Merge staging-next into staging

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2024 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2025 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

maintainers/maintainer-list.nix

@@ -15627,6 +15627,12 @@
     githubId = 38578268;
     name = "Morgan Wolfe";
   };
+  mx2uller = {
+    email = "mx2uller@pm.me";
+    github = "mx2uller";
+    githubId = 93703653;
+    name = "Marko Müller";
+  };
   mxkrsv = {
     email = "mxkrsv@disroot.org";
     github = "mxkrsv";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -304,6 +304,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.
+
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
 - Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.

nixos/modules/services/hardware/kmonad.nix

@@ -15,6 +15,7 @@ let
       options = {
         name = lib.mkOption {
           type = lib.types.str;
+          default = name;
           example = "laptop-internal";
           description = "Keyboard name.";
         };
@@ -35,16 +36,16 @@ let
             Since KMonad runs as an unprivileged user, it may sometimes
             need extra permissions in order to read the keyboard device
             file.  If your keyboard's device file isn't in the input
-            group you'll need to list its group in this option.
+            group, you'll need to list its group in this option.
           '';
         };
 
         defcfg = {
           enable = lib.mkEnableOption ''
-            Automatically generate the defcfg block.
+            automatic generation of the defcfg block.
 
-            When this is option is set to true the config option for
-            this keyboard should not include a defcfg block.
+            When this option is set to true, the config option for
+            this keyboard should not include a defcfg block
           '';
 
           compose = {
@@ -55,15 +56,15 @@ let
             };
 
             delay = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.ints.unsigned;
               default = 5;
               description = "The delay (in milliseconds) between compose key sequences.";
             };
           };
 
-          fallthrough = lib.mkEnableOption "Re-emit unhandled key events.";
+          fallthrough = lib.mkEnableOption "re-emitting unhandled key events";
 
-          allowCommands = lib.mkEnableOption "Allow keys to run shell commands.";
+          allowCommands = lib.mkEnableOption "keys to run shell commands";
         };
 
         config = lib.mkOption {
@@ -71,12 +72,10 @@ let
           description = "Keyboard configuration.";
         };
       };
-
-      config = {
-        name = lib.mkDefault name;
-      };
     };
 
+  mkName = name: "kmonad-" + name;
+
   # Create a complete KMonad configuration file:
   mkCfg =
     keyboard:
@@ -84,7 +83,7 @@ let
       defcfg = ''
         (defcfg
           input  (device-file "${keyboard.device}")
-          output (uinput-sink "kmonad-${keyboard.name}")
+          output (uinput-sink "${mkName keyboard.name}")
           ${lib.optionalString (keyboard.defcfg.compose.key != null) ''
             cmp-seq ${keyboard.defcfg.compose.key}
             cmp-seq-delay ${toString keyboard.defcfg.compose.delay}
@@ -95,9 +94,9 @@ let
       '';
     in
     pkgs.writeTextFile {
-      name = "kmonad-${keyboard.name}.cfg";
+      name = "${mkName keyboard.name}.kbd";
       text = lib.optionalString keyboard.defcfg.enable (defcfg + "\n") + keyboard.config;
-      checkPhase = "${cfg.package}/bin/kmonad -d $out";
+      checkPhase = "${lib.getExe cfg.package} -d $out";
     };
 
   # Build a systemd path config that starts the service below when a
@@ -105,7 +104,7 @@ let
   mkPath =
     keyboard:
     let
-      name = "kmonad-${keyboard.name}";
+      name = mkName keyboard.name;
     in
     lib.nameValuePair name {
       description = "KMonad trigger for ${keyboard.device}";
@@ -129,7 +128,7 @@ let
         ++ cfg.extraArgs
         ++ [ "${mkCfg keyboard}" ];
     in
-    lib.nameValuePair "kmonad-${keyboard.name}" {
+    lib.nameValuePair (mkName keyboard.name) {
       description = "KMonad for ${keyboard.device}";
       script = lib.escapeShellArgs cmd;
       unitConfig = {
@@ -155,13 +154,26 @@ let
           config.users.groups.uinput.name
         ] ++ keyboard.extraGroups;
       };
+      # make sure the new config is used after nixos-rebuild switch
+      # stopIfChanged controls[0] how a service is "restarted" during
+      # nixos-rebuild switch.  By default, stopIfChanged is true, which stops
+      # the old service and then starts the new service after config updates.
+      # Since we use path-based activation[1] here, the service unit will
+      # immediately[2] be started by the path unit.  Probably that start is
+      # before config updates, whcih causes the service unit to use the old
+      # config after nixos-rebuild switch.  Setting stopIfChanged to false works
+      # around this issue by restarting the service after config updates.
+      # [0]: https://nixos.org/manual/nixos/unstable/#sec-switching-systems
+      # [1]: man 7 daemon
+      # [2]: man 5 systemd.path
+      stopIfChanged = false;
     };
 in
 {
   options.services.kmonad = {
-    enable = lib.mkEnableOption "KMonad: An advanced keyboard manager.";
+    enable = lib.mkEnableOption "KMonad: an advanced keyboard manager";
 
-    package = lib.mkPackageOption pkgs "kmonad" { };
+    package = lib.mkPackageOption pkgs "KMonad" { default = "kmonad"; };
 
     keyboards = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule keyboard);
@@ -188,4 +200,11 @@ in
       services = lib.mapAttrs' (_: mkService) cfg.keyboards;
     };
   };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      linj
+      rvdp
+    ];
+  };
 }

nixos/modules/services/matrix/synapse.nix

@@ -705,7 +705,7 @@ in
 
         withJemalloc = mkOption {
           type = types.bool;
-          default = false;
+          default = true;
           description = ''
             Whether to preload jemalloc to reduce memory fragmentation and overall usage.
           '';
@@ -1462,6 +1462,7 @@ in
         baseServiceConfig = {
           environment = optionalAttrs (cfg.withJemalloc) {
             LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
+            PYTHONMALLOC = "malloc";
           };
           serviceConfig = {
             Type = "notify";

nixos/modules/services/networking/coturn.nix

@@ -36,8 +36,6 @@ let
     ${lib.optionalString (cfg.cert != null) "cert=${cfg.cert}"}
     ${lib.optionalString (cfg.pkey != null) "pkey=${cfg.pkey}"}
     ${lib.optionalString (cfg.dh-file != null) "dh-file=${cfg.dh-file}"}
-    no-stdout-log
-    syslog
     pidfile=${pidfile}
     ${lib.optionalString cfg.secure-stun "secure-stun"}
     ${lib.optionalString cfg.no-cli "no-cli"}

nixos/modules/services/security/tor.nix

@@ -29,16 +29,18 @@ let
           in
           p1 != null && 0 < p2 && p2 < 1024
       )
-      (flatten [
-        cfg.settings.ORPort
-        cfg.settings.DirPort
-        cfg.settings.DNSPort
-        cfg.settings.ExtORPort
-        cfg.settings.HTTPTunnelPort
-        cfg.settings.NATDPort
-        cfg.settings.SOCKSPort
-        cfg.settings.TransPort
-      ]);
+      (
+        lib.flatten [
+          cfg.settings.ORPort
+          cfg.settings.DirPort
+          cfg.settings.DNSPort
+          cfg.settings.ExtORPort
+          cfg.settings.HTTPTunnelPort
+          cfg.settings.NATDPort
+          cfg.settings.SOCKSPort
+          cfg.settings.TransPort
+        ]
+      );
   optionBool =
     optionName:
     lib.mkOption {
@@ -68,7 +70,7 @@ let
       description = (descriptionGeneric optionName);
     };
   optionAddress = lib.mkOption {
-    type = with types; nullOr str;
+    type = with lib.types; nullOr str;
     default = null;
     example = "0.0.0.0";
     description = ''
@@ -76,7 +78,7 @@ let
     '';
   };
   optionUnix = lib.mkOption {
-    type = with types; nullOr path;
+    type = with lib.types; nullOr path;
     default = null;
     description = ''
       Unix domain socket path to use.
@@ -84,7 +86,7 @@ let
   };
   optionPort = lib.mkOption {
     type =
-      with types;
+      with lib.types;
       nullOr (oneOf [
         port
         (enum [ "auto" ])
@@ -126,7 +128,7 @@ let
           config = {
             flags =
               filter (name: config.${name} == true) isolateFlags
-              ++ optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}";
+              ++ lib.optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}";
           };
         }
       ))
@@ -196,13 +198,13 @@ let
             # Only add flags in SOCKSPort to avoid duplicates
             flags =
               filter (name: config.${name} == true) flags
-              ++ optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}";
+              ++ lib.optional (config.SessionGroup != null) "SessionGroup=${toString config.SessionGroup}";
           };
         }
       ))
     ];
   optionFlags = lib.mkOption {
-    type = with types; listOf str;
+    type = with lib.types; listOf str;
     default = [ ];
   };
   optionORPort =
@@ -273,23 +275,23 @@ let
     else if isBool v then
       (if v then "1" else "0")
     else if v ? "unix" && v.unix != null then
-      "unix:" + v.unix + optionalString (v ? "flags") (" " + concatStringsSep " " v.flags)
+      "unix:" + v.unix + lib.optionalString (v ? "flags") (" " + concatStringsSep " " v.flags)
     else if v ? "port" && v.port != null then
-      optionalString (v ? "addr" && v.addr != null) "${v.addr}:"
+      lib.optionalString (v ? "addr" && v.addr != null) "${v.addr}:"
       + toString v.port
-      + optionalString (v ? "flags") (" " + concatStringsSep " " v.flags)
+      + lib.optionalString (v ? "flags") (" " + concatStringsSep " " v.flags)
     else if k == "ServerTransportPlugin" then
-      optionalString (v.transports != [ ]) "${concatStringsSep "," v.transports} exec ${v.exec}"
+      lib.optionalString (v.transports != [ ]) "${concatStringsSep "," v.transports} exec ${v.exec}"
     else if k == "HidServAuth" then
       v.onion + " " + v.auth
     else
-      generators.mkValueStringDefault { } v;
+      lib.generators.mkValueStringDefault { } v;
   genTorrc =
     settings:
-    generators.toKeyValue
+    lib.generators.toKeyValue
       {
         listsAsDuplicateKeys = true;
-        mkKeyValue = k: generators.mkKeyValueDefault { mkValueString = mkValueString k; } " " k;
+        mkKeyValue = k: lib.generators.mkKeyValueDefault { mkValueString = mkValueString k; } " " k;
       }
       (
         lib.mapAttrs (
@@ -311,8 +313,8 @@ let
       );
   torrc = pkgs.writeText "torrc" (
     genTorrc cfg.settings
-    + concatStrings (
-      mapAttrsToList (
+    + lib.concatStrings (
+      lib.mapAttrsToList (
         name: onion: "HiddenServiceDir ${onion.path}\n" + genTorrc onion.settings
       ) cfg.relay.onionServices
     )
@@ -506,7 +508,7 @@ in
           };
           type = lib.types.attrsOf (
             lib.types.submodule (
-              { name, config, ... }:
+              { ... }:
               {
                 options.clientAuthorizations = lib.mkOption {
                   description = ''
@@ -810,7 +812,7 @@ in
                   };
                 };
                 config = {
-                  path = mkDefault ((if config.secretKey == null then stateDir else runDir) + "/onion/${name}");
+                  path = lib.mkDefault ((if config.secretKey == null then stateDir else runDir) + "/onion/${name}");
                   settings.HiddenServiceVersion = config.version;
                   settings.HiddenServiceAuthorizeClient =
                     if config.authorizeClient != null then
@@ -890,7 +892,7 @@ in
           options.ConnDirectionStatistics = optionBool "ConnDirectionStatistics";
           options.ConstrainedSockets = optionBool "ConstrainedSockets";
           options.ContactInfo = optionString "ContactInfo";
-          options.ControlPort = lib.mkOption rec {
+          options.ControlPort = lib.mkOption {
             description = (descriptionGeneric "ControlPort");
             default = [ ];
             example = [ { port = 9051; } ];
@@ -1177,8 +1179,11 @@ in
     # Not sure if `cfg.relay.role == "private-bridge"` helps as tor
     # sends a lot of stats
     warnings =
-      optional
-        (cfg.settings.BridgeRelay && flatten (mapAttrsToList (n: o: o.map) cfg.relay.onionServices) != [ ])
+      lib.optional
+        (
+          cfg.settings.BridgeRelay
+          && lib.flatten (lib.mapAttrsToList (n: o: o.map) cfg.relay.onionServices) != [ ]
+        )
         ''
           Running Tor hidden services on a public relay makes the
           presence of hidden services visible through simple statistical
@@ -1189,16 +1194,16 @@ in
           actually hide your hidden services. In either case, you can
           always create a container/VM with a separate Tor daemon instance.
         ''
-      ++ flatten (
-        mapAttrsToList (
+      ++ lib.flatten (
+        lib.mapAttrsToList (
           n: o:
-          optionals (o.settings.HiddenServiceVersion == 2) [
+          lib.optionals (o.settings.HiddenServiceVersion == 2) [
             (optional (o.settings.HiddenServiceExportCircuitID != null) ''
               HiddenServiceExportCircuitID is used in the HiddenService: ${n}
               but this option is only for v3 hidden services.
             '')
           ]
-          ++ optionals (o.settings.HiddenServiceVersion != 2) [
+          ++ lib.optionals (o.settings.HiddenServiceVersion != 2) [
             (optional (o.settings.HiddenServiceAuthorizeClient != null) ''
               HiddenServiceAuthorizeClient is used in the HiddenService: ${n}
               but this option is only for v2 hidden services.
@@ -1220,12 +1225,12 @@ in
       uid = config.ids.uids.tor;
     };
 
