Merge master into staging-next

lib/systems/default.nix

@@ -389,6 +389,8 @@ let
               "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
             else if final.isWasi then
               "${pkgs.wasmtime}/bin/wasmtime"
+            else if final.isGhcjs then
+              "${pkgs.nodejs-slim}/bin/node"
             else if final.isMmix then
               "${pkgs.mmixware}/bin/mmix"
             else

maintainers/team-list.nix

@@ -300,6 +300,7 @@ with lib.maintainers;
 
   gitlab = {
     members = [
+      gabyx
       krav
       leona
       talyz

nixos/modules/services/display-managers/generic.nix

@@ -51,6 +51,8 @@ in
       '')
     ];
 
+    services.displayManager.enable = true;
+
     systemd.services.display-manager = {
       description = "Display Manager";
       after = [

nixos/modules/services/x11/xserver.nix

@@ -810,8 +810,6 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    services.displayManager.enable = true;
-
     services.xserver.displayManager.lightdm.enable =
       let
         dmConf = cfg.displayManager;

nixos/tests/all-tests.nix

@@ -1288,7 +1288,7 @@ in
       { };
   postfix-tlspol = runTest ./postfix-tlspol.nix;
   postgres-websockets = runTest ./postgres-websockets.nix;
-  postgresql = handleTest ./postgresql { };
+  postgresql = import ./postgresql { inherit runTest pkgs; };
   postgrest = runTest ./postgrest.nix;
   power-profiles-daemon = runTest ./power-profiles-daemon.nix;
   powerdns = runTest ./powerdns.nix;

nixos/tests/postgresql/anonymizer.nix

@@ -1,114 +1,115 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql_anonymizer-${package.name}";
-      meta.maintainers = [
-        lib.maintainers.leona
-        lib.maintainers.osnyx
-      ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "postgresql_anonymizer-${package.name}";
+        meta.maintainers = [
+          lib.maintainers.leona
+          lib.maintainers.osnyx
+        ];
 
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ (pkgs.pg-dump-anon.override { postgresql = package; }) ];
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions = ps: [ ps.anonymizer ];
-            settings.shared_preload_libraries = [ "anon" ];
+        nodes.machine =
+          { pkgs, ... }:
+          {
+            environment.systemPackages = [ (pkgs.pg-dump-anon.override { postgresql = package; }) ];
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              extensions = ps: [ ps.anonymizer ];
+              settings.shared_preload_libraries = [ "anon" ];
+            };
           };
-        };
 
-      testScript = ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_for_unit("postgresql.target")
+        testScript = ''
+          start_all()
+          machine.wait_for_unit("multi-user.target")
+          machine.wait_for_unit("postgresql.target")
 
-        with subtest("Setup"):
-            machine.succeed("sudo -u postgres psql --command 'create database demo'")
-            machine.succeed(
-                "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
-                  create extension anon cascade;
-                  select anon.init();
-                  create table player(id serial, name text, points int);
-                  insert into player(id,name,points) values (1,'Foo', 23);
-                  insert into player(id,name,points) values (2,'Bar',42);
-                  security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name()';
-                  security label for anon on column player.points is 'MASKED WITH VALUE NULL';
-                ''}"
-            )
+          with subtest("Setup"):
+              machine.succeed("sudo -u postgres psql --command 'create database demo'")
+              machine.succeed(
+                  "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
+                    create extension anon cascade;
+                    select anon.init();
+                    create table player(id serial, name text, points int);
+                    insert into player(id,name,points) values (1,'Foo', 23);
+                    insert into player(id,name,points) values (2,'Bar',42);
+                    security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name()';
+                    security label for anon on column player.points is 'MASKED WITH VALUE NULL';
+                  ''}"
+              )
 
-        def get_player_table_contents():
-            return [
-                x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
-            ]
+          def get_player_table_contents():
+              return [
+                  x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
+              ]
 
-        def check_anonymized_row(row, id, original_name):
-            t.assertEqual(row[0], id)
-            t.assertNotEqual(row[1], original_name)
-            t.assertFalse(bool(row[2]))
+          def check_anonymized_row(row, id, original_name):
+              t.assertEqual(row[0], id)
+              t.assertNotEqual(row[1], original_name)
+              t.assertFalse(bool(row[2]))
 
-        def find_xsv_in_dump(dump, sep=','):
-            """
-            Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
+          def find_xsv_in_dump(dump, sep=','):
+              """
+              Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
 
-                COPY public.player ...
-                1,Shields,
-                2,Salazar,
-                \\.
+                  COPY public.player ...
+                  1,Shields,
+                  2,Salazar,
+                  \\.
 
-            in the given dump (the commas are tabs in case of pg_dump).
-                  Extract the CSV lines and split by `sep`.
-            """
+              in the given dump (the commas are tabs in case of pg_dump).
+                    Extract the CSV lines and split by `sep`.
+              """
 
-            try:
-                from itertools import dropwhile, takewhile
-                return [x.split(sep) for x in list(takewhile(
-                    lambda x: x != "\\.",
-                    dropwhile(
-                        lambda x: not x.startswith("COPY public.player"),
-                        dump.splitlines()
-                    )
-                ))[1:]]
-            except:
-                print(f"Dump to process: {dump}")
-                raise
+              try:
+                  from itertools import dropwhile, takewhile
+                  return [x.split(sep) for x in list(takewhile(
+                      lambda x: x != "\\.",
+                      dropwhile(
+                          lambda x: not x.startswith("COPY public.player"),
+                          dump.splitlines()
+                      )
+                  ))[1:]]
+              except:
+                  print(f"Dump to process: {dump}")
+                  raise
 
-        def check_original_data(output):
-            t.assertEqual(output[0], ["1", "Foo", "23"])
-            t.assertEqual(output[1], ["2", "Bar", "42"])
+          def check_original_data(output):
+              t.assertEqual(output[0], ["1", "Foo", "23"])
+              t.assertEqual(output[1], ["2", "Bar", "42"])
 
-        def check_anonymized_rows(output):
-            check_anonymized_row(output[0], '1', 'Foo')
-            check_anonymized_row(output[1], '2', 'Bar')
+          def check_anonymized_rows(output):
+              check_anonymized_row(output[0], '1', 'Foo')
+              check_anonymized_row(output[1], '2', 'Bar')
 
-        with subtest("Check initial state"):
-            check_original_data(get_player_table_contents())
+          with subtest("Check initial state"):
+              check_original_data(get_player_table_contents())
 
-        with subtest("Anonymous dumps"):
-            check_original_data(find_xsv_in_dump(
-                machine.succeed("sudo -u postgres pg_dump demo"),
-                sep='\t'
-            ))
-            check_anonymized_rows(find_xsv_in_dump(
-                machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
-                sep=','
-            ))
+          with subtest("Anonymous dumps"):
+              check_original_data(find_xsv_in_dump(
+                  machine.succeed("sudo -u postgres pg_dump demo"),
+                  sep='\t'
+              ))
+              check_anonymized_rows(find_xsv_in_dump(
+                  machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
+                  sep=','
+              ))
 
-        with subtest("Anonymize"):
-            machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
-            check_anonymized_rows(get_player_table_contents())
-      '';
-    };
+          with subtest("Anonymize"):
+              machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
+              check_anonymized_rows(get_player_table_contents())
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/default.nix

@@ -1,11 +1,8 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  pkgs,
 }:
 
-with import ../../lib/testing-python.nix { inherit system pkgs; };
-
 let
   inherit (pkgs.lib)
     recurseIntoAttrs
@@ -25,7 +22,12 @@ let
       }
     );
 
-  importWithArgs = path: import path { inherit pkgs makeTest genTests; };
+  importWithArgs =
+    path:
+    import path {
+      inherit runTest genTests;
+      inherit (pkgs) lib;
+    };
 in
 {
   # postgresql

nixos/tests/postgresql/pgjwt.nix

@@ -1,51 +1,52 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "pgjwt-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [
-          spinus
-        ];
-      };
-
-      nodes.master =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                pgjwt
-                pgtap
-              ];
-          };
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "pgjwt-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [
+            spinus
+          ];
         };
 
-      testScript =
-        { nodes, ... }:
-        let
-          sqlSU = "${nodes.master.services.postgresql.superUser}";
-          pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
-          inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
-        in
-        ''
-          start_all()
-          master.wait_for_unit("postgresql.target")
-          master.succeed(
-              "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
-          )
-        '';
-    };
+        nodes.master =
+          { ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              extensions =
+                ps: with ps; [
+                  pgjwt
+                  pgtap
+                ];
+            };
+          };
+
+        testScript =
+          { nodes, ... }:
+          let
+            sqlSU = "${nodes.master.services.postgresql.superUser}";
+            pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
+            inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
+          in
+          ''
+            start_all()
+            master.wait_for_unit("postgresql.target")
+            master.succeed(
+                "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
+            )
+          '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/postgresql-jit.nix

@@ -1,53 +1,54 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-jit-${package.name}";
-      meta.maintainers = with lib.maintainers; [ ma27 ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "postgresql-jit-${package.name}";
+        meta.maintainers = with lib.maintainers; [ ma27 ];
 
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            enableJIT = true;
-            initialScript = pkgs.writeText "init.sql" ''
-              create table demo (id int);
-              insert into demo (id) select generate_series(1, 5);
-            '';
+        nodes.machine =
+          { pkgs, ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              enableJIT = true;
+              initialScript = pkgs.writeText "init.sql" ''
+                create table demo (id int);
+                insert into demo (id) select generate_series(1, 5);
+              '';
+            };
           };
-        };
 
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("postgresql.target")
+        testScript = ''
+          machine.start()
+          machine.wait_for_unit("postgresql.target")
 
-        with subtest("JIT is enabled"):
-            machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
+          with subtest("JIT is enabled"):
+              machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
 
-        with subtest("Test JIT works fine"):
-            output = machine.succeed(
-                "cat ${pkgs.writeText "test.sql" ''
-                  set jit_above_cost = 1;
-                  EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
-                  SELECT CONCAT('jit result = ', SUM(id)) from demo;
-                ''} | sudo -u postgres psql"
-            )
-            t.assertIn("JIT:", output)
-            t.assertIn("jit result = 15", output)
+          with subtest("Test JIT works fine"):
+              output = machine.succeed(
+                  "cat ${pkgs.writeText "test.sql" ''
+                    set jit_above_cost = 1;
+                    EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
+                    SELECT CONCAT('jit result = ', SUM(id)) from demo;
+                  ''} | sudo -u postgres psql"
+              )
+              t.assertIn("JIT:", output)
+              t.assertIn("jit result = 15", output)
 
-        machine.shutdown()
-      '';
-    };
+          machine.shutdown()
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/postgresql-replication.nix

@@ -1,125 +1,127 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
 
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-replication-${package.name}";
-      meta.maintainers = with lib.maintainers; [ bouk ];
+    runTest (
+      { lib, ... }:
+      {
+        name = "postgresql-replication-${package.name}";
+        meta.maintainers = with lib.maintainers; [ bouk ];
 
