiders "-insiders"; # This is used for VS Code - Remote SSH test - rev = "18e3a1ec544e6907be1e944a94c496e302073435"; + rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4"; executableName = "code" + lib.optionalString isInsiders "-insiders"; longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders"; @@ -75,7 +75,7 @@ callPackage ./generic.nix rec { src = fetchurl { name = "vscode-server-${rev}.tar.gz"; url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable"; - hash = "sha256-Myq0OUrwv6bq53Q5FDCVtt+wfGlEX2bjz9CMeVLfd+4="; + hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY="; }; stdenv = stdenvNoCC; }; From 3d43aebdaafb524c1949e31905d1b9c3a3771bdd Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 18:53:44 +0000 Subject: [PATCH 34/42] signaturepdf: 1.7.4 -> 1.8.0 --- pkgs/by-name/si/signaturepdf/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/si/signaturepdf/package.nix b/pkgs/by-name/si/signaturepdf/package.nix index c03942e480cb..d0b6389ac200 100644 --- a/pkgs/by-name/si/signaturepdf/package.nix +++ b/pkgs/by-name/si/signaturepdf/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation rec { pname = "signaturepdf"; - version = "1.7.4"; + version = "1.8.0"; src = fetchFromGitHub { owner = "24eme"; repo = "signaturepdf"; rev = "v${version}"; - hash = "sha256-8R1eowMpdb4oj3j+gMJ2RsWVzHvNiXPwFaLHR0jqFJo="; + hash = "sha256-Sk59yHnLSmO/Dd+cAntiAXzYyo6Rsp779Q+SszonbMc="; }; nativeBuildInputs = [ makeWrapper ]; From 5bd32a7071c66dd1fedb1f8233193785fd3d370d Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Mon, 30 Jun 2025 12:16:23 +0200 Subject: [PATCH 35/42] treewide: add knownVulnerabilities to old libxml2 Users should be informed if they're using packages that are deliberately opting in to using old versions of dependencies with vulnerabilities that have otherwise been fixed in Nixpkgs. --- .../networking/remote/citrix-workspace/generic.nix | 9 +++++++-- pkgs/by-name/ci/ciscoPacketTracer7/package.nix | 9 +++++++-- pkgs/by-name/ci/ciscoPacketTracer8/package.nix | 9 +++++++-- 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix index f0210e97a8ab..bbfd19e15745 100644 --- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix +++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix @@ -90,13 +90,18 @@ let ''; }; - libxml2' = libxml2.overrideAttrs rec { + libxml2' = libxml2.overrideAttrs (oldAttrs: rec { version = "2.13.8"; src = fetchurl { url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz"; hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo="; }; - }; + meta = oldAttrs.meta // { + knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [ + "CVE-2025-6021" + ]; + }; + }); in diff --git a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix index 01a9e7d6ee09..bbdead8e26a8 100644 --- a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix +++ b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix @@ -50,13 +50,18 @@ let ]; }; - libxml2' = libxml2.overrideAttrs rec { + libxml2' = libxml2.overrideAttrs (oldAttrs: rec { version = "2.13.8"; src = fetchurl { url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz"; hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo="; }; - }; + meta = oldAttrs.meta // { + knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [ + "CVE-2025-6021" + ]; + }; + }); fhs = buildFHSEnv { pname = "packettracer7"; diff --git a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix index 10472dc0f356..6032f5407ed5 100644 --- a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix +++ b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix @@ -41,13 +41,18 @@ let "8.2.2" = "CiscoPacketTracer822_amd64_signed.deb"; }; - libxml2' = libxml2.overrideAttrs rec { + libxml2' = libxml2.overrideAttrs (oldAttrs: rec { version = "2.13.8"; src = fetchurl { url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz"; hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo="; }; - }; + meta = oldAttrs.meta // { + knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [ + "CVE-2025-6021" + ]; + }; + }); unwrapped = stdenvNoCC.mkDerivation { name = "ciscoPacketTracer8-unwrapped"; From 7c9b7050b4021ca279c78ba3c269ffab08e266b7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 19:14:47 +0000 Subject: [PATCH 36/42] parca-debuginfo: 0.12.0 -> 0.12.2 --- pkgs/by-name/pa/parca-debuginfo/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pa/parca-debuginfo/package.nix