Merge master into staging-next

.github/workflows/eval.yml

@@ -38,7 +38,7 @@ jobs:
         # Add this to _all_ subsequent steps to skip them
         if: steps.merged.outputs.mergedSha
         with:
-          ref: ${{ env.mergedSha }}
+          ref: ${{ steps.merged.outputs.mergedSha }}
           path: nixpkgs
 
       - name: Install Nix
@@ -104,7 +104,7 @@ jobs:
   process:
     name: Process
     runs-on: ubuntu-latest
-    needs: outpaths
+    needs: [ outpaths, attrs ]
     steps:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

ci/OWNERS

@@ -14,7 +14,7 @@
 # Processing of this file is implemented in workflows/codeowners-v2.yml
 
 # CI
-/.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
 /.github/workflows/codeowners-v2.yml @infinisil

ci/eval/default.nix

@@ -5,7 +5,7 @@
   linkFarm,
   time,
   procps,
-  nix,
+  nixVersions,
   jq,
   sta,
 }:
@@ -29,6 +29,8 @@ let
       );
     };
 
+  nix = nixVersions.nix_2_24;
+
   supportedSystems = import ../supportedSystems.nix;
 
   attrpathsSuperset =

doc/languages-frameworks/vim.section.md

@@ -264,10 +264,15 @@ nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --github-token=mytoken
 Alternatively, set the number of processes to a lower count to avoid rate-limiting.
 
 ```sh
-
 nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --proc 1'
 ```
 
+If you want to update only certain plugins, you can specify them after the `update` command. Note that you must use the same plugin names as the `pkgs/applications/editors/vim/plugins/vim-plugin-names` file.
+
+```sh
+nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater update "nvim-treesitter" "LazyVim"'
+```
+
 ## How to maintain an out-of-tree overlay of vim plugins ? {#vim-out-of-tree-overlays}
 
 You can use the updater script to generate basic packages out of a custom vim

maintainers/scripts/pluginupdate-py/pluginupdate.py

@@ -32,7 +32,7 @@ from functools import wraps
 from multiprocessing.dummy import Pool
 from pathlib import Path
 from tempfile import NamedTemporaryFile
-from typing import Any, Callable, Dict, List, Optional, Tuple, Union
+from typing import Any, Callable
 from urllib.parse import urljoin, urlparse
 
 import git
@@ -94,7 +94,7 @@ def make_request(url: str, token=None) -> urllib.request.Request:
 
 
 # a dictionary of plugins and their new repositories
-Redirects = Dict["PluginDesc", "Repo"]
+Redirects = dict["PluginDesc", "Repo"]
 
 
 class Repo:
@@ -103,7 +103,7 @@ class Repo:
         """Url to the repo"""
         self._branch = branch
         # Redirect is the new Repo to use
-        self.redirect: Optional["Repo"] = None
+        self.redirect: "Repo | None" = None
         self.token = "dummy_token"
 
     @property
@@ -125,14 +125,14 @@ class Repo:
         return True
 
     @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
-    def latest_commit(self) -> Tuple[str, datetime]:
+    def latest_commit(self) -> tuple[str, datetime]:
         log.debug("Latest commit")
         loaded = self._prefetch(None)
         updated = datetime.strptime(loaded["date"], "%Y-%m-%dT%H:%M:%S%z")
 
         return loaded["rev"], updated
 
-    def _prefetch(self, ref: Optional[str]):
+    def _prefetch(self, ref: str | None):
         cmd = ["nix-prefetch-git", "--quiet", "--fetch-submodules", self.uri]
         if ref is not None:
             cmd.append(ref)
@@ -141,7 +141,7 @@ class Repo:
         loaded = json.loads(data)
         return loaded
 
-    def prefetch(self, ref: Optional[str]) -> str:
+    def prefetch(self, ref: str | None) -> str:
         log.info("Prefetching %s", self.uri)
         loaded = self._prefetch(ref)
         return loaded["sha256"]
@@ -186,7 +186,7 @@ class RepoGitHub(Repo):
         return True
 
     @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
-    def latest_commit(self) -> Tuple[str, datetime]:
+    def latest_commit(self) -> tuple[str, datetime]:
         commit_url = self.url(f"commits/{self.branch}.atom")
         log.debug("Sending request to %s", commit_url)
         commit_req = make_request(commit_url, self.token)
@@ -252,14 +252,14 @@ class RepoGitHub(Repo):
 class PluginDesc:
     repo: Repo
     branch: str
-    alias: Optional[str]
+    alias: str | None
 
     @property
     def name(self):
         return self.alias or self.repo.name
 
     @staticmethod
-    def load_from_csv(config: FetchConfig, row: Dict[str, str]) -> "PluginDesc":
+    def load_from_csv(config: FetchConfig, row: dict[str, str]) -> "PluginDesc":
         log.debug("Loading row %s", row)
         branch = row["branch"]
         repo = make_repo(row["repo"], branch.strip())
@@ -292,7 +292,7 @@ class Plugin:
     commit: str
     has_submodules: bool
     sha256: str
-    date: Optional[datetime] = None
+    date: datetime | None = None
 
     @property
     def normalized_name(self) -> str:
@@ -303,7 +303,7 @@ class Plugin:
         assert self.date is not None
         return self.date.strftime("%Y-%m-%d")
 
-    def as_json(self) -> Dict[str, str]:
+    def as_json(self) -> dict[str, str]:
         copy = self.__dict__.copy()
         del copy["date"]
         return copy
@@ -312,7 +312,7 @@ class Plugin:
 def load_plugins_from_csv(
     config: FetchConfig,
     input_file: Path,
-) -> List[PluginDesc]:
+) -> list[PluginDesc]:
     log.debug("Load plugins from csv %s", input_file)
     plugins = []
     with open(input_file, newline="") as csvfile:
@@ -359,10 +359,10 @@ class Editor:
         name: str,
         root: Path,
         get_plugins: str,
-        default_in: Optional[Path] = None,
-        default_out: Optional[Path] = None,
-        deprecated: Optional[Path] = None,
-        cache_file: Optional[str] = None,
+        default_in: Path | None = None,
+        default_out: Path | None = None,
+        deprecated: Path | None = None,
+        cache_file: str | None = None,
     ):
         log.debug("get_plugins:", get_plugins)
         self.name = name
@@ -388,6 +388,19 @@ class Editor:
                 fetch_config, args.input_file, editor.deprecated, append=append
             )
             plugin, _ = prefetch_plugin(pdesc)
+
+            if (  # lua updater doesn't support updating individual plugin
+                self.name != "lua"
+            ):
+                # update generated.nix
+                update = self.get_update(
+                    args.input_file,
+                    args.outfile,
+                    fetch_config,
+                    [plugin.normalized_name],
+                )
+                update()
+
             autocommit = not args.no_commit
             if autocommit:
                 commit(
@@ -404,16 +417,35 @@ class Editor:
         """CSV spec"""
         print("the update member function should be overridden in subclasses")
 
-    def get_current_plugins(self, nixpkgs: str) -> List[Plugin]:
+    def get_current_plugins(
+        self, config: FetchConfig, nixpkgs: str
+    ) -> list[tuple[PluginDesc, Plugin]]:
         """To fill the cache"""
         data = run_nix_expr(self.get_plugins, nixpkgs)
         plugins = []
         for name, attr in data.items():
-            p = Plugin(name, attr["rev"], attr["submodules"], attr["sha256"])
-            plugins.append(p)
+            checksum = attr["checksum"]
+
+            # https://github.com/NixOS/nixpkgs/blob/8a335419/pkgs/applications/editors/neovim/build-neovim-plugin.nix#L36
+            # https://github.com/NixOS/nixpkgs/pull/344478#discussion_r1786646055
+            version = re.search(r"\d\d\d\d-\d\d?-\d\d?", attr["version"])
+            if version is None:
+                raise ValueError(f"Cannot parse version: {attr['version']}")
+            date = datetime.strptime(version.group(), "%Y-%m-%d")
+
+            pdesc = PluginDesc.load_from_string(config, f'{attr["homePage"]} as {name}')
+            p = Plugin(
+                attr["pname"],
+                checksum["rev"],
+                checksum["submodules"],
+                checksum["sha256"],
+                date,
+            )
+
+            plugins.append((pdesc, p))
         return plugins
 
-    def load_plugin_spec(self, config: FetchConfig, plugin_file) -> List[PluginDesc]:
+    def load_plugin_spec(self, config: FetchConfig, plugin_file) -> list[PluginDesc]:
         """CSV spec"""
         return load_plugins_from_csv(config, plugin_file)
 
@@ -421,28 +453,115 @@ class Editor:
         """Returns nothing for now, writes directly to outfile"""
         raise NotImplementedError()
 
-    def get_update(self, input_file: str, outfile: str, config: FetchConfig):
-        cache: Cache = Cache(self.get_current_plugins(self.nixpkgs), self.cache_file)
+    def filter_plugins_to_update(
+        self, plugin: PluginDesc, to_update: list[str]
+    ) -> bool:
+        """Function for filtering out plugins, that user doesn't want to update.
+
+        It is mainly used for updating only specific plugins, not all of them.
+        By default it filters out plugins not present in `to_update`,
+        assuming `to_update` is a list of plugin names (the same as in the
+        result expression).
+
+        This function is never called if `to_update` is empty.
+        Feel free to override this function in derived classes.
+
+        Note:
+            Known bug: you have to use a deprecated name, instead of new one.
+            This is because we resolve deprecations later and can't get new
+            plugin URL before we request info about it.
+
+            Although, we could parse deprecated.json, but it's a whole bunch
+            of spaghetti code, which I don't want to write.
+
+        Arguments:
+            plugin: Plugin on which you decide whether to ignore or not.
+            to_update:
+                List of strings passed to via the `--update` command line parameter.
+                By default, we assume it is a list of URIs identical to what
+                is in the input file.
+
+        Returns:
+            True if we should update plugin and False if not.
+        """
+        return plugin.name.replace(".", "-") in to_update
+
+    def get_update(
+        self,
+        input_file: str,
+        output_file: str,
+        config: FetchConfig,
+        to_update: list[str] | None,
+    ):
+        if to_update is None:
+            to_update = []
+
+        current_plugins = self.get_current_plugins(config, self.nixpkgs)
+        current_plugin_specs = self.load_plugin_spec(config, input_file)
+
+        cache: Cache = Cache(
+            [plugin for _description, plugin in current_plugins], self.cache_file
+        )
         _prefetch = functools.partial(prefetch, cache=cache)
 
-        def update() -> dict:
-            plugins = self.load_plugin_spec(config, input_file)
+        plugins_to_update = (
+            current_plugin_specs
+            if len(to_update) == 0
+            else [
+                description
+                for description in current_plugin_specs
+                if self.filter_plugins_to_update(description, to_update)
+            ]
+        )
+
+        def update() -> Redirects:
+            if len(plugins_to_update) == 0:
+                log.error(
+                    "\n\n\n\nIt seems like you provided some arguments to `--update`:\n"
+                    + ", ".join(to_update)
+                    + "\nBut after filtering, the result list of plugins is empty\n"
+                    "\n"
+                    "Are you sure you provided the same URIs as in your input file?\n"
+                    "(" + str(input_file) + ")\n\n"
+                )
+                return {}
 
             try:
                 pool = Pool(processes=config.proc)
-                results = pool.map(_prefetch, plugins)
+                results = pool.map(_prefetch, plugins_to_update)
             finally:
                 cache.store()
 