-    services.tor.settings = mkMerge [
-      (mkIf cfg.enableGeoIP {
+    services.tor.settings = lib.mkMerge [
+      (lib.mkIf cfg.enableGeoIP {
         GeoIPFile = "${cfg.package.geoip}/share/tor/geoip";
         GeoIPv6File = "${cfg.package.geoip}/share/tor/geoip6";
       })
-      (mkIf cfg.controlSocket.enable {
+      (lib.mkIf cfg.controlSocket.enable {
         ControlPort = [
           {
             unix = runDir + "/control";
@@ -1234,47 +1239,47 @@ in
           }
         ];
       })
-      (mkIf cfg.relay.enable (
-        optionalAttrs (cfg.relay.role != "exit") {
-          ExitPolicy = mkForce [ "reject *:*" ];
+      (lib.mkIf cfg.relay.enable (
+        lib.optionalAttrs (cfg.relay.role != "exit") {
+          ExitPolicy = lib.mkForce [ "reject *:*" ];
         }
         //
-          optionalAttrs
+          lib.optionalAttrs
             (elem cfg.relay.role [
               "bridge"
               "private-bridge"
             ])
             {
               BridgeRelay = true;
-              ExtORPort.port = mkDefault "auto";
-              ServerTransportPlugin.transports = mkDefault [ "obfs4" ];
-              ServerTransportPlugin.exec = mkDefault "${lib.getExe pkgs.obfs4} managed";
+              ExtORPort.port = lib.mkDefault "auto";
+              ServerTransportPlugin.transports = lib.mkDefault [ "obfs4" ];
+              ServerTransportPlugin.exec = lib.mkDefault "${lib.getExe pkgs.obfs4} managed";
             }
-        // optionalAttrs (cfg.relay.role == "private-bridge") {
+        // lib.optionalAttrs (cfg.relay.role == "private-bridge") {
           ExtraInfoStatistics = false;
           PublishServerDescriptor = false;
         }
       ))
-      (mkIf (!cfg.relay.enable) {
+      (lib.mkIf (!cfg.relay.enable) {
         # Avoid surprises when leaving ORPort/DirPort configurations in cfg.settings,
         # because it would still enable Tor as a relay,
         # which can trigger all sort of problems when not carefully done,
         # like the blocklisting of the machine's IP addresses
         # by some hosting providers...
-        DirPort = mkForce [ ];
-        ORPort = mkForce [ ];
-        PublishServerDescriptor = mkForce false;
+        DirPort = lib.mkForce [ ];
+        ORPort = lib.mkForce [ ];
+        PublishServerDescriptor = lib.mkForce false;
       })
-      (mkIf (!cfg.client.enable) {
+      (lib.mkIf (!cfg.client.enable) {
         # Make sure application connections via SOCKS are disabled
         # when services.tor.client.enable is false
-        SOCKSPort = mkForce [ 0 ];
+        SOCKSPort = lib.mkForce [ 0 ];
       })
-      (mkIf cfg.client.enable (
+      (lib.mkIf cfg.client.enable (
         {
           SOCKSPort = [ cfg.client.socksListenAddress ];
         }
-        // optionalAttrs cfg.client.transparentProxy.enable {
+        // lib.optionalAttrs cfg.client.transparentProxy.enable {
           TransPort = [
             {
               addr = "127.0.0.1";
@@ -1282,7 +1287,7 @@ in
             }
           ];
         }
-        // optionalAttrs cfg.client.dns.enable {
+        // lib.optionalAttrs cfg.client.dns.enable {
           DNSPort = [
             {
               addr = "127.0.0.1";
@@ -1292,8 +1297,8 @@ in
           AutomapHostsOnResolve = true;
         }
         //
-          optionalAttrs
-            (flatten (mapAttrsToList (n: o: o.clientAuthorizations) cfg.client.onionServices) != [ ])
+          lib.optionalAttrs
+            (lib.flatten (lib.mapAttrsToList (n: o: o.clientAuthorizations) cfg.client.onionServices) != [ ])
             {
               ClientOnionAuthDir = runDir + "/ClientOnionAuthDir";
             }
@@ -1305,12 +1310,17 @@ in
         concatMap
           (
             o:
-            if isInt o && o > 0 then [ o ] else optionals (o ? "port" && isInt o.port && o.port > 0) [ o.port ]
+            if isInt o && o > 0 then
+              [ o ]
+            else
+              lib.optionals (o ? "port" && isInt o.port && o.port > 0) [ o.port ]
           )
-          (flatten [
-            cfg.settings.ORPort
-            cfg.settings.DirPort
-          ]);
+          (
+            lib.flatten [
+              cfg.settings.ORPort
+              cfg.settings.DirPort
+            ]
+          );
     };
 
     systemd.services.tor = {
@@ -1332,11 +1342,11 @@ in
             "+"
             + pkgs.writeShellScript "ExecStartPre" (
               concatStringsSep "\n" (
-                flatten (
+                lib.flatten (
                   [ "set -eu" ]
-                  ++ mapAttrsToList (
+                  ++ lib.mapAttrsToList (
                     name: onion:
-                    optional (onion.authorizedClients != [ ]) ''
+                    lib.optional (onion.authorizedClients != [ ]) ''
                       rm -rf ${escapeShellArg onion.path}/authorized_clients
                       install -d -o tor -g tor -m 0700 ${escapeShellArg onion.path} ${escapeShellArg onion.path}/authorized_clients
                     ''
@@ -1344,7 +1354,7 @@ in
                       echo ${pubKey} |
                       install -o tor -g tor -m 0400 /dev/stdin ${escapeShellArg onion.path}/authorized_clients/${toString i}.auth
                     '') onion.authorizedClients
-                    ++ optional (onion.secretKey != null) ''
+                    ++ lib.optional (onion.secretKey != null) ''
                       install -d -o tor -g tor -m 0700 ${escapeShellArg onion.path}
                       key="$(cut -f1 -d: ${escapeShellArg onion.secretKey} | head -1)"
                       case "$key" in
@@ -1354,7 +1364,7 @@ in
                       esac
                     ''
                   ) cfg.relay.onionServices
-                  ++ mapAttrsToList (
+                  ++ lib.mapAttrsToList (
                     name: onion:
                     imap0 (
                       i: prvKeyPath:
@@ -1393,9 +1403,9 @@ in
             "tor"
             "tor/onion"
           ]
-          ++ flatten (
-            mapAttrsToList (
-              name: onion: optional (onion.secretKey == null) "tor/onion/${name}"
+          ++ lib.flatten (
+            lib.mapAttrsToList (
+              name: onion: lib.optional (onion.secretKey == null) "tor/onion/${name}"
             ) cfg.relay.onionServices
           );
         # The following options are only to optimize:
@@ -1410,7 +1420,7 @@ in
             storeDir
             "/etc"
           ]
-          ++ optionals config.services.resolved.enable [
+          ++ lib.optionals config.services.resolved.enable [
             "/run/systemd/resolve/stub-resolv.conf"
             "/run/systemd/resolve/resolv.conf"
           ];
@@ -1423,7 +1433,7 @@ in
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
-        PrivateNetwork = mkDefault false;
+        PrivateNetwork = lib.mkDefault false;
         PrivateTmp = true;
         # Tor cannot currently bind privileged port when PrivateUsers=true,
         # see https://gitlab.torproject.org/legacy/trac/-/issues/20930

nixos/tests/all-tests.nix

@@ -520,6 +520,7 @@ in {
   keyd = handleTest ./keyd.nix {};
   keymap = handleTest ./keymap.nix {};
   kimai = handleTest ./kimai.nix {};
+  kmonad = runTest ./kmonad.nix;
   knot = handleTest ./knot.nix {};
   komga = handleTest ./komga.nix {};
   krb5 = discoverTests (import ./krb5);

nixos/tests/kmonad.nix

@@ -0,0 +1,47 @@
+{ lib, ... }:
+
+{
+  name = "kmonad";
+
+  meta = {
+    maintainers = with lib.maintainers; [ linj ];
+  };
+
+  nodes = {
+    machine = {
+      services.kmonad = {
+        enable = true;
+        keyboards = {
+          defaultKbd = {
+            device = "/dev/input/by-id/vm-default-kbd";
+            defcfg = {
+              enable = true;
+              fallthrough = true;
+            };
+            config = ''
+              (defsrc :name default-src
+                1)
+              (deflayer default-layer :source default-src
+                @T2)
+              (defalias
+                T2 2)
+            '';
+          };
+        };
+      };
+
+      # make a determinate symlink to the default vm keyboard for kmonad to use
+      services.udev.extraRules = ''
+        ACTION=="add", KERNEL=="event*", SUBSYSTEM=="input", ATTRS{name}=="QEMU Virtio Keyboard", ATTRS{id/product}=="0001", ATTRS{id/vendor}=="0627", SYMLINK+="input/by-id/vm-default-kbd"
+      '';
+    };
+  };
+
+  testScript = ''
+    service_name = "kmonad-defaultKbd"
+    machine.wait_for_unit(f"{service_name}.service")
+
+    with subtest("kmonad is running"):
+         machine.succeed(f"systemctl status {service_name}")
+  '';
+}