b/pkgs/by-name/pa/parca-debuginfo/package.nix index f3a2a69fe3f2..3b54ae93e021 100644 --- a/pkgs/by-name/pa/parca-debuginfo/package.nix +++ b/pkgs/by-name/pa/parca-debuginfo/package.nix @@ -6,13 +6,13 @@ buildGoModule rec { pname = "parca-debuginfo"; - version = "0.12.0"; + version = "0.12.2"; src = fetchFromGitHub { owner = "parca-dev"; repo = "parca-debuginfo"; tag = "v${version}"; - hash = "sha256-FXi/iLVDdzyfClRD1tk0FQ9oF5zxW2dfGl4JuDPyZQE="; + hash = "sha256-tJ3Xc5b9XnTL460u11RkCmbIc41vHKql/oZ7enTaPgQ="; }; vendorHash = "sha256-bH7Y1y9BDMQJGtYfEaSrq+sWVLnovvV/uGbutJUXV2w="; From c18e94361ef21171c48522142adfbb1081be90bf Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 1 Jul 2025 19:28:31 +0000 Subject: [PATCH 37/42] Revert "workflows/labels: label stale issues" --- .github/stale.yml | 9 ++ .github/workflows/labels.yml | 300 +++++++++++++++++------------------ 2 files changed, 153 insertions(+), 156 deletions(-) create mode 100644 .github/stale.yml diff --git a/.github/stale.yml b/.github/stale.yml new file mode 100644 index 000000000000..d6134c7ce112 --- /dev/null +++ b/.github/stale.yml @@ -0,0 +1,9 @@ +# Configuration for probot-stale - https://github.com/probot/stale +daysUntilStale: 180 +daysUntilClose: false +exemptLabels: + - "1.severity: security" + - "2.status: never-stale" +staleLabel: "2.status: stale" +markComment: false +closeComment: false diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index e61615091486..d84f49b5895c 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -27,8 +27,10 @@ concurrency: # This is used as fallback without app only. # This happens when testing in forks without setting up that app. +# Labels will most likely not exist in forks, yet. For this case, +# we add the issues permission only here. permissions: - issues: write + issues: write # needed to create *new* labels pull-requests: write defaults: @@ -50,7 +52,8 @@ jobs: with: app-id: ${{ vars.NIXPKGS_CI_APP_ID }} private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }} - permission-issues: write + # No issues: write permission here, because labels in Nixpkgs should + # be created explicitly via the UI with color and description. permission-pull-requests: write - name: Log current API rate limits @@ -72,7 +75,6 @@ jobs: const artifactClient = new DefaultArtifactClient() const stats = { - issues: 0, prs: 0, requests: 0, artifacts: 0 @@ -121,125 +123,6 @@ jobs: // Update remaining requests every minute to account for other jobs running in parallel. const reservoirUpdater = setInterval(updateReservoir, 60 * 1000) - async function handlePullRequest(item) { - const log = (k,v) => core.info(`PR #${item.number} - ${k}: ${v}`) - - const pull_number = item.number - - // This API request is important for the merge-conflict label, because it triggers the - // creation of a new test merge commit. This is needed to actually determine the state of a PR. - const pull_request = (await github.rest.pulls.get({ - ...context.repo, - pull_number - })).data - - const approvals = new Set( - (await github.paginate(github.rest.pulls.listReviews, { - ...context.repo, - pull_number - })) - .filter(review => review.state == 'APPROVED') - .map(review => review.user?.id) - ) - - // After creation of a Pull Request, `merge_commit_sha` will be null initially: - // The very first merge commit will only be calculated after a little while. - // To avoid labeling the PR as conflicted before that, we wait a few minutes. - // This is intentionally less than the time that Eval takes, so that the label job - // running after Eval can indeed label the PR as conflicted if that is the case. - const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000 - - const prLabels = { - // We intentionally don't use the mergeable or mergeable_state attributes. - // Those have an intermediate state while the test merge commit is created. - // This doesn't work well for us, because we might have just triggered another - // test merge commit creation by request the pull request via API at the start - // of this function. - // The attribute merge_commit_sha keeps the old value of null or the hash *until* - // the new test merge commit has either successfully been created or failed so. - // This essentially means we are updating the merge conflict label in two steps: - // On the first pass of the day, we just fetch the pull request, which