+            print(f"{len(results)} of {len(current_plugins)} were checked")
+            # Do only partial update of out file
+            if len(results) != len(current_plugins):
+                results = self.merge_results(current_plugins, results)
             plugins, redirects = check_results(results)
 
             plugins = sorted(plugins, key=lambda v: v[1].normalized_name)
-            self.generate_nix(plugins, outfile)
+            self.generate_nix(plugins, output_file)
 
             return redirects
 
         return update
 
+    def merge_results(
+        self,
+        current: list[tuple[PluginDesc, Plugin]],
+        fetched: list[tuple[PluginDesc, Exception | Plugin, Repo | None]],
+    ) -> list[tuple[PluginDesc, Exception | Plugin, Repo | None]]:
+        # transforming this to dict, so lookup is O(1) instead of O(n) (n is len(current))
+        result: dict[str, tuple[PluginDesc, Exception | Plugin, Repo | None]] = {
+            # also adding redirect (third item in the result tuple)
+            pl.normalized_name: (pdesc, pl, None)
+            for pdesc, pl in current
+        }
+
+        for plugin_desc, plugin, redirect in fetched:
+            result[plugin.normalized_name] = (plugin_desc, plugin, redirect)
+
+        return list(result.values())
+
     @property
     def attr_path(self):
         return self.name + "Plugins"
@@ -544,6 +663,12 @@ class Editor:
             description="Update all or a subset of existing plugins",
             add_help=False,
         )
+        pupdate.add_argument(
+            "update_only",
+            default=None,
+            nargs="*",
+            help="Plugin URLs to update (must be the same as in the input file)",
+        )
         pupdate.set_defaults(func=self.update)
         return main
 
@@ -587,8 +712,8 @@ class CleanEnvironment(object):
 
 def prefetch_plugin(
     p: PluginDesc,
-    cache: "Optional[Cache]" = None,
-) -> Tuple[Plugin, Optional[Repo]]:
+    cache: "Cache | None" = None,
+) -> tuple[Plugin, Repo | None]:
     commit = None
     log.info(f"Fetching last commit for plugin {p.name} from {p.repo.uri}@{p.branch}")
     commit, date = p.repo.latest_commit()
@@ -621,10 +746,10 @@ def print_download_error(plugin: PluginDesc, ex: Exception):
 
 
 def check_results(
-    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Optional[Repo]]],
-) -> Tuple[List[Tuple[PluginDesc, Plugin]], Redirects]:
+    results: list[tuple[PluginDesc, Exception | Plugin, Repo | None]],
+) -> tuple[list[tuple[PluginDesc, Plugin]], Redirects]:
     """ """
-    failures: List[Tuple[PluginDesc, Exception]] = []
+    failures: list[tuple[PluginDesc, Exception]] = []
     plugins = []
     redirects: Redirects = {}
     for pdesc, result, redirect in results:
@@ -637,11 +762,10 @@ def check_results(
                 new_pdesc = PluginDesc(redirect, pdesc.branch, pdesc.alias)
             plugins.append((new_pdesc, result))
 
-    print(f"{len(results) - len(failures)} plugins were checked", end="")
     if len(failures) == 0:
         return plugins, redirects
     else:
-        log.error(f", {len(failures)} plugin(s) could not be downloaded:\n")
+        log.error(f"{len(failures)} plugin(s) could not be downloaded:\n")
 
         for plugin, exception in failures:
             print_download_error(plugin, exception)
@@ -661,7 +785,7 @@ def make_repo(uri: str, branch) -> Repo:
     return repo
 
 
-def get_cache_path(cache_file_name: str) -> Optional[Path]:
+def get_cache_path(cache_file_name: str) -> Path | None:
     xdg_cache = os.environ.get("XDG_CACHE_HOME", None)
     if xdg_cache is None:
         home = os.environ.get("HOME", None)
@@ -673,7 +797,7 @@ def get_cache_path(cache_file_name: str) -> Optional[Path]:
 
 
 class Cache:
-    def __init__(self, initial_plugins: List[Plugin], cache_file_name: str) -> None:
+    def __init__(self, initial_plugins: list[Plugin], cache_file_name: str) -> None:
         self.cache_file = get_cache_path(cache_file_name)
 
         downloads = {}
@@ -682,11 +806,11 @@ class Cache:
         downloads.update(self.load())
         self.downloads = downloads
 
-    def load(self) -> Dict[str, Plugin]:
+    def load(self) -> dict[str, Plugin]:
         if self.cache_file is None or not self.cache_file.exists():
             return {}
 
-        downloads: Dict[str, Plugin] = {}
+        downloads: dict[str, Plugin] = {}
         with open(self.cache_file) as f:
             data = json.load(f)
             for attr in data.values():
@@ -707,7 +831,7 @@ class Cache:
                 data[name] = attr.as_json()
             json.dump(data, f, indent=4, sort_keys=True)
 
-    def __getitem__(self, key: str) -> Optional[Plugin]:
+    def __getitem__(self, key: str) -> Plugin | None:
         return self.downloads.get(key, None)
 
     def __setitem__(self, key: str, value: Plugin) -> None:
@@ -716,7 +840,7 @@ class Cache:
 
 def prefetch(
     pluginDesc: PluginDesc, cache: Cache
-) -> Tuple[PluginDesc, Union[Exception, Plugin], Optional[Repo]]:
+) -> tuple[PluginDesc, Exception | Plugin, Repo | None]:
     try:
         plugin, redirect = prefetch_plugin(pluginDesc, cache)
         cache[plugin.commit] = plugin
@@ -731,7 +855,7 @@ def rewrite_input(
     deprecated: Path,
     # old pluginDesc and the new
     redirects: Redirects = {},
-    append: List[PluginDesc] = [],
+    append: list[PluginDesc] = [],
 ):
     log.info("Rewriting input file %s", input_file)
     plugins = load_plugins_from_csv(config, input_file)
@@ -779,7 +903,7 @@ def rewrite_input(
             writer.writerow(asdict(plugin))
 
 
-def commit(repo: git.Repo, message: str, files: List[Path]) -> None:
+def commit(repo: git.Repo, message: str, files: list[Path]) -> None:
     repo.index.add([str(f.resolve()) for f in files])
 
     if repo.index.diff("HEAD"):
@@ -802,7 +926,14 @@ def update_plugins(editor: Editor, args):
         )
 
     fetch_config = FetchConfig(args.proc, args.github_token)
-    update = editor.get_update(args.input_file, args.outfile, fetch_config)
+    update = editor.get_update(
+        input_file=args.input_file,
+        output_file=args.outfile,
+        config=fetch_config,
+        to_update=getattr(  # if script was called without arguments
+            args, "update_only", None
+        ),
+    )
 
     start_time = time.time()
     redirects = update()

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -33,6 +33,11 @@
   [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0)
   for more information.
 
+- the notmuch vim plugin now lives in a separate output of the `notmuch`
+  package. Installing `notmuch` will not bring the notmuch vim package anymore,
+  add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
+  vim plugin.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-25.05-notable-changes}

nixos/modules/module-list.nix

@@ -1316,6 +1316,7 @@
   ./services/security/aesmd.nix
   ./services/security/authelia.nix
   ./services/security/bitwarden-directory-connector-cli.nix
+  ./services/security/canaille.nix
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix
   ./services/security/clamav.nix

nixos/modules/programs/nncp.nix

@@ -79,7 +79,7 @@ in {
         for f in ${jsonCfgFile} ${builtins.toString config.programs.nncp.secrets}
         do
           ${lib.getExe pkgs.hjson-go} -c <"$f"
-        done |${lib.getExe pkgs.jq} --slurp add >${nncpCfgFile}
+        done |${lib.getExe pkgs.jq} --slurp 'reduce .[] as $x ({}; . * $x)' >${nncpCfgFile}
         chgrp ${programCfg.group} ${nncpCfgFile}
       '';
     };

