Merge master into staging-next

maintainers/maintainer-list.nix

@@ -20357,6 +20357,11 @@
     githubId = 3958212;
     name = "Tom Sorlie";
   };
+  scd31 = {
+    name = "scd31";
+    github = "scd31";
+    githubId = 57571338;
+  };
   schinmai-akamai = {
     email = "schinmai@akamai.com";
     github = "tchinmai7";
@@ -25035,6 +25040,12 @@
     githubId = 58453832;
     keys = [ { fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4"; } ];
   };
+  yechielw = {
+    name = "yechielw";
+    email = "yechielworen@gmail.com";
+    github = "yechielw";
+    githubId = 41305372;
+  };
   yelite = {
     name = "Lite Ye";
     email = "yelite958@gmail.com";

nixos/doc/manual/redirects.json

@@ -875,6 +875,12 @@
   "module-services-networking-dnsmasq-references": [
     "index.html#module-services-networking-dnsmasq-references"
   ],
+  "module-service-doh-server": [
+    "index.html#module-service-doh-server"
+  ],
+  "module-service-doh-server-quick-start": [
+    "index.html#module-service-doh-server-quick-start"
+  ],
   "module-services-samba": [
     "index.html#module-services-samba"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -53,6 +53,8 @@
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
+- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
+
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).

nixos/modules/module-list.nix

@@ -1055,6 +1055,7 @@
   ./services/networking/dnsmasq.nix
   ./services/networking/dnsproxy.nix
   ./services/networking/doh-proxy-rust.nix
+  ./services/networking/doh-server.nix
   ./services/networking/ejabberd.nix
   ./services/networking/envoy.nix
   ./services/networking/epmd.nix

nixos/modules/services/networking/doh-server.md

@@ -0,0 +1,69 @@
+# DNS-over-HTTPS Server {#module-service-doh-server}
+
+[DNS-over-HTTPS](https://github.com/m13253/dns-over-https) is a high performance DNS over HTTPS client & server. This module enables its server part (`doh-server`).
+
+## Quick Start {#module-service-doh-server-quick-start}
+
+Setup with Nginx + ACME (recommended):
+
+```nix
+{
+  services.doh-server = {
+    enable = true;
+    settings = {
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."doh.example.com" = {
+      enableACME = true;
+      forceSSL = true;
+      http2 = true;
+      locations."/".return = 404;
+      locations."/dns-query" = {
+        proxyPass = "http://127.0.0.1:8053/dns-query";
+        recommendedProxySettings = true;
+      };
+    };
+    # and other virtual hosts ...
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "you@example.com";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
+```
+
+`doh-server` can also work as a standalone HTTPS web server (with SSL cert and key specified), but this is not recommended as `doh-server` does not do OCSP Stabbing.
+
+Setup a standalone instance with ACME:
+
+```nix
+let
+  domain = "doh.example.com";
+in
+{
+  security.acme.certs.${domain} = {
+    dnsProvider = "cloudflare";
+    credentialFiles."CF_DNS_API_TOKEN_FILE" = "/run/secrets/cf-api-token";
+  };
+
+  services.doh-server = {
+    enable = true;
+    settings = {
+      listen = [ ":443" ];
+      upstream = [ "udp:1.1.1.1:53" ];
+    };
+    useACMEHost = domain;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 443 ];
+}
+```
+
+See a full configuration in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf.

nixos/modules/services/networking/doh-server.nix

@@ -0,0 +1,175 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.doh-server;
+  toml = pkgs.formats.toml { };
+in
+{
+  options.services.doh-server = {
+    enable = lib.mkEnableOption "DNS-over-HTTPS server";
+
+    package = lib.mkPackageOption pkgs "dns-over-https" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = toml.type;
+        options = {
+
+          listen = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "127.0.0.1:8053"
+              "[::1]:8053"
+            ];
+            example = [ ":443" ];
+            description = "HTTP listen address and port";
+          };
+
+          path = lib.mkOption {
+            type = lib.types.str;
+            default = "/dns-query";
+            example = "/dns-query";
+            description = "HTTP path for resolve application";
+          };
+
+          upstream = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [
+              "udp:1.1.1.1:53"
+              "udp:1.0.0.1:53"
+              "udp:8.8.8.8:53"
+              "udp:8.8.4.4:53"
+            ];
+            example = [ "udp:127.0.0.1:53" ];
+            description = ''
+              Upstream DNS resolver.
+              If multiple servers are specified, a random one will be chosen each time.
+              You can use "udp", "tcp" or "tcp-tls" for the type prefix.
+              For "udp", UDP will first be used, and switch to TCP when the server asks to or the response is too large.
+              For "tcp", only TCP will be used.
+              For "tcp-tls", DNS-over-TLS (RFC 7858) will be used to secure the upstream connection.
+            '';
+          };
+
+          timeout = lib.mkOption {
+            type = lib.types.int;
+            default = 10;
+            example = 15;
+            description = "Upstream timeout";
+          };
+
+          tries = lib.mkOption {
+            type = lib.types.int;
+            default = 3;
+            example = 5;
+            description = "Number of tries if upstream DNS fails";
+          };
+
+          verbose = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = "Enable logging";
+          };
+
+          log_guessed_client_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
+              Note: http uri/useragent log cannot be controlled by this config
+            '';
+          };
+
+          ecs_allow_non_global_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              By default, non global IP addresses are never forwarded to upstream servers.
+              This is to prevent two things from happening:
+                1. the upstream server knowing your private LAN addresses;
+                2. the upstream server unable to provide geographically near results,
+                  or even fail to provide any result.
+              However, if you are deploying a split tunnel corporation network environment, or for any other reason you want to inhibit this behavior and allow local (eg RFC1918) address to be forwarded, change the following option to "true".
+            '';
+          };
+
+          ecs_use_precise_ip = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask. This option is to be used only on private networks where knowledge of the terminal endpoint may be required for security purposes (eg. DNS Firewalling). Not a good option on the internet where IP address may be used to identify the user and not only the approximate location.
+            '';
+          };
+        };
+      };
+      default = { };
+      example = {
+        listen = [ ":8153" ];
+        upstream = [ "udp:127.0.0.1:53" ];
+      };
+      description = "Configuration of doh-server in toml. See example in https://github.com/m13253/dns-over-https/blob/master/doh-server/doh-server.conf";
+    };
+
+    useACMEHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "doh.example.com";
+      description = ''
+        A host of an existing Let's Encrypt certificate to use.
+        *Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using [](#opt-security.acme.certs).*
+      '';
+    };
+
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/path/to/doh-server.conf";
+      description = ''
+        The config file for the doh-server.
+        Setting this option will override any configuration applied by the `settings` option.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.doh-server.configFile = lib.mkDefault (toml.generate "doh-server.conf" cfg.settings);
+    services.doh-server.settings = lib.mkIf (cfg.useACMEHost != null) (
+      let
+        sslCertDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
+      in
+      {
+        cert = "${sslCertDir}/cert.pem";
+        key = "${sslCertDir}/key.pem";
+      }
+    );
+    systemd.services.doh-server = {
+      description = "DNS-over-HTTPS Server";
+      documentation = [ "https://github.com/m13253/dns-over-https" ];
+      after = [
+        "network.target"
+      ] ++ lib.optional (cfg.useACMEHost != null) "acme-${cfg.useACMEHost}.service";
+      wants = lib.optional (cfg.useACMEHost != null) "acme-finished-${cfg.useACMEHost}.target";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        ExecStart = "${cfg.package}/bin/doh-server -conf ${cfg.configFile}";
+        LimitNOFILE = 1048576;
+        Restart = "always";
+        RestartSec = 3;
+        Type = "simple";
+        DynamicUser = true;
+        SupplementaryGroups = lib.optional (cfg.useACMEHost != null) "acme";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ DictXiong ];
+  meta.doc = ./doh-server.md;
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/el-easydraw/package.nix