pkgs/applications/misc/megasync/default.nix

@@ -1,51 +1,69 @@
-{ lib
-, stdenv
-, autoconf
-, automake
-, c-ares
-, cryptopp
-, curl
-, doxygen
-, fetchFromGitHub
-, ffmpeg
-, libmediainfo
-, libraw
-, libsodium
-, libtool
-, libuv
-, libzen
-, lsb-release
-, mkDerivation
-, pkg-config
-, qtbase
-, qttools
-, qtx11extras
-, sqlite
-, swig
-, unzip
-, wget
+{
+  lib,
+  stdenv,
+  c-ares,
+  cmake,
+  cryptopp,
+  curl,
+  fetchFromGitHub,
+  fetchpatch,
+  ffmpeg,
+  hicolor-icon-theme,
+  icu,
+  libmediainfo,
+  libsodium,
+  libtool,
+  libuv,
+  libxcb,
+  libzen,
+  mkDerivation,
+  openssl,
+  pkg-config,
+  qtbase,
+  qtdeclarative,
+  qtgraphicaleffects,
+  qttools,
+  qtquickcontrols,
+  qtquickcontrols2,
+  qtsvg,
+  qtx11extras,
+  readline,
+  sqlite,
+  unzip,
+  wget,
+  xorg,
+  zlib,
+  qt5,
 }:
 mkDerivation rec {
   pname = "megasync";
-  version = "4.9.1.0";
+  version = "5.6.1.0";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitHub rec {
     owner = "meganz";
     repo = "MEGAsync";
     rev = "v${version}_Linux";
-    hash = "sha256-Y1nfY5iP64iSCYwzqxbjZAQNHyj4yVbSudSInm+yJzY=";
-    fetchSubmodules = true;
+    hash = "sha256-EjXmx+beYH3J60RidkEbZHFS5ZAOpJKmNC+WCIM84RA=";
+    fetchSubmodules = false; # DesignTokensImporter cannot be fetched, see #1010 in github:meganz/megasync
+    leaveDotGit = true;
+    postFetch = ''
+      cd $out
+
+      git remote add origin $url
+      git fetch origin
+      git clean -fdx
+      git checkout ${rev}
+      git submodule update --init src/MEGASync/mega
+
+      rm -rf .git
+    ''; # Why so complicated, I just want a single submodule
   };
 
   nativeBuildInputs = [
-    autoconf
-    automake
-    doxygen
+    cmake
     libtool
-    lsb-release
     pkg-config
     qttools
-    swig
     unzip
   ];
   buildInputs = [
@@ -53,23 +71,40 @@ mkDerivation rec {
     cryptopp
     curl
     ffmpeg
+    hicolor-icon-theme
+    icu
     libmediainfo
-    libraw
     libsodium
     libuv
+    libxcb
     libzen
+    openssl
     qtbase
+    qtdeclarative
+    qtgraphicaleffects
+    qtquickcontrols
+    qtquickcontrols2
+    qtsvg
     qtx11extras
+    readline
     sqlite
     wget
+    zlib
   ];
 
   patches = [
-    # Distro and version targets attempt to use lsb_release which is broken
-    # (see issue: https://github.com/NixOS/nixpkgs/issues/22729)
-    ./noinstall-distro-version.patch
-    # megasync target is not part of the install rule thanks to a commented block
-    ./install-megasync.patch
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/020-megasync-sdk-fix-cmake-dependencies-detection.patch?h=megasync&id=4b1eca5bc0d75709dee3a1260264d1b6386d3398";
+      hash = "sha256-y3WhLkawFzQRzzRBpioiyAT3F1NDQvYBOm2888g5V5c=";
+      extraPrefix = "src/MEGASync/mega/";
+      stripLen = true;
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/030-megasync-app-fix-cmake-dependencies-detection.patch?h=megasync&id=4b1eca5bc0d75709dee3a1260264d1b6386d3398";
+      hash = "sha256-11XWctv1veUEguc9Xvz2hMYw26CaCwu6M4hyA+5r81U=";
+    })
+    ./megasync-fix-cmake-install-bindir.patch
+    ./dont-fetch-clang-format.patch
   ];
 
   postPatch = ''
@@ -81,46 +116,24 @@ mkDerivation rec {
   dontUseQmakeConfigure = true;
   enableParallelBuilding = true;
 
-  preConfigure = ''
-    cd src/MEGASync/mega
-    ./autogen.sh
-  '';
-
-  configureFlags = [
-    "--disable-examples"
-    "--disable-java"
-    "--disable-php"
-    "--enable-chat"
-    "--with-cares"
-    "--with-cryptopp"
-    "--with-curl"
-    "--with-ffmpeg"
-    "--without-freeimage"
-    "--without-readline"
-    "--without-termcap"
-    "--with-sodium"
-    "--with-sqlite"
-    "--with-zlib"
+  cmakeFlags = [
+    (lib.cmakeBool "USE_PDFIUM" false) # PDFIUM is not in nixpkgs
+    (lib.cmakeBool "USE_FREEIMAGE" false) # freeimage is insecure
+    (lib.cmakeBool "ENABLE_DESIGN_TOKENS_IMPORTER" false) # cannot be fetched
   ];
 
-  postConfigure = ''
-    cd ../..
-  '';
-
-  preBuild = ''
-    qmake CONFIG+="nofreeimage release" MEGA.pro
-    pushd MEGASync
-      lrelease MEGASync.pro
-      DESKTOP_DESTDIR="$out" qmake PREFIX="$out" -o Makefile MEGASync.pro CONFIG+="nofreeimage release"
-    popd
+  preFixup = ''
+    qtWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ xorg.xrdb ]})
   '';
 
   meta = with lib; {
-    description =
-      "Easy automated syncing between your computers and your MEGA Cloud Drive";
+    description = "Easy automated syncing between your computers and your MEGA Cloud Drive";
     homepage = "https://mega.nz/";
     license = licenses.unfree;
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
     maintainers = [ ];
   };
 }

pkgs/applications/misc/megasync/dont-fetch-clang-format.patch

@@ -0,0 +1,10 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b04f57067..0f6e7b163 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -63,5 +63,3 @@ include(desktopapp_configuration)
+ # Load the MEGA targets
+ add_subdirectory(src)
+ 
+-include(get_clang_format)
+-get_clang_format()

pkgs/applications/misc/megasync/install-megasync.patch

@@ -1,21 +0,0 @@
-Index: source/src/MEGASync/MEGASync.pro
-===================================================================
---- source.orig/src/MEGASync/MEGASync.pro
-+++ source/src/MEGASync/MEGASync.pro
-@@ -28,11 +28,11 @@ unix:!macx {
-     TARGET = megasync
- 
- #    Uncomment the following if "make install" doesn't copy megasync in /usr/bin directory
--#    isEmpty(PREFIX) {
--#        PREFIX = /usr
--#    }
--#    target.path = $$PREFIX/bin
--#    INSTALLS += target
-+    isEmpty(PREFIX) {
-+        PREFIX = /usr
-+    }
-+    target.path = $$PREFIX/bin
-+    INSTALLS += target
- }
- else {
-     TARGET = MEGAsync

pkgs/applications/misc/megasync/megasync-fix-cmake-install-bindir.patch

@@ -0,0 +1,12 @@
+diff --git a/contrib/cmake/modules/desktopapp_configuration.cmake b/contrib/cmake/modules/desktopapp_configuration.cmake
+index 8e9f35cb2..b62f5a9b5 100644
+--- a/contrib/cmake/modules/desktopapp_configuration.cmake
++++ b/contrib/cmake/modules/desktopapp_configuration.cmake
+@@ -30,7 +30,6 @@ if(UNIX AND NOT APPLE)
+     #       Used for building packages: in which install dir is a path construction folder that will not be there in packages
+ 
+     set(CMAKE_INSTALL_LIBDIR "opt/megasync/lib") # override default "lib" from GNUInstallDirs
+-    set(CMAKE_INSTALL_BINDIR "usr/bin") # override default "bin" from GNUInstallDirs
+ 
+     # Override CMAKE_INSTALL_PREFIX
+     if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT) # In consecutive runs it will always be undef/false

pkgs/applications/misc/megasync/noinstall-distro-version.patch

@@ -1,13 +0,0 @@
-Index: source/src/MEGASync/platform/platform.pri
-===================================================================
---- source.orig/src/MEGASync/platform/platform.pri
-+++ source/src/MEGASync/platform/platform.pri
-@@ -37,7 +37,7 @@ unix:!macx {
-     system(command -v lsb_release): version.commands = lsb_release -rs > $$version.target
- 	version.files = $$version.target
- 
--	INSTALLS += distro version
-+	# INSTALLS += distro version
- 
-     QT += dbus
-     SOURCES += $$PWD/linux/LinuxPlatform.cpp \

pkgs/applications/science/chemistry/jmol/default.nix

@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.3.5";
+  version = "16.3.7";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-6fjVVjNnJZMyOZnQQms8NsgzQa7+GLRQwaUw2WHpD98=";
+    hash = "sha256-SQuIjwafPipQy9C2yJQ2CIFV/lSAnHkp1jYnPK1BWcQ=";
   };
 
   patchPhase = ''

pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix

@@ -55,6 +55,8 @@ stdenv.mkDerivation rec {
     shopt -s extglob
     rm -rf deps/!(abc|sanitizers-cmake|subprocess)/*
     shopt -u extglob
+    # https://github.com/emsec/hal/issues/602
+    sed -i 1i'#include <algorithm>' include/hal_core/utilities/utils.h
   '';
 
   nativeBuildInputs = [

pkgs/applications/science/math/R/default.nix

@@ -15,13 +15,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "R";
-  version = "4.4.1";
+  version = "4.4.2";
 
   src = let
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-tMtnXequtymdOyZdIYzeQ/GSlRzluJt7saUUijay2U0=";
+    sha256 = "sha256-FXjNYD6NhmtYdD5J2L+ZxWnoEHm2pgzzPN973/64F+w=";
   };
 
   outputs = [ "out" "tex" ];

pkgs/applications/video/kodi/addons/formula1/default.nix

@@ -10,11 +10,11 @@
 buildKodiAddon rec {
   pname = "formula1";
   namespace = "plugin.video.formula1";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-aClAgkJKvixeKzrwgEsfDhPXiFv9+ULLmb8c9QTaUgM=";
+    sha256 = "sha256-T2q7/bbzarjbqmLQR5g5lBnO0mdrwrWX5/c5GZ48nKM=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/ba/bash-env-json/package.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bash-env-json";
-  version = "0.9.2";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "tesujimath";
     repo = "bash-env-json";
     rev = finalAttrs.version;
-    hash = "sha256-EYro4pMILnQFpXpFjdzSDuudhqC2EvysYMUmIOvesgo=";
+    hash = "sha256-IHfUIAkpaRyBmzT654bAzpTHUhcrtU643uxkPbveYOM=";
   };
 
   installPhase = ''

pkgs/by-name/bo/bossa/package.nix

@@ -5,7 +5,6 @@
   wxGTK32,
   libX11,
   readline,
-  darwin,
   fetchpatch,
 }:
 
@@ -48,15 +47,11 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ bin2c ];
-  buildInputs =
-    [
-      wxGTK32
-      libX11
-      readline
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = [
+    wxGTK32
+    libX11
+    readline
+  ];
 
   makeFlags = [
     "WXVERSION=3.2"
@@ -65,7 +60,15 @@ stdenv.mkDerivation rec {
     "bin/bossash"
     "bin/bossa"
   ];
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-Wno-error=deprecated-declarations"
+    ]
+    ++ lib.optionals stdenv.cc.isClang [
+      "-Wno-error=vla-cxx-extension"
+    ]
+  );
 
   installPhase = ''
     mkdir -p $out/bin

pkgs/by-name/cl/cli-tips/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "cli-tips";
-  version = "0-unstable-2024-11-14";
+  version = "0-unstable-2024-12-26";
 
   src = fetchFromGitHub {
     owner = "cli-stuff";
     repo = "cli-tips";
-    rev = "ebc191a54be7e39accd1948c3de8aded438d0495";
-    hash = "sha256-KELgatdL+2M5ktuAHEljIEJ9wqP578dp5tYWYPpP3bg=";
+    rev = "ddb654baa8ffda13e325e2d48f1089c64025153a";
+    hash = "sha256-eRQcYoqDxhsfbOdWGcYABQMcwjwmYQXfAUzTKeKPW8I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/co/codeberg-pages/package.nix

@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "codeberg-pages";
-  version = "6.1";
+  version = "6.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Codeberg";
     repo = "pages-server";
     rev = "v${version}";
-    hash = "sha256-zG+OicdwtiHm/Ji+xfB61leCq9Ni0ysXkh4pQRju7IA=";
+    hash = "sha256-VZIrg6Hzn9yP9zdOPGx6HOK64XHeX5xc52hZXwmuMKA=";
   };
 