nixos/modules/services/security/canaille.nix

@@ -0,0 +1,390 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.canaille;
+
+  inherit (lib)
+    mkOption
+    mkIf
+    mkEnableOption
+    mkPackageOption
+    types
+    getExe
+    optional
+    converge
+    filterAttrsRecursive
+    ;
+
+  dataDir = "/var/lib/canaille";
+  secretsDir = "${dataDir}/secrets";
+
+  settingsFormat = pkgs.formats.toml { };
+
+  # Remove null values, so we can document optional/forbidden values that don't end up in the generated TOML file.
+  filterConfig = converge (filterAttrsRecursive (_: v: v != null));
+
+  finalPackage = cfg.package.overridePythonAttrs (old: {
+    dependencies =
+      old.dependencies
+      ++ old.optional-dependencies.front
+      ++ old.optional-dependencies.oidc
+      ++ old.optional-dependencies.ldap
+      ++ old.optional-dependencies.sentry
+      ++ old.optional-dependencies.postgresql;
+    makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
+      "--set CONFIG /etc/canaille/config.toml"
+      "--set SECRETS_DIR \"${secretsDir}\""
+    ];
+  });
+  inherit (finalPackage) python;
+  pythonEnv = python.buildEnv.override {
+    extraLibs = with python.pkgs; [
+      (toPythonModule finalPackage)
+      celery
+    ];
+  };
+
+  commonServiceConfig = {
+    WorkingDirectory = dataDir;
+    User = "canaille";
+    Group = "canaille";
+    StateDirectory = "canaille";
+    StateDirectoryMode = "0750";
+    PrivateTmp = true;
+  };
+
+  postgresqlHost = "postgresql://localhost/canaille?host=/run/postgresql";
+  createLocalPostgresqlDb = cfg.settings.CANAILLE_SQL.DATABASE_URI == postgresqlHost;
+in
+{
+
+  options.services.canaille = {
+    enable = mkEnableOption "Canaille";
+    package = mkPackageOption pkgs "canaille" { };
+    secretKeyFile = mkOption {
+      description = ''
+        File containing the Flask secret key. Its content is going to be
+        provided to Canaille as `SECRET_KEY`. Make sure it has appropriate
+        permissions. For example, copy the output of this to the specified
+        file:
+
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+      '';
+      type = types.path;
+    };
+    smtpPasswordFile = mkOption {
+      description = ''
+        File containing the SMTP password. Make sure it has appropriate permissions.
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    jwtPrivateKeyFile = mkOption {
+      description = ''
+        File containing the JWT private key. Make sure it has appropriate permissions.
+
+        You can generate one using
+        ```
+        openssl genrsa -out private.pem 4096
+        openssl rsa -in private.pem -pubout -outform PEM -out public.pem
+        ```
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    ldapBindPasswordFile = mkOption {
+      description = ''
+        File containing the LDAP bind password.
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    settings = mkOption {
+      default = { };
+      description = "Settings for Canaille. See [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html) for details.";
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          SECRET_KEY = mkOption {
+            readOnly = true;
+            description = ''
+              Flask Secret Key. Can't be set and must be provided through
+              `services.canaille.settings.secretKeyFile`.
+            '';
+            default = null;
+            type = types.nullOr types.str;
+          };
+          SERVER_NAME = mkOption {
+            description = "The domain name on which canaille will be served.";
+            example = "auth.example.org";
+            type = types.str;
+          };
+          PREFERRED_URL_SCHEME = mkOption {
+            description = "The url scheme by which canaille will be served.";
+            default = "https";
+            type = types.enum [
+              "http"
+              "https"
+            ];
+          };
+
+          CANAILLE = {
+            ACL = mkOption {
+              default = null;
+              description = ''
+                Access Control Lists.
+
+                See also [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.core.configuration.ACLSettings).
+              '';
+              type = types.nullOr (
+                types.submodule {
+                  freeformType = settingsFormat.type;
+                  options = { };
+                }
+              );
+            };
+            SMTP = mkOption {
+              default = null;
+              example = { };
+              description = ''
+                SMTP configuration. By default, sending emails is not enabled.
+
+                Set to an empty attrs to send emails from localhost without
+                authentication.
+
+                See also [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.core.configuration.SMTPSettings).
+              '';
+              type = types.nullOr (
+                types.submodule {
+                  freeformType = settingsFormat.type;
+                  options = {
+                    PASSWORD = mkOption {
+                      readOnly = true;
+                      description = ''
+                        SMTP Password. Can't be set and has to be provided using
+                        `services.canaille.smtpPasswordFile`.
+                      '';
+                      default = null;
+                      type = types.nullOr types.str;
+                    };
+                  };
+                }
+              );
+            };
+
+          };
+          CANAILLE_OIDC = mkOption {
+            default = null;
+            description = ''
+              OpenID Connect settings. See [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.oidc.configuration.OIDCSettings).
+            '';
+            type = types.nullOr (
+              types.submodule {
+                freeformType = settingsFormat.type;
+                options = {
+                  JWT.PRIVATE_KEY = mkOption {
+                    readOnly = true;
+                    description = ''
+                      JWT private key. Can't be set and has to be provided using
+                      `services.canaille.jwtPrivateKeyFile`.
+                    '';
+                    default = null;
+                    type = types.nullOr types.str;
+                  };
+                };
+              }
+            );
+          };
+          CANAILLE_LDAP = mkOption {
+            default = null;
+            description = ''
+              Configuration for the LDAP backend. This storage backend is not
+              yet supported by the module, so use at your own risk!
+            '';
+            type = types.nullOr (
+              types.submodule {
+                freeformType = settingsFormat.type;
+                options = {
+                  BIND_PW = mkOption {
+                    readOnly = true;
+                    description = ''
+                      The LDAP bind password. Can't be set and has to be provided using
+                      `services.canaille.ldapBindPasswordFile`.
+                    '';
+                    default = null;
+                    type = types.nullOr types.str;
+                  };
+                };
+              }
+            );
+          };
+          CANAILLE_SQL = {
+            DATABASE_URI = mkOption {
+              description = ''
+                The SQL server URI. Will configure a local PostgreSQL db if
+                left to default. Please note that the NixOS module only really
+                supports PostgreSQL for now. Change at your own risk!
+              '';
+              default = postgresqlHost;
+              type = types.str;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # We can use some kind of fix point for the config anyways, and
+    # /etc/canaille is recommended by upstream. The alternative would be to use
+    # a double wrapped canaille executable, to avoid having to rebuild Canaille
+    # on every config change.
+    environment.etc."canaille/config.toml" = {
+      source = settingsFormat.generate "config.toml" (filterConfig cfg.settings);
+      user = "canaille";
+      group = "canaille";
+    };
+
+    # Secrets management is unfortunately done in a semi stateful way, due to these constraints:
+    # - Canaille uses Pydantic, which currently only accepts an env file or a single
+    #   directory (SECRETS_DIR) for loading settings from files.
+    # - The canaille user needs access to secrets, as it needs to run the CLI
+    #   for e.g. user creation. Therefore specifying the SECRETS_DIR as systemd's
+    #   CREDENTIALS_DIRECTORY is not an option.
+    #
+    # See this for how Pydantic maps file names/env vars to config settings:
+    # https://docs.pydantic.dev/latest/concepts/pydantic_settings/#parsing-environment-variable-values
+    systemd.tmpfiles.rules =
+      [
+        "Z  ${secretsDir} 700 canaille canaille - -"
+        "L+ ${secretsDir}/SECRET_KEY - - - - ${cfg.secretKeyFile}"
+      ]
+      ++ optional (
+        cfg.smtpPasswordFile != null
+      ) "L+ ${secretsDir}/CANAILLE_SMTP__PASSWORD - - - - ${cfg.smtpPasswordFile}"
+      ++ optional (
+        cfg.jwtPrivateKeyFile != null
+      ) "L+ ${secretsDir}/CANAILLE_OIDC__JWT__PRIVATE_KEY - - - - ${cfg.jwtPrivateKeyFile}"
+      ++ optional (
+        cfg.ldapBindPasswordFile != null
+      ) "L+ ${secretsDir}/CANAILLE_LDAP__BIND_PW - - - - ${cfg.ldapBindPasswordFile}";
+
+    # This is not a migration, just an initial setup of schemas
+    systemd.services.canaille-install = {
+      # We want this on boot, not on socket activation
+      wantedBy = [ "multi-user.target" ];
+      after = optional createLocalPostgresqlDb "postgresql.service";
+      serviceConfig = commonServiceConfig // {
+        Type = "oneshot";
+        ExecStart = "${getExe finalPackage} install";
+      };
+    };
+
+    systemd.services.canaille = {
+      description = "Canaille";
+      documentation = [ "https://canaille.readthedocs.io/en/latest/tutorial/deployment.html" ];
+      after = [
+        "network.target"
+        "canaille-install.service"
+      ] ++ optional createLocalPostgresqlDb "postgresql.service";
+      requires = [
+        "canaille-install.service"
+        "canaille.socket"
+      ];
+      environment = {
+        PYTHONPATH = "${pythonEnv}/${python.sitePackages}/";
+        CONFIG = "/etc/canaille/config.toml";
+        SECRETS_DIR = secretsDir;
+      };
+      serviceConfig = commonServiceConfig // {
+        Restart = "on-failure";
+        ExecStart =
+          let
+            gunicorn = python.pkgs.gunicorn.overridePythonAttrs (old: {
+              # Allows Gunicorn to set a meaningful process name
+              dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
+            });
+          in
+          ''
+            ${getExe gunicorn} \
+              --name=canaille \
+              --bind='unix:///run/canaille.socket' \
+              'canaille:create_app()'
+          '';
+      };
+      restartTriggers = [ "/etc/canaille/config.toml" ];
+    };
+
+    systemd.sockets.canaille = {
+      before = [ "nginx.service" ];
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "/run/canaille.socket";
+        SocketUser = "canaille";
+        SocketGroup = "canaille";
+        SocketMode = "770";
+      };
+    };
+
+    services.nginx.enable = true;
+    services.nginx.recommendedGzipSettings = true;
+    services.nginx.recommendedProxySettings = true;
+    services.nginx.virtualHosts."${cfg.settings.SERVER_NAME}" = {
+      forceSSL = true;
+      enableACME = true;
+      # Config from https://canaille.readthedocs.io/en/latest/tutorial/deployment.html#nginx
+      extraConfig = ''
+        charset utf-8;
+        client_max_body_size 10M;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+        add_header X-Frame-Options                      "SAMEORIGIN"    always;
+        add_header X-XSS-Protection                     "1; mode=block" always;
+        add_header X-Content-Type-Options               "nosniff"       always;
+        add_header Referrer-Policy                      "same-origin"   always;
+      '';
+      locations = {
+        "/".proxyPass = "http://unix:///run/canaille.socket";
+        "/static" = {
+          root = "${finalPackage}/${python.sitePackages}/canaille";
+        };
+        "~* ^/static/.+\\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$" = {
+          root = "${finalPackage}/${python.sitePackages}/canaille";
+          extraConfig = ''
+            access_log off;
+            expires 30d;
+            more_set_headers Cache-Control public;
+          '';
+        };
+      };
+    };
+
+    services.postgresql = mkIf createLocalPostgresqlDb {
+      enable = true;
+      ensureUsers = [
+        {
+          name = "canaille";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [ "canaille" ];
+    };
+
+    users.users.canaille = {
+      isSystemUser = true;
+      group = "canaille";
+      packages = [ finalPackage ];
+    };
+
+    users.groups.canaille.members = [ config.services.nginx.user ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+}

nixos/tests/all-tests.nix

@@ -184,6 +184,7 @@ in {
   cagebreak = handleTest ./cagebreak.nix {};
   calibre-web = handleTest ./calibre-web.nix {};
   calibre-server = handleTest ./calibre-server.nix {};
+  canaille = handleTest ./canaille.nix {};
   castopod = handleTest ./castopod.nix {};
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
   cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };

nixos/tests/canaille.nix

@@ -0,0 +1,62 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  let
+    certs = import ./common/acme/server/snakeoil-certs.nix;
+    inherit (certs) domain;
+  in
+  {
+    name = "canaille";
+    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+
+    nodes.server =
+      { pkgs, lib, ... }:
+      {
+        services.canaille = {
+          enable = true;
+          secretKeyFile = pkgs.writeText "canaille-secret-key" ''
+            this is not a secret key
+          '';
+          settings = {
+            SERVER_NAME = domain;
+          };
+        };
+
+        services.nginx.virtualHosts."${domain}" = {
+          enableACME = lib.mkForce false;
+          sslCertificate = certs."${domain}".cert;
+          sslCertificateKey = certs."${domain}".key;
+        };
+
+        networking.hosts."::1" = [ "${domain}" ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
+
+        users.users.canaille.shell = pkgs.bashInteractive;
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    nodes.client =
+      { nodes, ... }:
+      {
+        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${domain}" ];
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    testScript =
+      { ... }:
+      ''
+        import json
+
+        start_all()
+        server.wait_for_unit("canaille.socket")
+        server.wait_until_succeeds("curl -f https://${domain}")
+        server.succeed("sudo -iu canaille -- canaille create user --user-name admin --password adminpass --emails admin@${domain}")
+        json_str = server.succeed("sudo -iu canaille -- canaille get user")
+        assert json.loads(json_str)[0]["user_name"] == "admin"
+        server.succeed("sudo -iu canaille -- canaille check")
+      '';
+  }
+)

pkgs/applications/editors/kakoune/plugins/update.py

@@ -12,7 +12,6 @@ import inspect
 import os
 import sys
 from pathlib import Path
-from typing import List, Tuple
 
 # Import plugin update library from maintainers/scripts/pluginupdate.py
 ROOT = Path(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe()))))  # type: ignore
@@ -21,13 +20,11 @@ sys.path.insert(
 )
 import pluginupdate
 
-GET_PLUGINS = f"""(
-with import <localpkgs> {{ }};
+GET_PLUGINS = f"""with import <localpkgs> {{ }};
 let
   inherit (kakouneUtils.override {{ }}) buildKakounePluginFrom2Nix;
-  generated = callPackage {ROOT}/generated.nix {{
-    inherit buildKakounePluginFrom2Nix;
-  }};
+  generated = callPackage {ROOT}/generated.nix {{ inherit buildKakounePluginFrom2Nix; }};
+
   hasChecksum =
     value:
     lib.isAttrs value
@@ -35,20 +32,23 @@ let
       "src"
       "outputHash"
     ] value;
-  getChecksum =
-    name: value:
-    if hasChecksum value then
-      {{
-        submodules = value.src.fetchSubmodules or false;
-        sha256 = value.src.outputHash;
-        rev = value.src.rev;
-      }}
-    else
-      null;
-  checksums = lib.mapAttrs getChecksum generated;
+
+  parse = name: value: {{
+    pname = value.pname;
+    version = value.version;
+    homePage = value.meta.homepage;
+    checksum =
+      if hasChecksum value then
+        {{
+          submodules = value.src.fetchSubmodules or false;
+          sha256 = value.src.outputHash;
+          rev = value.src.rev;
+        }}
+      else
+        null;
+  }};
 in
-lib.filterAttrs (n: v: v != null) checksums
-)"""
+lib.mapAttrs parse generated"""
 
 HEADER = "# This file has been @generated by ./pkgs/applications/editors/kakoune/plugins/update.py. Do not edit!"
 