-      nodes = {
-        primary =
-          { ... }:
-          {
-            services.postgresql = {
-              inherit package;
-              enable = true;
-              enableTCPIP = true;
-              settings = {
-                wal_level = "replica";
-                max_wal_senders = 10;
-                max_replication_slots = 10;
+        nodes = {
+          primary =
+            { ... }:
+            {
+              services.postgresql = {
+                inherit package;
+                enable = true;
+                enableTCPIP = true;
+                settings = {
+                  wal_level = "replica";
+                  max_wal_senders = 10;
+                  max_replication_slots = 10;
+                };
+                authentication = ''
+                  local replication postgres peer
+                  host replication replication all trust
+                '';
+                ensureUsers = [
+                  {
+                    name = "replication";
+                    ensureClauses.replication = true;
+                  }
+                ];
               };
-              authentication = ''
-                local replication postgres peer
-                host replication replication all trust
-              '';
-              ensureUsers = [
-                {
-                  name = "replication";
-                  ensureClauses.replication = true;
-                }
-              ];
+              networking.firewall.allowedTCPPorts = [ 5432 ];
             };
-            networking.firewall.allowedTCPPorts = [ 5432 ];
-          };
 
-        replica =
-          { nodes, ... }:
-          {
-            services.postgresql = {
-              inherit package;
-              enable = true;
-              settings = {
-                hot_standby = "on";
-                primary_conninfo = "host=${nodes.primary.networking.primaryIPAddress} user=replication";
-                primary_slot_name = "replica_slot";
+          replica =
+            { nodes, ... }:
+            {
+              services.postgresql = {
+                inherit package;
+                enable = true;
+                settings = {
+                  hot_standby = "on";
+                  primary_conninfo = "host=${nodes.primary.networking.primaryIPAddress} user=replication";
+                  primary_slot_name = "replica_slot";
+                };
               };
             };
-          };
-      };
+        };
 
-      testScript = ''
-        start_all()
-        primary.wait_for_unit("postgresql.target")
+        testScript = ''
+          start_all()
+          primary.wait_for_unit("postgresql.target")
 
-        primary.succeed(
-            "sudo -u postgres psql -c \"SELECT * FROM pg_create_physical_replication_slot('replica_slot');\""
-        )
+          primary.succeed(
+              "sudo -u postgres psql -c \"SELECT * FROM pg_create_physical_replication_slot('replica_slot');\""
+          )
 
-        primary.succeed(
-            "sudo -u postgres pg_basebackup -D /tmp/basebackup -S replica_slot -X stream"
-        )
-        primary.succeed("tar -C /tmp -cf /tmp/shared/basebackup.tar basebackup")
+          primary.succeed(
+              "sudo -u postgres pg_basebackup -D /tmp/basebackup -S replica_slot -X stream"
+          )
+          primary.succeed("tar -C /tmp -cf /tmp/shared/basebackup.tar basebackup")
 
-        replica.wait_for_unit("postgresql.target")
-        replica.succeed("systemctl stop postgresql")
+          replica.wait_for_unit("postgresql.target")
+          replica.succeed("systemctl stop postgresql")
 
-        replica_data_dir = "/var/lib/postgresql/${package.psqlSchema}"
-        replica.succeed(f"rm -rf {replica_data_dir}")
-        replica.succeed(f"mkdir -p {replica_data_dir}")
-        replica.succeed(f"tar -C {replica_data_dir} --strip-components=1 -xf /tmp/shared/basebackup.tar")
-        replica.succeed(f"touch {replica_data_dir}/standby.signal")
-        replica.succeed(f"chown -R postgres:postgres {replica_data_dir}")
-        replica.succeed(f"chmod 700 {replica_data_dir}")
+          replica_data_dir = "/var/lib/postgresql/${package.psqlSchema}"
+          replica.succeed(f"rm -rf {replica_data_dir}")
+          replica.succeed(f"mkdir -p {replica_data_dir}")
+          replica.succeed(f"tar -C {replica_data_dir} --strip-components=1 -xf /tmp/shared/basebackup.tar")
+          replica.succeed(f"touch {replica_data_dir}/standby.signal")
+          replica.succeed(f"chown -R postgres:postgres {replica_data_dir}")
+          replica.succeed(f"chmod 700 {replica_data_dir}")
 
-        replica.succeed("systemctl start postgresql")
-        replica.wait_for_unit("postgresql.target")
+          replica.succeed("systemctl start postgresql")
+          replica.wait_for_unit("postgresql.target")
 
-        replica.wait_until_succeeds(
-            "sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();' | grep t"
-        )
+          replica.wait_until_succeeds(
+              "sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();' | grep t"
+          )
 
-        primary.succeed(
-            "sudo -u postgres psql -c 'CREATE TABLE test_replication (id serial PRIMARY KEY, data text);'"
-        )
-        primary.succeed(
-            "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('hello');\""
-        )
+          primary.succeed(
+              "sudo -u postgres psql -c 'CREATE TABLE test_replication (id serial PRIMARY KEY, data text);'"
+          )
+          primary.succeed(
+              "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('hello');\""
+          )
 
-        replica.wait_until_succeeds(
-            "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep hello",
-            timeout=30
-        )
+          replica.wait_until_succeeds(
+              "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep hello",
+              timeout=30
+          )
 
-        with subtest("Verify replica is in recovery mode"):
-            result = replica.succeed("sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();'")
-            t.assertEqual(result.strip(), "t")
+          with subtest("Verify replica is in recovery mode"):
+              result = replica.succeed("sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();'")
+              t.assertEqual(result.strip(), "t")
 
-        with subtest("Verify replication slot is active"):
-            result = primary.succeed(
-                "sudo -u postgres psql -tAc \"SELECT active FROM pg_replication_slots WHERE slot_name = 'replica_slot';\""
-            )
-            t.assertEqual(result.strip(), "t")
+          with subtest("Verify replication slot is active"):
+              result = primary.succeed(
+                  "sudo -u postgres psql -tAc \"SELECT active FROM pg_replication_slots WHERE slot_name = 'replica_slot';\""
+              )
+              t.assertEqual(result.strip(), "t")
 
-        with subtest("Insert more data and verify replication"):
-            primary.succeed(
-                "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('world');\""
-            )
-            replica.wait_until_succeeds(
-                "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep world",
-                timeout=30
-            )
+          with subtest("Insert more data and verify replication"):
+              primary.succeed(
+                  "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('world');\""
+              )
+              replica.wait_until_succeeds(
+                  "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep world",
+                  timeout=30
+              )
 
-        primary.shutdown()
-        replica.shutdown()
-      '';
-    };
+          primary.shutdown()
+          replica.shutdown()
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -1,145 +1,147 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
-  runWithOpenSSL =
-    file: cmd:
-    pkgs.runCommand file {
-      buildInputs = [ pkgs.openssl ];
-    } cmd;
-  caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  caCert = runWithOpenSSL "ca.crt" ''
-    openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
-  '';
-  serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  serverKeyPath = "/var/lib/postgresql";
-  serverCert = runWithOpenSSL "server.crt" ''
-    openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
-    openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
-      -CAcreateserial -out $out -days 36500 -sha256
-  '';
-  clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  clientCert = runWithOpenSSL "client.crt" ''
-    openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
-    openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
-      -CAcreateserial -out $out -days 36500 -sha256
-  '';
-  clientKeyPath = "/root";
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-tls-client-cert-${package.name}";
-      meta.maintainers = with lib.maintainers; [ erictapen ];
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        runWithOpenSSL =
+          file: cmd:
+          pkgs.runCommand file {
+            buildInputs = [ pkgs.openssl ];
+          } cmd;
+        caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        caCert = runWithOpenSSL "ca.crt" ''
+          openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
+        '';
+        serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        serverKeyPath = "/var/lib/postgresql";
+        serverCert = runWithOpenSSL "server.crt" ''
+          openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
+          openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
+            -CAcreateserial -out $out -days 36500 -sha256
+        '';
+        clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        clientCert = runWithOpenSSL "client.crt" ''
+          openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
+          openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
+            -CAcreateserial -out $out -days 36500 -sha256
+        '';
+        clientKeyPath = "/root";
+      in
+      {
+        name = "postgresql-tls-client-cert-${package.name}";
+        meta.maintainers = with lib.maintainers; [ erictapen ];
 
-      nodes.server =
-        { ... }:
-        {
-          systemd.services.create-keys = {
-            wantedBy = [ "postgresql.target" ];
+        nodes.server =
+          { ... }:
+          {
+            systemd.services.create-keys = {
+              wantedBy = [ "postgresql.target" ];
 
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+
+              script = ''
+                mkdir -p '${serverKeyPath}'
+                cp '${serverKey}' '${serverKeyPath}/server.key'
+                chown postgres:postgres '${serverKeyPath}/server.key'
+                chmod 600 '${serverKeyPath}/server.key'
+              '';
             };
-
-            script = ''
-              mkdir -p '${serverKeyPath}'
-              cp '${serverKey}' '${serverKeyPath}/server.key'
-              chown postgres:postgres '${serverKeyPath}/server.key'
-              chmod 600 '${serverKeyPath}/server.key'
-            '';
-          };
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            enableTCPIP = true;
-            ensureUsers = [
-              {
-                name = "test";
-                ensureDBOwnership = true;
-              }
-            ];
-            ensureDatabases = [ "test" ];
-            settings = {
-              ssl = "on";
-              ssl_ca_file = toString caCert;
-              ssl_cert_file = toString serverCert;
-              ssl_key_file = "${serverKeyPath}/server.key";
-            };
-            authentication = ''
-              hostssl test test ::/0 cert clientcert=verify-full
-            '';
-          };
-          networking = {
-            interfaces.eth1 = {
-              ipv6.addresses = [
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              enableTCPIP = true;
+              ensureUsers = [
                 {
-                  address = "fc00::1";
-                  prefixLength = 120;
+                  name = "test";
+                  ensureDBOwnership = true;
                 }
               ];
+              ensureDatabases = [ "test" ];
+              settings = {
+                ssl = "on";
+                ssl_ca_file = toString caCert;
+                ssl_cert_file = toString serverCert;
+                ssl_key_file = "${serverKeyPath}/server.key";
+              };
+              authentication = ''
+                hostssl test test ::/0 cert clientcert=verify-full
+              '';
             };
-            firewall.allowedTCPPorts = [ 5432 ];
-          };
-        };
-
-      nodes.client =
-        { ... }:
-        {
-          systemd.services.create-keys = {
-            wantedBy = [ "multi-user.target" ];
-
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-
-            script = ''
-              mkdir -p '${clientKeyPath}'
-              cp '${clientKey}' '${clientKeyPath}/client.key'
-              chown root:root '${clientKeyPath}/client.key'
-              chmod 600 '${clientKeyPath}/client.key'
-            '';
-          };
-          environment = {
-            variables = {
-              PGHOST = "db.test.example";
-              PGPORT = "5432";
-              PGDATABASE = "test";
-              PGUSER = "test";
-              PGSSLMODE = "verify-full";
-              PGSSLCERT = clientCert;
-              PGSSLKEY = "${clientKeyPath}/client.key";
-              PGSSLROOTCERT = caCert;
-            };
-            systemPackages = [ package ];
-          };
-          networking = {
-            interfaces.eth1 = {
-              ipv6.addresses = [
-                {
-                  address = "fc00::2";
-                  prefixLength = 120;
-                }
-              ];
-            };
-            hosts = {
-              "fc00::1" = [ "db.test.example" ];
+            networking = {
+              interfaces.eth1 = {
+                ipv6.addresses = [
+                  {
+                    address = "fc00::1";
+                    prefixLength = 120;
+                  }
+                ];
+              };
+              firewall.allowedTCPPorts = [ 5432 ];
             };
           };
-        };
 