@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "edraw";
-  version = "1.2.0-unstable-2024-12-18";
+  version = "1.2.0-unstable-2025-01-06";
 
   src = fetchFromGitHub {
     owner = "misohena";
     repo = "el-easydraw";
-    rev = "1c46469d0ea3642958eaf7cea1016fcf05b4daec";
-    hash = "sha256-Z7LPC112FXHtDop1HXPnR6S+cSqfEW1HuYS8YD/qM+c=";
+    rev = "9a5b5e2b071be99350bfc8db6fbc2c9c667f3725";
+    hash = "sha256-lQYSUQFAv6rqvZySsFbe8B7ZqEaa2L+L3HXB231D4OQ=";
   };
 
   propagatedUserEnvPkgs = [ gzip ];

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -9,24 +9,24 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.78";
+        stable = "0.0.79";
         ptb = "0.0.124";
-        canary = "0.0.549";
-        development = "0.0.60";
+        canary = "0.0.556";
+        development = "0.0.61";
       }
     else
       {
-        stable = "0.0.330";
-        ptb = "0.0.153";
-        canary = "0.0.661";
-        development = "0.0.68";
+        stable = "0.0.331";
+        ptb = "0.0.154";
+        canary = "0.0.668";
+        development = "0.0.70";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-1G9NM0Z6dN2LtunHkkIzNNA+xFslxhnI8GVrjXlNZK8=";
+        hash = "sha256-gQVx+PueGDofUjKSvyorCu73myNujcKz9gugMKB9koY=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
@@ -34,29 +34,29 @@ let
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-hwgvPNoEGjfg6uLlC/k3iYfxfjbja5H2F2aSiEcGZ/o=";
+        hash = "sha256-5qn0YL0+1uE6kmQO3Fh2DD0gNjk6MT+yAdIoMK7Y8Tw=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-SL+lWMSXC1Y11Sk59sE7F8n04DED2365RKKeKFU8R6o=";
+        hash = "sha256-9ssgue3Y8StyKnc1dvr6b0Z3hjPYtJCNuVsruqFx8ug=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-wLDr2jtjPsV3rUsFCNKKHXTwGPdoR/whLmr4w8I7x+U=";
+        hash = "sha256-U37JyZwPmsk6ArD8Lz0xAiy/I78H+wHSig3+1BpD9iA=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-EvIEMyqOotnyqBC8w4XbF+RuP+g2Bjt4hD4aEeEzZGU=";
+        hash = "sha256-BVKhyLoz/EoaZ6LgCaJuZZ37u9ProXOPddrfg171Eu4=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-dCeLnfgvaKngO8r/VIDgQLkMKgV7BDOOKcXUdo91Eeo=";
+        hash = "sha256-1eCHufW68AuYuYWzfq6Tt+YylFgCLT88DrvrNZvQG8A=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-5sUkGN9ucyYArGkfbGBdJokoqpHKBrkwxH055LpMlrs=";
+        hash = "sha256-UdHwa/ALOOt/bNA6UmVJB8GNe+yHJ1xFoyF0nT1Zn3g=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/by-name/bi/bigloo/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bigloo";
-  version = "4.4b";
+  version = "4.5b";
 
   src = fetchurl {
     url = "ftp://ftp-sop.inria.fr/indes/fp/Bigloo/bigloo-${version}.tar.gz";
-    sha256 = "sha256-oxOSJwKWmwo7PYAwmeoFrKaYdYvmvQquWXyutolc488=";
+    sha256 = "sha256-hk1SXuan/zOf2ajJc8xGv5piOjgn2Ev7bgSikiNwfaU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cn/cnquery/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.35.0";
+  version = "11.36.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-WBzl3DyjPr5vV9oobqZx1pprs4gkVN9BafOMIMqqb7E=";
+    hash = "sha256-LISy9xMAv9Wal+iRF9qoCLrQnq0r4HOqCir/w0uTrAA=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-rgjYpiTWp9KqC7gX05Fx5h2hKT1ah2GQorPzPhJpQH0=";
+  vendorHash = "sha256-JweIdmjnybaOyL5GOxCmP8TpyMYTG9qD5aFbabAJ4h8=";
 
   ldflags = [
     "-w"

pkgs/by-name/de/debootstrap/package.nix

@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "debootstrap";
-  version = "1.0.138";
+  version = "1.0.140";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "debootstrap";
     rev = "refs/tags/${version}";
-    hash = "sha256-2NUFt39isGThOqlg1LNOFxYJOPm93jDCvIztJoE5Vts=";
+    hash = "sha256-kusY42HwyMFuzwJimdVzuwx9XGjKssGAR7guB4E0TbQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch

@@ -1,4 +1,4 @@
-From 47406ebaf0260e5b66a92baac3717936c8386b69 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:52:59 +0200
 Subject: [PATCH] nixpkgs: use system Python
@@ -10,7 +10,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  2 files changed, 5 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 9f2b336b1a..53a2c93c59 100644
+index 9f2b336b1a36ca0d2f04a40ac1809b30ff21df27..53a2c93c59492a12ef4a6ecfc0c8a679f0df73f7 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
 @@ -1,28 +1,25 @@
@@ -47,7 +47,7 @@ index 9f2b336b1a..53a2c93c59 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index b92dd461ba..cef32b3140 100644
+index b92dd461ba7037d2f1c079f283ff2c466686f7a4..cef32b3140588cb7668d47d0c08528f131184fe4 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
 @@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")

pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch

@@ -1,4 +1,4 @@
-From 4be181e96199529a36e9a93c837af7173c827493 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:58:00 +0200
 Subject: [PATCH] nixpkgs: use system Go
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index c68eb4bf3e..addee4f6af 100644
+index c68eb4bf3ed2d39d46d38d7bd0eeab2c74a507fa..addee4f6af74ea78ae778b73384e01db83ac6694 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -20,7 +20,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")

pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch

@@ -1,4 +1,4 @@
-From 3ecb08a7603a07310d1a38c0f47bc54bbe1f11c8 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:59:22 +0200
 Subject: [PATCH] nixpkgs: use system C/C++ toolchains
@@ -9,7 +9,7 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index addee4f6af..dc1967e43b 100644
+index addee4f6af74ea78ae778b73384e01db83ac6694..dc1967e43b2b71358d2767a3d83b52819987290d 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
 @@ -26,7 +26,11 @@ JQ_VERSION = "1.7"

pkgs/by-name/en/envoy/0004-nixpkgs-patch-boringssl-for-gcc14.patch

@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <katexochen0@gmail.com>
+Date: Thu, 2 Jan 2025 09:32:41 +0100
+Subject: [PATCH] nixpkgs: patch boringssl for gcc14
+
+Signed-off-by: Paul Meyer <katexochen0@gmail.com>
+---
+ bazel/boringssl-gcc14.patch | 25 +++++++++++++++++++++++++
+ bazel/repositories.bzl      |  1 +
+ 2 files changed, 26 insertions(+)
+ create mode 100644 bazel/boringssl-gcc14.patch
+
+diff --git a/bazel/boringssl-gcc14.patch b/bazel/boringssl-gcc14.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..8dcad4cc11f691eec93efa29075c1d356732e58b
+--- /dev/null
++++ b/bazel/boringssl-gcc14.patch
+@@ -0,0 +1,25 @@
++diff --git a/crypto/internal.h b/crypto/internal.h
++index a77102d..a45f97b 100644
++--- a/crypto/internal.h
+++++ b/crypto/internal.h
++@@ -1174,6 +1174,11 @@
++ 
++ // Arithmetic functions.
++ 
+++// The most efficient versions of these functions on GCC and Clang depend on C11
+++// |_Generic|. If we ever need to call these from C++, we'll need to add a
+++// variant that uses C++ overloads instead.
+++#if !defined(__cplusplus)
+++
++ // CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
++ // bit. |carry| must be zero or one.
++ #if OPENSSL_HAS_BUILTIN(__builtin_addc)
++@@ -1275,6 +1280,8 @@
++ #define CRYPTO_subc_w CRYPTO_subc_u32
++ #endif
++ 
+++#endif  // !__cplusplus
+++
++ 
++ // FIPS functions.
++ 
+diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
+index 5cb573770f0aeac7b42d803673c8c520b5e35131..e864ef24db4bf837ef50d90c8eca316eba939d74 100644
+--- a/bazel/repositories.bzl
++++ b/bazel/repositories.bzl
+@@ -264,6 +264,7 @@ def _boringssl():
+         patch_args = ["-p1"],
+         patches = [
+             "@envoy//bazel:boringssl_static.patch",
++            "@envoy//bazel:boringssl-gcc14.patch",
+         ],
+     )
+ 

pkgs/by-name/en/envoy/0005-deps-Bump-rules_rust-0.54.1-37056.patch

@@ -0,0 +1,128 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "dependency-envoy[bot]"
+ <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Date: Fri, 8 Nov 2024 21:09:22 +0000
+Subject: [PATCH] deps: Bump `rules_rust` -> 0.54.1 (#37056)
+
+Fix #37054
+
+Signed-off-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
+Signed-off-by: Ryan Northey <ryan@synca.io>
+---
+ bazel/repository_locations.bzl                | 10 ++++++---
+ .../dynamic_modules/sdk/rust/Cargo.Bazel.lock | 21 +++++++++++--------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
+index 85a125d44ece6c655f94aab3d986d96ab837897f..cfe7d145b59b691f6455b58b1baaae48276b7e9f 100644
+--- a/bazel/repository_locations.bzl
++++ b/bazel/repository_locations.bzl
+@@ -1465,12 +1465,16 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         license = "Emscripten SDK",
+         license_url = "https://github.com/emscripten-core/emsdk/blob/{version}/LICENSE",
+     ),
++    # After updating you may need to run:
++    #
++    #     CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
++    #
+     rules_rust = dict(
+         project_name = "Bazel rust rules",
+         project_desc = "Bazel rust rules (used by Wasm)",
+         project_url = "https://github.com/bazelbuild/rules_rust",
+-        version = "0.51.0",
+-        sha256 = "042acfb73469b2d1848fe148d81c3422c61ea47a9e1900f1c9ec36f51e8e7193",
++        version = "0.54.1",
++        sha256 = "af4f56caae50a99a68bfce39b141b509dd68548c8204b98ab7a1cafc94d5bb02",
+         # Note: rules_rust should point to the releases, not archive to avoid the hassle of bootstrapping in crate_universe.
+         # This is described in https://bazelbuild.github.io/rules_rust/crate_universe.html#setup, otherwise bootstrap
+         # is required which in turn requires a system CC toolchains, not the bazel controlled ones.
+@@ -1482,7 +1486,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         ],
+         implied_untracked_deps = ["rules_cc"],
+         extensions = ["envoy.wasm.runtime.wasmtime"],
+-        release_date = "2024-09-19",
++        release_date = "2024-11-07",
+         cpe = "N/A",
+         license = "Apache-2.0",
+         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",
+diff --git a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+index fa6012f406464428b37d548eecd6cec3fdaf901b..6af752304b65af39aa621fa201a8c0108931dad0 100644
+--- a/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
++++ b/source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
+@@ -1,5 +1,5 @@
+ {
+-  "checksum": "96b309ddded40cf6f46a62829d15a02d7253b4cc94af2ac1890e492f9c07e93f",
++  "checksum": "b550022ca979d6b55c6dbee950bbf18368e4b8da16973c4e88e292b4d6f28e81",
+   "crates": {
+     "aho-corasick 1.1.3": {
+       "name": "aho-corasick",
+@@ -2149,9 +2149,6 @@
+     "aarch64-apple-ios-sim": [
+       "aarch64-apple-ios-sim"
+     ],
+-    "aarch64-fuchsia": [
+-      "aarch64-fuchsia"
+-    ],
+     "aarch64-linux-android": [
+       "aarch64-linux-android"
+     ],
+@@ -2159,6 +2156,9 @@
+     "aarch64-pc-windows-msvc": [
+       "aarch64-pc-windows-msvc"
+     ],
++    "aarch64-unknown-fuchsia": [
++      "aarch64-unknown-fuchsia"
++    ],
+     "aarch64-unknown-linux-gnu": [
+       "aarch64-unknown-linux-gnu"
+     ],
+@@ -2197,8 +2197,8 @@
+       "aarch64-apple-darwin",
+       "aarch64-apple-ios",
+       "aarch64-apple-ios-sim",
+-      "aarch64-fuchsia",
+       "aarch64-linux-android",
++      "aarch64-unknown-fuchsia",
+       "aarch64-unknown-linux-gnu",
+       "aarch64-unknown-nixos-gnu",
+       "aarch64-unknown-nto-qnx710",
+@@ -2213,9 +2213,9 @@
+       "s390x-unknown-linux-gnu",
+       "x86_64-apple-darwin",
+       "x86_64-apple-ios",
+-      "x86_64-fuchsia",
+       "x86_64-linux-android",
+       "x86_64-unknown-freebsd",
++      "x86_64-unknown-fuchsia",
+       "x86_64-unknown-linux-gnu",
+       "x86_64-unknown-nixos-gnu"
+     ],
+@@ -2264,15 +2264,15 @@
+     "wasm32-wasi": [
+       "wasm32-wasi"
+     ],
++    "wasm32-wasip1": [
++      "wasm32-wasip1"
++    ],
+     "x86_64-apple-darwin": [
+       "x86_64-apple-darwin"
+     ],
+     "x86_64-apple-ios": [
+       "x86_64-apple-ios"
+     ],
+-    "x86_64-fuchsia": [
+-      "x86_64-fuchsia"
+-    ],
+     "x86_64-linux-android": [
+       "x86_64-linux-android"
+     ],
+@@ -2283,6 +2283,9 @@
+     "x86_64-unknown-freebsd": [
+       "x86_64-unknown-freebsd"
+     ],
++    "x86_64-unknown-fuchsia": [
++      "x86_64-unknown-fuchsia"
++    ],
+     "x86_64-unknown-linux-gnu": [
+       "x86_64-unknown-linux-gnu"
+     ],