@@ -56,7 +56,7 @@ HEADER = "# This file has been @generated by ./pkgs/applications/editors/kakoune
 class KakouneEditor(pluginupdate.Editor):
     def generate_nix(
         self,
-        plugins: List[Tuple[pluginupdate.PluginDesc, pluginupdate.Plugin]],
+        plugins: list[tuple[pluginupdate.PluginDesc, pluginupdate.Plugin]],
         outfile: str,
     ):
         with open(outfile, "w+") as f:

pkgs/applications/editors/vim/plugins/generated.nix

@@ -6242,6 +6242,18 @@ final: prev:
     meta.homepage = "https://github.com/lspcontainers/lspcontainers.nvim/";
   };
 
+  lspecho-nvim = buildVimPlugin {
+    pname = "lspecho.nvim";
+    version = "2024-10-06";
+    src = fetchFromGitHub {
+      owner = "deathbeam";
+      repo = "lspecho.nvim";
+      rev = "6b00e2ed29a1f7b254a07d4b8a918ebf855026e5";
+      sha256 = "0z45b0mk7hd5h9d79318nyhhyhprwr929rpqfbblk5x0j4x2glxf";
+    };
+    meta.homepage = "https://github.com/deathbeam/lspecho.nvim/";
+  };
+
   lspkind-nvim = buildVimPlugin {
     pname = "lspkind.nvim";
     version = "2024-10-25";

pkgs/applications/editors/vim/plugins/get-plugins.nix

@@ -6,6 +6,7 @@ let
   generated = callPackage <localpkgs/pkgs/applications/editors/vim/plugins/generated.nix> {
     inherit buildNeovimPlugin buildVimPlugin;
   } { } { };
+
   hasChecksum =
     value:
     lib.isAttrs value
@@ -13,16 +14,20 @@ let
       "src"
       "outputHash"
     ] value;
-  getChecksum =
-    name: value:
-    if hasChecksum value then
-      {
-        submodules = value.src.fetchSubmodules or false;
-        sha256 = value.src.outputHash;
-        rev = value.src.rev;
-      }
-    else
-      null;
-  checksums = lib.mapAttrs getChecksum generated;
+
+  parse = name: value: {
+    pname = value.pname;
+    version = value.version;
+    homePage = value.meta.homepage;
+    checksum =
+      if hasChecksum value then
+        {
+          submodules = value.src.fetchSubmodules or false;
+          sha256 = value.src.outputHash;
+          rev = value.src.rev;
+        }
+      else
+        null;
+  };
 in
-lib.filterAttrs (n: v: v != null) checksums
+lib.mapAttrs parse generated

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -38,6 +38,7 @@
   languagetool,
   llvmPackages,
   meson,
+  notmuch,
   neovim-unwrapped,
   nim1,
   nodePackages,
@@ -1407,6 +1408,11 @@ in
     nvimRequireCheck = "lsp-progress";
   };
 
+  lspecho-nvim = super.lspecho-nvim.overrideAttrs {
+    meta.license = lib.licenses.mit;
+    nvimRequireCheck = "lspecho";
+  };
+
   lualine-lsp-progress = super.lualine-lsp-progress.overrideAttrs {
     dependencies = with self; [ lualine-nvim ];
   };
@@ -1755,6 +1761,8 @@ in
     nvimRequireCheck = "null-ls";
   };
 
+  notmuch-vim = notmuch.vim;
+
   NotebookNavigator-nvim = super.NotebookNavigator-nvim.overrideAttrs {
     nvimRequireCheck = "notebook-navigator";
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -518,6 +518,7 @@ https://github.com/nvim-lua/lsp_extensions.nvim/,,
 https://git.sr.ht/~whynothugo/lsp_lines.nvim,,
 https://github.com/ray-x/lsp_signature.nvim/,,
 https://github.com/lspcontainers/lspcontainers.nvim/,,
+https://github.com/deathbeam/lspecho.nvim/,HEAD,
 https://github.com/onsails/lspkind.nvim/,,
 https://github.com/nvimdev/lspsaga.nvim/,,
 https://github.com/barreiroleo/ltex_extra.nvim/,HEAD,

pkgs/applications/misc/sweethome3d/default.nix

@@ -108,13 +108,13 @@ in {
 
   application = mkSweetHome3D rec {
     pname = lib.toLower module + "-application";
-    version = "7.3";
+    version = "7.5";
     module = "SweetHome3D";
     description = "Design and visualize your future home";
     license = lib.licenses.gpl2Plus;
     src = fetchzip {
       url = "mirror://sourceforge/sweethome3d/${module}-${version}-src.zip";
-      hash = "sha256-adMQzQE+xAZpMJyQFm01A+AfvcB5YHsJvk+533BUf1Q=";
+      hash = "sha256-+rAhq5sFXC34AMYCcdAYZzrUa3LDy4S5Zid4DlEVvTQ=";
     };
     desktopName = "Sweet Home 3D";
     icons = {

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.7.1";
+  version = "5.8.2";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-MPVm9WfAjF11sy0hyhDTI/mM2OsENSMavnVrOwXTGUk=";
+    hash = "sha256-zgvyxhQDF1JcGe/fpputvPrAFh1Z+EGaynSXHDk9k/8=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/applications/networking/mailreaders/notmuch/default.nix

@@ -11,6 +11,7 @@
 , withEmacs ? true
 , withRuby ? true
 , withSfsexp ? true # also installs notmuch-git, which requires sexp-support
+# TODO upstream: it takes too long ! 800 ms here
 , withVim ? true
 }:
 
@@ -76,7 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   outputs = [ "out" "man" "info" "bindingconfig" ]
-    ++ lib.optional withEmacs "emacs";
+    ++ lib.optional withEmacs "emacs"
+    ++ lib.optional withVim "vim";
 
   # if notmuch is built with s-expression support, the testsuite (T-850.sh) only
   # passes if notmuch-git can be executed, so we need to patch its shebang.
@@ -133,14 +135,14 @@ stdenv.mkDerivation (finalAttrs: {
     cp notmuch-git $out/bin/notmuch-git
     wrapProgram $out/bin/notmuch-git --prefix PATH : $out/bin:${lib.getBin git}/bin
   '' + lib.optionalString withVim ''
-    make -C vim DESTDIR="$out/share/vim-plugins/notmuch" prefix="" install
-    mkdir -p $out/share/nvim
-    ln -s $out/share/vim-plugins/notmuch $out/share/nvim/site
+    make -C vim DESTDIR="$vim/share/vim-plugins/notmuch" prefix="" install
+    mkdir -p $vim/share/nvim
+    ln -s $vim/share/vim-plugins/notmuch $vim/share/nvim/site
   '' + lib.optionalString (withVim && withRuby) ''
-    PLUG=$out/share/vim-plugins/notmuch/plugin/notmuch.vim
+    PLUG=$vim/share/vim-plugins/notmuch/plugin/notmuch.vim
     cat >> $PLUG << EOF
       let \$GEM_PATH=\$GEM_PATH . ":${finalAttrs.passthru.gemEnv}/${ruby.gemPath}"
-      let \$RUBYLIB=\$RUBYLIB . ":$out/${ruby.libPath}/${ruby.system}"
+      let \$RUBYLIB=\$RUBYLIB . ":$vim/${ruby.libPath}/${ruby.system}"
       if has('nvim')
     EOF
     for gem in ${finalAttrs.passthru.gemEnv}/${ruby.gemPath}/gems/*/lib; do

pkgs/by-name/am/amazon-ssm-agent/package.nix

@@ -136,6 +136,7 @@ buildGoModule rec {
   checkFlags = [
     # Skip time dependent/flaky test
     "-skip=TestSendStreamDataMessageWithStreamDataSequenceNumberMutexLocked"
+    "-skip=TestParallelAccessOfQueue"
   ];
 
   postFixup = ''

pkgs/by-name/ba/backblaze-b2/package.nix

@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "4.0.1";
+  version = "4.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "B2_Command_Line_Tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rZUWPSI7CrKOdEKdsSpekwBerbIMf2iiVrWkV8WrqSc=";
+    hash = "sha256-a0XJq8M1yw4GmD5ndIAJtmHFKqS0rYdvYIxK7t7oyZw=";
   };
 
   nativeBuildInputs = with python3Packages; [

pkgs/by-name/ca/canaille/package.nix

@@ -0,0 +1,118 @@
+{
+  lib,
+  python3,
+  fetchFromGitLab,
+  openldap,
+  nixosTests,
+}:
+
+let
+  python = python3;
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "canaille";
+  version = "0.0.56";
+  pyproject = true;
+
+  disabled = python.pythonOlder "3.10";
+
+  src = fetchFromGitLab {
+    owner = "yaal";
+    repo = "canaille";
+    rev = "refs/tags/${version}";
+    hash = "sha256-cLsLwttUDxMKVqtVDCY5A22m1YY1UezeZQh1j74WzgU=";
+  };
+
+  build-system = with python.pkgs; [
+    hatchling
+    babel
+    setuptools
+  ];
+
+  dependencies =
+    with python.pkgs;
+    [
+      flask
+      flask-wtf
+      pydantic-settings
+      wtforms
+    ]
+    ++ sentry-sdk.optional-dependencies.flask;
+
+  nativeCheckInputs =
+    with python.pkgs;
+    [
+      pytestCheckHook
+      coverage
+      flask-webtest
+      pyquery
+      pytest-cov
+      pytest-httpserver
+      pytest-lazy-fixtures
+      pytest-smtpd
+      pytest-xdist
+      slapd
+      toml
+      faker
+      time-machine
+    ]
+    ++ optional-dependencies.front
+    ++ optional-dependencies.oidc
+    ++ optional-dependencies.ldap
+    ++ optional-dependencies.postgresql;
+
+  postInstall = ''
+    mkdir -p $out/etc/schema
+    cp $out/${python.sitePackages}/canaille/backends/ldap/schemas/* $out/etc/schema/
+  '';
+
+  preCheck = ''
+    # Needed by tests to setup a mockup ldap server.
+    export BIN="${openldap}/bin"
+    export SBIN="${openldap}/bin"
+    export SLAPD="${openldap}/libexec/slapd"
+    export SCHEMA="${openldap}/etc/schema"
+
+    # Just use their example config for testing
+    export CONFIG=canaille/config.sample.toml
+  '';
+
+  optional-dependencies = with python.pkgs; {
+    front = [
+      email-validator
+      flask-babel
+      flask-themer
+      pycountry
+      pytz
+      toml
+      zxcvbn-rs-py
+    ];
+    oidc = [ authlib ];
+    ldap = [ python-ldap ];
+    sentry = [ sentry-sdk ];
+    postgresql = [
+      passlib
+      sqlalchemy
+      sqlalchemy-json
+      sqlalchemy-utils
+    ] ++ sqlalchemy.optional-dependencies.postgresql;
+  };
+
+  passthru = {
+    inherit python;
+    tests = {
+      inherit (nixosTests) canaille;
+    };
+  };
+
+  meta = with lib; {
+    description = "Lightweight Identity and Authorization Management";
+    homepage = "https://canaille.readthedocs.io/en/latest/index.html";
+    changelog = "https://gitlab.com/yaal/canaille/-/blob/${src.rev}/CHANGES.rst";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ erictapen ];
+    mainProgram = "canaille";
+  };
+
+}

pkgs/by-name/dn/dnslink-std-go/package.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "dnslink";
+  version = "0.6.0";
+  src = fetchFromGitHub {
+    owner = "dnslink-std";
+    repo = "go";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-aATnNDUogNS4jBoWxUAFYFMa2ZS0+th3XH+1KWqwfWQ=";
+  };
+  vendorHash = "sha256-RH55yfIO9jHLbjtEdUF5QpL5ILV5ctX2hBYBJWutmUA=";
+  doCheck = false; # Uses network, unsuprisingly.
+  meta = {
+    changelog = "https://github.com/dnslink-std/go/releases/tag/v${version}";
+    description = "Reference implementation for DNSLink in golang";
+    homepage = "https://dnslink.org/";
+    license = lib.licenses.mit;
+    mainProgram = "dnslink";
+    maintainers = with lib.maintainers; [ ehmry ];
+  };
+}

pkgs/by-name/fa/faircamp/package.nix

@@ -2,7 +2,6 @@
 , stdenv
 , rustPlatform
 , fetchFromGitea
-, fetchpatch
 , makeWrapper
 , pkg-config
 , glib
@@ -17,24 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faircamp";
-  version = "0.15.1";
+  version = "0.21.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "simonrepp";
     repo = "faircamp";
     rev = version;
-    hash = "sha256-TMN4DLur61bJAPp2kahBAAjf2lto62X/7rhC88nhISg=";
+    hash = "sha256-1awOzIvWUaqsmtg0XP4BNCRZP+d26JTjn+3Lcvo/WcI=";
   };
 