-      testScript = ''
-        server.wait_for_unit("multi-user.target")
-        client.wait_for_unit("multi-user.target")
-        client.succeed("psql -c \"SELECT 1;\"")
-      '';
-    };
+        nodes.client =
+          { ... }:
+          {
+            systemd.services.create-keys = {
+              wantedBy = [ "multi-user.target" ];
+
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+
+              script = ''
+                mkdir -p '${clientKeyPath}'
+                cp '${clientKey}' '${clientKeyPath}/client.key'
+                chown root:root '${clientKeyPath}/client.key'
+                chmod 600 '${clientKeyPath}/client.key'
+              '';
+            };
+            environment = {
+              variables = {
+                PGHOST = "db.test.example";
+                PGPORT = "5432";
+                PGDATABASE = "test";
+                PGUSER = "test";
+                PGSSLMODE = "verify-full";
+                PGSSLCERT = clientCert;
+                PGSSLKEY = "${clientKeyPath}/client.key";
+                PGSSLROOTCERT = caCert;
+              };
+              systemPackages = [ package ];
+            };
+            networking = {
+              interfaces.eth1 = {
+                ipv6.addresses = [
+                  {
+                    address = "fc00::2";
+                    prefixLength = 120;
+                  }
+                ];
+              };
+              hosts = {
+                "fc00::1" = [ "db.test.example" ];
+              };
+            };
+          };
+
+        testScript = ''
+          server.wait_for_unit("multi-user.target")
+          client.wait_for_unit("multi-user.target")
+          client.succeed("psql -c \"SELECT 1;\"")
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -1,111 +1,112 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    let
-      postgresqlDataDir = "/var/lib/postgresql/${package.psqlSchema}";
-      replicationUser = "wal_receiver_user";
-      replicationSlot = "wal_receiver_slot";
-      replicationConn = "postgresql://${replicationUser}@localhost";
-      baseBackupDir = "/var/cache/wals/pg_basebackup";
-      walBackupDir = "/var/cache/wals/pg_wal";
-      recoveryFile = pkgs.writeTextDir "recovery.signal" "";
-    in
-    makeTest {
-      name = "postgresql-wal-receiver-${package.name}";
-      meta.maintainers = with lib.maintainers; [ euxane ];
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        postgresqlDataDir = "/var/lib/postgresql/${package.psqlSchema}";
+        replicationUser = "wal_receiver_user";
+        replicationSlot = "wal_receiver_slot";
+        replicationConn = "postgresql://${replicationUser}@localhost";
+        baseBackupDir = "/var/cache/wals/pg_basebackup";
+        walBackupDir = "/var/cache/wals/pg_wal";
+        recoveryFile = pkgs.writeTextDir "recovery.signal" "";
+      in
+      {
+        name = "postgresql-wal-receiver-${package.name}";
+        meta.maintainers = with lib.maintainers; [ euxane ];
 
-      nodes.machine =
-        { ... }:
-        {
-          systemd.tmpfiles.rules = [
-            "d /var/cache/wals 0750 postgres postgres - -"
-          ];
+        nodes.machine =
+          { ... }:
+          {
+            systemd.tmpfiles.rules = [
+              "d /var/cache/wals 0750 postgres postgres - -"
+            ];
 
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            settings = {
-              max_replication_slots = 10;
-              max_wal_senders = 10;
-              recovery_end_command = "touch recovery.done";
-              restore_command = "cp ${walBackupDir}/%f %p";
-              wal_level = "archive"; # alias for replica on pg >= 9.6
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              settings = {
+                max_replication_slots = 10;
+                max_wal_senders = 10;
+                recovery_end_command = "touch recovery.done";
+                restore_command = "cp ${walBackupDir}/%f %p";
+                wal_level = "archive"; # alias for replica on pg >= 9.6
+              };
+              authentication = ''
+                host replication ${replicationUser} all trust
+              '';
+              initialScript = pkgs.writeText "init.sql" ''
+                create user ${replicationUser} replication;
+                select * from pg_create_physical_replication_slot('${replicationSlot}');
+              '';
             };
-            authentication = ''
-              host replication ${replicationUser} all trust
-            '';
-            initialScript = pkgs.writeText "init.sql" ''
-              create user ${replicationUser} replication;
-              select * from pg_create_physical_replication_slot('${replicationSlot}');
-            '';
+
+            services.postgresqlWalReceiver.receivers.main = {
+              postgresqlPackage = package;
+              connection = replicationConn;
+              slot = replicationSlot;
+              directory = walBackupDir;
+            };
+            # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
+            # default 60sec is fine for real system, but is too much for a test
+            systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+            systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
           };
 
-          services.postgresqlWalReceiver.receivers.main = {
-            postgresqlPackage = package;
-            connection = replicationConn;
-            slot = replicationSlot;
-            directory = walBackupDir;
-          };
-          # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
-          # default 60sec is fine for real system, but is too much for a test
-          systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
-          systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
-        };
+        testScript = ''
+          # make an initial base backup
+          machine.wait_for_unit("postgresql.target")
+          machine.wait_for_unit("postgresql-wal-receiver-main")
+          # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
+          # required only for 9.4
+          machine.sleep(5)
+          machine.succeed(
+              "${package}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
+          )
 
-      testScript = ''
-        # make an initial base backup
-        machine.wait_for_unit("postgresql.target")
-        machine.wait_for_unit("postgresql-wal-receiver-main")
-        # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
-        # required only for 9.4
-        machine.sleep(5)
-        machine.succeed(
-            "${package}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
-        )
+          # create a dummy table with 100 records
+          machine.succeed(
+              "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
+          )
 
-        # create a dummy table with 100 records
-        machine.succeed(
-            "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
-        )
+          # stop postgres and destroy data
+          machine.systemctl("stop postgresql")
+          machine.systemctl("stop postgresql-wal-receiver-main")
+          machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
 
-        # stop postgres and destroy data
-        machine.systemctl("stop postgresql")
-        machine.systemctl("stop postgresql-wal-receiver-main")
-        machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
+          # restore the base backup
+          machine.succeed(
+              "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
+          )
 
-        # restore the base backup
-        machine.succeed(
-            "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
-        )
+          # prepare WAL and recovery
+          machine.succeed("chmod a+rX -R ${walBackupDir}")
+          machine.execute(
+              "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
+          )  # make use of partial segments too
+          machine.succeed(
+              "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
+          )
 
-        # prepare WAL and recovery
-        machine.succeed("chmod a+rX -R ${walBackupDir}")
-        machine.execute(
-            "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
-        )  # make use of partial segments too
-        machine.succeed(
-            "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
-        )
+          # replay WAL
+          machine.systemctl("start postgresql")
+          machine.wait_for_file("${postgresqlDataDir}/recovery.done")
+          machine.systemctl("restart postgresql")
+          machine.wait_for_unit("postgresql.target")
 
-        # replay WAL
-        machine.systemctl("start postgresql")
-        machine.wait_for_file("${postgresqlDataDir}/recovery.done")
-        machine.systemctl("restart postgresql")
-        machine.wait_for_unit("postgresql.target")
-
-        # check that our records have been restored
-        machine.succeed(
-            "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
-        )
-      '';
-    };
+          # check that our records have been restored
+          machine.succeed(
+              "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
+          )
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql.nix

@@ -1,12 +1,11 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  lib,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
     lib.recurseIntoAttrs {
@@ -15,263 +14,271 @@ let
       postgresql-clauses = makeEnsureTestFor package;
     };
 
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
-    CREATE TABLE sth (
-      id int
-    );
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    CREATE TABLE xmltest ( doc xml );
-    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-
-    -- check if hardening gets relaxed
-    CREATE EXTENSION plv8;
-    -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-    DO $$
-      let xs = [];
-      for (let i = 0, n = 400000; i < n; i++) {
-          xs.push(Math.round(Math.random() * n))
-      }
-      console.log(xs.reduce((acc, x) => acc + x, 0));
-    $$ LANGUAGE plv8;
-  '';
-
   makeTestForWithBackupAll =
     package: backupAll:
-    makeTest {
-      name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ zagy ];
-      };
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        test-sql = pkgs.writeText "postgresql-test" ''
+          CREATE EXTENSION pgcrypto; -- just to check if lib loading works
+          CREATE TABLE sth (
+            id int
+          );
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          CREATE TABLE xmltest ( doc xml );
+          INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
 
-      nodes.machine =
-        { config, ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            identMap = ''
-              postgres root postgres
-            '';
-            # TODO(@Ma27) split this off into its own VM test and move a few other
-            # extension tests to use postgresqlTestExtension.
-            extensions = ps: with ps; [ plv8 ];
-          };
+          -- check if hardening gets relaxed
+          CREATE EXTENSION plv8;
+          -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
+          DO $$
+            let xs = [];
+            for (let i = 0, n = 400000; i < n; i++) {
+                xs.push(Math.round(Math.random() * n))
+            }
+            console.log(xs.reduce((acc, x) => acc + x, 0));
+          $$ LANGUAGE plv8;
+        '';
 
-          services.postgresqlBackup = {
-            enable = true;
-            databases = lib.optional (!backupAll) "postgres";
-            pgdumpOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-            pgdumpAllOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-          };
+      in
+      {
+        name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [ zagy ];
         };
 
-      testScript =
-        let
-          backupName = if backupAll then "all" else "postgres";
-          backupService = if backupAll then "postgresqlBackup" else "postgresqlBackup-postgres";
-          backupFileBase = "/var/backup/postgresql/${backupName}";
-        in
-        ''
-          def check_count(statement, lines):
-              return 'test $(psql -U postgres postgres -tAc "{}"|wc -l) -eq {}'.format(
-                  statement, lines
-              )
+        nodes.machine =
+          { config, ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              identMap = ''
+                postgres root postgres
+              '';
+              # TODO(@Ma27) split this off into its own VM test and move a few other
+              # extension tests to use postgresqlTestExtension.
+              extensions = ps: with ps; [ plv8 ];
+            };
+
+            services.postgresqlBackup = {
+              enable = true;
+              databases = lib.optional (!backupAll) "postgres";
+              pgdumpOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+              pgdumpAllOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+            };
+          };
+
+        testScript =
+          let
+            backupName = if backupAll then "all" else "postgres";
+            backupService = if backupAll then "postgresqlBackup" else "postgresqlBackup-postgres";
+            backupFileBase = "/var/backup/postgresql/${backupName}";
+          in
+          ''
+            def check_count(statement, lines):
+                return 'test $(psql -U postgres postgres -tAc "{}"|wc -l) -eq {}'.format(
+                    statement, lines
+                )
 
 
-          machine.start()
-          machine.wait_for_unit("postgresql.target")
+            machine.start()
+            machine.wait_for_unit("postgresql.target")
 