pkgs/by-name/en/envoy/0006-gcc-warnings.patch

@@ -0,0 +1,127 @@
+From 448e4e14f4f188687580362a861ae4a0dbb5b1fb Mon Sep 17 00:00:00 2001
+From: "Krinkin, Mike" <krinkin.m.u@gmail.com>
+Date: Sat, 16 Nov 2024 00:40:40 +0000
+Subject: [PATCH] [contrib] Disable GCC warnings and broken features (#37131)
+
+Currently contrib does not build with GCC because of various false
+positive compiler warnings turned to errors and a GCC compiler bug.
+
+Let's first start with the bug, in GCC apparently
+using -gsplit-dwarf (debug fission) and -fdebug-types-section (used to
+optimize the size of debug inforamtion), when used together, can result
+in a linker failure.
+
+Refer to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885 for the GCC
+bug report of this issue. When it comes to Envoy, optimized builds with
+GCC are affected on at least GCC 11 (used by --config=docker-gcc) and
+GCC 12 (and I'm pretty sure the bug isn't fixed in any newer versions
+either, though I didn't check each version).
+
+Given that we cannot have both debug fission and a debug types section,
+we decided to abandon the debug types sections and keep the fission.
+
+That being said, apparently both of those options are unmaintained in
+GCC which poses a question of long term viability of using those or GCC.
+
+Other changes in this commit disable GCC compiler errors for various
+warnings that happen when building contrib. I checked those warnings and
+didn't find any true
+positive.
+
+And additionally, for warnings that exists in both Clang and GCC, Clang
+warnings don't trigger, so Clang also disagrees with GCC here.
+
+Additionally missing-requires warning is new and does not exist in GCC
+11, but exists in later versions of GCC, so to avoid breaking on this
+warning for future versions of GCC I disabled it, but also tell GCC to
+not complain if it sees a flag related to an unknwon diagnostic.
+
+This is the last change required to make GCC contrib builds work (you
+can find more context and discussions in
+https://github.com/envoyproxy/envoy/issues/31807)
+
+Risk Level: Low
+Testing: building with --config=gcc and --config=docker-gcc
+Docs Changes: N/A
+Release Notes: N/A
+Platform Specific Features: N/A
+Fixes #31807
+
+Signed-off-by: Mikhail Krinkin <krinkin.m.u@gmail.com>
+---
+ .bazelrc                 | 18 +++++++++++++++++-
+ bazel/envoy_internal.bzl | 16 +++++++++++++++-
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/.bazelrc b/.bazelrc
+index e0e4899cecf1..7df94c77944c 100644
+--- a/.bazelrc
++++ b/.bazelrc
+@@ -57,9 +57,9 @@ test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
+ # Allow tags to influence execution requirements
+ common --experimental_allow_tags_propagation
+ 
++build:linux --copt=-fdebug-types-section
+ # Enable position independent code (this is the default on macOS and Windows)
+ # (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
+-build:linux --copt=-fdebug-types-section
+ build:linux --copt=-fPIC
+ build:linux --copt=-Wno-deprecated-declarations
+ build:linux --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
+@@ -95,6 +95,21 @@ build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
+ build:gcc --test_env=HEAPCHECK=
+ build:gcc --action_env=BAZEL_COMPILER=gcc
+ build:gcc --action_env=CC=gcc --action_env=CXX=g++
++# This is to work around a bug in GCC that makes debug-types-section
++# option not play well with fission:
++# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885
++build:gcc --copt=-fno-debug-types-section
++# These trigger errors in multiple places both in Envoy dependecies
++# and in Envoy code itself when using GCC.
++# And in all cases the reports appear to be clear false positives.
++build:gcc --copt=-Wno-error=restrict
++build:gcc --copt=-Wno-error=uninitialized
++build:gcc --cxxopt=-Wno-missing-requires
++# We need this because -Wno-missing-requires options is rather new
++# in GCC, so flags -Wno-missing-requires exists in GCC 12, but does
++# not in GCC 11 and GCC 11 is what is used in docker-gcc
++# configuration currently
++build:gcc --cxxopt=-Wno-unknown-warning
+ 
+ # Clang-tidy
+ # TODO(phlax): enable this, its throwing some errors as well as finding more issues
+@@ -375,6 +390,7 @@ build:docker-clang-libc++ --config=docker-sandbox
+ build:docker-clang-libc++ --config=rbe-toolchain-clang-libc++
+ 
+ build:docker-gcc --config=docker-sandbox
++build:docker-gcc --config=gcc
+ build:docker-gcc --config=rbe-toolchain-gcc
+ 
+ build:docker-asan --config=docker-sandbox
+diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
+index 015659851c1b..27ecaa0bbf47 100644
+--- a/bazel/envoy_internal.bzl
++++ b/bazel/envoy_internal.bzl
+@@ -68,7 +68,21 @@ def envoy_copts(repository, test = False):
+                    "-Wc++2a-extensions",
+                    "-Wrange-loop-analysis",
+                ],
+-               repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
++               repository + "//bazel:gcc_build": [
++                   "-Wno-maybe-uninitialized",
++                   # GCC implementation of this warning is too noisy.
++                   #
++                   # It generates warnings even in cases where there is no ambiguity
++                   # between the overloaded version of a method and the hidden version
++                   # from the base class. E.g., when the two have different number of
++                   # arguments or incompatible types and therefore a wrong function
++                   # cannot be called by mistake without triggering a compiler error.
++                   #
++                   # As a safeguard, this warning is only disabled for GCC builds, so
++                   # if Clang catches a problem in the code we would get a warning
++                   # anyways.
++                   "-Wno-error=overloaded-virtual",
++               ],
+                # Allow 'nodiscard' function results values to be discarded for test code only
+                # TODO(envoyproxy/windows-dev): Replace /Zc:preprocessor with /experimental:preprocessor
+                # for msvc versions between 15.8 through 16.4.x. see