-  vendorHash = "sha256-OmrkO++2vnIY7ay4q3oplDYDPWH1d5VSpDCBM6nD4rk=";
+  vendorHash = "sha256-pBCVkuCuyUxla6+uZM3SWXApBpMv0rFORP4tffXkuF4=";
 
   postPatch = ''
     # disable httptest

pkgs/by-name/co/codeblocks/package.nix

@@ -118,6 +118,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/arnholm/codeblocks_sfmirror/commit/92cb2239662952e3b59b31e03edd653bb8066e64.patch";
       hash = "sha256-XI7JW9Nuueb7muKpaC2icM/CxhrCJtO48cLHK+BVWXI=";
     })
+    (fetchpatch {
+      name = "fix-build-with-clang-2.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/edc6b145bcdcaf2823ef9c7da51a211f65d6f5d0.patch";
+      hash = "sha256-GuttBL4gp1IBn3ia2O8wtOR6xOSGrzwCKXwFLI3RO5o=";
+    })
     (fetchpatch {
       name = "fix-normalize.patch";
       url = "https://github.com/archlinux/svntogit-community/raw/458eacb60bc0e71e3d333943cebbc41e75ed0956/trunk/sc_wxtypes-normalize.patch";

pkgs/by-name/co/colo/package.nix

@@ -0,0 +1,26 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "colo";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "Aloso";
+    repo = "colo";
+    tag = "v${version}";
+    hash = "sha256-ocGzZR4gM2sInXccbHxh7Vf0kcZTZOnVW0KM6zp/pR8=";
+  };
+
+  cargoHash = "sha256-HjEYC7FUHpxNWy/nUVO65O3f/RdT9hYZc3TpcqP3SSM=";
+
+  meta = {
+    description = "Displays colors in various color spaces";
+    homepage = "https://aloso.github.io/colo";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ llakala ];
+  };
+}

pkgs/by-name/in/incus/1531.diff

@@ -0,0 +1,271 @@
+diff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go
+index 1c773213468..fb43917ca96 100644
+--- a/internal/server/instance/drivers/driver_qemu.go
++++ b/internal/server/instance/drivers/driver_qemu.go
+@@ -2393,7 +2393,7 @@ func (d *qemu) deviceAttachPath(deviceName string, configCopy map[string]string,
+ 
+ 	d.logger.Debug("Using PCI bus device to hotplug virtiofs into", logger.Ctx{"device": deviceName, "port": pciDeviceName})
+ 
+-	qemuDev := map[string]string{
++	qemuDev := map[string]any{
+ 		"driver":  "vhost-user-fs-pci",
+ 		"bus":     pciDeviceName,
+ 		"addr":    "00.0",
+@@ -2535,7 +2535,7 @@ func (d *qemu) deviceAttachNIC(deviceName string, configCopy map[string]string,
+ 		return err
+ 	}
+ 
+-	qemuDev := make(map[string]string)
++	qemuDev := make(map[string]any)
+ 
+ 	// PCIe and PCI require a port device name to hotplug the NIC into.
+ 	if slices.Contains([]string{"pcie", "pci"}, qemuBus) {
+@@ -2633,7 +2633,7 @@ func (d *qemu) deviceAttachPCI(deviceName string, configCopy map[string]string,
+ 		return err
+ 	}
+ 
+-	qemuDev := make(map[string]string)
++	qemuDev := make(map[string]any)
+ 	escapedDeviceName := linux.PathNameEncode(devName)
+ 
+ 	d.logger.Debug("Using PCI bus device to hotplug NIC into", logger.Ctx{"device": deviceName, "port": pciDeviceName})
+@@ -3589,7 +3589,7 @@ func (d *qemu) generateQemuConfigFile(cpuInfo *cpuTopology, mountInfo *storagePo
+ 					break
+ 				}
+ 
+-				qemuDev := make(map[string]string)
++				qemuDev := make(map[string]any)
+ 				if slices.Contains([]string{"nvme", "virtio-blk"}, busName) {
+ 					// Allocate a PCI(e) port and write it to the config file so QMP can "hotplug" the
+ 					// drive into it later.
+@@ -3600,7 +3600,7 @@ func (d *qemu) generateQemuConfigFile(cpuInfo *cpuTopology, mountInfo *storagePo
+ 					qemuDev["addr"] = devAddr
+ 
+ 					if multi {
+-						qemuDev["multifunction"] = "on"
++						qemuDev["multifunction"] = true
+ 					}
+ 				}
+ 
+@@ -3624,7 +3624,7 @@ func (d *qemu) generateQemuConfigFile(cpuInfo *cpuTopology, mountInfo *storagePo
+ 
+ 		// Add network device.
+ 		if len(runConf.NetworkInterface) > 0 {
+-			qemuDev := make(map[string]string)
++			qemuDev := make(map[string]any)
+ 			if slices.Contains([]string{"pcie", "pci"}, bus.name) {
+ 				// Allocate a PCI(e) port and write it to the config file so QMP can "hotplug" the
+ 				// NIC into it later.
+@@ -3635,7 +3635,7 @@ func (d *qemu) generateQemuConfigFile(cpuInfo *cpuTopology, mountInfo *storagePo
+ 				qemuDev["addr"] = devAddr
+ 
+ 				if multi {
+-					qemuDev["multifunction"] = "on"
++					qemuDev["multifunction"] = true
+ 				}
+ 			}
+ 
+@@ -3860,7 +3860,7 @@ func (d *qemu) addFileDescriptor(fdFiles *[]*os.File, file *os.File) int {
+ }
+ 
+ // addRootDriveConfig adds the qemu config required for adding the root drive.
+-func (d *qemu) addRootDriveConfig(qemuDev map[string]string, mountInfo *storagePools.MountInfo, bootIndexes map[string]int, rootDriveConf deviceConfig.MountEntryItem) (monitorHook, error) {
++func (d *qemu) addRootDriveConfig(qemuDev map[string]any, mountInfo *storagePools.MountInfo, bootIndexes map[string]int, rootDriveConf deviceConfig.MountEntryItem) (monitorHook, error) {
+ 	if rootDriveConf.TargetPath != "/" {
+ 		return nil, fmt.Errorf("Non-root drive config supplied")
+ 	}
+@@ -3992,7 +3992,7 @@ func (d *qemu) addDriveDirConfig(cfg *[]cfgSection, bus *qemuBus, fdFiles *[]*os
+ }
+ 
+ // addDriveConfig adds the qemu config required for adding a supplementary drive.
+-func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]int, driveConf deviceConfig.MountEntryItem) (monitorHook, error) {
++func (d *qemu) addDriveConfig(qemuDev map[string]any, bootIndexes map[string]int, driveConf deviceConfig.MountEntryItem) (monitorHook, error) {
+ 	aioMode := "native" // Use native kernel async IO and O_DIRECT by default.
+ 	cacheMode := "none" // Bypass host cache, use O_DIRECT semantics by default.
+ 	media := "disk"
+@@ -4248,7 +4248,7 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
+ 	}
+ 
+ 	if qemuDev == nil {
+-		qemuDev = map[string]string{}
++		qemuDev = map[string]any{}
+ 	}
+ 
+ 	qemuDev["id"] = fmt.Sprintf("%s%s", qemuDeviceIDPrefix, escapedDeviceName)
+@@ -4256,8 +4256,8 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
+ 	qemuDev["serial"] = fmt.Sprintf("%s%s", qemuBlockDevIDPrefix, escapedDeviceName)
+ 
+ 	if bus == "virtio-scsi" {
+-		qemuDev["channel"] = "0"
+-		qemuDev["lun"] = "1"
++		qemuDev["channel"] = 0
++		qemuDev["lun"] = 1
+ 		qemuDev["bus"] = "qemu_scsi.0"
+ 
+ 		if media == "disk" {
+@@ -4282,7 +4282,7 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
+ 	}
+ 
+ 	if bootIndexes != nil {
+-		qemuDev["bootindex"] = strconv.Itoa(bootIndexes[driveConf.DevName])
++		qemuDev["bootindex"] = bootIndexes[driveConf.DevName]
+ 	}
+ 
+ 	monHook := func(m *qmp.Monitor) error {
+@@ -4336,7 +4336,7 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
+ 		}
+ 
+ 		if driveConf.Limits != nil {
+-			err = m.SetBlockThrottle(qemuDev["id"], int(driveConf.Limits.ReadBytes), int(driveConf.Limits.WriteBytes), int(driveConf.Limits.ReadIOps), int(driveConf.Limits.WriteIOps))
++			err = m.SetBlockThrottle(qemuDev["id"].(string), int(driveConf.Limits.ReadBytes), int(driveConf.Limits.WriteBytes), int(driveConf.Limits.ReadIOps), int(driveConf.Limits.WriteIOps))
+ 			if err != nil {
+ 				return fmt.Errorf("Failed applying limits for disk device %q: %w", driveConf.DevName, err)
+ 			}
+@@ -4351,7 +4351,7 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
+ 
+ // addNetDevConfig adds the qemu config required for adding a network device.
+ // The qemuDev map is expected to be preconfigured with the settings for an existing port to use for the device.
+-func (d *qemu) addNetDevConfig(busName string, qemuDev map[string]string, bootIndexes map[string]int, nicConfig []deviceConfig.RunConfigItem) (monitorHook, error) {
++func (d *qemu) addNetDevConfig(busName string, qemuDev map[string]any, bootIndexes map[string]int, nicConfig []deviceConfig.RunConfigItem) (monitorHook, error) {
+ 	reverter := revert.New()
+ 	defer reverter.Fail()
+ 
+@@ -4382,7 +4382,7 @@ func (d *qemu) addNetDevConfig(busName string, qemuDev map[string]string, bootIn
+ 	if len(bootIndexes) > 0 {
+ 		bootIndex, found := bootIndexes[devName]
+ 		if found {
+-			qemuDev["bootindex"] = strconv.Itoa(bootIndex)
++			qemuDev["bootindex"] = bootIndex
+ 		}
+ 	}
+ 
+@@ -4400,9 +4400,9 @@ func (d *qemu) addNetDevConfig(busName string, qemuDev map[string]string, bootIn
+ 		// Number of vectors is number of vCPUs * 2 (RX/TX) + 2 (config/control MSI-X).
+ 		vectors := 2*queueCount + 2
+ 		if vectors > 0 {
+-			qemuDev["mq"] = "on"
++			qemuDev["mq"] = true
+ 			if slices.Contains([]string{"pcie", "pci"}, busName) {
+-				qemuDev["vectors"] = strconv.Itoa(vectors)
++				qemuDev["vectors"] = vectors
+ 			}
+ 		}
+ 
+@@ -4591,9 +4591,9 @@ func (d *qemu) addNetDevConfig(busName string, qemuDev map[string]string, bootIn
+ 			}
+ 
+ 			qemuDev["netdev"] = qemuNetDev["id"].(string)
+-			qemuDev["page-per-vq"] = "on"
+-			qemuDev["iommu_platform"] = "on"
+-			qemuDev["disable-legacy"] = "on"
++			qemuDev["page-per-vq"] = true
++			qemuDev["iommu_platform"] = true
++			qemuDev["disable-legacy"] = true
+ 
+ 			err = m.AddNIC(qemuNetDev, qemuDev)
+ 			if err != nil {
+@@ -4819,7 +4819,7 @@ func (d *qemu) addGPUDevConfig(cfg *[]cfgSection, bus *qemuBus, gpuConfig []devi
+ }
+ 
+ func (d *qemu) addUSBDeviceConfig(usbDev deviceConfig.USBDeviceItem) (monitorHook, error) {
+-	device := map[string]string{
++	qemuDev := map[string]any{
+ 		"id":     fmt.Sprintf("%s%s", qemuDeviceIDPrefix, usbDev.DeviceName),
+ 		"driver": "usb-host",
+ 		"bus":    "qemu_usb.0",
+@@ -4836,18 +4836,18 @@ func (d *qemu) addUSBDeviceConfig(usbDev deviceConfig.USBDeviceItem) (monitorHoo
+ 
+ 		defer func() { _ = f.Close() }()
+ 
+-		info, err := m.SendFileWithFDSet(device["id"], f, false)
++		info, err := m.SendFileWithFDSet(qemuDev["id"].(string), f, false)
+ 		if err != nil {
+ 			return fmt.Errorf("Failed to send file descriptor: %w", err)
+ 		}
+ 
+ 		revert.Add(func() {
+-			_ = m.RemoveFDFromFDSet(device["id"])
++			_ = m.RemoveFDFromFDSet(qemuDev["id"].(string))
+ 		})
+ 
+-		device["hostdevice"] = fmt.Sprintf("/dev/fdset/%d", info.ID)
++		qemuDev["hostdevice"] = fmt.Sprintf("/dev/fdset/%d", info.ID)
+ 
+-		err = m.AddDevice(device)
++		err = m.AddDevice(qemuDev)
+ 		if err != nil {
+ 			return fmt.Errorf("Failed to add device: %w", err)
+ 		}
+@@ -9188,19 +9188,19 @@ func (d *qemu) setCPUs(monitor *qmp.Monitor, count int) error {
+ 
+ 			devID := fmt.Sprintf("cpu%d%d%d", cpu.Props.SocketID, cpu.Props.CoreID, cpu.Props.ThreadID)
+ 
+-			dev := map[string]string{
++			qemuDev := map[string]any{
+ 				"id":      devID,
+ 				"driver":  cpu.Type,
+-				"core-id": fmt.Sprintf("%d", cpu.Props.CoreID),
++				"core-id": cpu.Props.CoreID,
+ 			}
+ 
+ 			// No such thing as sockets and threads on s390x.
+ 			if d.architecture != osarch.ARCH_64BIT_S390_BIG_ENDIAN {
+-				dev["socket-id"] = fmt.Sprintf("%d", cpu.Props.SocketID)
+-				dev["thread-id"] = fmt.Sprintf("%d", cpu.Props.ThreadID)
++				qemuDev["socket-id"] = cpu.Props.SocketID
++				qemuDev["thread-id"] = cpu.Props.ThreadID
+ 			}
+ 
+-			err := monitor.AddDevice(dev)
++			err := monitor.AddDevice(qemuDev)
+ 			if err != nil {
+ 				return fmt.Errorf("Failed to add device: %w", err)
+ 			}
+@@ -9229,12 +9229,12 @@ func (d *qemu) setCPUs(monitor *qmp.Monitor, count int) error {
+ 			}
+ 
+ 			revert.Add(func() {
+-				err := monitor.AddDevice(map[string]string{
++				err := monitor.AddDevice(map[string]any{
+ 					"id":        devID,
+ 					"driver":    cpu.Type,
+-					"socket-id": fmt.Sprintf("%d", cpu.Props.SocketID),
+-					"core-id":   fmt.Sprintf("%d", cpu.Props.CoreID),
+-					"thread-id": fmt.Sprintf("%d", cpu.Props.ThreadID),
++					"socket-id": cpu.Props.SocketID,
++					"core-id":   cpu.Props.CoreID,
++					"thread-id": cpu.Props.ThreadID,
+ 				})
+ 				d.logger.Warn("Failed to add CPU device", logger.Ctx{"err": err})
+ 			})
+diff --git a/internal/server/instance/drivers/qmp/commands.go b/internal/server/instance/drivers/qmp/commands.go
+index 3e9752780c5..d81da8ff4f4 100644
+--- a/internal/server/instance/drivers/qmp/commands.go
++++ b/internal/server/instance/drivers/qmp/commands.go
+@@ -538,7 +538,7 @@ func (m *Monitor) SetMemoryBalloonSizeBytes(sizeBytes int64) error {
+ }
+ 
+ // AddBlockDevice adds a block device.
+-func (m *Monitor) AddBlockDevice(blockDev map[string]any, device map[string]string) error {
++func (m *Monitor) AddBlockDevice(blockDev map[string]any, device map[string]any) error {
+ 	revert := revert.New()
+ 	defer revert.Fail()
+ 
+@@ -624,7 +624,7 @@ func (m *Monitor) RemoveCharDevice(deviceID string) error {
+ }
+ 
+ // AddDevice adds a new device.
+-func (m *Monitor) AddDevice(device map[string]string) error {
++func (m *Monitor) AddDevice(device map[string]any) error {
+ 	if device != nil {
+ 		err := m.Run("device_add", device, nil)
+ 		if err != nil {
+@@ -656,7 +656,7 @@ func (m *Monitor) RemoveDevice(deviceID string) error {
+ }
+ 
+ // AddNIC adds a NIC device.
+-func (m *Monitor) AddNIC(netDev map[string]any, device map[string]string) error {
++func (m *Monitor) AddNIC(netDev map[string]any, device map[string]any) error {
+ 	revert := revert.New()
+ 	defer revert.Fail()
+ 