-          with subtest("Postgresql is available just after unit start"):
-              machine.succeed(
-                  "cat ${test-sql} | sudo -u postgres psql"
-              )
+            with subtest("Postgresql is available just after unit start"):
+                machine.succeed(
+                    "cat ${test-sql} | sudo -u postgres psql"
+                )
 
-          with subtest("Postgresql survives restart (bug #1735)"):
-              machine.shutdown()
-              import time
-              time.sleep(2)
-              machine.start()
-              machine.wait_for_unit("postgresql.target")
+            with subtest("Postgresql survives restart (bug #1735)"):
+                machine.shutdown()
+                import time
+                time.sleep(2)
+                machine.start()
+                machine.wait_for_unit("postgresql.target")
 
-          machine.fail(check_count("SELECT * FROM sth;", 3))
-          machine.succeed(check_count("SELECT * FROM sth;", 5))
-          machine.fail(check_count("SELECT * FROM sth;", 4))
-          machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
+            machine.fail(check_count("SELECT * FROM sth;", 3))
+            machine.succeed(check_count("SELECT * FROM sth;", 5))
+            machine.fail(check_count("SELECT * FROM sth;", 4))
+            machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
 
-          with subtest("killing postgres process should trigger an automatic restart"):
-              machine.succeed("systemctl kill -s KILL postgresql")
+            with subtest("killing postgres process should trigger an automatic restart"):
+                machine.succeed("systemctl kill -s KILL postgresql")
 
-              machine.wait_until_succeeds("systemctl is-active postgresql.service")
-              machine.wait_until_succeeds("systemctl is-active postgresql.target")
+                machine.wait_until_succeeds("systemctl is-active postgresql.service")
+                machine.wait_until_succeeds("systemctl is-active postgresql.target")
 
-          with subtest("Backup service works"):
-              machine.succeed(
-                  "systemctl start ${backupService}.service",
-                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
-                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-              )
-          with subtest("Backup service removes prev files"):
-              machine.succeed(
-                  # Create dummy prev files.
-                  "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
-                  "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
+            with subtest("Backup service works"):
+                machine.succeed(
+                    "systemctl start ${backupService}.service",
+                    "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
+                    "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+                )
+            with subtest("Backup service removes prev files"):
+                machine.succeed(
+                    # Create dummy prev files.
+                    "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
+                    "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
 
-                  # Run backup.
-                  "systemctl start ${backupService}.service",
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
+                    # Run backup.
+                    "systemctl start ${backupService}.service",
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
 
-                  # Since nothing has changed in the database, the cur and prev files
-                  # should match.
-                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-                  "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
+                    # Since nothing has changed in the database, the cur and prev files
+                    # should match.
+                    "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                    "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
 
-                  # The prev files with unused suffix should be removed.
-                  "[ ! -f '${backupFileBase}.prev.sql' ]",
-                  "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
+                    # The prev files with unused suffix should be removed.
+                    "[ ! -f '${backupFileBase}.prev.sql' ]",
+                    "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
 
-                  # Both cur and prev file should only be accessible by the postgres user.
-                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-                  "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
-              )
-          with subtest("Backup service fails gracefully"):
-              # Sabotage the backup process
-              machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
-              machine.fail(
-                  "systemctl start ${backupService}.service",
-              )
-              machine.succeed(
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
-                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-                  "stat ${backupFileBase}.in-progress.sql.gz",
-              )
-              # In a previous version, the second run would overwrite prev.sql.gz,
-              # so we test a second run as well.
-              machine.fail(
-                  "systemctl start ${backupService}.service",
-              )
-              machine.succeed(
-                  "stat ${backupFileBase}.in-progress.sql.gz",
-                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-              )
+                    # Both cur and prev file should only be accessible by the postgres user.
+                    "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+                    "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
+                )
+            with subtest("Backup service fails gracefully"):
+                # Sabotage the backup process
+                machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
+                machine.fail(
+                    "systemctl start ${backupService}.service",
+                )
+                machine.succeed(
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
+                    "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+                    "stat ${backupFileBase}.in-progress.sql.gz",
+                )
+                # In a previous version, the second run would overwrite prev.sql.gz,
+                # so we test a second run as well.
+                machine.fail(
+                    "systemctl start ${backupService}.service",
+                )
+                machine.succeed(
+                    "stat ${backupFileBase}.in-progress.sql.gz",
+                    "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+                )
 
 
-          with subtest("Initdb works"):
-              machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
+            with subtest("Initdb works"):
+                machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
 
-          machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+            machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
 
-          machine.shutdown()
-        '';
-    };
+            machine.shutdown()
+          '';
+      }
+    );
 
   makeEnsureTestFor =
     package:
-    makeTest {
-      name = "postgresql-clauses-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ zagy ];
-      };
-
-      nodes.machine =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            ensureUsers = [
-              {
-                name = "all-clauses";
-                ensureClauses = {
-                  superuser = true;
-                  createdb = true;
-                  createrole = true;
-                  "inherit" = true;
-                  login = true;
-                  replication = true;
-                  bypassrls = true;
-                  # SCRAM-SHA-256 hashed password for "password"
-                  password = "SCRAM-SHA-256$4096:SZEJF5Si4QZ6l4fedrZZWQ==$6u3PWVcz+dts+NdpByPIjKa4CaSnoXGG3M2vpo76bVU=:WSZ0iGUCmVtKYVvNX0pFOp/60IgsdJ+90Y67Eun+QE0=";
-                  connection_limit = 5;
-                };
-              }
-              {
-                name = "default-clauses";
-              }
-            ];
-          };
+    runTest (
+      { lib, ... }:
+      {
+        name = "postgresql-clauses-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [ zagy ];
         };
 
-      testScript =
-        let
-          getClausesQuery =
-            user:
-            lib.concatStringsSep " " [
-              "SELECT row_to_json(row)"
-              "FROM ("
-              "SELECT"
-              "rolsuper,"
-              "rolinherit,"
-              "rolcreaterole,"
-              "rolcreatedb,"
-              "rolcanlogin,"
-              "rolreplication,"
-              "rolbypassrls,"
-              "rolconnlimit,"
-              "rolpassword"
-              "FROM pg_authid"
-              "WHERE rolname = '${user}'"
-              ") row;"
-            ];
-        in
-        ''
-          import json
-          machine.start()
-          machine.wait_for_unit("postgresql.target")
+        nodes.machine =
+          { ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              ensureUsers = [
+                {
+                  name = "all-clauses";
+                  ensureClauses = {
+                    superuser = true;
+                    createdb = true;
+                    createrole = true;
+                    "inherit" = true;
+                    login = true;
+                    replication = true;
+                    bypassrls = true;
+                    # SCRAM-SHA-256 hashed password for "password"
+                    password = "SCRAM-SHA-256$4096:SZEJF5Si4QZ6l4fedrZZWQ==$6u3PWVcz+dts+NdpByPIjKa4CaSnoXGG3M2vpo76bVU=:WSZ0iGUCmVtKYVvNX0pFOp/60IgsdJ+90Y67Eun+QE0=";
+                    connection_limit = 5;
+                  };
+                }
+                {
+                  name = "default-clauses";
+                }
+              ];
+            };
+          };
 
-          with subtest("All user permissions are set according to the ensureClauses attr"):
-              clauses = json.loads(
-                machine.succeed(
-                    "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
+        testScript =
+          let
+            getClausesQuery =
+              user:
+              lib.concatStringsSep " " [
+                "SELECT row_to_json(row)"
+                "FROM ("
+                "SELECT"
+                "rolsuper,"
+                "rolinherit,"
+                "rolcreaterole,"
+                "rolcreatedb,"
+                "rolcanlogin,"
+                "rolreplication,"
+                "rolbypassrls,"
+                "rolconnlimit,"
+                "rolpassword"
+                "FROM pg_authid"
+                "WHERE rolname = '${user}'"
+                ") row;"
+              ];
+          in
+          ''
+            import json
+            machine.start()
+            machine.wait_for_unit("postgresql.target")
+
+            with subtest("All user permissions are set according to the ensureClauses attr"):
+                clauses = json.loads(
+                  machine.succeed(
+                      "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
+                  )
                 )
-              )
-              print(clauses)
-              t.assertTrue(clauses["rolsuper"])
-              t.assertTrue(clauses["rolinherit"])
-              t.assertTrue(clauses["rolcreaterole"])
-              t.assertTrue(clauses["rolcreatedb"])
-              t.assertTrue(clauses["rolcanlogin"])
-              t.assertTrue(clauses["rolreplication"])
-              t.assertTrue(clauses["rolbypassrls"])
-              t.assertTrue(clauses["rolconnlimit"] == 5)
-              t.assertTrue(clauses["rolpassword"])
-              machine.succeed(
-                "PGPASSWORD='password' psql -h localhost -U all-clauses -d postgres -c \"SELECT 1\""
-              )
-
-          with subtest("All user permissions default when ensureClauses is not provided"):
-              clauses = json.loads(
+                print(clauses)
+                t.assertTrue(clauses["rolsuper"])
+                t.assertTrue(clauses["rolinherit"])
+                t.assertTrue(clauses["rolcreaterole"])
+                t.assertTrue(clauses["rolcreatedb"])
+                t.assertTrue(clauses["rolcanlogin"])
+                t.assertTrue(clauses["rolreplication"])
+                t.assertTrue(clauses["rolbypassrls"])
+                t.assertTrue(clauses["rolconnlimit"] == 5)
+                t.assertTrue(clauses["rolpassword"])
                 machine.succeed(
-                    "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
+                  "PGPASSWORD='password' psql -h localhost -U all-clauses -d postgres -c \"SELECT 1\""
                 )
-              )
-              t.assertFalse(clauses["rolsuper"])
-              t.assertTrue(clauses["rolinherit"])
-              t.assertFalse(clauses["rolcreaterole"])
-              t.assertFalse(clauses["rolcreatedb"])
-              t.assertTrue(clauses["rolcanlogin"])
-              t.assertFalse(clauses["rolreplication"])
-              t.assertFalse(clauses["rolbypassrls"])
-              t.assertFalse(clauses["rolconnlimit"] == 5)
-              t.assertFalse(clauses["rolpassword"])
 
-          machine.shutdown()
-        '';
-    };
+            with subtest("All user permissions default when ensureClauses is not provided"):
+                clauses = json.loads(
+                  machine.succeed(
+                      "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
+                  )
+                )
+                t.assertFalse(clauses["rolsuper"])
+                t.assertTrue(clauses["rolinherit"])
+                t.assertFalse(clauses["rolcreaterole"])
+                t.assertFalse(clauses["rolcreatedb"])
+                t.assertTrue(clauses["rolcanlogin"])
+                t.assertFalse(clauses["rolreplication"])
+                t.assertFalse(clauses["rolbypassrls"])
+                t.assertFalse(clauses["rolconnlimit"] == 5)
+                t.assertFalse(clauses["rolpassword"])
+
+            machine.shutdown()
+          '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/wal2json.nix

@@ -1,47 +1,48 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "wal2json-${package.name}";
-      meta.maintainers = with pkgs.lib.maintainers; [ euank ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "wal2json-${package.name}";
+        meta.maintainers = with pkgs.lib.maintainers; [ euank ];
 