pkgs/by-name/en/envoy/0007-protobuf-remove-Werror.patch

@@ -0,0 +1,19 @@
+diff -Naur a/bazel/protobuf.patch b/bazel/protobuf.patch
+--- a/bazel/protobuf.patch	2025-01-06 23:00:26.683972526 +0100
++++ b/bazel/protobuf.patch	2025-01-07 00:53:33.997482569 +0100
+@@ -149,3 +149,15 @@
+  #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
+  #define PROTOBUF_DEBUG true
+  #else
++diff -Naur a/build_defs/cpp_opts.bzl b/build_defs/cpp_opts.bzl
++--- a/build_defs/cpp_opts.bzl	2025-01-06 23:02:56.356552216 +0100
+++++ b/build_defs/cpp_opts.bzl	2025-01-07 00:23:30.534047300 +0100
++@@ -22,7 +22,7 @@
++         "-Woverloaded-virtual",
++         "-Wno-sign-compare",
++         "-Wno-nonnull",
++-        "-Werror",
+++        "-Wno-maybe-uninitialized",
++     ],
++ })
++ 

pkgs/by-name/en/envoy/package.nix

@@ -4,6 +4,7 @@
   bazel-gazelle,
   buildBazelPackage,
   fetchFromGitHub,
+  applyPatches,
   stdenv,
   cacert,
   cargo,
@@ -29,32 +30,66 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.32.0";
-    rev = "86dc7ef91ca15fb4957a74bd599397413fc26a24";
-    hash = "sha256-Wcbt62RfaNcTntmPjaAM0cP3LJangm4ht7Q0bzEpu5A=";
+    version = "1.32.3";
+    rev = "58bd599ebd5918d4d005de60954fcd2cb00abd95";
+    hash = "sha256-5HpxcsAPoyVOJ3Aem+ZjSLa8Zu6s76iCMiWJbp8RjHc=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-LkDNPFT7UUCsGPG1dMnwzdIw0lzc5+3JYDoblF5oZVk=";
-      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
+      x86_64-linux = "sha256-YFXNatolLM9DdwkMnc9SWsa6Z6/aGzqLmo/zKE7OFy0=";
+      aarch64-linux = "sha256-AjG1OBjPjiSwWCmIJgHevSQHx8+rzRgmLsw3JwwD0hk=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
   bazel = bazel_6;
-  src = fetchFromGitHub {
-    owner = "envoyproxy";
-    repo = "envoy";
-    inherit (srcVer) hash rev;
 
-    postFetch = ''
-      chmod -R +w $out
-      rm $out/.bazelversion
-      echo ${srcVer.rev} > $out/SOURCE_VERSION
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "envoyproxy";
+      repo = "envoy";
+      inherit (srcVer) hash rev;
+    };
+    patches = [
+      # use system Python, not bazel-fetched binary Python
+      ./0001-nixpkgs-use-system-Python.patch
+
+      # use system Go, not bazel-fetched binary Go
+      ./0002-nixpkgs-use-system-Go.patch
+
+      # use system C/C++ tools
+      ./0003-nixpkgs-use-system-C-C-toolchains.patch
+
+      # patch boringssl to work with GCC 14
+      # vendored patch from https://boringssl.googlesource.com/boringssl/+/c70190368c7040c37c1d655f0690bcde2b109a0d
+      ./0004-nixpkgs-patch-boringssl-for-gcc14.patch
+
+      # update rust rules to work with rustc v1.83
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/019f589da2cc8da7673edd077478a100b4d99436
+      # drop with v1.33.x
+      ./0005-deps-Bump-rules_rust-0.54.1-37056.patch
+
+      # patch gcc flags to work with GCC 14
+      # (silences erroneus -Werror=maybe-uninitialized and others)
+      # cherry-pick of https://github.com/envoyproxy/envoy/commit/448e4e14f4f188687580362a861ae4a0dbb5b1fb
+      # drop with v1.33.x
+      ./0006-gcc-warnings.patch
+
+      # Remove "-Werror" from protobuf build
+      # This is fixed in protobuf v28 and later:
+      # https://github.com/protocolbuffers/protobuf/commit/f5a1b178ad52c3e64da40caceaa4ca9e51045cb4
+      # drop with v1.33.x
+      ./0007-protobuf-remove-Werror.patch
+    ];
+    postPatch = ''
+      chmod -R +w .
+      rm ./.bazelversion
+      echo ${srcVer.rev} > ./SOURCE_VERSION
     '';
   };
 