pkgs/by-name/in/incus/package.nix

@@ -2,5 +2,8 @@ import ./generic.nix {
   hash = "sha256-Ir+cT+2xA+L4kBXhwA0XXE/D8zjMPGYiwW0VrEdobZ4=";
   version = "6.8.0";
   vendorHash = "sha256-CDLq41AB2Y9nYlTuXZaAOgwXIin9CbqSXCFoigsc14A=";
-  patches = [ ];
+  patches = [
+    # qemu 9.2 support
+    ./1531.diff
+  ];
 }

pkgs/by-name/li/libtorrent/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rakshasa-libtorrent";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
     rev = "v${version}";
-    hash = "sha256-MDLAp7KFmVvHL+haWVYwWG8gnLkTh6g19ydRkbu9cIs=";
+    hash = "sha256-FtuVDXH9vIdz+Wz7PLY2lRZkR+j9NYmgaHPDDx2SA98=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/linbox/package.nix

@@ -30,6 +30,25 @@ stdenv.mkDerivation rec {
       url = "https://github.com/linbox-team/linbox/commit/4be26e9ef0eaf36a9909e5008940e8bf7dc625b6.patch";
       sha256 = "PX0Tik7blXOV2vHUq92xMxaADkNoNGiax4qrjQyGK6U=";
     })
+    (fetchpatch {
+      name = "gcc-14.patch";
+      url = "https://github.com/linbox-team/linbox/commit/b8f2d4ccdc0af4418d14f72caf6c4d01969092a3.patch";
+      includes = [
+        "linbox/matrix/sparsematrix/sparse-ell-matrix.h"
+        "linbox/matrix/sparsematrix/sparse-ellr-matrix.h"
+      ];
+      hash = "sha256-sqwgHkECexR2uX/SwYP7r9ZGHnGG+i4RXtfnvWsVQlk=";
+    })
+    (fetchpatch {
+      name = "clang-19.patch";
+      url = "https://github.com/linbox-team/linbox/commit/4f7a9bc830696b2f2c0219feaa74e85202700412.patch";
+      hash = "sha256-DoKh8/+2WPbMhN9MhpKmQ5sKmizD9iE81zS/XI0aM9Q=";
+    })
+    (fetchpatch {
+      name = "clang-19.patch";
+      url = "https://github.com/linbox-team/linbox/commit/4a1e1395804d4630ec556c61ba3f2cb67e140248.patch";
+      hash = "sha256-sCe/8hb27RuMxU1XXWsVU5gaGk2V+T6Ee7yrC5G5Hsc=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/mp/mpfi/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   autoreconfHook,
   texinfo,
   mpfr,
@@ -26,6 +27,15 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "${src.name}/mpfi";
 
+  patches = [
+    (fetchpatch {
+      name = "incorrect-types-corrected.patch";
+      url = "https://gitlab.inria.fr/mpfi/mpfi/-/commit/a02e3f9cc10767cc4284a2ef6554f6df85e41982.patch";
+      relative = "mpfi";
+      hash = "sha256-ogUoZbQMkZMF8chSGdDymH/ewzjKSSc7GAMK2Wp58uo=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     texinfo

pkgs/by-name/op/open-webui/package.nix

@@ -7,19 +7,19 @@
 }:
 let
   pname = "open-webui";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-QQSJaef/0G8elj3c3uVWq9Yh7puNhe0vZc+IVH3rDpE=";
+    hash = "sha256-6jMlEA3GufTXikyg5txyTtpPzIfk6hA9zkg+015UnqY=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-SUrI5nKtW/NoqT2BNRjBM9Aw9KIZL/T6SEtEbazhvPQ=";
+    npmDepsHash = "sha256-2Zu9YlkL3PY2MgN6NAjCVQL2f2CWXP0AsQcOGEs7B1g=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.

pkgs/by-name/os/osu-lazer-bin/package.nix

@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2024.1224.1";
+  version = "2025.101.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-p/1rmz+CnuVl72wOKJpHFkJv64vKRoMSV15KRUgjhu0=";
+        hash = "sha256-JPRjnpBt9CW4/8ykPbVCM6kv8CXEacqJTt6CPByd1P4=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-jVEjqpKJsFC+rSwSNokKxYarwB4CybWSG8gdtxocFZ4=";
+        hash = "sha256-ryDKe8A8pCycPpupWv+zEtGWFs96sBahLF00hCzUViM=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-9qZ5XNAII2I4PemNGrWuUCY1Syq5PH3NBc2/Jj5tcoQ=";
+        hash = "sha256-GsnTxVpNk2RXHLET6Ugv0/ZOlq8RUkw2ZXqRjkU+dzw=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/os/osu-lazer/package.nix

@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2024.1224.1";
+  version = "2025.101.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-T9KYb+fVcCWtb33ImHyoipJqsLr2em4GoYyvsSgIWx0=";
+    hash = "sha256-8sckmwFFL7Vcf947EVxqIRPU/yYrEFVwz+zqwZZ34Mw=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

pkgs/by-name/pa/passage/package.nix

@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./darwin-getopt-path.patch {
       inherit getopt;
     })
+    ./set-correct-program-name-for-sleep.patch
   ];
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/pa/passage/set-correct-program-name-for-sleep.patch

@@ -0,0 +1,50 @@
+From d11261c2ad184daf6e9edd777bc8a3372c277b4b Mon Sep 17 00:00:00 2001
+From: Johannes Frankenau <johannes@frankenau.net>
+Date: Fri, 10 Aug 2018 09:49:57 +0200
+Subject: [PATCH] Patch the clip() function to work even when using
+ single-binary coreutils
+
+---
+ src/platform/cygwin.sh | 4 ++--
+ src/platform/darwin.sh | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/platform/cygwin.sh b/src/platform/cygwin.sh
+index 5a8d5ea..423e0ce 100644
+--- a/src/platform/cygwin.sh
++++ b/src/platform/cygwin.sh
+@@ -3,11 +3,11 @@
+ 
+ clip() {
+ 	local sleep_argv0="password store sleep on display $DISPLAY"
+-	pkill -f "^$sleep_argv0" 2>/dev/null && sleep 0.5
++	pkill -P $(pgrep -f "^$sleep_argv0") 2>/dev/null && sleep 0.5
+ 	local before="$($BASE64 < /dev/clipboard)"
+ 	echo -n "$1" > /dev/clipboard
+ 	(
+-		( exec -a "$sleep_argv0" sleep "$CLIP_TIME" )
++		( exec -a "$sleep_argv0" bash <(echo sleep "$CLIP_TIME") )
+ 		local now="$($BASE64 < /dev/clipboard)"
+ 		[[ $now != $(echo -n "$1" | $BASE64) ]] && before="$now"
+ 		echo "$before" | $BASE64 -d > /dev/clipboard
+diff --git a/src/platform/darwin.sh b/src/platform/darwin.sh
+index 342ecce..9e12837 100644
+--- a/src/platform/darwin.sh
++++ b/src/platform/darwin.sh
+@@ -3,11 +3,11 @@
+ 
+ clip() {
+ 	local sleep_argv0="password store sleep for user $(id -u)"
+-	pkill -f "^$sleep_argv0" 2>/dev/null && sleep 0.5
++	pkill -P $(pgrep -f "^$sleep_argv0") 2>/dev/null && sleep 0.5
+ 	local before="$(pbpaste | $BASE64)"
+ 	echo -n "$1" | pbcopy
+ 	(
+-		( exec -a "$sleep_argv0" sleep "$CLIP_TIME" )
++		( exec -a "$sleep_argv0" bash <(echo sleep "$CLIP_TIME") )
+ 		local now="$(pbpaste | $BASE64)"
+ 		[[ $now != $(echo -n "$1" | $BASE64) ]] && before="$now"
+ 		echo "$before" | $BASE64 -d | pbcopy
+-- 
+2.16.4
+

pkgs/by-name/py/pybugz/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pybugz";
+  version = "0.14";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "williamh";
+    repo = "pybugz";
+    tag = version;
+    hash = "sha256-rhiCQPSh987QEM4aMd3R/7e6l+pm2eJDE7f5LckIuho=";
+  };
+
+  build-system = [ python3Packages.flit-core ];
+
+  pythonImportsCheck = [ "bugz" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = {
+    homepage = "https://github.com/williamh/pybugz";
+    description = "Command line interface for Bugzilla";
+    mainProgram = "bugz";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+  };
+}

pkgs/by-name/se/serie/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "serie";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "serie";
     rev = "v${version}";
-    hash = "sha256-RP9Tv6IrDfawjXCQp0nB0nd7b6IwkdykHcEfGEguFHo=";
+    hash = "sha256-F7AlDuvRYCMhOXyzg9/oTukAEaDJENG0ZEhIlNe+Cic=";
   };
 