-      nodes.machine = {
-        services.postgresql = {
-          inherit package;
-          enable = true;
-          extensions = with package.pkgs; [ wal2json ];
-          settings = {
-            wal_level = "logical";
-            max_replication_slots = "10";
-            max_wal_senders = "10";
+        nodes.machine = {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extensions = with package.pkgs; [ wal2json ];
+            settings = {
+              wal_level = "logical";
+              max_replication_slots = "10";
+              max_wal_senders = "10";
+            };
           };
         };
-      };
 
-      testScript = ''
-        machine.wait_for_unit("postgresql.target")
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
-        )
-        machine.succeed(
-            "diff ${./wal2json/example2.out} /tmp/example2.out"
-        )
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./wal2json/example3.sql} postgres > /tmp/example3.out"
-        )
-        machine.succeed(
-            "diff ${./wal2json/example3.out} /tmp/example3.out"
-        )
-      '';
-    };
+        testScript = ''
+          machine.wait_for_unit("postgresql.target")
+          machine.succeed(
+              "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
+          )
+          machine.succeed(
+              "diff ${./wal2json/example2.out} /tmp/example2.out"
+          )
+          machine.succeed(
+              "sudo -u postgres psql -qAt -f ${./wal2json/example3.sql} postgres > /tmp/example3.out"
+          )
+          machine.succeed(
+              "diff ${./wal2json/example3.out} /tmp/example3.out"
+          )
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-01-20";
+  version = "0-unstable-2026-01-25";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "c69ecd250eb76cdceae1dbb962116f706e4fa661";
-    hash = "sha256-cCUHTaHDNn7k5mK589RoNXiPgFvEBCxCSyp+8azUtpg=";
+    rev = "38c84798aac5239a06d75e85469225a2ad9c4707";
+    hash = "sha256-3N2/v9yv44GdSEoPjC2yne43f4WqLTlWr8dYRrb+GxY=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/by-name/ap/appium-inspector/package.nix

@@ -11,7 +11,7 @@
 
 let
   electron = electron_39;
-  version = "2026.1.2";
+  version = "2026.1.3";
 in
 
 buildNpmPackage {
@@ -22,10 +22,10 @@ buildNpmPackage {
     owner = "appium";
     repo = "appium-inspector";
     tag = "v${version}";
-    hash = "sha256-uNRm6XHgK55gayl4ab9atV4+i9uCnxEcl4C6HEOX6Ro=";
+    hash = "sha256-9WhSQq3is2qucL1cGQIYPuLM9VkCFIWq2XVU2QioRMo=";
   };
 
-  npmDepsHash = "sha256-MraVLbKNgEhwT9sTyNhi4uDfyXOEAGOznvSs0B+mEUA=";
+  npmDepsHash = "sha256-2DNUTvZ6yFL9U8JKw4ZFR81a6Mv9rPXtRu/v/Il/Rhw=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [

pkgs/by-name/bl/blightmud/package.nix

@@ -55,9 +55,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
         "test_tls_init_no_verify"
         "test_tls_init_verify"
       ];
-      skipFlag = test: "--skip " + test;
     in
-    builtins.concatStringsSep " " (map skipFlag skipList);
+    builtins.map (x: "--skip=" + x) skipList;
 
   meta = {
     description = "Terminal MUD client written in Rust";

pkgs/by-name/bu/bun/package.nix

@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
-  version = "1.3.6";
+  version = "1.3.7";
   pname = "bun";
 
   src =
@@ -71,35 +71,29 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           && !(stdenvNoCC.hostPlatform.isDarwin && stdenvNoCC.hostPlatform.isx86_64)
         )
         ''
-          completions_dir=$(mktemp -d)
-
-          SHELL="bash" $out/bin/bun completions $completions_dir
-          SHELL="zsh" $out/bin/bun completions $completions_dir
-          SHELL="fish" $out/bin/bun completions $completions_dir
-
-          installShellCompletion --name bun \
-            --bash $completions_dir/bun.completion.bash \
-            --zsh $completions_dir/_bun \
-            --fish $completions_dir/bun.fish
+          installShellCompletion --cmd bun \
+            --bash <(SHELL="bash" $out/bin/bun completions) \
+            --zsh <(SHELL="zsh" $out/bin/bun completions) \
+            --fish <(SHELL="fish" $out/bin/bun completions)
         '';
 
   passthru = {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-aarch64.zip";
-        hash = "sha256-KvHshDd1mrBbOw6kIf6eIubHBctMsHUcMmmCZC2s6Po=";
+        hash = "sha256-FnAeSUmY5HZNSa8vvmLSXsWc88ee5pbrod7yz+kEnWQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-aarch64.zip";
-        hash = "sha256-Wv0Ss2a6LYKXJFzCnAOUFjNN2HIVLB2wLlyKqMZulrE=";
+        hash = "sha256-1cfWUUI8K8WuP5LTaDf/st3G7pGElnJQC3/o5aUVn7w=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-stiZTUz3BkE2bWm4dCC4BdHZhPTqfhajUt8VaUlHT6U=";
+        hash = "sha256-nCwa7m1y6WGVwwUfkSMlBHWVB6qusJPVtw+IaX4ajq8=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-x64.zip";
-        hash = "sha256-m6mNITRVDWaQh1sjpPXEjnS3yyZ+jMG49SYFkhxsEe8=";
+        hash = "sha256-K9Lg4L3wlIO+Z6cEYHhI6+csKEIIJOTOdyzj2mLCPWU=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ca/cargo-bisect-rustc/package.nix

@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-SigRm2ZC7jH1iCEGRpka1G/e9kBEieFVU0YDBl2LfTM=";
 
   checkFlags = [
-    "--skip test_github" # requires internet
+    "--skip=test_github" # requires internet
   ];
 
   meta = {

pkgs/by-name/ca/cargo-deadlinks/package.nix

@@ -20,15 +20,16 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # uses internet
-    "--skip non_existent_http_link --skip working_http_check"
+    "--skip=non_existent_http_link"
+    "--skip=working_http_check"
     # makes assumption about HTML paths that changed in rust 1.82.0
-    "--skip simple_project::it_checks_okay_project_correctly"
-    "--skip cli_args::it_passes_arguments_through_to_cargo"
+    "--skip=simple_project::it_checks_okay_project_correctly"
+    "--skip=cli_args::it_passes_arguments_through_to_cargo"
   ]
-  ++
-    lib.optional (stdenv.hostPlatform.system != "x86_64-linux")
-      # assumes the target is x86_64-unknown-linux-gnu
-      "--skip simple_project::it_checks_okay_project_correctly";
+  ++ lib.optionals (stdenv.hostPlatform.system != "x86_64-linux") [
+    # assumes the target is x86_64-unknown-linux-gnu
+    "--skip=simple_project::it_checks_okay_project_correctly"
+  ];
 
   meta = {
     description = "Cargo subcommand to check rust documentation for broken links";

pkgs/by-name/ca/cargo-geiger/package.nix

@@ -53,21 +53,21 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # skip tests with networking or other failures
   checkFlags = [
     # panics
-    "--skip serialize_test2_quick_report"
-    "--skip serialize_test3_quick_report"
-    "--skip serialize_test6_quick_report"
-    "--skip serialize_test2_report"
-    "--skip serialize_test3_report"
-    "--skip serialize_test6_report"
+    "--skip=serialize_test2_quick_report"
+    "--skip=serialize_test3_quick_report"
+    "--skip=serialize_test6_quick_report"
+    "--skip=serialize_test2_report"
+    "--skip=serialize_test3_report"
+    "--skip=serialize_test6_report"
     # requires networking
-    "--skip test_package::case_2"
-    "--skip test_package::case_3"
-    "--skip test_package::case_6"
-    "--skip test_package::case_9"
+    "--skip=test_package::case_2"
+    "--skip=test_package::case_3"
+    "--skip=test_package::case_6"
+    "--skip=test_package::case_9"
     # panics, snapshot assertions fails
-    "--skip test_package_update_readme::case_2"
-    "--skip test_package_update_readme::case_3"
-    "--skip test_package_update_readme::case_5"
+    "--skip=test_package_update_readme::case_2"
+    "--skip=test_package_update_readme::case_3"
+    "--skip=test_package_update_readme::case_5"
   ];
 
   passthru.tests.version = testers.testVersion {

pkgs/by-name/ca/cargo-sweep/package.nix

@@ -19,9 +19,9 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # Requires a rustup toolchain to be installed.
-    "--skip check_toolchain_listing_on_multiple_projects"
+    "--skip=check_toolchain_listing_on_multiple_projects"
     # Does not work with a `--target` build in the environment
-    "--skip empty_project_output"
+    "--skip=empty_project_output"
   ];
 
   meta = {

pkgs/by-name/ca/cargo-valgrind/package.nix

@@ -33,9 +33,9 @@ rustPlatform.buildRustPackage rec {
   '';
 
   checkFlags = [
-    "--skip tests_are_runnable"
-    "--skip default_cargo_project_reports_no_violations"
-    "--skip empty_tests_not_leak_in_release_mode"
+    "--skip=tests_are_runnable"
+    "--skip=default_cargo_project_reports_no_violations"
+    "--skip=empty_tests_not_leak_in_release_mode"
   ];
 
   meta = {

pkgs/by-name/cl/claude-code-bin/manifest.json

@@ -1,34 +1,34 @@
 {
-  "version": "2.1.20",
-  "buildDate": "2026-01-27T00:41:34Z",
+  "version": "2.1.21",
+  "buildDate": "2026-01-28T01:39:36Z",
   "platforms": {
     "darwin-arm64": {
-      "checksum": "c5703596ed854ae8e5775cf38de5d71d8a56ecfe3f36904812870e9e34178c8c",
-      "size": 181661168
+      "checksum": "e8265d8719f131ab8f2863e66ce69cc829c4f55387ae2286e45d4a06b802c6fd",
+      "size": 181892336
     },
     "darwin-x64": {
-      "checksum": "0d38292770c88bd9b13b0684afb0d2dc0028a1437d0c09be3449d2b3d369b045",
-      "size": 187958208
+      "checksum": "1824c9a01e0266bef1c0da880503e49db08823cf7eb6a54fef2a385028c2bb05",
+      "size": 188189376
     },
     "linux-arm64": {
-      "checksum": "eb8801c7a4a8501b21c235f36674f17328e65e796cf8a6196b3bf9a23ae16f99",
-      "size": 216047898
+      "checksum": "e043ed95e4df4282a9adb34eb51ee14d59a53f2feeeb19884a6b4edeccbe7f3a",
+      "size": 216288068
     },
     "linux-x64": {
-      "checksum": "f9d3698f5378a486db2d4eea5c80f95c2ceb410fbcea9ffc5703b5aac9574fcc",
-      "size": 223852550
+      "checksum": "35fcccfced2e8669dc4aacf2bb76fab9816bcc5fc566e66b5ae42f4e7b4474b1",
+      "size": 224093184
     },
     "linux-arm64-musl": {
-      "checksum": "2a7d24d2b85068c5aca6c014dd5f3f94bd8d55803a06f0d39eea776ab3282d76",
-      "size": 211311930
+      "checksum": "5e453c59b3c8fea4e6848e0972ab093e8eda4711e2be20b68dd4ebaea12db4e1",
+      "size": 211552100
     },
     "linux-x64-musl": {
-      "checksum": "0b392cc1c268f0e48ceedee384535451013f69887a61e23f989e3b743373796a",
-      "size": 216541126
+      "checksum": "afa929dbccd23f746b01821699b1985eb7cc35018d0a8e9bbab678764ea58fb7",
+      "size": 216781760
     },
     "win32-x64": {
-      "checksum": "12e88d78570b6e979f5cf290652dc45ca8b9327f43bb27e275f87146190bef05",
-      "size": 233703072
+      "checksum": "325abe8bb0b907c008e229085815c938037864411ced6c553dbb52e0be587efe",
+      "size": 233936544
     }
   }
 }