-  patches = [
-    # Fix build error in tests
-    (fetchpatch {
-      url = "https://codeberg.org/simonrepp/faircamp/commit/7240dd707f3669d49e755088393d27369ca368c2.patch";
-      hash = "sha256-Ec75Gte2zUp/q912keLdYXUse60QirTQ+DkSaCwEboQ=";
-    })
-  ];
-
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {

pkgs/by-name/im/immich-machine-learning/package.nix

@@ -17,10 +17,6 @@ python.pkgs.buildPythonApplication rec {
   src = "${immich.src}/machine-learning";
   pyproject = true;
 
-  postPatch = ''
-    substituteInPlace pyproject.toml --replace-fail 'fastapi-slim' 'fastapi'
-  '';
-
   pythonRelaxDeps = [
     "pillow"
     "pydantic-settings"

pkgs/by-name/im/immich/package.nix

@@ -152,7 +152,7 @@ buildNpmPackage' {
     # pg_dumpall fails without database root access
     # see https://github.com/immich-app/immich/issues/13971
     substituteInPlace src/services/backup.service.ts \
-      --replace-fail '`pg_dumpall`' '`pg_dump`'
+      --replace-fail '`/usr/lib/postgresql/''${databaseMajorVersion}/bin/pg_dumpall`' '`pg_dump`'
   '';
 
   nativeBuildInputs = [

pkgs/by-name/im/immich/sources.json

@@ -1,22 +1,22 @@
 {
-  "version": "1.120.1",
-  "hash": "sha256-FKPs6BHOXmqnHh2yH+PPBFQoK5ykP716dNvES/45t4g=",
+  "version": "1.121.0",
+  "hash": "sha256-3Rk/0LtbRIrtnPBhG6TzYFcPlZqlkZoyO01jIL4gzC8=",
   "components": {
     "cli": {
-      "npmDepsHash": "sha256-5JmcDjLAVXhF3TH0M88dKLYPDsSctcOGPz9nV1n3k9c=",
-      "version": "2.2.30"
+      "npmDepsHash": "sha256-LsStgf6iJMpqCYZoZoP7cNnHbuzawTQ02wvJ5q/2RyU=",
+      "version": "2.2.32"
     },
     "server": {
-      "npmDepsHash": "sha256-u2ZQv+z8uyn7z52V+7hNRWgnHVm4xMdhjspPqsLHYek=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-9xyl+8YItzHSHcgUi1X9MwNtmZpdDGtg4DUa2YZv08I=",
+      "version": "1.121.0"
     },
     "web": {
-      "npmDepsHash": "sha256-EAFUOhcmE1TfUBN0uxzuNkHibdaDRn8Lxvma70UJqDE=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-vHmiNWVLl4len6SnJ/NmiRVLLc4uUUWF/25LiOMnvf0=",
+      "version": "1.121.0"
     },
     "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-AJcK5NE+ZNAK2FJblY32jtYxY0Z9npH92A3htcPes4A=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-jiwUoWrMH/mDO+GPi13Q+Z87NAtDx95h6igI0NuPhnc=",
+      "version": "1.121.0"
     }
   }
 }

pkgs/by-name/ko/koboldcpp/package.nix

@@ -5,11 +5,10 @@
   makeWrapper,
   gitUpdater,
   python3Packages,
-  python311Packages ? null, # Ignored. Kept for compatibility with the release
   tk,
   addDriverRunpath,
 
-  darwin,
+  apple-sdk_12,
 
   koboldLiteSupport ? true,
 
@@ -30,10 +29,8 @@
 
   vulkanSupport ? true,
   vulkan-loader,
-
-  metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64,
-  march ? "",
-  mtune ? "",
+  metalSupport ? stdenv.hostPlatform.isDarwin,
+  nix-update-script,
 }:
 
 let
@@ -43,12 +40,6 @@ let
     --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ addDriverRunpath.driverLink ]}"
   '';
 
-  darwinFrameworks =
-    if (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) then
-      darwin.apple_sdk.frameworks
-    else
-      darwin.apple_sdk_11_0.frameworks;
-
   effectiveStdenv = if cublasSupport then cudaPackages.backendStdenv else stdenv;
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
@@ -74,17 +65,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ tk ]
     ++ finalAttrs.pythonInputs
-    ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-      darwinFrameworks.Accelerate
-      darwinFrameworks.CoreVideo
-      darwinFrameworks.CoreGraphics
-      darwinFrameworks.CoreServices
-    ]
-    ++ lib.optionals metalSupport [
-      darwinFrameworks.MetalKit
-      darwinFrameworks.Foundation
-      darwinFrameworks.MetalPerformanceShaders
-    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
     ++ lib.optionals openblasSupport [ openblas ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
@@ -100,29 +81,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
   pythonPath = finalAttrs.pythonInputs;
 
-  darwinLdFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-F${darwinFrameworks.CoreServices}/Library/Frameworks"
-    "-F${darwinFrameworks.Accelerate}/Library/Frameworks"
-    "-framework CoreServices"
-    "-framework Accelerate"
-  ];
-  metalLdFlags = lib.optionals metalSupport [
-    "-F${darwinFrameworks.Foundation}/Library/Frameworks"
-    "-F${darwinFrameworks.Metal}/Library/Frameworks"
-    "-framework Foundation"
-    "-framework Metal"
-  ];
-
-  env.NIX_LDFLAGS = lib.concatStringsSep " " (finalAttrs.darwinLdFlags ++ finalAttrs.metalLdFlags);
-
-  env.NIX_CFLAGS_COMPILE =
-    lib.optionalString (march != "") (
-      lib.warn "koboldcpp: the march argument is only kept for compatibility; use overrideAttrs intead" "-march=${march}"
-    )
-    + lib.optionalString (mtune != "") (
-      lib.warn "koboldcpp: the mtune argument is only kept for compatibility; use overrideAttrs intead" "-mtune=${mtune}"
-    );
-
   makeFlags = [
     (makeBool "LLAMA_OPENBLAS" openblasSupport)
     (makeBool "LLAMA_CUBLAS" cublasSupport)
@@ -153,19 +111,13 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  # Remove an unused argument, mainly intended for Darwin to reduce warnings
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace-warn " -s " " "
-  '';
-
   postFixup = ''
     wrapPythonProgramsIn "$out/bin" "$pythonPath"
     makeWrapper "$out/bin/koboldcpp.unwrapped" "$out/bin/koboldcpp" \
       --prefix PATH : ${lib.makeBinPath [ tk ]} ${libraryPathWrapperArgs}
   '';
 
-  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     changelog = "https://github.com/LostRuins/koboldcpp/releases/tag/v${finalAttrs.version}";

pkgs/by-name/lu/luarocks-packages-updater/updater.py

@@ -17,7 +17,6 @@ import textwrap
 from dataclasses import dataclass
 from multiprocessing.dummy import Pool
 from pathlib import Path
-from typing import List, Optional, Tuple
 
 import pluginupdate
 from pluginupdate import FetchConfig, update_plugins
@@ -49,18 +48,18 @@ class LuaPlugin:
     """Name of the plugin, as seen on luarocks.org"""
     rockspec: str
     """Full URI towards the rockspec"""
-    ref: Optional[str]
+    ref: str | None
     """git reference (branch name/tag)"""
-    version: Optional[str]
+    version: str | None
     """Set it to pin a package """
-    server: Optional[str]
+    server: str | None
     """luarocks.org registers packages under different manifests.
     Its value can be 'http://luarocks.org/dev'
     """
-    luaversion: Optional[str]
+    luaversion: str | None
     """lua version if a package is available only for a specific lua version"""
-    maintainers: Optional[str]
-    """ Optional string listing maintainers separated by spaces"""
+    maintainers: str | None
+    """Optional string listing maintainers separated by spaces"""
 
     @property
     def normalized_name(self) -> str:
@@ -77,7 +76,7 @@ class LuaEditor(pluginupdate.Editor):
     def get_current_plugins(self):
         return []
 
-    def load_plugin_spec(self, input_file) -> List[LuaPlugin]:
+    def load_plugin_spec(self, input_file) -> list[LuaPlugin]:
         luaPackages = []
         csvfilename = input_file
         log.info("Loading package descriptions from %s", csvfilename)
@@ -95,7 +94,7 @@ class LuaEditor(pluginupdate.Editor):
     def update(self, args):
         update_plugins(self, args)
 
-    def generate_nix(self, results: List[Tuple[LuaPlugin, str]], outfilename: str):
+    def generate_nix(self, results: list[tuple[LuaPlugin, str]], outfilename: str):
         with tempfile.NamedTemporaryFile("w+") as f:
             f.write(HEADER)
             header2 = textwrap.dedent(
@@ -121,7 +120,16 @@ class LuaEditor(pluginupdate.Editor):
     def attr_path(self):
         return "luaPackages"
 
-    def get_update(self, input_file: str, outfile: str, config: FetchConfig):
+    def get_update(
+        self,
+        input_file: str,
+        outfile: str,
+        config: FetchConfig,
+        # TODO: implement support for adding/updating individual plugins
+        to_update: list[str] | None,
+    ):
+        if to_update is not None:
+            raise NotImplementedError("For now, lua updater doesn't support updating individual packages.")
         _prefetch = generate_pkg_nix
 
         def update() -> dict:

pkgs/by-name/ni/nim-unwrapped-1_0/extra-mangling.patch

@@ -1,13 +1,17 @@
 diff --git a/compiler/modulepaths.nim b/compiler/modulepaths.nim
-index e80ea3fa6..8ecf27a85 100644
+index fa8fab08a..63b0cb44d 100644
 --- a/compiler/modulepaths.nim
 +++ b/compiler/modulepaths.nim
-@@ -70,6 +70,13 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
+@@ -73,6 +73,17 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
    else:
      result = fileInfoIdx(conf, fullPath)
  