@@ -80,17 +115,6 @@ buildBazelPackage rec {
     mv bazel/nix/rules_rust.patch bazel/rules_rust.patch
   '';
 
-  patches = [
-    # use system Python, not bazel-fetched binary Python
-    ./0001-nixpkgs-use-system-Python.patch
-
-    # use system Go, not bazel-fetched binary Go
-    ./0002-nixpkgs-use-system-Go.patch
-
-    # use system C/C++ tools
-    ./0003-nixpkgs-use-system-C-C-toolchains.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     python3
@@ -194,6 +218,8 @@ buildBazelPackage rec {
       "--noexperimental_strict_action_env"
       "--cxxopt=-Wno-error"
       "--linkopt=-Wl,-z,noexecstack"
+      "--config=gcc"
+      "--verbose_failures"
 
       # Force use of system Java.
       "--extra_toolchains=@local_jdk//:all"

pkgs/by-name/hy/hyfetch/package.nix

@@ -3,12 +3,18 @@
   fetchFromGitHub,
   python3Packages,
   pciutils,
+  installShellFiles,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "hyfetch";
   version = "1.99.0";
   pyproject = true;
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
@@ -24,6 +30,10 @@ python3Packages.buildPythonApplication rec {
     python3Packages.typing-extensions
   ];
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   # No test available
   doCheck = false;
 
@@ -31,6 +41,15 @@ python3Packages.buildPythonApplication rec {
     "hyfetch"
   ];
 
+  # NOTE: The HyFetch project maintains an updated version of neofetch renamed
+  # to "neowofetch" which is included in this package. However, the man page
+  # included is still named "neofetch", so to prevent conflicts and confusion
+  # we rename the file to "neowofetch" before installing it:
+  postInstall = ''
+    mv ./docs/neofetch.1 ./docs/neowofetch.1
+    installManPage ./docs/hyfetch.1 ./docs/neowofetch.1
+  '';
+
   postFixup = ''
     wrapProgram $out/bin/neowofetch \
       --prefix PATH : ${lib.makeBinPath [ pciutils ]}
@@ -53,6 +72,7 @@ python3Packages.buildPythonApplication rec {
     maintainers = with lib.maintainers; [
       yisuidenghua
       isabelroses
+      nullcube
     ];
   };
 }

pkgs/by-name/ji/jitsi-meet-electron/package.nix

@@ -91,6 +91,8 @@ buildNpmPackage rec {
         -c.electronVersion=${electron.version}
   '';
 
+  NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/li/libmsquic/package.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  lttng-tools,
+  libatomic_ops,
+  perl,
+  coreutils,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmsquic";
+  version = "2.4.7";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "msquic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WveyZ9rMevLTc5C4cgMFcnj0O6Hd+HcfU8ccD6VBgyU=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+
+  buildInputs = [
+    lttng-tools
+    libatomic_ops
+  ];
+
+  postUnpack = ''
+    for f in "$(find . -type f -name "*.pl")"; do
+      patchShebangs --build $f 2>&1 > /dev/null
+    done
+
+    for g in $(find . -type f -name "*" ); do
+      if test -f $g; then
+        sed -i "s|/usr/bin/env|${coreutils}/bin/env|g" $g
+      fi
+    done
+  '';
+
+  meta = {
+    description = "Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust";
+    homepage = "https://github.com/microsoft/msquic";
+    changelog = "https://github.com/microsoft/msquic/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ SohamG ];
+  };
+})

pkgs/by-name/lu/lunar-client/package.nix

@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-tRLT/jR6e9fwmQWAZ1OwjAOMiLy7us9WjiGpS8NBOzHO7jJ4TofSRvvSwpohr9YsnLiLnqANdlWtuabRpQhLLw==";
+    hash = "sha512-Gpm17h5U9Cw9r5EHE1wF5e0aza9yaGPUf+rhMVAhXjrVYBqiUsc/UG11TXWqarKlLpRmPDe+BvCF0qqTtTEZhw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/mi/minio-warp/package.nix

@@ -3,20 +3,21 @@
   fetchFromGitHub,
   buildGoModule,
   versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "minio-warp";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "warp";
     rev = "v${version}";
-    hash = "sha256-TqgF8WkWz+OZGSwrjIMFg4WaSdunOrcjuYDhWuPZTU8=";
+    hash = "sha256-kME4yafNZtHDF/EAIG8qR4PH6HlokIfdBAJH+ibl5ro=";
   };
 
-  vendorHash = "sha256-i0npOEo+rplC+hU4yxGRpY8gX+VGjR7HwKbiv5mQ28M=";
+  vendorHash = "sha256-073ssCOh0CiiJaatwzhNrwpe2QO21iC6GSkwVtsmYjs=";
 
   # See .goreleaser.yml
   ldflags = [
@@ -37,6 +38,8 @@ buildGoModule rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = [ "--version" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "S3 benchmarking tool";
     homepage = "https://github.com/minio/warp";

pkgs/by-name/nw/nwg-panel/package.nix

@@ -23,13 +23,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.58";
+  version = "0.9.59";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-zYxZk3j8ODrK52aLSI+qA9tmJbH/eFfKYXMyd0V1LzM=";
+    hash = "sha256-ey0Fb9ilm7I2QWG1gQpnHTlMPoQswNlkrZ/WhUaLbDk=";
   };
 
   # No tests

pkgs/by-name/sm/smap/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+}:
+
+buildGoModule rec {
+  pname = "smap";
+  version = "0.1.12";
+
+  src = fetchFromGitHub {
+    owner = "s0md3v";
+    repo = "Smap";
+    tag = version;
+    hash = "sha256-GLw0zgjWnEwtwRV4vTHqGUS6TqcFhhZ1zeThKe6S0CY=";
+  };
+
+  vendorHash = "sha256-19plbD+ibjoqAA6gGhCvpO52z/VejJkRRh8ljBHN+qY=";
+
+  subPackages = [ "cmd/smap" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Drop-in replacement for Nmap powered by shodan.io";
+    homepage = "https://github.com/s0md3v/Smap";
+    changelog = "https://github.com/s0md3v/Smap/releases/tag/${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yechielw ];
+    mainProgram = "smap";
+  };
+}

pkgs/by-name/te/television/package.nix

@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "television";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
-    rev = "refs/tags/" + version;
-    hash = "sha256-LzO6LpKsox5U2IHYZXDDkUbPeZmAa/gBpG6nk78tIzQ=";
+    tag = version;
+    hash = "sha256-p6RuLuhtgVOa8+l0JU5byQ4SHG/TmURPlZUMNVqvfp8=";
   };
 