triggers - // the creation. At this stage, the label is likely not updated, yet. - // The second pass will then read the result from the first pass and set the label. - '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha, - '12.approvals: 1': approvals.size == 1, - '12.approvals: 2': approvals.size == 2, - '12.approvals: 3+': approvals.size >= 3, - '12.first-time contribution': - [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association), - } - - const run_id = (await github.rest.actions.listWorkflowRuns({ - ...context.repo, - workflow_id: 'pr.yml', - event: 'pull_request_target', - exclude_pull_requests: true, - head_sha: pull_request.head.sha - })).data.workflow_runs[0]?.id ?? - // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired. - (await github.rest.actions.listWorkflowRuns({ - ...context.repo, - // In older PRs, we need eval.yml instead of pr.yml. - workflow_id: 'eval.yml', - event: 'pull_request_target', - status: 'success', - exclude_pull_requests: true, - head_sha: pull_request.head.sha - })).data.workflow_runs[0]?.id - - // Newer PRs might not have run Eval to completion, yet. - // Older PRs might not have an eval.yml workflow, yet. - // In either case we continue without fetching an artifact on a best-effort basis. - log('Last eval run', run_id ?? '') - - const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({ - ...context.repo, - run_id, - name: 'comparison' - })).data.artifacts[0] - - // Instead of checking the boolean artifact.expired, we will give us a minute to - // actually download the artifact in the next step and avoid that race condition. - // Older PRs, where the workflow run was already eval.yml, but the artifact was not - // called "comparison", yet, will skip the download. - const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000) - log('Artifact expires at', artifact?.expires_at ?? '') - if (!expired) { - stats.artifacts++ - - await artifactClient.downloadArtifact(artifact.id, { - findBy: { - repositoryName: context.repo.repo, - repositoryOwner: context.repo.owner, - token: core.getInput('github-token') - }, - path: path.resolve(pull_number.toString()), - expectedHash: artifact.digest - }) - - const maintainers = new Set(Object.keys( - JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8')) - ).map(m => Number.parseInt(m, 10))) - - const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels - - Object.assign( - prLabels, - // Ignore `evalLabels` if it's an array. - // This can happen for older eval runs, before we switched to objects. - // The old eval labels would have been set by the eval run, - // so now they'll be present in `before`. - // TODO: Simplify once old eval results have expired (~2025-10) - (Array.isArray(evalLabels) ? undefined : evalLabels), - { - '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)), - } - ) - } - - return prLabels - } - async function handle(item) { try { const log = (k,v,skip) => { @@ -248,19 +131,87 @@ jobs: } log('Last updated at', item.updated_at) + stats.prs++ log('URL', item.html_url) + const pull_number = item.number const issue_number = item.number - const itemLabels = {} + // This API request is important for the merge-conflict label, because it triggers the + // creation of a new test merge commit. This is needed to actually determine the state of a PR. + const pull_request = (await github.rest.pulls.get({ + ...context.repo, + pull_number + })).data - if (item.pull_request) { - stats.prs++ - Object.assign(itemLabels, await handlePullRequest(item)) - } else { - stats.issues++ + const run_id = (await github.rest.actions.listWorkflowRuns({ + ...context.repo, + workflow_id: 'pr.yml', + event: 'pull_request_target', + exclude_pull_requests: true, + head_sha: pull_request.head.sha + })).data.workflow_runs[0]?.id ?? + // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired. + (await github.rest.actions.listWorkflowRuns({ + ...context.repo, + // In older PRs, we need eval.yml instead of pr.yml. + workflow_id: 'eval.yml', + event: 'pull_request_target', + status: 'success', + exclude_pull_requests: true, + head_sha: pull_request.head.sha + })).data.workflow_runs[0]?.id + + // Newer PRs might not have run Eval to completion, yet. + // Older PRs might not have an eval.yml workflow, yet. + // In either case we continue without fetching an artifact on a best-effort basis. + log('Last eval run', run_id ?? '') + + const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({ + ...context.repo, + run_id, + name: 'comparison' + })).data.artifacts[0] + + // Instead of checking the boolean artifact.expired, we will give us a minute to + // actually download the artifact in the next step and avoid that race condition. + // Older PRs, where the workflow run was already eval.yml, but the artifact was not + // called "comparison", yet, will skip the download. + const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000) + log('Artifact expires at', artifact?.expires_at ?? '') + if (!expired) { + stats.artifacts++ + + await artifactClient.downloadArtifact(artifact.id, { + findBy: { + repositoryName: context.repo.repo, + repositoryOwner: context.repo.owner, + token: core.getInput('github-token') + }, + path: path.resolve(pull_number.toString()), + expectedHash: artifact.digest + }) } + // Create a map (Label -> Boolean) of all currently set labels. + // Each label is set to True and can be disabled later. + const before = Object.fromEntries( + (await github.paginate(github.rest.issues.listLabelsOnIssue, { + ...context.repo, + issue_number + })) + .map(({ name }) => [name, true]) + ) + + const approvals = new Set( + (await github.paginate(github.rest.pulls.listReviews, { + ...context.repo, + pull_number + })) + .filter(review => review.state == 'APPROVED') + .map(review => review.user?.id) + ) + const latest_event_at = new Date( (await github.paginate( github.rest.issues.listEventsForTimeline, @@ -299,21 +250,60 @@ jobs: const stale_at = new Date(new Date().setDate(new Date().getDate() - 180)) - // Create a map (Label -> Boolean) of all currently set labels. - // Each label is set to True and can be disabled later. - const before = Object.fromEntries( - (await github.paginate(github.rest.issues.listLabelsOnIssue, { - ...context.repo, - issue_number - })) - .map(({ name }) => [name, true]) + // After creation of a Pull Request, `merge_commit_sha` will be null initially: + // The very first merge commit will only be calculated after a little while. + // To avoid labeling the PR as conflicted before that, we wait a few minutes. + // This is intentionally less than the time that Eval takes, so that the label job + // running after Eval can indeed label the PR as conflicted if that is the case. + const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000 + + // Manage most of the labels, without eval results + const after = Object.assign( + {}, + before, + { + // We intentionally don't use the mergeable or mergeable_state attributes. + // Those have an intermediate state while the test merge commit is created. + // This doesn't work well for us, because we might have just triggered another + // test merge commit creation by request the pull request via API at the start + // of this function. + // The attribute merge_commit_sha keeps the old value of null or the hash *until* + // the new test merge commit has either successfully been created or failed so. + // This essentially means we are updating the merge conflict label in two steps: + // On the first pass of the day, we just fetch the pull request, which triggers + // the creation. At this stage, the label is likely not updated, yet. + // The second pass will then read the result from the first pass and set the label. + '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha, + '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at, + '12.approvals: 1': approvals.size == 1, + '12.approvals: 2': approvals.size == 2, + '12.approvals: 3+': approvals.size >= 3, + '12.first-time contribution': + [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association), + } ) - Object.assign(itemLabels, { - '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at, - }) + // Manage labels based on eval results + if (!expired) { + const maintainers = new Set(Object.keys( + JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8')) + ).map(m => Number.parseInt(m, 10))) - const after = Object.assign({}, before, itemLabels) + const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels + + Object.assign( + after, + // Ignore `evalLabels` if it's an array. + // This can happen for older eval runs, before we switched to objects. + // The old eval labels would have been set by the eval run, + // so now they'll be present in `before`. + // TODO: Simplify once old eval results have expired (~2025-10) + (Array.isArray(evalLabels) ? undefined : evalLabels), + { + '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)), + } + ) + } // No need for an API request, if all labels are the same. const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name]) @@ -359,6 +349,7 @@ jobs: { q: [ `repo:"${process.env.GITHUB_REPOSITORY}"`, + 'type:pr', 'is:open', `updated:>=${cutoff.toISOString()}` ].join(' AND '), @@ -368,11 +359,13 @@ jobs: ) // The search endpoint only allows fetching the first 1000 records, but the - // list endpoints do not support counting the total number of results. - // Thus, we use /search for counting and /issues for reading the response. - const { total_count: total_items } = (await github.rest.search.issuesAndPullRequests({ + // pull request list endpoint does not support counting the total number + // of results. + // Thus, we use /search for counting and /pulls for reading the response. + const { total_count: total_pulls } = (await github.rest.search.issuesAndPullRequests({ q: [ `repo:"${process.env.GITHUB_REPOSITORY}"`, + 'type:pr', 'is:open' ].join(' AND '), sort: 'created', @@ -383,37 +376,32 @@ jobs: })).data const { total_count: total_runs } = workflowData - // From GitHub's API docs: - // GitHub's REST API considers every pull request an issue, but not every issue is a pull request. - // For this reason, "Issues" endpoints may return both issues and pull requests in the response. - // You can identify pull requests by the pull_request key. - const allItems = (await github.rest.issues.listForRepo({ + const allPulls = (await github.rest.pulls.list({ ...context.repo, state: 'open', sort: 'created', direction: 'asc', per_page: 100, - // We iterate through pages of 100 items across scheduled runs. With currently ~7000 open PRs, - // 10000 open Issues and up to 6*24=144 scheduled runs per day, we hit every items a little less - // than once a day. - // We might not hit every item on one iteration, because the pages will shift slightly when - // items are closed or merged. We assume this to be OK on the bigger scale, because an item which was + // We iterate through pages of 100 items across scheduled runs. With currently ~7000 open PRs and + // up to 6*24=144 scheduled runs per day, we hit every PR twice each day. + // We might not hit every PR on one iteration, because the pages will shift slightly when + // PRs are closed or merged. We assume this to be OK on the bigger scale, because a PR which was // missed once, would have to move through the whole page to be missed again. This is very unlikely, // so it should certainly be hit on the next iteration. // TODO: Evaluate after a while, whether the above holds still true and potentially implement // an overlap between runs. - page: (total_runs % Math.ceil(total_items / 100)) + 1 + page: (total_runs % Math.ceil(total_pulls / 100)) + 1 })).data // Some items might be in both search results, so filtering out duplicates as well. - const items = [].concat(updatedItems, allItems) + const items = [].concat(updatedItems, allPulls) .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number)) ;(await Promise.allSettled(items.map(handle))) .filter(({ status }) => status == 'rejected') .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`)) - core.notice(`Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`) + core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`) } } finally { clearInterval(reservoirUpdater) From 86609619db57ae6a1dd686922935700d155af7e0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 20:45:41 +0000 Subject: [PATCH 38/42] github-mcp-server: 0.5.0 -> 0.6.0 --- pkgs/by-name/gi/github-mcp-server/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix index 857c7593ae15..7acdc60c152d 100644 --- a/pkgs/by-name/gi/github-mcp-server/package.nix +++ b/pkgs/by-name/gi/github-mcp-server/package.nix @@ -7,16 +7,16 @@ buildGoModule (finalAttrs: { pname = "github-mcp-server"; - version = "0.5.0"; + version = "0.6.0"; src = fetchFromGitHub { owner = "github"; repo = "github-mcp-server"; tag = "v${finalAttrs.version}"; - hash = "sha256-dbzO8yTAIfdAwcZEdoJqp+loPQea8iRSsAHdk2DfZ2A="; + hash = "sha256-jW/X8vwV47J20aa3E+WqjRL5n9H+Pb2EQwIVIg1pfug="; }; - vendorHash = "sha256-gVR7Md3xYrPpeMhHRTKCQKCJvRRIl85uXo+QwlVaPzk="; + vendorHash = "sha256-GYfK5QQH0DhoJqc4ynZBWuhhrG5t6KoGpUkZPSfWfEQ="; ldflags = [ "-s" From