pkgs/by-name/de/deck/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.54.0";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     tag = "v${version}";
-    hash = "sha256-DVj4VHmU3yORL4zytWzXIPEjrS1P+WLE18Vdcdbibos=";
+    hash = "sha256-Xw8IROfseCo4e0yDC5Y6aD/aTu9JYsGYjeSzSVIXd+E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ buildGoModule rec {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-x+nL+bnwXio/z3XFC9A9G9T7mtB5BsnNgLWT54OJLCE=";
+  vendorHash = "sha256-LmYsPrHKTYu07jLkAo7UsIV74sVyLSdhAwUV6Cu0JNQ=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd deck \

pkgs/by-name/de/deno/package.nix

@@ -29,17 +29,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.6.5";
+  version = "2.6.6";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-oNZXPBW61IQdA3MFS1gxNoInSCt6mUitedAXx+tuFaw=";
+    hash = "sha256-QqzV4Ikr5iWrOX+KJH/65S1HHhxOB0SmHj7yejVJp3M=";
   };
 
-  cargoHash = "sha256-H1vX/aiB5inK6Fo0l3sEZnvqgRImTpjkxRZHLBPgz0U=";
+  cargoHash = "sha256-soJ2ZKpxlBskl2b3pz4pn6zMaWUXjYOBRKBuoxHokes=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch

pkgs/by-name/eg/ego/package.nix

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   # requires access to /root
   checkFlags = [
-    "--skip tests::test_check_user_homedir"
+    "--skip=tests::test_check_user_homedir"
   ];
 
   postInstall = ''

pkgs/by-name/fl/flip-link/package.nix

@@ -23,9 +23,9 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # requires embedded toolchains
-    "--skip should_link_example_firmware::case_1_normal"
-    "--skip should_link_example_firmware::case_2_custom_linkerscript"
-    "--skip should_verify_memory_layout"
+    "--skip=should_link_example_firmware::case_1_normal"
+    "--skip=should_link_example_firmware::case_2_custom_linkerscript"
+    "--skip=should_verify_memory_layout"
   ];
 
   meta = {

pkgs/by-name/gi/gitlab-clippy/package.nix

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-O3Pey0XwZITePTiVHrG5EVZpIp96sRWjUf1vzZ/JnCw=";
 
-  # TODO re-add theses tests once they get fixed in upstream
+  # TODO re-add these tests once they get fixed in upstream
   checkFlags = [
-    "--skip cli::converts_error_from_pipe"
-    "--skip cli::converts_warnings_from_pipe"
+    "--skip=cli::converts_error_from_pipe"
+    "--skip=cli::converts_warnings_from_pipe"
   ];
 
   meta = {

pkgs/by-name/gr/grcov/package.nix

@@ -30,9 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
         "test_integration_zip_dir"
         "test_integration_zip_zip"
       ];
-      skipFlag = test: "--skip " + test;
     in
-    builtins.concatStringsSep " " (map skipFlag skipList);
+    builtins.map (x: "--skip=" + x) skipList;
 
   meta = {
     description = "Rust tool to collect and aggregate code coverage data for multiple source files";

pkgs/by-name/gv/gvm-libs/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "22.35.2";
+  version = "22.35.4";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DVYU+6hUps2nwgkTWu228wVYtke4oDFUqXM73DEN6LM=";
+    hash = "sha256-fD8pi3eSmeSC0qPhX0DpATYMkblnat74VMzwBqWe5n4=";
   };
 
   postPatch = ''

pkgs/by-name/hu/hullcaster/package.nix

@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
 
   # work around error: Could not create filepath: /homeless-shelter/.local/share
   checkFlags = [
-    "--skip gpodder::tests::gpodder"
+    "--skip=gpodder::tests::gpodder"
   ];
 
   meta = {

pkgs/by-name/ka/karlender/package.nix

@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   checkFlags = [
-    "--skip domain::time::tests::test_get_correct_offset_for_dst" # Need time
+    "--skip=domain::time::tests::test_get_correct_offset_for_dst" # Need time
   ];
 
   preBuild = ''

pkgs/by-name/li/libation/deps.json

@@ -1,13 +1,13 @@
 [
   {
     "pname": "AAXClean",
-    "version": "2.1.0.1",
-    "hash": "sha256-dQJKHzET1QXKwxXqEb6X/B+vN6f8tF5jchxSGxUVeTs="
+    "version": "2.1.1.1",
+    "hash": "sha256-SjM74bfcqb3L6Ux+crofEsOWoHB0O78afNrld9WEFY0="
   },
   {
     "pname": "AAXClean.Codecs",
-    "version": "2.1.3.1",
-    "hash": "sha256-GeIQgSPzAhpNfulGWA9tJmnFDN1CsSnerq9rKaK8poE="
+    "version": "2.1.3.2",
+    "hash": "sha256-la4yuCQi75bCRr700CDD2huNEjk5ZKrTzwrtuUjyWAk="
   },
   {
     "pname": "AudibleApi",

pkgs/by-name/li/libation/package.nix

@@ -15,13 +15,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "13.1.3";
+  version = "13.1.4";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-gK0UZ+3EZGVEiy+O47GhU4wsHmdPIbrHWyHnUOtWrm8=";
+    hash = "sha256-KKdyDBT+EAqOVRxt3SH05Kd+u3g3O40MNZbrwc3GeFQ=";
   };
 
   sourceRoot = "${src.name}/Source";

pkgs/by-name/li/libks/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libks";
-  version = "2.0.8";
+  version = "2.0.9";
 
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = "libks";
     tag = "v${version}";
-    hash = "sha256-cBNNCOm+NcIvozN4Z4XnZWBBqq0LVELVqXubQB4JMTU=";
+    hash = "sha256-XnNyzH+VdBHligJ5+ct835Mekw2DbxMboC06Umm2Zak=";
   };
 
   patches = [
@@ -63,6 +63,9 @@ stdenv.mkDerivation rec {
   # Something seems to go wrong with testwebsock2 when using parallelism
   enableParallelChecking = false;
 
+  # Some tests require this on Darwin
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     tests.freeswitch = freeswitch;
     updateScript = nix-update-script { };

pkgs/by-name/li/lighthouse/package.nix

@@ -67,10 +67,15 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-aeTeHRT3QtxBRSNMCITIWmx89vGtox2OzSff8vZ+RYY=";
   };
 
-  LIGHTHOUSE_DEPOSIT_CONTRACT_SPEC_URL = "file://${depositContractSpec}";
-  LIGHTHOUSE_DEPOSIT_CONTRACT_TESTNET_URL = "file://${testnetDepositContractSpec}";
+  env = {
+    LIGHTHOUSE_DEPOSIT_CONTRACT_SPEC_URL = "file://${depositContractSpec}";
+    LIGHTHOUSE_DEPOSIT_CONTRACT_TESTNET_URL = "file://${testnetDepositContractSpec}";
 
-  OPENSSL_NO_VENDOR = true;
+    OPENSSL_NO_VENDOR = true;
+
+    # This is needed by the unit tests.
+    FORK_NAME = "capella";
+  };
 
   cargoBuildFlags = [
     "--package lighthouse"
@@ -96,229 +101,229 @@ rustPlatform.buildRustPackage rec {
 