 +proc rot13(result: var string) =
-+  for i, c in result:
++  # don't mangle .nim
++  let finalIdx =
++    if result.endsWith(".nim"): result.len - 4
++    else: result.len
++  for i, c in result[0..<finalIdx]:
 +    case c
 +    of 'a'..'m', 'A'..'M': result[i] = char(c.uint8 + 13)
 +    of 'n'..'z', 'N'..'Z': result[i] = char(c.uint8 - 13)
@@ -16,7 +20,7 @@ index e80ea3fa6..8ecf27a85 100644
  proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
    ## Mangle a relative module path to avoid path and symbol collisions.
    ##
-@@ -78,9 +85,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
+@@ -81,9 +92,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
    ##
    ## Example:
    ## `foo-#head/../bar` becomes `@foo-@hhead@s..@sbar`
@@ -30,10 +34,10 @@ index e80ea3fa6..8ecf27a85 100644
    result = path.multiReplace({"@@": "@", "@h": "#", "@s": "/", "@m": "", "@c": ":"})
 +  rot13(result)
 diff --git a/compiler/msgs.nim b/compiler/msgs.nim
-index 3f386cc61..054f7f647 100644
+index ae4bcfcb8..1ad7e5c08 100644
 --- a/compiler/msgs.nim
 +++ b/compiler/msgs.nim
-@@ -659,8 +659,10 @@ proc uniqueModuleName*(conf: ConfigRef; fid: FileIndex): string =
+@@ -661,8 +661,10 @@ proc uniqueModuleName*(conf: ConfigRef; fid: FileIndex): string =
    for i in 0..<trunc:
      let c = rel[i]
      case c

pkgs/by-name/ni/nim-unwrapped-2_2/extra-mangling-2.patch

@@ -1,34 +1,3 @@
-diff --git a/compiler/modulepaths.nim b/compiler/modulepaths.nim
-index c9e6060e5..acb289498 100644
---- a/compiler/modulepaths.nim
-+++ b/compiler/modulepaths.nim
-@@ -79,6 +79,13 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
-   else:
-     result = fileInfoIdx(conf, fullPath)
- 
-+proc rot13(result: var string) =
-+  for i, c in result:
-+    case c
-+    of 'a'..'m', 'A'..'M': result[i] = char(c.uint8 + 13)
-+    of 'n'..'z', 'N'..'Z': result[i] = char(c.uint8 - 13)
-+    else: discard
-+
- proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ## Mangle a relative module path to avoid path and symbol collisions.
-   ##
-@@ -87,9 +94,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
-   ##
-   ## Example:
-   ## `foo-#head/../bar` becomes `@foo-@hhead@s..@sbar`
--  "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-+  result = "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
-     {$os.DirSep: "@s", $os.AltSep: "@s", "#": "@h", "@": "@@", ":": "@c"})
-+  rot13(result)
- 
- proc demangleModuleName*(path: string): string =
-   ## Demangle a relative module path.
-   result = path.multiReplace({"@@": "@", "@h": "#", "@s": "/", "@m": "", "@c": ":"})
-+  rot13(result)
 diff --git a/compiler/modulegraphs.nim b/compiler/modulegraphs.nim
 index 77762d23a..59dd8903a 100644
 --- a/compiler/modulegraphs.nim
@@ -46,3 +15,38 @@ index 77762d23a..59dd8903a 100644
        result.add c
      of {os.DirSep, os.AltSep}:
        result.add 'Z' # because it looks a bit like '/'
+diff --git a/compiler/modulepaths.nim b/compiler/modulepaths.nim
+index c9e6060e5..2b349f27c 100644
+--- a/compiler/modulepaths.nim
++++ b/compiler/modulepaths.nim
+@@ -79,6 +79,17 @@ proc checkModuleName*(conf: ConfigRef; n: PNode; doLocalError=true): FileIndex =
+   else:
+     result = fileInfoIdx(conf, fullPath)
+ 
++proc rot13(result: var string) =
++  # don't mangle .nim
++  let finalIdx =
++    if result.endsWith(".nim"): result.len - 4
++    else: result.len
++  for i, c in result[0..<finalIdx]:
++    case c
++    of 'a'..'m', 'A'..'M': result[i] = char(c.uint8 + 13)
++    of 'n'..'z', 'N'..'Z': result[i] = char(c.uint8 - 13)
++    else: discard
++
+ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
+   ## Mangle a relative module path to avoid path and symbol collisions.
+   ##
+@@ -87,9 +98,11 @@ proc mangleModuleName*(conf: ConfigRef; path: AbsoluteFile): string =
+   ##
+   ## Example:
+   ## `foo-#head/../bar` becomes `@foo-@hhead@s..@sbar`
+-  "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
++  result = "@m" & relativeTo(path, conf.projectPath).string.multiReplace(
+     {$os.DirSep: "@s", $os.AltSep: "@s", "#": "@h", "@": "@@", ":": "@c"})
++  rot13(result)
+ 
+ proc demangleModuleName*(path: string): string =
+   ## Demangle a relative module path.
+   result = path.multiReplace({"@@": "@", "@h": "#", "@s": "/", "@m": "", "@c": ":"})
++  rot13(result)

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py

@@ -217,11 +217,11 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
     _base_path: Path
     _in_dir: Path
     _html_params: HTMLParameters
-    _redirects: Redirects
+    _redirects: Redirects | None
 
     def __init__(self, toplevel_tag: str, revision: str, html_params: HTMLParameters,
                  manpage_urls: Mapping[str, str], xref_targets: dict[str, XrefTarget],
-                 redirects: Redirects, in_dir: Path, base_path: Path):
+                 redirects: Redirects | None, in_dir: Path, base_path: Path):
         super().__init__(toplevel_tag, revision, manpage_urls, xref_targets)
         self._in_dir = in_dir
         self._base_path = base_path.absolute()
@@ -310,9 +310,12 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
                 '  </div>',
             ])
 
-        redirects_path = f'{self._base_path}/{toc.target.path.split('.html')[0]}-redirects.js'
-        with open(redirects_path, 'w') as file:
-            file.write(self._redirects.get_redirect_script(toc.target.path))
+        scripts = self._html_params.scripts
+        if self._redirects:
+            redirects_path = f'{self._base_path}/{toc.target.path.split('.html')[0]}-redirects.js'
+            with open(redirects_path, 'w') as file:
+                file.write(self._redirects.get_redirect_script(toc.target.path))
+            scripts.append(redirects_path)
 
         return "\n".join([
             '<?xml version="1.0" encoding="utf-8" standalone="no"?>',
@@ -325,7 +328,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             "".join((f'<link rel="stylesheet" type="text/css" href="{html.escape(style, True)}" />'
                      for style in self._html_params.stylesheets)),
             "".join((f'<script src="{html.escape(script, True)}" type="text/javascript"></script>'
-                     for script in [*self._html_params.scripts, redirects_path])),
+                     for script in scripts)),
             f' <meta name="generator" content="{html.escape(self._html_params.generator, True)}" />',
             f' <link rel="home" href="{home.target.href()}" title="{home.target.title}" />' if home.target.href() else "",
             f' {up_link}{prev_link}{next_link}',
@@ -509,7 +512,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
     _revision: str
     _html_params: HTMLParameters
     _manpage_urls: Mapping[str, str]
-    _redirects: Redirects
+    _redirects: Redirects | None
     _xref_targets: dict[str, XrefTarget]
     _redirection_targets: set[str]
     _appendix_count: int = 0
@@ -518,7 +521,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         self._appendix_count += 1
         return _to_base26(self._appendix_count - 1)
 
-    def __init__(self, revision: str, html_params: HTMLParameters, manpage_urls: Mapping[str, str], redirects: Redirects):
+    def __init__(self, revision: str, html_params: HTMLParameters, manpage_urls: Mapping[str, str], redirects: Redirects | None = None):
         super().__init__()
         self._revision, self._html_params, self._manpage_urls, self._redirects = revision, html_params, manpage_urls, redirects
         self._xref_targets = {}
@@ -679,13 +682,14 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
                 )
 
         TocEntry.collect_and_link(self._xref_targets, tokens)
-        self._redirects.validate(self._xref_targets)
-        server_redirects = self._redirects.get_server_redirects()
-        with open(outfile.parent / '_redirects', 'w') as server_redirects_file:
-            formatted_server_redirects = []
-            for from_path, to_path in server_redirects.items():
-                formatted_server_redirects.append(f"{from_path} {to_path} 301")
-            server_redirects_file.write("\n".join(formatted_server_redirects))
+        if self._redirects:
+            self._redirects.validate(self._xref_targets)
+            server_redirects = self._redirects.get_server_redirects()
+            with open(outfile.parent / '_redirects', 'w') as server_redirects_file:
+                formatted_server_redirects = []
+                for from_path, to_path in server_redirects.items():
+                    formatted_server_redirects.append(f"{from_path} {to_path} 301")
+                server_redirects_file.write("\n".join(formatted_server_redirects))
 
 
 def _build_cli_html(p: argparse.ArgumentParser) -> None:
@@ -704,16 +708,16 @@ def _build_cli_html(p: argparse.ArgumentParser) -> None:
 
 def _run_cli_html(args: argparse.Namespace) -> None:
     with open(args.manpage_urls) as manpage_urls, open(Path(__file__).parent / "redirects.js") as redirects_script:
-        redirects = {}
+        redirects = None
         if args.redirects:
             with open(args.redirects) as raw_redirects:
-                redirects = json.load(raw_redirects)
+                redirects = Redirects(json.load(raw_redirects), redirects_script.read())
 
         md = HTMLConverter(
             args.revision,
             HTMLParameters(args.generator, args.stylesheet, args.script, args.toc_depth,
                            args.chunk_toc_depth, args.section_toc_depth, args.media_dir),
-            json.load(manpage_urls), Redirects(redirects, redirects_script.read()))
+            json.load(manpage_urls), redirects)
         md.convert(args.infile, args.outfile)
 
 def build_cli(p: argparse.ArgumentParser) -> None:

pkgs/by-name/ni/nixos-render-docs/src/tests/test_auto_id_prefix.py

@@ -11,7 +11,7 @@ def set_prefix(token: Token, ident: str) -> None:
 
 
 def test_auto_id_prefix_simple() -> None:
-    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {}, Redirects({}, ''))
+    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {})
 
     src = f"""
 # title
@@ -32,7 +32,7 @@ def test_auto_id_prefix_simple() -> None:
 
 
 def test_auto_id_prefix_repeated() -> None:
-    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {}, Redirects({}, ''))
+    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {})
 
     src = f"""
 # title
@@ -58,7 +58,7 @@ def test_auto_id_prefix_repeated() -> None:
     ]
 
 def test_auto_id_prefix_maximum_nested() -> None:
-    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {}, Redirects({}, ''))
+    md = HTMLConverter("1.0.0", HTMLParameters("", [], [], 2, 2, 2, Path("")), {})
 
     src = f"""
 # h1

pkgs/by-name/pe/perf_data_converter/package.nix

@@ -38,8 +38,8 @@ buildBazelPackage rec {
   fetchAttrs = {
     hash =
       {
-        aarch64-linux = "sha256-gSRSkLGZhHe8o3byZVFsUxXPM+xzetOPhfzkAVTGAUs=";
-        x86_64-linux = "sha256-ZYjFpdH0oYrJguw16DSJWiXjhfJusG+inShbx/BOrcY=";
+        aarch64-linux = "sha256-F4fYZfdCmDzJRR+z1rCLsculP9y9B8H8WHNQbFZEv+s=";
+        x86_64-linux = "sha256-rjlquK0WcB7Te2uUKKVOrL7+6PtcWQImUWTVafIsbHY=";
       }
       .${system} or (throw "No hash for system: ${system}");
   };

pkgs/by-name/pu/puncia/package.nix

@@ -1,41 +1,35 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "puncia";
-  version = "0.15-unstable-2024-03-23";
+  version = "0.24";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ARPSyndicate";
     repo = "puncia";
-    # https://github.com/ARPSyndicate/puncia/issues/5
-    rev = "c70ed93ea1e7e42e12dd9c14713cab71bb0e0fe9";
-    hash = "sha256-xGJk8y26tluHUPm9ikrBBiWGuzq6MKl778BF8wNDmps=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4PJyAYPRsqay5Y9RxhOpUgIJvntVKokqYhE1b+hVc44=";
   };
 