ca08829af3935e3f213e23b8e6bc50877d5602f7 Mon Sep 17 00:00:00 2001 From: NilaTheDragon Date: Tue, 17 Jun 2025 00:28:11 +0200 Subject: [PATCH 39/42] bink-player: init at 2025.05 --- pkgs/by-name/bi/bink-player/package.nix | 57 +++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 pkgs/by-name/bi/bink-player/package.nix diff --git a/pkgs/by-name/bi/bink-player/package.nix b/pkgs/by-name/bi/bink-player/package.nix new file mode 100644 index 000000000000..5bd2442cb32e --- /dev/null +++ b/pkgs/by-name/bi/bink-player/package.nix @@ -0,0 +1,57 @@ +{ + lib, + stdenv, + fetchurl, + autoPatchelfHook, + p7zip, + libGL, + libX11, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "bink-player"; + version = "2025.05"; + + src = fetchurl { + url = "https://web.archive.org/web/20250602103030if_/https://www.radgametools.com/down/Bink/BinkLinuxPlayer.7z"; + hash = "sha256-A3IDQtdYlIcU2U8uieQI6xe1SvW4BqH+5ZwPYJxr83M="; + }; + + unpackPhase = '' + runHook preUnpack + + 7z x $src + + runHook postUnpack + ''; + + nativeBuildInputs = [ + autoPatchelfHook + p7zip + ]; + + buildInputs = [ + stdenv.cc.cc.lib + libGL + libX11 + ]; + + installPhase = '' + runHook preInstall + + install -Dm755 BinkPlayer64 -t $out/bin/ + install -Dm755 BinkPlayer -t $out/bin/ + + runHook postInstall + ''; + + meta = { + description = "Play videos in the Bink format"; + homepage = "https://www.radgametools.com/bnkmain.htm"; + sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; + license = lib.licenses.unfree; + mainProgram = "BinkPlayer64"; + maintainers = with lib.maintainers; [ nilathedragon ]; + platforms = [ "x86_64-linux" ]; + }; +}) From 27874455ad8dae31bbda8eedb2c1d9e600f646f6 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 1 Jul 2025 09:43:39 +0200 Subject: [PATCH 40/42] python3Packages.orbax-checkpoint: 0.11.16 -> 0.11.18 Diff: https://github.com/google/orbax/compare/refs/tags/v0.11.16...refs/tags/v0.11.18 Changelog: https://github.com/google/orbax/blob/v0.11.18/checkpoint/CHANGELOG.md --- pkgs/development/python-modules/orbax-checkpoint/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix index ea5d64dbeaa4..68c88de3c4ae 100644 --- a/pkgs/development/python-modules/orbax-checkpoint/default.nix +++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix @@ -35,14 +35,14 @@ buildPythonPackage rec { pname = "orbax-checkpoint"; - version = "0.11.16"; + version = "0.11.18"; pyproject = true; src = fetchFromGitHub { owner = "google"; repo = "orbax"; tag = "v${version}"; - hash = "sha256-C5glSasB4LtxcaDx8U5rn7Y5J39+ieP0Mh2ITE1y1k8="; + hash = "sha256-Uosd2TfC3KJMp46SnNnodPBc+G1nNdqFOwPQA+aVyrQ="; }; sourceRoot = "${src.name}/checkpoint"; From 403add6263c14f9b253fd5da4ce2226ed4541fdd Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Wed, 2 Jul 2025 08:47:57 +1000 Subject: [PATCH 41/42] firefox-unwrapped: 140.0.1 -> 140.0.2 (#421627) https://www.mozilla.org/en-US/firefox/140.0.2/releasenotes/ --- .../networking/browsers/firefox/packages/firefox.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix index db99cd8674b1..bf91a6453515 100644 --- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix +++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix @@ -9,10 +9,10 @@ buildMozillaMach rec { pname = "firefox"; - version = "140.0.1"; + version = "140.0.2"; src = fetchurl { url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz"; - sha512 = "d521405f49a38b8449a24f90e5ea14d4337085918779d93d282cec80b2627f381648529d6f69930eb6e90e37302797b0049fec5846d25dc40f556bbd86d55ef1"; + sha512 = "11d3295c82835668f43a888bd5aada22248776e033aecc7558348e6ee26626bf4b65bbaae2680f7285a6b2b6209ec5d4aea453f1e0603544cd48bf45c735b2ea"; }; meta = { From b26c116900313d651cdfb22e0ea7ccd360c602a0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Jul 2025 23:45:33 +0000 Subject: [PATCH 42/42] zashboard: 1.94.2 -> 1.96.0 --- pkgs/by-name/za/zashboard/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix index d4d031d62319..9a80dd69c623 100644 --- a/pkgs/by-name/za/zashboard/package.nix +++ b/pkgs/by-name/za/zashboard/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "zashboard"; - version = "1.94.2"; + version = "1.96.0"; src = fetchFromGitHub { owner = "Zephyruso"; repo = "zashboard"; tag = "v${finalAttrs.version}"; - hash = "sha256-bG4fa6lsOsHYly6ORDx9WzUjgW5liY8hgUblYicbXXY="; + hash = "sha256-3sY3C4iNqVPhbwWCzGRRJ9pDfewPq7q70kMrXuqZQpc="; }; nativeBuildInputs = [