   # All of these tests require network access
   checkFlags = [
-    "--skip tests::broadcast_should_send_to_all_bns"
-    "--skip tests::check_candidate_order"
-    "--skip tests::first_success_should_try_nodes_in_order"
-    "--skip tests::update_all_candidates_should_update_sync_status"
-    "--skip engine_api::http::test::forkchoice_updated_v1_request"
-    "--skip engine_api::http::test::forkchoice_updated_v1_with_payload_attributes_request"
-    "--skip engine_api::http::test::get_block_by_hash_request"
-    "--skip engine_api::http::test::get_block_by_number_request"
-    "--skip engine_api::http::test::get_payload_v1_request"
-    "--skip engine_api::http::test::geth_test_vectors"
-    "--skip engine_api::http::test::new_payload_v1_request"
-    "--skip test::finds_valid_terminal_block_hash"
-    "--skip test::produce_three_valid_pos_execution_blocks"
-    "--skip test::rejects_invalid_terminal_block_hash"
-    "--skip test::rejects_terminal_block_with_equal_timestamp"
-    "--skip test::rejects_unknown_terminal_block_hash"
-    "--skip test::test_forked_terminal_block"
-    "--skip test::verifies_valid_terminal_block_hash"
-    "--skip deposit_tree::cache_consistency"
-    "--skip deposit_tree::double_update"
-    "--skip deposit_tree::updating"
-    "--skip eth1_cache::big_skip"
-    "--skip eth1_cache::double_update"
-    "--skip eth1_cache::pruning"
-    "--skip eth1_cache::simple_scenario"
-    "--skip fast::deposit_cache_query"
-    "--skip http::incrementing_deposits"
-    "--skip persist::test_persist_caches"
-    "--skip can_read_finalized_block"
-    "--skip invalid_attestation_delayed_slot"
-    "--skip invalid_attestation_empty_bitfield"
-    "--skip invalid_attestation_future_block"
-    "--skip invalid_attestation_future_epoch"
-    "--skip invalid_attestation_inconsistent_ffg_vote"
-    "--skip invalid_attestation_past_epoch"
-    "--skip invalid_attestation_target_epoch"
-    "--skip invalid_attestation_unknown_beacon_block_root"
-    "--skip invalid_attestation_unknown_target_root"
-    "--skip invalid_block_finalized_descendant"
-    "--skip invalid_block_finalized_slot"
-    "--skip invalid_block_future_slot"
-    "--skip invalid_block_unknown_parent"
-    "--skip justified_and_finalized_blocks"
-    "--skip justified_balances"
-    "--skip justified_checkpoint_updates_with_descendent"
-    "--skip justified_checkpoint_updates_with_descendent_first_justification"
-    "--skip justified_checkpoint_updates_with_non_descendent"
-    "--skip progressive_balances_cache_attester_slashing"
-    "--skip progressive_balances_cache_proposer_slashing"
-    "--skip valid_attestation"
-    "--skip valid_attestation_skip_across_epoch"
-    "--skip weak_subjectivity_check_epoch_boundary_is_skip_slot"
-    "--skip weak_subjectivity_check_epoch_boundary_is_skip_slot_failure"
-    "--skip weak_subjectivity_check_fails_early_epoch"
-    "--skip weak_subjectivity_check_fails_incorrect_root"
-    "--skip weak_subjectivity_check_fails_late_epoch"
-    "--skip weak_subjectivity_check_passes"
-    "--skip weak_subjectivity_pass_on_startup"
-    "--skip basic"
-    "--skip returns_200_ok"
-    "--skip release_tests::attestation_aggregation_insert_get_prune"
-    "--skip release_tests::attestation_duplicate"
-    "--skip release_tests::attestation_get_max"
-    "--skip release_tests::attestation_pairwise_overlapping"
-    "--skip release_tests::attestation_rewards"
-    "--skip release_tests::cross_fork_attester_slashings"
-    "--skip release_tests::cross_fork_exits"
-    "--skip release_tests::cross_fork_proposer_slashings"
-    "--skip release_tests::duplicate_proposer_slashing"
-    "--skip release_tests::max_coverage_attester_proposer_slashings"
-    "--skip release_tests::max_coverage_different_indices_set"
-    "--skip release_tests::max_coverage_effective_balances"
-    "--skip release_tests::overlapping_max_cover_attester_slashing"
-    "--skip release_tests::prune_attester_slashing_noop"
-    "--skip release_tests::prune_proposer_slashing_noop"
-    "--skip release_tests::simple_max_cover_attester_slashing"
-    "--skip release_tests::sync_contribution_aggregation_insert_get_prune"
-    "--skip release_tests::sync_contribution_duplicate"
-    "--skip release_tests::sync_contribution_with_fewer_bits"
-    "--skip release_tests::sync_contribution_with_more_bits"
-    "--skip release_tests::test_earliest_attestation"
-    "--skip per_block_processing::tests::block_replayer_peeking_state_roots"
-    "--skip per_block_processing::tests::fork_spanning_exit"
-    "--skip per_block_processing::tests::invalid_attester_slashing_1_invalid"
-    "--skip per_block_processing::tests::invalid_attester_slashing_2_invalid"
-    "--skip per_block_processing::tests::invalid_attester_slashing_not_slashable"
-    "--skip per_block_processing::tests::invalid_bad_proposal_1_signature"
-    "--skip per_block_processing::tests::invalid_bad_proposal_2_signature"
-    "--skip per_block_processing::tests::invalid_block_header_state_slot"
-    "--skip per_block_processing::tests::invalid_block_signature"
-    "--skip per_block_processing::tests::invalid_deposit_bad_merkle_proof"
-    "--skip per_block_processing::tests::invalid_deposit_count_too_small"
-    "--skip per_block_processing::tests::invalid_deposit_deposit_count_too_big"
-    "--skip per_block_processing::tests::invalid_deposit_invalid_pub_key"
-    "--skip per_block_processing::tests::invalid_deposit_wrong_sig"
-    "--skip per_block_processing::tests::invalid_parent_block_root"
-    "--skip per_block_processing::tests::invalid_proposer_slashing_duplicate_slashing"
-    "--skip per_block_processing::tests::invalid_proposer_slashing_proposal_epoch_mismatch"
-    "--skip per_block_processing::tests::invalid_proposer_slashing_proposals_identical"
-    "--skip per_block_processing::tests::invalid_proposer_slashing_proposer_unknown"
-    "--skip per_block_processing::tests::invalid_randao_reveal_signature"
-    "--skip per_block_processing::tests::valid_4_deposits"
-    "--skip per_block_processing::tests::valid_block_ok"
-    "--skip per_block_processing::tests::valid_insert_attester_slashing"
-    "--skip per_block_processing::tests::valid_insert_proposer_slashing"
-    "--skip per_epoch_processing::tests::release_tests::altair_state_on_base_fork"
-    "--skip per_epoch_processing::tests::release_tests::base_state_on_altair_fork"
-    "--skip per_epoch_processing::tests::runs_without_error"
-    "--skip exit::custom_tests::valid"
-    "--skip exit::custom_tests::valid_three"
-    "--skip exit::tests::invalid_bad_signature"
-    "--skip exit::tests::invalid_duplicate"
-    "--skip exit::tests::invalid_exit_already_initiated"
-    "--skip exit::tests::invalid_future_exit_epoch"
-    "--skip exit::tests::invalid_not_active_after_exit_epoch"
-    "--skip exit::tests::invalid_not_active_before_activation_epoch"
-    "--skip exit::tests::invalid_too_young_by_a_lot"
-    "--skip exit::tests::invalid_too_young_by_one_epoch"
-    "--skip exit::tests::invalid_validator_unknown"
-    "--skip exit::tests::valid_genesis_epoch"
-    "--skip exit::tests::valid_previous_epoch"
-    "--skip exit::tests::valid_single_exit"
-    "--skip exit::tests::valid_three_exits"
-    "--skip iter::test::block_root_iter"
-    "--skip iter::test::state_root_iter"
-    "--skip beacon_state::committee_cache::tests::initializes_with_the_right_epoch"
-    "--skip beacon_state::committee_cache::tests::min_randao_epoch_correct"
-    "--skip beacon_state::committee_cache::tests::shuffles_for_the_right_epoch"
-    "--skip beacon_state::tests::beacon_proposer_index"
-    "--skip beacon_state::tests::cache_initialization"
-    "--skip beacon_state::tests::committees::current_epoch_committee_consistency"
-    "--skip beacon_state::tests::committees::next_epoch_committee_consistency"
-    "--skip beacon_state::tests::committees::previous_epoch_committee_consistency"
-    "--skip tests::hd_validator_creation"
-    "--skip tests::invalid_pubkey"
-    "--skip tests::keystore_validator_creation"
-    "--skip tests::keystores::check_get_set_fee_recipient"
-    "--skip tests::keystores::check_get_set_gas_limit"
-    "--skip tests::keystores::delete_concurrent_with_signing"
-    "--skip tests::keystores::delete_keystores_twice"
-    "--skip tests::keystores::delete_nonexistent_keystores"
-    "--skip tests::keystores::delete_nonexistent_remotekey"
-    "--skip tests::keystores::delete_remotekey_then_reimport_different_url"
-    "--skip tests::keystores::delete_remotekeys_twice"
-    "--skip tests::keystores::delete_then_reimport"
-    "--skip tests::keystores::delete_then_reimport_remotekeys"
-    "--skip tests::keystores::get_auth_no_token"
-    "--skip tests::keystores::get_empty_keystores"
-    "--skip tests::keystores::get_empty_remotekeys"
-    "--skip tests::keystores::get_web3_signer_keystores"
-    "--skip tests::keystores::import_and_delete_conflicting_web3_signer_keystores"
-    "--skip tests::keystores::import_invalid_slashing_protection"
-    "--skip tests::keystores::import_keystores_wrong_password"
-    "--skip tests::keystores::import_new_keystores"
-    "--skip tests::keystores::import_new_remotekeys"
-    "--skip tests::keystores::import_only_duplicate_keystores"
-    "--skip tests::keystores::import_only_duplicate_remotekeys"
-    "--skip tests::keystores::import_remote_and_local_keys"
-    "--skip tests::keystores::import_remotekey_web3signer"
-    "--skip tests::keystores::import_remotekey_web3signer_disabled"
-    "--skip tests::keystores::import_remotekey_web3signer_enabled"
-    "--skip tests::keystores::import_same_local_and_remote_keys"
-    "--skip tests::keystores::import_same_remote_and_local_keys"
-    "--skip tests::keystores::import_same_remotekey_different_url"
-    "--skip tests::keystores::import_some_duplicate_keystores"
-    "--skip tests::keystores::import_some_duplicate_remotekeys"
-    "--skip tests::keystores::import_wrong_number_of_passwords"
-    "--skip tests::keystores::migrate_all_with_slashing_protection"
-    "--skip tests::keystores::migrate_some_extra_slashing_protection"
-    "--skip tests::keystores::migrate_some_missing_slashing_protection"
-    "--skip tests::keystores::migrate_some_with_slashing_protection"
-    "--skip tests::prefer_builder_proposals_validator"
-    "--skip tests::routes_with_invalid_auth"
-    "--skip tests::simple_getters"
-    "--skip tests::validator_builder_boost_factor"
-    "--skip tests::validator_builder_boost_factor_global_builder_proposals_false"
-    "--skip tests::validator_builder_boost_factor_global_builder_proposals_true"
-    "--skip tests::validator_builder_boost_factor_global_prefer_builder_proposals_true"
-    "--skip tests::validator_builder_boost_factor_global_prefer_builder_proposals_true_override"
-    "--skip tests::validator_builder_proposals"
-    "--skip tests::validator_derived_builder_boost_factor_with_process_defaults"
-    "--skip tests::validator_enabling"
-    "--skip tests::validator_exit"
-    "--skip tests::validator_gas_limit"
-    "--skip tests::validator_graffiti"
-    "--skip tests::validator_graffiti_api"
-    "--skip tests::web3signer_validator_creation"
-    "--skip create_validators::tests::bogus_bn_url"
-    "--skip delete_validators::test::delete_multiple_validators"
-    "--skip import_validators::tests::create_one_validator"
-    "--skip import_validators::tests::create_one_validator_keystore_format"
-    "--skip import_validators::tests::create_one_validator_with_offset"
-    "--skip import_validators::tests::create_one_validator_with_offset_keystore_format"
-    "--skip import_validators::tests::create_three_validators"
-    "--skip import_validators::tests::create_three_validators_with_offset"