-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
-  dependencies = with python3.pkgs; [
-    requests
-  ];
+  dependencies = with python3.pkgs; [ requests ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "puncia"
-  ];
+  pythonImportsCheck = [ "puncia" ];
 
   meta = with lib; {
     description = "CLI utility for Subdomain Center & Exploit Observer";
     homepage = "https://github.com/ARPSyndicate/puncia";
-    # https://github.com/ARPSyndicate/puncia/issues/6
-    license = licenses.unfree;
+    changelog = "https://github.com/ARPSyndicate/puncia/releases/tag/v${version}";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "puncia";
   };

pkgs/by-name/su/sudachi-rs/package.nix

@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sudachi-rs";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "WorksApplications";
     repo = "sudachi.rs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9GXU+YDPuQ+roqQfUE5q17Hl6AopsvGhRPjZ+Ui+n24=";
+    hash = "sha256-G+lJzOYxrR/Le2lgfZMXbbjCqPYmCKMy1pIomTP5NIg=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"resources"' '"${placeholder "out"}/share/resources"'
   '';
 
-  cargoHash = "sha256-Ufo3dB2KGDDNiebp7hLhQrUMLsefO8wRpJQDz57Yb8Y=";
+  cargoHash = "sha256-iECIk5+QvTP1xiH9AcEJGKt1YHG8KASYmsuIq0vHD20=";
 
   # prepare the resources before the build so that the binary can find sudachidict
   preBuild = ''

pkgs/by-name/vi/vikunja/package.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub, stdenv, nodejs, pnpm, buildGoModule, mage, writeShellScriptBin, nixosTests }:
 
 let
-  version = "0.24.4";
+  version = "0.24.5";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-h3Jz28HYQYZC+oWGXNeKv2iNsrU0gbBRfWgOvuKijtw=";
+    hash = "sha256-P5H+NfjE8wTmPD1VOI72hPi2DlDb4pCyq0nphK1VGK0=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -67,7 +67,7 @@ buildGoModule {
     in
     [ fakeGit mage ];
 
-  vendorHash = "sha256-d2BNzsBeWlpZGbU7PkXWO5e9FLJA/Wda5ImXwqh/WV4=";
+  vendorHash = "sha256-OsKejno8QGg7HzRsrftngiWGiWHFc1jDLi5mQ9/NjI4=";
 
   inherit frontend;
 

pkgs/by-name/ya/yandex-music/package.nix

@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.23.2";
+  version = "5.28.4";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-nhy4D2PgTMsQOs8hPY39Z+I+Tldgf1ASZbatfxWqNTw=";
+    hash = "sha256-0YUZKklwHkZ3bDI4OLmXyj0v2wzWzJbJpQ8QQa356fI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ya/yandex-music/ym_info.json

@@ -1,6 +1,6 @@
 {
-  "version": "5.23.2",
-  "exe_name": "Yandex_Music_x64_5.23.2.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.23.2.exe",
-  "exe_hash": "sha256-PhXmUGV9+9zfRZufw3FVvpPGqVLAB51lrz7KJovm+C8="
+  "version": "5.28.4",
+  "exe_name": "Yandex_Music_x64_5.28.4.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.28.4.exe",
+  "exe_hash": "sha256-fJlRtGgOJcHbAgUBxrv3AJro7uN5En9le2b+a5K2QMc="
 }

pkgs/development/interpreters/python/default.nix

@@ -100,9 +100,9 @@ in {
       major = "3";
       minor = "14";
       patch = "0";
-      suffix = "a1";
+      suffix = "a2";
     };
-    hash = "sha256-PkZLDLt1NeLbNCYv0ZoKOT0OYr4PQ7FRPtmDebBU6tQ=";
+    hash = "sha256-L/nhAUc0Kz79afXNnMBuxGJQ8qBGWHWZ0Y4srGnAWSA=";
     inherit passthruFun;
   };
   # Minimal versions of Python (built without optional dependencies)

pkgs/development/python-modules/ailment/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.128";
+  version = "9.2.129";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "ailment";
     rev = "refs/tags/v${version}";
-    hash = "sha256-08cIIFuo0Kf3jLtH6STPRAJVo+0ywFCcOo5rpXHXnwA=";
+    hash = "sha256-xxrqr5zh6n3A7YTxf7K1x3iLsCh8s0l/4esdoTtoIbQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/aioopenexchangerates/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioopenexchangerates";
-  version = "0.6.10";
+  version = "0.6.13";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GDAeBk4h0YLFbLSGEjomvzR94y0JGsRzd15J4sv6i6o=";
+    hash = "sha256-5RLD3Y0DxsOSejSOPo+071hpsgoduMcLniQNqt/shs8=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];

pkgs/development/python-modules/angr/default.nix

@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.128";
+  version = "9.2.129";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OAdPBmJAGqQEiQCXKZMtEoyDMS/A9pUYeTXJQ0qQYVs=";
+    hash = "sha256-GO8Vk/L1swhQsGfH/Ugi5i9MwWbaco/f1ukqJ2+R6IA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/archinfo/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.128";
+  version = "9.2.129";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "archinfo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uNzT3doBHbbRLjxTtndQx+03M9zCdOI+FuTmVea1C1M=";
+    hash = "sha256-s0EaGaSLQ3lLUKOZKU1wTLs7apYXvYwXbgCs48UO6EE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/asyncwhois/default.nix

@@ -6,6 +6,7 @@
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
+  python-dateutil,
   python-socks,
   pythonOlder,
   tldextract,
@@ -14,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "asyncwhois";
-  version = "1.1.5";
+  version = "1.1.9";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,12 +24,13 @@ buildPythonPackage rec {
     owner = "pogzyb";
     repo = "asyncwhois";
     rev = "refs/tags/v${version}";
-    hash = "sha256-y5JmAbrk9qJeNYejNcz5nI5bghaetUw1xkD8qgwOkao=";
+    hash = "sha256-Eb7De2AMxZi0Wu8dYA5wlX84BbF62L24vIuBEnvfxBU=";
   };
 
   build-system = [ hatchling ];
 
   dependencies = [
+    python-dateutil
     python-socks
     tldextract
     whodap

pkgs/development/python-modules/claripy/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.128";
+  version = "9.2.129";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YP2Cphf57iyZXrdseZhUkzrkop0+jCRu98ckurxS1UU=";
+    hash = "sha256-q4TFOjJs3mybn5y4W3B3pSC5l+6co8PXCOEEk8+wP3M=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail

pkgs/development/python-modules/cle/default.nix

@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.128";
+  version = "9.2.129";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wROuTg+RMp2tkjPsjHTK7aJs4SWTuIw4SsuIKIUZvkw=";
+    hash = "sha256-LP29VvCImJ3jbNrqwBYi829EO75jximrQkR9aj/gNPM=";
   };
 in
 buildPythonPackage rec {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C3lp9Dhg0XZXTxnYbRMfanxVn8qJhL1VEVDrMCpkMe4=";
+    hash = "sha256-0CQVnnzK7eeQNCLuUDPibWCkeKp3QEpxfQ+lT1SoMLA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/flask-themer/default.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  flask,
+  pytestCheckHook,
+  pytest-cov-stub,
+}:
+
+buildPythonPackage rec {
+  pname = "flask-themer";
+  version = "2.0.0";
+  pyproject = true;
+
+  # Pypi tarball doesn't contain tests/
+  src = fetchFromGitHub {
+    owner = "TkTech";
+    repo = "flask-themer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2Zw+gKKN0kfjYuruuLQ+3dIFF0X07DTy0Ypc22Ih66w=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ flask ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  pythonImportsCheck = [ "flask_themer" ];
+
+  meta = with lib; {
+    description = "Simple theming support for Flask apps";
+    homepage = "https://github.com/TkTech/flask-themer";
+    changelog = "https://github.com/TkTech/flask-themer/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erictapen ];
+  };
+}

pkgs/development/python-modules/flask-webtest/default.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  flask,
+  webtest,
+  blinker,
+  flask-sqlalchemy,
+  greenlet,
+}:
+
+buildPythonPackage rec {
+  pname = "flask-webtest";
+  version = "0.1.4";
+  pyproject = true;
+
+  # Pypi tarball doesn't include version.py
+  src = fetchFromGitHub {
+    owner = "level12";
+    repo = "flask-webtest";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4USNT6HYh49v+euCePYkL1gR6Ul8C0+/xanuYGxKpfM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    flask
+    webtest
+    blinker
+  ];
+
+  nativeCheckInputs = [
+    flask-sqlalchemy
+    greenlet
+  ];
+
+  pythonImportsCheck = [ "flask_webtest" ];
+
+  meta = with lib; {
+    description = "Utilities for testing Flask applications with WebTest";
+    homepage = "https://github.com/level12/flask-webtest";
+    changelog = "https://github.com/level12/flask-webtest/blob/${src.rev}/changelog.rst";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ erictapen ];
+  };
+}

pkgs/development/python-modules/keke/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  wheel,
+  setuptools-scm,
+}:
+
+buildPythonPackage rec {
+  pname = "keke";
+  version = "0.1.4";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-qGU7fZk23a4I0eosKY5eNqUOs3lwXj90qwix9q44MaA=";
+  };
+
+  installCheckPhase = ''
+    python -m keke.tests
+  '';
+
+  nativeBuildInputs = [ setuptools-scm ];
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  pythonImportsCheck = [
+    "keke"
+  ];
+
+  meta = {
+    description = "Easy profiling in chrome trace format";
+    homepage = "https://pypi.org/project/keke/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+  };
+}

pkgs/development/python-modules/mail-parser/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "mail-parser";
-  version = "4.0.0";
+  version = "4.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SpamScope";
     repo = "mail-parser";
     rev = "refs/tags/${version}";
-    hash = "sha256-WpV1WJFwzAquPXimew86YpEp++dnkIiBe5E4lMBDl7w=";
+    hash = "sha256-AXMfb+9POEaosCc+dv1xenhvBbpVkllMjftMoADUPXE=";
   };
 
   LC_ALL = "en_US.utf-8";
@@ -49,11 +49,11 @@ buildPythonPackage rec {
     cat tests/mails/mail_malformed_3 | ${python.interpreter} -m mailparser -k -j
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Mail parser for python 2 and 3";
     mainProgram = "mailparser";
     homepage = "https://github.com/SpamScope/mail-parser";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ psyanticy ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ psyanticy ];
   };
 }

pkgs/development/python-modules/mailsuite/default.nix

@@ -16,18 +16,22 @@
 
 buildPythonPackage rec {
   pname = "mailsuite";
-  version = "1.9.16";
+  version = "1.9.18";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rfavOOivttXXmdA/Nl3jUmXIUQrjxDDZ8cHcNIJQL6U=";
+    hash = "sha256-3rK5PgcAOKVvZbFT7PaZX9lhU8yKpPQozvh2F8mTkfA=";
   };
 
   nativeBuildInputs = [ hatchling ];
 