-  cargoHash = "sha256-HxIyWlFKDRod5nSENZguNYz/vn+E9Ux0K3dMhX7I/zQ=";
+  cargoHash = "sha256-Ug4dB3Xx0bm4brztpBbf55QdWc+7nyShMYP8kPC/82k=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks;

pkgs/by-name/sv/sview/package.nix

@@ -0,0 +1,85 @@
+{
+  fetchFromGitHub,
+  fetchurl,
+  ffmpeg_4,
+  fontconfig,
+  gtk2,
+  lib,
+  libconfig,
+  libGL,
+  libXpm,
+  makeFontsConf,
+  makeWrapper,
+  nanum,
+  openal,
+  pkg-config,
+  stdenv,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sview";
+  version = "20_08";
+
+  src = fetchFromGitHub {
+    owner = "gkv311";
+    repo = "sview";
+    tag = version;
+    hash = "sha256-mbEacdBQchziXoZ5vJUiEpa/iHeXeaozte2aXs50/Fo=";
+  };
+
+  droidSansFallback = fetchurl {
+    url = "https://raw.githubusercontent.com/aosp-mirror/platform_frameworks_base/2d8961d99f3aa559dbd4b78b716ab36c456b43e1/data/fonts/DroidSansFallbackFull.ttf";
+    sha256 = "sha256-I5IBVTBDi6/Ejt/ErubZ3iOH9iemE02Ks9/MmdIcgkA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    ffmpeg_4
+    gtk2
+    libconfig
+    libGL
+    libXpm
+    openal
+  ];
+
+  fontsConf = makeFontsConf {
+    fontDirectories = [
+      nanum
+      "placeholder"
+    ];
+  };
+
+  installPhase = ''
+    runHook preInstall
+    make install APP_PREFIX=$out DISABLE_UPDATER=1
+    mkdir -p $out/share/sView/fonts
+    cp ${droidSansFallback} $out/share/sView/fonts/DroidSansFallbackFull.ttf
+    cp '${fontsConf}' $out/share/sView/fonts/fonts.conf
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/share/sView/fonts/fonts.conf \
+      --replace-warn "placeholder" "$out/share/sView/fonts/";
+    wrapProgram $out/bin/sView \
+      --set StShare $out/share/sView \
+      --set FONTCONFIG_FILE $out/share/sView/fonts/fonts.conf
+  '';
+
+  meta = with lib; {
+    description = "Viewer for 3D stereoscopic videos and images";
+    homepage = "https://www.sview.ru/en/";
+    license = with licenses; [
+      cc-by-40
+      gpl3Only
+      asl20
+    ];
+    maintainers = with maintainers; [ mx2uller ];
+    mainProgram = "sView";
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/wo/worldofgoo/package.nix

@@ -73,6 +73,8 @@ stdenv.mkDerivation rec {
     patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath $libPath $out/bin/WorldOfGoo.bin.${arch}
   '';
 
+  dontStrip = true;
+
   meta = with lib; {
     description = "Physics based puzzle game";
     longDescription = ''

pkgs/by-name/xn/xnee/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchpatch,
+  fetchDebianPatch,
   autoreconfHook,
   pkg-config,
   gtk2,
@@ -31,6 +32,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://savannah.gnu.org/bugs/download.php?file_id=49534";
       hash = "sha256-Ar5SyVIEp8/knDHm+4f0KWAH+A5gGhXGezEqL7xkQhI=";
     })
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "9.2";
+      patch = "fix-implicit-declarations.patch";
+      hash = "sha256-ct/ATuiC6b7rw9n2wsRNKvfj02i7V20bMOzL7pKDd0A=";
+    })
   ];
 
   postPatch =

pkgs/development/haskell-modules/configuration-nix.nix

@@ -1512,7 +1512,14 @@ self: super: builtins.intersectAttrs super {
   # cause actual problems in dependent packages, see https://github.com/lehins/pvar/issues/4
   pvar = dontCheck super.pvar;
 
-  kmonad = enableSeparateBinOutput super.kmonad;
+  kmonad = lib.pipe super.kmonad [
+    enableSeparateBinOutput
+    (overrideCabal (drv: {
+      passthru = lib.recursiveUpdate
+        drv.passthru or { }
+        { tests.nixos = pkgs.nixosTests.kmonad; };
+    }))
+  ];
 
   xmobar = enableSeparateBinOutput super.xmobar;
 

pkgs/development/libraries/boost/generic.nix

@@ -89,6 +89,8 @@ let
       "link=${link}"
       "-sEXPAT_INCLUDE=${expat.dev}/include"
       "-sEXPAT_LIBPATH=${expat.out}/lib"
+    ]
+    ++ lib.optionals (lib.versionAtLeast version "1.85") [
       (
         # The stacktrace from exception feature causes memory leaks when built
         # with libc++. For all other standard library implementations, i.e.
@@ -99,9 +101,8 @@ let
         else
           "define=BOOST_STACKTRACE_LIBCXX_RUNTIME_MAY_CAUSE_MEMORY_LEAK"
       )
-
-      # TODO: make this unconditional
     ]
+    # TODO: make this unconditional
     ++
       lib.optionals
         (

pkgs/development/libraries/givaro/default.nix

@@ -31,6 +31,19 @@ stdenv.mkDerivation rec {
       url = "https://github.com/linbox-team/givaro/commit/a81d44b3b57c275bcb04ab00db79be02561deaa2.patch";
       hash = "sha256-sSk+VWffoEjZRTJcHRISLHPyW6yuvI1u8knBOfxNUIE=";
     })
+    # https://github.com/linbox-team/givaro/issues/226
+    (fetchpatch {
+      name = "gcc-14.patch";
+      url = "https://github.com/linbox-team/givaro/commit/b0cf33e1d4437530c7e4b3db90b6c80057a7f2f3.patch";
+      includes = [ "src/kernel/integer/random-integer.h" ];
+      hash = "sha256-b2Q8apP9ueEqIUtibTeP47x6TlroRzLgAxuv5ZM1EUw=";
+    })
+    # https://github.com/linbox-team/givaro/issues/232
+    (fetchpatch {
+      name = "clang-19.patch";
+      url = "https://github.com/linbox-team/givaro/commit/a18baf5227d4f3e81a50850fe98e0d954eaa3ddb.patch";
+      hash = "sha256-IR0IHhCqbxgtsST30vxM9ak1nGtt0apxcLUQ1kS1DHw=";
+    })
   ];
 
   enableParallelBuilding = true;

pkgs/development/libraries/itk/5.x.nix

@@ -1,5 +1,5 @@
 import ./generic.nix rec {
-  version = "5.4.0";
+  version = "5.4.1";
   rev = "refs/tags/v${version}";
-  sourceSha256 = "sha256-1RSWgH0iQ2NQNsieW2m37udXWQlqYslJNM3TXC9xeP4=";
+  sourceSha256 = "sha256-XzBmfyv7Bz7CD/RaNgL888R6rUossWLCS8QtbCLPBnY=";
 }

pkgs/development/ocaml-modules/patch/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  gitUpdater,
+  alcotest,
+  crowbar,
+}:
+
+buildDunePackage rec {
+  pname = "patch";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "hannesm";
+    repo = "patch";
+    tag = "v${version}";
+    hash = "sha256-xqcUZaKlbyXF2//MbCom7/pGA2ej6KHYI3rizXwoqTY=";
+  };
+
+  checkInputs = [
+    alcotest
+    crowbar
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Patch library purely in OCaml";
+    longDescription = ''
+      This is a library which parses unified diff and git diff output, and can apply a patch in memory.
+    '';
+    homepage = "https://github.com/hannesm/patch";
+    maintainers = with lib.maintainers; [ r17x ];
+    license = lib.licenses.isc;
+  };
+}

pkgs/development/ocaml-modules/raylib/default.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  dune-configurator,
+  ctypes,
+  integers,
+  patch,
+  gitUpdater,
+}:
+
+buildDunePackage rec {
+  pname = "raylib";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "tjammer";
+    repo = "raylib-ocaml";
+    tag = version;
+    hash = "sha256-Fh79YnmboQF5Kn3VF//JKLaIFKl8QJWVOqRexTzxF0U=";
+    # enable submodules for vendored raylib sources
+    fetchSubmodules = true;
+  };
+
+  propagatedBuildInputs = [
+    dune-configurator
+    ctypes
+    integers
+    patch
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "OCaml bindings for Raylib (5.0.0)";
+    homepage = "https://tjammer.github.io/raylib-ocaml";
+    maintainers = with lib.maintainers; [ r17x ];
+    license = lib.licenses.mit;
+  };
+}

pkgs/development/ocaml-modules/raylib/raygui.nix

@@ -0,0 +1,18 @@
+{
+  buildDunePackage,
+  raylib,
+}:
+
+buildDunePackage {
+  pname = "raygui";
+
+  inherit (raylib) src version;
+
+  propagatedBuildInputs = [
+    raylib
+  ];
+
+  meta = raylib.meta // {
+    description = "OCaml bindings for raygui";
+  };
+}

pkgs/development/python-modules/aiosomecomfort/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "aiosomecomfort";
-  version = "0.0.26";
+  version = "0.0.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkmer";
     repo = "AIOSomecomfort";
-    rev = "refs/tags/${version}";
-    hash = "sha256-Vu49mJoS2FTXvlyJ/BFDJmh8uS/ZYM+Lb3IO8TTcZYg=";
+    tag = version;
+    hash = "sha256-AsYq5ElfHtUoEEI5TMIs0wf5yMK1ZKCteWYfTon+Wik=";
   };
 
   build-system = [

pkgs/development/python-modules/amqp/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "amqp";
-  version = "5.3.0";
+  version = "5.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ET5mMQai+wEjyQMNQr85WbliSSg/8UI6sH9crQYtNvc=";
+    hash = "sha256-zdwAxyVElSICO62Un3D/97SPCxredNFwpvEKsERzlDI=";
   };
 
   propagatedBuildInputs = [ vine ];

pkgs/development/python-modules/awswrangler/default.nix

@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "awswrangler";
-  version = "3.9.1";
+  version = "3.10.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,8 +33,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-pandas";
-    rev = "refs/tags/${version}";
-    hash = "sha256-k+jQj/EajjjvvXZJd8c/3vtaGrQJedbYSDIzel0Sp44=";
+    tag = version;
+    hash = "sha256-JR1gO24biFluwqZAIQMFGjjbn9VBxTlAS8i76N82onc=";
   };
 
   pythonRelaxDeps = [ "packaging" ];