-  cargoHash = "sha256-I0muMgPfk72dnR4iufipjt+C7v6X/IMOdLCH12qHjA8=";
+  cargoHash = "sha256-0tXsoKSQ0c3po75oMd6LTG+HSkKr5UvI0lBg6FySwfs=";
 
   passthru = {
     tests.version = testers.testVersion {

pkgs/by-name/uc/ucspi-tcp/package.nix

@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
+  quilt,
 }:
 
 stdenv.mkDerivation rec {
@@ -13,21 +15,22 @@ stdenv.mkDerivation rec {
     sha256 = "171yl9kfm8w7l17dfxild99mbf877a9k5zg8yysgb1j8nz51a1ja";
   };
 
-  # Plain upstream tarball doesn't build, get patches from Debian
   patches = [
-    (fetchurl {
-      url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-3.diff.gz";
-      sha256 = "0mzmhz8hjkrs0khmkzs5i0s1kgmgaqz07h493bd5jj5fm5njxln6";
-    })
     ./remove-setuid.patch
   ];
 
-  # Apply Debian patches
+  debian = fetchzip {
+    url = "http://ftp.de.debian.org/debian/pool/main/u/ucspi-tcp/ucspi-tcp_0.88-11.debian.tar.xz";
+    sha256 = "0x8h46wkm62dvyj1acsffcl4s06k5zh6139qxib3zzhk716hv5xg";
+  };
+
+  nativeBuildInputs = [
+    quilt
+  ];
+
+  # Plain upstream tarball doesn't build, apply patches from Debian
   postPatch = ''
-    for fname in debian/diff/*.diff; do
-        echo "Applying patch $fname"
-        patch < "$fname"
-    done
+    QUILT_PATCHES=$debian/patches quilt push -a
   '';
 
   # The build system is weird; 'make install' doesn't install anything, instead
@@ -40,7 +43,7 @@ stdenv.mkDerivation rec {
   preBuild = ''
     echo "$out" > conf-home
 
-    echo "main() { return 0; }" > chkshsgr.c
+    echo "int main() { return 0; }" > chkshsgr.c
   '';
 
   installPhase = ''
@@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
     ./install
 
     # Install Debian man pages (upstream has none)
-    cp debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
+    cp $debian/ucspi-tcp-man/*.1 "$out/share/man/man1"
   '';
 
   meta = with lib; {

pkgs/by-name/ws/wsjtz/package.nix

@@ -0,0 +1,31 @@
+{
+  wsjtx,
+  fetchzip,
+  lib,
+}:
+
+wsjtx.overrideAttrs (old: rec {
+  pname = "wsjtz";
+  version = "2.7.0-rc7-1.43";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/wsjt-z/Source/wsjtz-${version}.zip";
+    hash = "sha256-m+P83S5P9v3NPtifc+XjZm/mAOs+NT9fTWXisxuWtZo=";
+  };
+
+  postFixup = ''
+    mv $out/bin/wsjtx $out/bin/wsjtz
+    mv $out/bin/wsjtx_app_version $out/bin/wsjtz_app_version
+  '';
+
+  meta = {
+    description = "WSJT-X fork, primarily focused on automation and enhanced functionality";
+    homepage = "https://sourceforge.net/projects/wsjt-z/";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      scd31
+    ];
+    mainProgram = "wsjtz";
+  };
+})

pkgs/by-name/zi/zizmor/package.nix

@@ -3,25 +3,22 @@
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
-  openssl,
   testers,
   zizmor,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zizmor";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = "zizmor";
     tag = "v${version}";
-    hash = "sha256-95YtFlnC8xFBz1v+qC3rh7jEUp+4JBoMGgVQd/6IFwE=";
+    hash = "sha256-1NpwBjJlpaP3iyTfrgMwO/1qR74/MNBYjtf4+wCe4m8=";
   };
 
-  cargoHash = "sha256-imq7ElZcC9E4nDkHaaFiBf8r1VuMtw5zOn9O7EzIPkQ=";
-
-  buildInputs = [ openssl ];
+  cargoHash = "sha256-feAfHkcLvEdFblehPGtLO01Vl9QpOueuJrpEujlv4qY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/development/python-modules/face/default.nix

@@ -5,12 +5,13 @@
   boltons,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "face";
   version = "22.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -19,7 +20,9 @@ buildPythonPackage rec {
     hash = "sha256-1daS+QvI9Zh7Y25H42OEubvaSZqvCneqCwu+g0x2kj0=";
   };
 
-  propagatedBuildInputs = [ boltons ];
+  build-system = [ setuptools ];
+
+  dependencies = [ boltons ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/frelatage/default.nix

@@ -23,9 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-eHVqp6govBV9FvSQyaZuEEImHQRs/mbLaW86RCvtDbM=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  pythonRelaxDeps = [ "numpy" ];
 
-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
     numpy
     timeout-decorator
   ];

pkgs/development/python-modules/glom/default.nix

@@ -9,12 +9,14 @@
   pythonAtLeast,
   pythonOlder,
   pyyaml,
+  setuptools,
+  tomli,
 }:
 
 buildPythonPackage rec {
   pname = "glom";
   version = "24.11.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,42 +25,45 @@ buildPythonPackage rec {
     hash = "sha256-QyX5Z1mpEgRK97bGvQ26RK2MHrYDiqsFcylmHSAhuyc=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "face==20.1.1" "face"
-  '';
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     boltons
     attrs
     face
   ];
 
+  optional-dependencies = {
+    toml = lib.optionals (pythonOlder "3.11") [ tomli ];
+    yaml = [ pyyaml ];
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
-    pyyaml
-  ];
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck = ''
     # test_cli.py checks the output of running "glom"
     export PATH=$out/bin:$PATH
   '';
 