+  pythonRelaxDeps = [
+    "mail-parser"
+  ];
+
   propagatedBuildInputs = [
     dnspython
     expiringdict

pkgs/development/python-modules/opensearch-py/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -62,6 +63,8 @@ buildPythonPackage rec {
     pytz
   ] ++ optional-dependencies.async;
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTestPaths = [
     # require network
     "test_opensearchpy/test_async/test_connection.py"
@@ -70,11 +73,21 @@ buildPythonPackage rec {
     "test_opensearchpy/test_server_secured"
   ];
 
-  disabledTests = [
-    # finds our ca-bundle, but expects something else (/path/to/clientcert/dir or None)
-    "test_ca_certs_ssl_cert_dir"
-    "test_no_ca_certs"
-  ];
+  disabledTests =
+    [
+      # finds our ca-bundle, but expects something else (/path/to/clientcert/dir or None)
+      "test_ca_certs_ssl_cert_dir"
+      "test_no_ca_certs"
+
+      # Failing tests, issue opened at https://github.com/opensearch-project/opensearch-py/issues/849
+      "test_basicauth_in_request_session"
+      "test_callable_in_request_session"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86) [
+      # Flaky tests: OSError: [Errno 48] Address already in use
+      "test_redirect_failure_when_allow_redirect_false"
+      "test_redirect_success_when_allow_redirect_true"
+    ];
 
   meta = {
     description = "Python low-level client for OpenSearch";

pkgs/development/python-modules/parsedmarc/default.nix

@@ -27,6 +27,7 @@
   nixosTests,
   opensearch-py,
   publicsuffixlist,
+  pygelf,
   pythonOlder,
   requests,
   tqdm,
@@ -41,14 +42,14 @@ let
 in
 buildPythonPackage rec {
   pname = "parsedmarc";
-  version = "8.15.0";
+  version = "8.15.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Z2KF8jv/D/SvwQWd1PGSlsAfowmYOd5CvvcC4kVuLos=";
+    hash = "sha256-lxW92jlSWgGVxOO+CwIZi5sKHqoZuR5VQCnDVORXmXU=";
   };
 
   nativeBuildInputs = [
@@ -82,6 +83,7 @@ buildPythonPackage rec {
     mailsuite
     msgraph-core
     publicsuffixlist
+    pygelf
     requests
     tqdm
     xmltodict

pkgs/development/python-modules/pygelf/default.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  mock,
+  pytestCheckHook,
+  requests,
+}:
+buildPythonPackage rec {
+  pname = "pygelf";
+  version = "0.4.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "pygelf";
+    inherit version;
+    hash = "sha256-0LuPRf9kipoYdxP0oFwJ9oX8uK3XsEu3Rx8gBxvRGq0=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "pygelf" ];
+
+  nativeCheckInputs = [
+    mock
+    pytestCheckHook
+    requests
+  ];
+
+  disabledTests = [
+    # ConnectionRefusedError: [Errno 111] Connection refused
+    "test_static_fields"
+    "test_dynamic_fields"
+  ];
+
+  disabledTestPaths = [
+    # These tests requires files that are stripped off by Pypi packaging
+    "tests/test_queuehandler_support.py"
+    "tests/test_debug_mode.py"
+    "tests/test_common_fields.py"
+  ];
+
+  meta = {
+    description = "Python logging handlers with GELF (Graylog Extended Log Format) support";
+    homepage = "https://github.com/keeprocking/pygelf";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}

pkgs/development/python-modules/pynina/default.nix

@@ -4,22 +4,27 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynina";
-  version = "0.3.3";
-  format = "setuptools";
+  version = "0.3.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "PyNINA";
     inherit version;
-    hash = "sha256-6HJ78tKl6If/ezwOrGl3VEYO4eMh/6cZq2j2AMBr0I8=";
+    hash = "sha256-/BeT05dHPHfqybsly0QUbBPFFJKEr67vG1xbBfZXQuY=";
   };
 
-  propagatedBuildInputs = [ aiohttp ];
+  pythonRelaxDeps = [ "aiohttp" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
 
   # Project has no tests
   doCheck = false;

pkgs/development/python-modules/pytest-smtpd/default.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  hatchling,
+  pytest,
+  smtpdfix,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-smtpd";
+  version = "0.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  # Pypi tarball doesn't include tests/
+  src = fetchFromGitHub {
+    owner = "bebleo";
+    repo = "pytest-smtpd";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Vu2D2hfxBYxgXQ4Gjr+jFpac9fjpLL2FftBhnqrcQaA=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    smtpdfix
+  ];
+
+  buildInputs = [ pytest ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pytest_smtpd" ];
+
+  meta = with lib; {
+    description = "Pytest fixture that creates an SMTP server";
+    homepage = "https://github.com/bebleo/pytest-smtpd";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erictapen ];
+  };
+}

pkgs/development/python-modules/pyvex/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.128";
+  version = "9.2.129";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ASo1hqxLsX4UkdhXLOArKBQdxws/maUjGb/HotAoxzw=";
+    hash = "sha256-xEq3W9f38yHf9hZiYpjcP89/5/mH85XRKW5nDotz4KY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/slapd/default.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  poetry-core,
+  openldap,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "slapd";
+  version = "0.1.5";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  # Pypi tarball doesn't include tests/
+  src = fetchFromGitHub {
+    owner = "python-ldap";
+    repo = "python-slapd";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AiJvhgJ62vCj75m6l5kuIEb7k2qCh/QJybS0uqw2vBY=";
+  };
+
+  build-system = [ poetry-core ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  preCheck = ''
+    # Needed by tests to setup a mockup ldap server
+    export BIN="${openldap}/bin"
+    export SBIN="${openldap}/bin"
+    export SLAPD="${openldap}/libexec/slapd"
+    export SCHEMA="${openldap}/etc/schema"
+  '';
+
+  pythonImportsCheck = [ "slapd" ];
+
+  meta = with lib; {
+    description = "Controls a slapd process in a pythonic way";
+    homepage = "https://github.com/python-ldap/python-slapd";
+    changelog = "https://github.com/python-ldap/python-slapd/blob/${src.rev}/CHANGES.rst";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erictapen ];
+  };
+
+}

pkgs/development/python-modules/sqlalchemy-json/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  sqlalchemy,
+}:
+
+let
+  version = "0.7.0";
+in
+buildPythonPackage {
+  pname = "sqlalchemy-json";
+  inherit version;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "edelooff";
+    repo = "sqlalchemy-json";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Is3DznojvpWYFSDutzCxRLceQMIiS3ZIg0c//MIOF+s=";
+  };
+
+  propagatedBuildInputs = [ sqlalchemy ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Full-featured JSON type with mutation tracking for SQLAlchemy";
+    homepage = "https://github.com/edelooff/sqlalchemy-json";
+    changelog = "https://github.com/edelooff/sqlalchemy-json/tree/v${version}#changelog";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ augustebaum ];
+  };
+}

pkgs/development/python-modules/sudachipy/default.nix

@@ -21,7 +21,7 @@ buildPythonPackage rec {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ARwvThfATDdzBTjPFr9yjbE/0eYvp/TCZOEGbUupJmU=";
+    hash = "sha256-vYn1dWu87ruEGT/9QVIvxY21LzesVyq1VPaLcTrDKvY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/zxcvbn-rs-py/default.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  pythonAtLeast,
+  fetchPypi,
+  rustPlatform,
+}:
+
+buildPythonPackage rec {
+  pname = "zxcvbn-rs-py";
+  version = "0.1.1";
+
+  pyproject = true;
+
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.13";
+
+  src = fetchPypi {
+    pname = "zxcvbn_rs_py";
+    inherit version;
+    hash = "sha256-7EZJ/WGekfsnisqTs9dwwbQia6OlDEx3MR9mkqSI+gA=";
+  };
+
+  build-system = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "${pname}-${version}";
+    inherit src;
+    hash = "sha256-OA6iyojBMAG9GtjHaIQ9cM0SEMwMa2bKFRIXmqp4OBE=";
+  };
+
+  pythonImportsCheck = [ "zxcvbn_rs_py" ];
+
+  meta = with lib; {
+    description = "Python bindings for zxcvbn-rs, the Rust implementation of zxcvbn";
+    homepage = "https://github.com/fief-dev/zxcvbn-rs-py/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ erictapen ];
+  };
+
+}

pkgs/development/tools/pnpm/default.nix

@@ -12,8 +12,8 @@ let
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
-      version = "9.12.3";
-      hash = "sha256-JCNXcsxKyCpiYnzUf4NMcmZ6LOh3mahG7E6OVV4tS4s=";
+      version = "9.14.2";
+      hash = "sha256-BuZaSWW6/21gl/nI91w19tQgl028A9d1AJBWpp7f0nE=";
     };
   };
 

pkgs/top-level/python-packages.nix

@@ -4702,10 +4702,14 @@ self: super: with self; {
 
   flask-testing = callPackage ../development/python-modules/flask-testing { };
 
+  flask-themer = callPackage ../development/python-modules/flask-themer { };
+
   flask-themes2 = callPackage ../development/python-modules/flask-themes2 { };
 
   flask-versioned = callPackage ../development/python-modules/flask-versioned { };
 
+  flask-webtest = callPackage ../development/python-modules/flask-webtest { };
+
   flask-wtf = callPackage ../development/python-modules/flask-wtf { };
 
   flatbuffers = callPackage ../development/python-modules/flatbuffers {
@@ -6862,6 +6866,8 @@ self: super: with self; {
 
   kegtron-ble = callPackage ../development/python-modules/kegtron-ble { };
 
+  keke = callPackage ../development/python-modules/keke { };
+
   keras-applications = callPackage ../development/python-modules/keras-applications { };
 
   keras = callPackage ../development/python-modules/keras { };
@@ -10401,6 +10407,8 @@ self: super: with self; {
 
   pyfreedompro = callPackage ../development/python-modules/pyfreedompro { };
 
+  pygelf = callPackage ../development/python-modules/pygelf { };
+
   pygments-style-github = callPackage ../development/python-modules/pygments-style-github { };
 
   pygnmi = callPackage ../development/python-modules/pygnmi { };
@@ -12794,6 +12802,8 @@ self: super: with self; {
 
   pytest-shutil = callPackage ../development/python-modules/pytest-shutil { };
 
+  pytest-smtpd = callPackage ../development/python-modules/pytest-smtpd { };
+
   pytest-spec = callPackage ../development/python-modules/pytest-spec { };
 
   python-status = callPackage ../development/python-modules/python-status { };
@@ -14681,6 +14691,8 @@ self: super: with self; {
 
   slack-sdk = callPackage ../development/python-modules/slack-sdk { };
 
+  slapd = callPackage ../development/python-modules/slapd { };
+
   sleekxmpp = callPackage ../development/python-modules/sleekxmpp { };
 
   sleekxmppfs = callPackage ../development/python-modules/sleekxmppfs { };
@@ -15148,6 +15160,8 @@ self: super: with self; {
 
   sqlalchemy-i18n = callPackage ../development/python-modules/sqlalchemy-i18n { };
 
+  sqlalchemy-json = callPackage ../development/python-modules/sqlalchemy-json { };
+
   sqlalchemy-jsonfield = callPackage ../development/python-modules/sqlalchemy-jsonfield { };
 
   sqlalchemy-mixins = callPackage ../development/python-modules/sqlalchemy-mixins { };
@@ -18293,6 +18307,8 @@ self: super: with self; {
 
   zxcvbn = callPackage ../development/python-modules/zxcvbn { };
 
+  zxcvbn-rs-py = callPackage ../development/python-modules/zxcvbn-rs-py { };
+
   zxing-cpp = callPackage ../development/python-modules/zxing-cpp {
     libzxing-cpp = pkgs.zxing-cpp;
   };