pkgs/development/python-modules/azure-mgmt-network/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-network";
-  version = "28.0.0";
+  version = "28.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_mgmt_network";
     inherit version;
-    hash = "sha256-QDVtNI70g4Mk8ZpBzYA0C0+N1KwvChiky9XMle8pdPM=";
+    hash = "sha256-jIS/+17HXG4CROWOzwfADV/EIdYWsMs2nG/lha8zz4c=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/bugz/default.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-}:
-
-buildPythonPackage {
-  pname = "bugz-0.9.3";
-  version = "0.13";
-
-  src = fetchFromGitHub {
-    owner = "williamh";
-    repo = "pybugz";
-    rev = "0.13";
-    sha256 = "1nw07q7r078dp82rcrhvvnhmnaqjx6f8a6cdjgrsiy6fryrx9dwz";
-  };
-
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://github.com/williamh/pybugz";
-    description = "Command line interface for Bugzilla";
-    mainProgram = "bugz";
-    license = licenses.gpl2;
-    maintainers = [ ];
-  };
-}

pkgs/development/python-modules/commitizen/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.0.0";
+  version = "4.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "commitizen-tools";
     repo = "commitizen";
     rev = "refs/tags/v${version}";
-    hash = "sha256-M6JoBVst2aJwxr/SyMpXXOnMKIl9gX0ltg3H0SpU7uQ=";
+    hash = "sha256-f3uusTNGMK6a3Plh6FHBeM8vEXDZW31o9E0i+sWsBgE=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/commoncode/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "commoncode";
-  version = "32.0.0";
+  version = "32.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "nexB";
     repo = "commoncode";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-yqvsBJHrxVkSqp3QnYmHDJr3sef/g4pkSlkSioYuOc4=";
+    tag = "v${version}";
+    hash = "sha256-TzQmAJlgcHaarUhicIH4EbOIn+3feu43QQlLq+Z5ERA=";
   };
 
   dontConfigure = true;

pkgs/development/python-modules/databricks-sql-connector/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "databricks-sql-connector";
-  version = "3.6.0";
+  version = "3.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,8 +28,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sql-python";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-Y0jI/06jVbivKkKd8ZXvotBBo+nvo7Wmp4VypTzDf5k=";
+    tag = "v${version}";
+    hash = "sha256-drtMkES3eHo1LfUICwxsIwfVc1qA0+0ZWm5W+Av81Z8=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/datalad/default.nix

@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "datalad";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "datalad";
     repo = "datalad";
-    rev = "refs/tags/${version}";
-    hash = "sha256-sIWHBaqTJuKQHvh+L10PUehsmjRFl/holXzp0SMqr+k=";
+    tag = version;
+    hash = "sha256-XwzYlSP2MbEb0U3tuVOq3NNqLTS08UzSfSFBidHbpAY=";
   };
 
   postPatch = ''

pkgs/development/python-modules/diff-cover/default.nix

@@ -20,15 +20,15 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "9.2.0";
+  version = "9.2.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-haCzU+u7Z4+eh+owP3W1Rb0LrKOPVjIZu3LyroYrujY=";
+    hash = "sha256-X6Wy1xzPXRbNIipxwsoGnZv1+j1lf2+sm02cIzeTI78=";
   };
 
   nativeBuildInputs = [ poetry-core ];

pkgs/development/python-modules/django-hijack/default.nix

@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-hijack";
-  version = "3.7.0";
+  version = "3.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-hijack";
     repo = "django-hijack";
     rev = "refs/tags/${version}";
-    hash = "sha256-WQ6s5s4Gccog78++tZX2IZ1605OHGhYSb2aTuU7LyBc=";
+    hash = "sha256-3P7SCKS+ThBRNfXpN17N1y5vhYYWRL2JGVBOUHRdhK8=";
   };
 
   build-system = [

pkgs/development/python-modules/djangorestframework-stubs/default.nix

@@ -19,16 +19,16 @@
 
 buildPythonPackage rec {
   pname = "djangorestframework-stubs";
-  version = "3.15.1";
+  version = "3.15.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "typeddjango";
     repo = "djangorestframework-stubs";
-    rev = "refs/tags/${version}";
-    hash = "sha256-m9KxC3dGe+uRB3YIykV/SCOHeItRYNKopF9fqCd10Vk=";
+    tag = version;
+    hash = "sha256-ZpnPJZhuKZCy6tV8KBRC4Wjr3t0igQOkkUyVtmmVRMg=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/dvclive/default.nix

@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.48.0";
+  version = "3.48.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvclive";
     rev = "refs/tags/${version}";
-    hash = "sha256-WIVRpJD7B6OI7ZfdHT+DunRRiaxHhri5Ge/B1BQ1kJY=";
+    hash = "sha256-fLlP3kWmThQVVPEOd9KWitBIye/fhd/+zcHoVTF/pV8=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/elasticsearch-dsl/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch-dsl";
-  version = "8.16.0";
+  version = "8.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "elasticsearch_dsl";
     inherit version;
-    hash = "sha256-Bb1QUO730HBqRIfNIoZNPBWMjhy8omtT7xpHO97hNFk=";
+    hash = "sha256-wgQhgXVGLRCKhPuRM3HkXT9J6d1xHKJux+2Jq06PKH0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/fakeredis/default.nix

@@ -18,16 +18,16 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.26.1";
+  version = "2.26.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-eBWdrN6QfrZaavKGuVMaU0s+k0VpsBCIaIzuxC7HyYE=";
+    tag = "v${version}";
+    hash = "sha256-jD0e04ltH1MjExfrPsR6LUn4X0/qoJZWzX9i2A58HHI=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/flask-limiter/default.nix

@@ -21,16 +21,16 @@
 
 buildPythonPackage rec {
   pname = "flask-limiter";
-  version = "3.8.0";
+  version = "3.9.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "flask-limiter";
-    rev = "refs/tags/${version}";
-    hash = "sha256-RkeG5XdanSp2syKrQgYUZ4r8D28Zt33/MsW0UxWxaU0=";
+    tag = version;
+    hash = "sha256-JkO5DNGVTnqbMfkadQGdyJEsfDfMDZ+nfjEjRpoMOfk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/fpdf2/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fpdf2";
-  version = "2.8.1";
+  version = "2.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-pdf";
     repo = "fpdf2";
-    rev = "refs/tags/${version}";
-    hash = "sha256-MYurl/nEZhdhGxeNalwTWnZ8lr9SYJBR7hIjBZLOrJU=";
+    tag = version;
+    hash = "sha256-NfHMmyFT+ZpqfRc41DetbFXs/twr12XagOkk3nGhrYk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/google-cloud-datacatalog/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-datacatalog";
-  version = "3.23.0";
+  version = "3.24.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_datacatalog";
     inherit version;
-    hash = "sha256-Rpx5+Mv+KTvJdposPJg+J/GNmHoj0I1jBp6YUOlcXmI=";
+    hash = "sha256-JYcOb+suHqXNPGNoGhXm1GI33UWFM3lo766HXf9mek8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/hvplot/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "hvplot";
-  version = "0.11.1";
+  version = "0.11.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mJ7QOJGJrcR+3NJgHS6rGL82bnSwf14oc+AhMjxKFLs=";
+    hash = "sha256-t60fLxxwXkfiayLInBFxGoT3d0+qq6t1a0Xo0eAKYBA=";
   };
 
   build-system = [

pkgs/development/python-modules/ipyparallel/default.nix

@@ -2,9 +2,9 @@
   lib,
   buildPythonPackage,
   decorator,
-  entrypoints,
   fetchPypi,
   hatchling,
+  importlib-metadata,
   ipykernel,
   ipython,
   jupyter-client,
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "ipyparallel";
-  version = "8.8.0";
+  version = "9.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JATVn4ajqqO9J79rV993e/9cE2PBxuYEA3WdFu1C3Hs=";
+    hash = "sha256-cGAcuvmhadNQ/+IsgtW73+bf5MTfAoNtmZDpxVm1vLY=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
@@ -41,7 +41,6 @@ buildPythonPackage rec {
 
   dependencies = [
     decorator
-    entrypoints
     ipykernel
     ipython
     jupyter-client
@@ -51,7 +50,7 @@ buildPythonPackage rec {
     tornado
     tqdm
     traitlets
-  ];
+  ] ++ lib.optional (pythonOlder "3.10") importlib-metadata;
 
   # Requires access to cluster
   doCheck = false;

pkgs/development/python-modules/livereload/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "livereload";
-  version = "2.7.0";
+  version = "2.7.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "python-livereload";
-    rev = "refs/tags/${version}";
-    sha256 = "sha256-1at/KMgDTj0TTnq5Vjgklkyha3QUF8bFeKxQSrvx1oE=";
+    tag = "v${version}";
+    sha256 = "sha256-WFpPCUjvyGT826EkIuqAB4jcJOEqoohJY9Xw/EJrk6c=";
   };
 
   buildInputs = [ django ];

pkgs/development/python-modules/logbook/default.nix

@@ -16,16 +16,16 @@
 
 buildPythonPackage rec {
   pname = "logbook";
-  version = "1.7.0.post0";
+  version = "1.8.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "getlogbook";
     repo = "logbook";
-    rev = "refs/tags/${version}";
-    hash = "sha256-bqfFSd7CPYII/3AJCMApqmAYrAWjecOb3JA17FPFMIc=";
+    tag = version;
+    hash = "sha256-SpM7LQVcQ9eJ88QDpq/3rq04jr0zrrrQuTeqtz9xsng=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/lsassy/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lsassy";
-  version = "3.1.12";
+  version = "3.1.13";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Hackndo";
     repo = "lsassy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Idel52GAzir+SVgKfMU+e8Z0EkMf+PBdIcaQd0o8qJE=";
+    hash = "sha256-DdIEDseGLI+hUIaUNPBqpkGGe+F+Z+jZ0g/JzXB8pf8=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/manga-ocr/default.nix

@@ -37,6 +37,11 @@ buildPythonPackage rec {
     unidic-lite
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy<2" "numpy"
+  '';
+
   meta = with lib; {
     description = "Optical character recognition for Japanese text, with the main focus being Japanese manga";
     homepage = "https://github.com/kha-white/manga-ocr";

pkgs/development/python-modules/mkdocs-drawio-exporter/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-drawio-exporter";
-  version = "0.9.1";
+  version = "0.10.1";
   pyproject = true;
 
   disabled = !isPy3k;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "mkdocs_drawio_exporter";
     inherit version;
-    hash = "sha256-x8X8hvN/tL8C6VhgMCEHDh2hILjBoyLgQfsFD1+qXgo=";
+    hash = "sha256-7DbJE5UHXRO3kQYM2HuzxQeEhWBKFE06WFSf5GTYGZ8=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/mlflow/default.nix

@@ -70,14 +70,14 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.18.0";
+  version = "2.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mlflow";
     repo = "mlflow";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-etfgdSf3pbcKtCOk9MOgcR+Tzg4cmLbdadAOtQqN4PM=";
+    tag = "v${version}";
+    hash = "sha256-QUyoT6tl/kv/RAntKYZ83p/lvssX1dJb45VpklAVQT4=";
   };
 
   # Remove currently broken dependency `shap`, a model explainability package.

pkgs/development/python-modules/nbsphinx/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "nbsphinx";
-  version = "0.9.5";
+  version = "0.9.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-c2kW57Daso/JBPSprjtTqaUMKfzMYynAUvzHSFq88rc=";
+    hash = "sha256-wrKKLXAvEVmpW4Q4MXmOhuYKF/xke5v/m6FYU1XeVOM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/notion-client/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "notion-client";
-  version = "2.2.1";
+  version = "2.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ramnes";
     repo = "notion-sdk-py";
-    rev = "refs/tags/${version}";
-    hash = "sha256-IEWFrdqrawFbuwA8bUewanmBoGWsjHJ7ucgvHQEaMcA=";
+    tag = version;
+    hash = "sha256-oqYBT7K0px0QvShSx1fnr2181h+QXz7I8sdURsBRgWw=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/numpy-stl/default.nix