-  disabledTests =
-    [
-      # Test is outdated (was made for PyYAML 3.x)
-      "test_main_yaml_target"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.11") [
-      "test_regular_error_stack"
-      "test_long_target_repr"
-    ];
+  disabledTests = lib.optionals (pythonAtLeast "3.11") [
+    "test_regular_error_stack"
+    "test_long_target_repr"
+    "test_glom_error_stack"
+    "test_glom_error_double_stack"
+    "test_branching_stack"
+    "test_midway_branch"
+    "test_partially_failing_branch"
+    "test_coalesce_stack"
+    "test_nesting_stack"
+    "test_3_11_byte_code_caret"
+  ];
 
   pythonImportsCheck = [ "glom" ];
 
   meta = with lib; {
-    description = "Restructuring data, the Python way";
-    mainProgram = "glom";
+    description = "Module for restructuring data";
     longDescription = ''
       glom helps pull together objects from other objects in a
       declarative, dynamic, and downright simple way.
@@ -67,5 +72,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/mahmoud/glom/blob/v${version}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [ twey ];
+    mainProgram = "glom";
   };
 }

pkgs/development/python-modules/jellyfish/Cargo.lock

@@ -0,0 +1,337 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "csv"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
+
+[[package]]
+name = "itoa"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+
+[[package]]
+name = "jellyfish"
+version = "1.1.2"
+dependencies = [
+ "ahash",
+ "csv",
+ "num-traits",
+ "pyo3",
+ "smallvec",
+ "unicode-normalization",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.169"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "portable-atomic"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "serde"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "syn"
+version = "2.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tinyvec"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unindent"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]

pkgs/development/python-modules/jellyfish/default.nix

@@ -1,49 +1,56 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
-  fetchPypi,
-  isPy3k,
-  pytest,
-  unicodecsv,
+  cargo,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  rustc,
   rustPlatform,
-  libiconv,
+  unicodecsv,
 }:
 
 buildPythonPackage rec {
   pname = "jellyfish";
-  version = "1.0.4";
+  version = "1.1.2";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.11";
 
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-cqq7O+3VE83SBxIkL9URc7WZcsCxRregucbzLxZWKT8=";
+  src = fetchFromGitHub {
+    owner = "jamesturk";
+    repo = "jellyfish";
+    rev = version;
+    hash = "sha256-xInjoTXYgZuHyvyKm+N4PAwHozE5BOkxoYhRzZnPs3Q=";
   };
 
-  nativeBuildInputs = with rustPlatform; [
-    maturinBuildHook
-    cargoSetupHook
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}-rust-dependencies";
-    hash = "sha256-HtzgxTO6tbN/tohaiTm9B9jrFYGTt1Szo9qRzpcy8BA=";
-  };
-
   nativeCheckInputs = [
-    pytest
+    pytestCheckHook
     unicodecsv
   ];
 
+  pythonImportsCheck = [ "jellyfish" ];
+
   meta = {
-    homepage = "https://github.com/sunlightlabs/jellyfish";
-    description = "Approximate and phonetic matching of strings";
+    description = "A python library for doing approximate and phonetic matching of strings";
+    homepage = "https://github.com/jamesturk/jellyfish";
+    changelog = "https://github.com/jamesturk/jellyfish/releases/tag/v${version}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ koral ];
   };
 }

pkgs/development/python-modules/meilisearch/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.33.0";
+  version = "0.33.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     tag = "v${version}";
-    hash = "sha256-Eo1KBpSek1FnSp21vpsJEwISvUYEqOaodwrbarVcu7c=";
+    hash = "sha256-8x6Q0nGFz1pJ1jPfbepE7YL6z/HPkeyRYvwS9jJblRI=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyliblo/default.nix

@@ -23,6 +23,11 @@ buildPythonPackage rec {
       url = "https://git.alpinelinux.org/aports/plain/community/py3-pyliblo/py3.11.patch?id=a7e1eca5533657ddd7e37c43e67e8126e3447258";
       hash = "sha256-4yCWNQaE/9FHGTVuvNEimBNuViWZ9aSJMcpTOP0fnM0=";
     })
+    # Fix compile error due to  incompatible pointer type 'lo_blob_dataptr'
+    (fetchurl {
+      url = "https://github.com/dsacre/pyliblo/commit/ebbb255d6a73384ec2560047eab236660d4589db.patch?full_index=1";
+      hash = "sha256-ZBAmBxSUT2xgoDVqSjq8TxW2jz3xR/pdCf2O3wMKvls=";
+    })
   ];
 
   build-system = [ cython_0 ];

pkgs/development/python-modules/whispers/default.nix

@@ -16,6 +16,7 @@
   wrapt,
   semgrep,
   setuptools,
+  six,
 }:
 
 buildPythonPackage rec {
@@ -38,9 +39,12 @@ buildPythonPackage rec {
   '';
 
   pythonRelaxDeps = [
+    "jellyfish"
     "lxml"
     "pyyaml"
     "semgrep"
+    "six"
+    "wrapt"
   ];
 
   build-system = [ setuptools ];
@@ -54,8 +58,9 @@ buildPythonPackage rec {
     luhn
     lxml
     pyyaml
-    wrapt
     semgrep
+    six
+    wrapt
   ];
 
   nativeCheckInputs = [

pkgs/games/curseofwar/default.nix

@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast-paced action strategy game";
     homepage = "https://a-nikolaev.github.io/curseofwar/";
     license = licenses.gpl3;
+    mainProgram = if SDL != null then "curseofwar-sdl" else "curseofwar";
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
   };

pkgs/kde/third-party/krohnkite/default.nix

@@ -9,16 +9,16 @@
 }:
 buildNpmPackage rec {
   pname = "krohnkite";
-  version = "0.9.8.4";
+  version = "0.9.8.5";
 
   src = fetchFromGitHub {
     owner = "anametologin";
     repo = "krohnkite";
     tag = version;
-    hash = "sha256-VVHusFuQ/awfFV4izId7VPYCrS8riTavhpB2KpJ9084=";
+    hash = "sha256-DcNU0nx6KHztfMPFs5PZtZIeu4hDxNYIJa5E1fwMa0Q=";
   };
 
-  npmDepsHash = "sha256-k44SltKLR/Y8qWFCLW2jBWElk9JGn+0azQn0G1f0vuY=";
+  npmDepsHash = "sha256-Q/D6s0wOPSEziE1dBXgTakjhXCGvzhvLVS7zXcZlPCI=";
 
   dontWrapQtApps = true;
 

pkgs/kde/third-party/krohnkite/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "krohnkite",
-  "version": "0.9.8.4",
+  "version": "0.9.8.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "krohnkite",
-      "version": "0.9.8.4",
+      "version": "0.9.8.5",
       "license": "MIT",
       "devDependencies": {
         "mocha": "^10.4.0",

pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix

@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-V7GPxyRPeyHXJErW/q9o7a+kbhrE46nDjYiSKvEMKnw=";
+    hash = "sha256-DTIXhs5gPN96C/fWz3s7ZTOybp7Mx+/NbNGXIOGyMmk=";
   };
 
   dependencies = [