@@ -12,15 +12,15 @@
 
 buildPythonPackage rec {
   pname = "numpy-stl";
-  version = "3.1.2";
+  version = "3.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "numpy_stl";
     inherit version;
-    hash = "sha256-crRpUN+jZC3xx7hzz6eKVIUzckuQdHjFZ9tC/fV+49I=";
+    hash = "sha256-WiDD95zdqgq8akuZ9Uhqzu1PiBUvKbGaV6zIROGD/U0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/plone-testing/default.nix

@@ -1,33 +1,41 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  six,
+  fetchFromGitHub,
   zope-testing,
   setuptools,
 }:
 
 buildPythonPackage rec {
-  pname = "plone.testing";
-  version = "9.0.1";
+  pname = "plone-testing";
+  version = "9.0.3";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-xdzm4LG/W5ziYXaXbCOfQbZYZvaUUih3lWhkLzWqeUc=";
+  src = fetchFromGitHub {
+    owner = "plone";
+    repo = "plone.testing";
+    tag = version;
+    hash = "sha256-EjKKwLUBhzjtk3stHkdUDsteXQGJcrwdu9EEA4FFK1w=";
   };
 
-  propagatedBuildInputs = [
-    six
+  build-system = [ setuptools ];
+
+  dependencies = [
     setuptools
     zope-testing
   ];
 
+  pythonImportsCheck = [ "plone.testing" ];
+
   # Huge amount of testing dependencies (including Zope2)
   doCheck = false;
 
+  pythonNamespaces = [ "plone" ];
+
   meta = {
     description = "Testing infrastructure for Zope and Plone projects";
     homepage = "https://github.com/plone/plone.testing";
+    changelog = "https://github.com/plone/plone.testing/blob/${src.tag}/CHANGES.rst";
     license = lib.licenses.bsd3;
   };
 }

pkgs/development/python-modules/py3status/default.nix

@@ -27,12 +27,12 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.60";
+  version = "3.61";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l7qlw3imOXY1nsNiFRB28Z6+uw+YGJGOO4GM7ryr1Q4=";
+    hash = "sha256-CL7bD+w8F59aVHAC9k4yG0qaSqJZdkFdEDKkyKkCBTs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/py4j/default.nix

@@ -7,12 +7,12 @@
 buildPythonPackage rec {
   pname = "py4j";
 
-  version = "0.10.9.7";
+  version = "0.10.9.8";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C25TFbs62lz2KsZR0Qe7LrwC3vPe6dlUjjuqxkTqjbs=";
+    hash = "sha256-evqA2+QFmFEYEZ7EfdXaldsqfW42f79d7lvZSYMtC3U=";
   };
 
   # No tests in archive

pkgs/development/python-modules/pyaprilaire/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyaprilaire";
-  version = "0.7.6";
+  version = "0.7.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chamberlain2007";
     repo = "pyaprilaire";
     tag = version;
-    hash = "sha256-7jTV0F7g6IMsBUYk1GMakyvQ66k7glOUNWv6tdKjdnQ=";
+    hash = "sha256-1cTbmpRB4PzjqCPmHULLVEs7r7IWxIglnHkXsLksp0I=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyathena/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "3.10.0";
+  version = "3.12.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-paFTmhPGr2qz1CK425tbSHEbexcl+lqmgoL6RZmfC2o=";
+    hash = "sha256-QASQXfDcReVNN1cRLmndhgY8Xkx5Q+z0lJXYdYV903E=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pyinstaller-hooks-contrib/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyinstaller-hooks-contrib";
-  version = "2024.10";
+  version = "2024.11";
 
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyinstaller_hooks_contrib";
     inherit version;
-    hash = "sha256-ikZlXlxbAYa15Sc5kRips0LxBRPrFCXEg/pPbQLogAw=";
+    hash = "sha256-hDma9rS5AgMJWAY98l9lerv/JJ0PMpxTRJKDVcmDOrQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pyipv8/default.nix

@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "pyipv8";
-  version = "2.13.0";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Qp5vqMa7kfSp22C5KAUvut+4YbSXMEZRsHsLevB4QvE=";
+    hash = "sha256-e8HoKKA1s93LbmvHs7gJqmCcuZZ9REenBwxKJFR6wjM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyperf/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyperf";
-  version = "2.7.0";
+  version = "2.8.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QgHGYBAy83TpyQDG0lRKL1iRq+3BqW7sDnsjOKYkdYk=";
+    hash = "sha256-7xA+IaTQSZkxUAMCai1lnEinz85eFEDwPW5yWRQAcTo=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/pyside2/default.nix

@@ -11,11 +11,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "pyside2";
-  version = "5.15.15";
+  version = "5.15.16";
 
   src = fetchurl {
     url = "https://download.qt.io/official_releases/QtForPython/pyside2/PySide2-${version}-src/pyside-setup-opensource-src-${version}.tar.xz";
-    hash = "sha256-IdaBiwZINLCFARgOSIkOX9h98vs3afgMWBQ0V/VIxAg=";
+    hash = "sha256-bT7W/RcnXqdIKatW35wudkG/ymtbIBzyRJmPqBzwc2A=";
   };
 
   patches = [

pkgs/development/python-modules/pysmart/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pysmart";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,8 +20,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "truenas";
     repo = "py-SMART";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-1k+5XnIT/AfZmzKUxkyU/uc0eW05CvugpY6OdJCoALc=";
+    tag = "v${version}";
+    hash = "sha256-gsMFJbh2I64W1CDbwu9HUHjzS2pxsw91nD3lOYlBUEY=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pytask/default.nix

@@ -25,15 +25,15 @@
 }:
 buildPythonPackage rec {
   pname = "pytask";
-  version = "0.5.1";
+  version = "0.5.2";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pytask-dev";
     repo = "pytask";
-    rev = "v${version}";
-    hash = "sha256-b+sS+l0Rp5bb8Dh6UBv3xHYTYKFp3dD5AuLqxB3n6Go=";
+    tag = "v${version}";
+    hash = "sha256-YJouWQ9Edj27nD72m7EDSH9TXcrsu6X+pGDo5fgGU5U=";
   };
 
   build-system = [

pkgs/development/python-modules/pytest-mypy-plugins/default.nix

@@ -18,16 +18,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy-plugins";
-  version = "3.1.2";
+  version = "3.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "typeddjango";
     repo = "pytest-mypy-plugins";
-    rev = "refs/tags/${version}";
-    hash = "sha256-yme1g9Kj5guao0Lf8mbkNJRw6ipS2Wd4Io1cSlEBAGo=";
+    tag = version;
+    hash = "sha256-60VxMUUCIP+Mp+OsgdyRTPZVLGC/3iaMxxhw02ABB9k=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pytest-testmon/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "2.1.1";
+  version = "2.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tarpas";
     repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-zbMX9r9lftdm9hzXMZRZZ/GEDViGk9QiYYUhO9ZcEAc=";
+    tag = "v${version}";
+    hash = "sha256-LSp3GkvyZ8wX6qelGy4PdCliGIzXo2nJNrYqxdSo/wM=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/python-utils/default.nix

@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "python-utils";
-  version = "3.9.0";
+  version = "3.9.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "WoLpH";
     repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-ZmCT41VMz8BkIqF8Od5PqteyXToA4xASs0qCPD0cNc8=";
+    tag = "v${version}";
+    hash = "sha256-lzLzYI5jShfIwQqvfA8UtPjGawXE80ww7jb/gPzpeDo=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyviz-comms/default.nix

@@ -1,21 +1,37 @@
 {
   buildPythonPackage,
   fetchPypi,
+  hatch-jupyter-builder,
+  hatch-nodejs-version,
+  hatchling,
   lib,
   param,
   panel,
 }:
 
 buildPythonPackage rec {
-  pname = "pyviz_comms";
-  version = "2.2.1";
+  pname = "pyviz-comms";
+  version = "3.0.3";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-omFFuM5D0tk0s8aCbXe5E84QXFKOsuSUyJCz41Jd3zM=";
+    pname = "pyviz_comms";
+    inherit version;
+    hash = "sha256-/eSgF8IhPs7mOppnQUMchF5CpcexWI5Ke6LkNwxYNyg=";
   };
 
-  propagatedBuildInputs = [ param ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"jupyterlab>=4.0.0,<5",' ""
+  '';
+
+  build-system = [
+    hatch-jupyter-builder
+    hatch-nodejs-version
+    hatchling
+  ];
+
+  dependencies = [ param ];
 
   # there are not tests with the package
   doCheck = false;
@@ -26,10 +42,10 @@ buildPythonPackage rec {
     inherit panel;
   };
 
-  meta = with lib; {
-    description = "Launch jobs, organize the output, and dissect the results";
+  meta = {
+    description = "Bidirectional communication for the HoloViz ecosystem";
     homepage = "https://pyviz.org/";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
 }

pkgs/development/python-modules/pywebview/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pywebview";
-  version = "5.2";
+  version = "5.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "r0x0r";
     repo = "pywebview";
-    rev = "refs/tags/${version}";
-    hash = "sha256-PNnsqb+gyeFfQwMFj7cYaiv54cZ+H5IF9+DS9RN/qB4=";
+    tag = version;
+    hash = "sha256-/jKauq+G3Nz91n/keTZGNDTaW5EhdyCx4c2Nylxqc+0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pywikibot/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pywikibot";
-  version = "9.5.0";
+  version = "9.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZUOsiadQ2zekQDc+wc9MvNgLBXQkguvrDufpC8+1kLo=";
+    hash = "sha256-736LEUwW1LofS1105TxVWHMGFaEpQGwa+WGIk2OQxmA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/relatorio/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "relatorio";
-  version = "0.10.2";
+  version = "0.11.1";
 
   disabled = pythonOlder "3.5";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zgCOmcR9FWj0lpi78U0G1CKR5kyNyr541HusIrBpF/Q=";
+    hash = "sha256-e6CvclFrRfXR5fL2ZG1LZxTTsTRouLsDicCwvXtySGE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/rst2pdf/default.nix

@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "rst2pdf";
-  version = "0.102";
+  version = "0.103.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NzAGJOlTpz7d3cuubyRjDvVGfCC+61jfZIrcUwhE9CU=";
+    hash = "sha256-P/6BbUsyda7iG4/90Isua+TXWQzYixifczy8aZbWN4Y=";
   };
 
   outputs = [

pkgs/development/python-modules/scikit-posthocs/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-posthocs";
-  version = "0.11.1";
+  version = "0.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maximtrp";
     repo = "scikit-posthocs";
     tag = "v${version}";
-    hash = "sha256-RPTWbhaDMdPiIQ6TLeWwZKYI9m23dEXu9iqBLYIEVN4=";
+    hash = "sha256-ChYBjT7xeAiKJFRI9ov4vOGucy0aK0j/0dndNs4ewBo=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/skl2onnx/default.nix

@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "skl2onnx";
-  version = "1.17.0";
+  version = "1.18.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cSfchORw9In2gJTM//mlqBW2CfcA1D5wjm9lijOwZAM=";
+    hash = "sha256-OepK4wxcGCNVoYJEZwExWCFERODOCxjzMzi9gn1PsA8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/srsly/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "srsly";
-  version = "2.4.8";
+  version = "2.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sk2VplAJwkR+C0nNoEOsU/7PTwnjWNh6V0RkWPkbipE=";
+    hash = "sha256-J3Z1LNsUJ1ygHpp7epwEfM8x2xfwB25zNDz8yajfbL0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/sumo/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "sumo";
-  version = "2.3.9";
+  version = "2.3.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -27,8 +27,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SMTG-UCL";
     repo = "sumo";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-e+nkTRopI0QeGq52e3Eqx2RJg82A7mvIaIuZ+yN18+o=";
+    tag = "v${version}";
+    hash = "sha256-WoOW+JPo5x9V6LN+e8Vf3Q3ohHhQVK81s0Qk7oPn1Tk=";
   };
 
   nativeBuildInputs = [ cython ];