-    "--skip import_validators::tests::import_duplicates_when_allowed"
-    "--skip import_validators::tests::import_duplicates_when_allowed_keystore_format"
-    "--skip import_validators::tests::import_duplicates_when_disallowed"
-    "--skip import_validators::tests::import_duplicates_when_disallowed_keystore_format"
-    "--skip list_validators::test::list_all_validators"
-    "--skip move_validators::test::no_validators"
-    "--skip move_validators::test::one_validator_move_all"
-    "--skip move_validators::test::one_validator_move_all_with_password_files"
-    "--skip move_validators::test::one_validator_move_one"
-    "--skip move_validators::test::one_validator_to_non_empty_dest"
-    "--skip move_validators::test::one_validators_move_two_by_count"
-    "--skip move_validators::test::three_validators_move_all"
-    "--skip move_validators::test::three_validators_move_one"
-    "--skip move_validators::test::three_validators_move_one_by_count"
-    "--skip move_validators::test::three_validators_move_three"
-    "--skip move_validators::test::three_validators_move_two"
-    "--skip move_validators::test::three_validators_move_two_by_count"
-    "--skip move_validators::test::two_validator_move_all_and_back_again"
-    "--skip move_validators::test::two_validator_move_all_passwords_removed"
-    "--skip move_validators::test::two_validator_move_all_passwords_removed_failed_password_attempt"
-    "--skip move_validators::test::two_validators_move_all_where_one_is_a_duplicate"
-    "--skip move_validators::test::two_validators_move_one_where_one_is_a_duplicate"
-    "--skip move_validators::test::two_validators_move_one_with_identical_password_files"
+    "--skip=tests::broadcast_should_send_to_all_bns"
+    "--skip=tests::check_candidate_order"
+    "--skip=tests::first_success_should_try_nodes_in_order"
+    "--skip=tests::update_all_candidates_should_update_sync_status"
+    "--skip=engine_api::http::test::forkchoice_updated_v1_request"
+    "--skip=engine_api::http::test::forkchoice_updated_v1_with_payload_attributes_request"
+    "--skip=engine_api::http::test::get_block_by_hash_request"
+    "--skip=engine_api::http::test::get_block_by_number_request"
+    "--skip=engine_api::http::test::get_payload_v1_request"
+    "--skip=engine_api::http::test::geth_test_vectors"
+    "--skip=engine_api::http::test::new_payload_v1_request"
+    "--skip=test::finds_valid_terminal_block_hash"
+    "--skip=test::produce_three_valid_pos_execution_blocks"
+    "--skip=test::rejects_invalid_terminal_block_hash"
+    "--skip=test::rejects_terminal_block_with_equal_timestamp"
+    "--skip=test::rejects_unknown_terminal_block_hash"
+    "--skip=test::test_forked_terminal_block"
+    "--skip=test::verifies_valid_terminal_block_hash"
+    "--skip=deposit_tree::cache_consistency"
+    "--skip=deposit_tree::double_update"
+    "--skip=deposit_tree::updating"
+    "--skip=eth1_cache::big_skip"
+    "--skip=eth1_cache::double_update"
+    "--skip=eth1_cache::pruning"
+    "--skip=eth1_cache::simple_scenario"
+    "--skip=fast::deposit_cache_query"
+    "--skip=http::incrementing_deposits"
+    "--skip=persist::test_persist_caches"
+    "--skip=can_read_finalized_block"
+    "--skip=invalid_attestation_delayed_slot"
+    "--skip=invalid_attestation_empty_bitfield"
+    "--skip=invalid_attestation_future_block"
+    "--skip=invalid_attestation_future_epoch"
+    "--skip=invalid_attestation_inconsistent_ffg_vote"
+    "--skip=invalid_attestation_past_epoch"
+    "--skip=invalid_attestation_target_epoch"
+    "--skip=invalid_attestation_unknown_beacon_block_root"
+    "--skip=invalid_attestation_unknown_target_root"
+    "--skip=invalid_block_finalized_descendant"
+    "--skip=invalid_block_finalized_slot"
+    "--skip=invalid_block_future_slot"
+    "--skip=invalid_block_unknown_parent"
+    "--skip=justified_and_finalized_blocks"
+    "--skip=justified_balances"
+    "--skip=justified_checkpoint_updates_with_descendent"
+    "--skip=justified_checkpoint_updates_with_descendent_first_justification"
+    "--skip=justified_checkpoint_updates_with_non_descendent"
+    "--skip=progressive_balances_cache_attester_slashing"
+    "--skip=progressive_balances_cache_proposer_slashing"
+    "--skip=valid_attestation"
+    "--skip=valid_attestation_skip_across_epoch"
+    "--skip=weak_subjectivity_check_epoch_boundary_is_skip_slot"
+    "--skip=weak_subjectivity_check_epoch_boundary_is_skip_slot_failure"
+    "--skip=weak_subjectivity_check_fails_early_epoch"
+    "--skip=weak_subjectivity_check_fails_incorrect_root"
+    "--skip=weak_subjectivity_check_fails_late_epoch"
+    "--skip=weak_subjectivity_check_passes"
+    "--skip=weak_subjectivity_pass_on_startup"
+    "--skip=basic"
+    "--skip=returns_200_ok"
+    "--skip=release_tests::attestation_aggregation_insert_get_prune"
+    "--skip=release_tests::attestation_duplicate"
+    "--skip=release_tests::attestation_get_max"
+    "--skip=release_tests::attestation_pairwise_overlapping"
+    "--skip=release_tests::attestation_rewards"
+    "--skip=release_tests::cross_fork_attester_slashings"
+    "--skip=release_tests::cross_fork_exits"
+    "--skip=release_tests::cross_fork_proposer_slashings"
+    "--skip=release_tests::duplicate_proposer_slashing"
+    "--skip=release_tests::max_coverage_attester_proposer_slashings"
+    "--skip=release_tests::max_coverage_different_indices_set"
+    "--skip=release_tests::max_coverage_effective_balances"
+    "--skip=release_tests::overlapping_max_cover_attester_slashing"
+    "--skip=release_tests::prune_attester_slashing_noop"
+    "--skip=release_tests::prune_proposer_slashing_noop"
+    "--skip=release_tests::simple_max_cover_attester_slashing"
+    "--skip=release_tests::sync_contribution_aggregation_insert_get_prune"
+    "--skip=release_tests::sync_contribution_duplicate"
+    "--skip=release_tests::sync_contribution_with_fewer_bits"
+    "--skip=release_tests::sync_contribution_with_more_bits"
+    "--skip=release_tests::test_earliest_attestation"
+    "--skip=per_block_processing::tests::block_replayer_peeking_state_roots"
+    "--skip=per_block_processing::tests::fork_spanning_exit"
+    "--skip=per_block_processing::tests::invalid_attester_slashing_1_invalid"
+    "--skip=per_block_processing::tests::invalid_attester_slashing_2_invalid"
+    "--skip=per_block_processing::tests::invalid_attester_slashing_not_slashable"
+    "--skip=per_block_processing::tests::invalid_bad_proposal_1_signature"
+    "--skip=per_block_processing::tests::invalid_bad_proposal_2_signature"
+    "--skip=per_block_processing::tests::invalid_block_header_state_slot"
+    "--skip=per_block_processing::tests::invalid_block_signature"
+    "--skip=per_block_processing::tests::invalid_deposit_bad_merkle_proof"
+    "--skip=per_block_processing::tests::invalid_deposit_count_too_small"
+    "--skip=per_block_processing::tests::invalid_deposit_deposit_count_too_big"
+    "--skip=per_block_processing::tests::invalid_deposit_invalid_pub_key"
+    "--skip=per_block_processing::tests::invalid_deposit_wrong_sig"
+    "--skip=per_block_processing::tests::invalid_parent_block_root"
+    "--skip=per_block_processing::tests::invalid_proposer_slashing_duplicate_slashing"
+    "--skip=per_block_processing::tests::invalid_proposer_slashing_proposal_epoch_mismatch"
+    "--skip=per_block_processing::tests::invalid_proposer_slashing_proposals_identical"
+    "--skip=per_block_processing::tests::invalid_proposer_slashing_proposer_unknown"
+    "--skip=per_block_processing::tests::invalid_randao_reveal_signature"
+    "--skip=per_block_processing::tests::valid_4_deposits"
+    "--skip=per_block_processing::tests::valid_block_ok"
+    "--skip=per_block_processing::tests::valid_insert_attester_slashing"
+    "--skip=per_block_processing::tests::valid_insert_proposer_slashing"
+    "--skip=per_epoch_processing::tests::release_tests::altair_state_on_base_fork"
+    "--skip=per_epoch_processing::tests::release_tests::base_state_on_altair_fork"
+    "--skip=per_epoch_processing::tests::runs_without_error"
+    "--skip=exit::custom_tests::valid"
+    "--skip=exit::custom_tests::valid_three"
+    "--skip=exit::tests::invalid_bad_signature"
+    "--skip=exit::tests::invalid_duplicate"
+    "--skip=exit::tests::invalid_exit_already_initiated"
+    "--skip=exit::tests::invalid_future_exit_epoch"
+    "--skip=exit::tests::invalid_not_active_after_exit_epoch"
+    "--skip=exit::tests::invalid_not_active_before_activation_epoch"
+    "--skip=exit::tests::invalid_too_young_by_a_lot"
+    "--skip=exit::tests::invalid_too_young_by_one_epoch"
+    "--skip=exit::tests::invalid_validator_unknown"
+    "--skip=exit::tests::valid_genesis_epoch"
+    "--skip=exit::tests::valid_previous_epoch"
+    "--skip=exit::tests::valid_single_exit"
+    "--skip=exit::tests::valid_three_exits"
+    "--skip=iter::test::block_root_iter"
+    "--skip=iter::test::state_root_iter"
+    "--skip=beacon_state::committee_cache::tests::initializes_with_the_right_epoch"
+    "--skip=beacon_state::committee_cache::tests::min_randao_epoch_correct"
+    "--skip=beacon_state::committee_cache::tests::shuffles_for_the_right_epoch"
+    "--skip=beacon_state::tests::beacon_proposer_index"
+    "--skip=beacon_state::tests::cache_initialization"
+    "--skip=beacon_state::tests::committees::current_epoch_committee_consistency"
+    "--skip=beacon_state::tests::committees::next_epoch_committee_consistency"
+    "--skip=beacon_state::tests::committees::previous_epoch_committee_consistency"
+    "--skip=tests::hd_validator_creation"
+    "--skip=tests::invalid_pubkey"
+    "--skip=tests::keystore_validator_creation"
+    "--skip=tests::keystores::check_get_set_fee_recipient"
+    "--skip=tests::keystores::check_get_set_gas_limit"
+    "--skip=tests::keystores::delete_concurrent_with_signing"
+    "--skip=tests::keystores::delete_keystores_twice"
+    "--skip=tests::keystores::delete_nonexistent_keystores"
+    "--skip=tests::keystores::delete_nonexistent_remotekey"
+    "--skip=tests::keystores::delete_remotekey_then_reimport_different_url"
+    "--skip=tests::keystores::delete_remotekeys_twice"
+    "--skip=tests::keystores::delete_then_reimport"
+    "--skip=tests::keystores::delete_then_reimport_remotekeys"
+    "--skip=tests::keystores::get_auth_no_token"
+    "--skip=tests::keystores::get_empty_keystores"
+    "--skip=tests::keystores::get_empty_remotekeys"
+    "--skip=tests::keystores::get_web3_signer_keystores"
+    "--skip=tests::keystores::import_and_delete_conflicting_web3_signer_keystores"
+    "--skip=tests::keystores::import_invalid_slashing_protection"
+    "--skip=tests::keystores::import_keystores_wrong_password"
+    "--skip=tests::keystores::import_new_keystores"
+    "--skip=tests::keystores::import_new_remotekeys"
+    "--skip=tests::keystores::import_only_duplicate_keystores"
+    "--skip=tests::keystores::import_only_duplicate_remotekeys"
+    "--skip=tests::keystores::import_remote_and_local_keys"
+    "--skip=tests::keystores::import_remotekey_web3signer"
+    "--skip=tests::keystores::import_remotekey_web3signer_disabled"
+    "--skip=tests::keystores::import_remotekey_web3signer_enabled"
+    "--skip=tests::keystores::import_same_local_and_remote_keys"
+    "--skip=tests::keystores::import_same_remote_and_local_keys"
+    "--skip=tests::keystores::import_same_remotekey_different_url"
+    "--skip=tests::keystores::import_some_duplicate_keystores"
+    "--skip=tests::keystores::import_some_duplicate_remotekeys"
+    "--skip=tests::keystores::import_wrong_number_of_passwords"
+    "--skip=tests::keystores::migrate_all_with_slashing_protection"
+    "--skip=tests::keystores::migrate_some_extra_slashing_protection"
+    "--skip=tests::keystores::migrate_some_missing_slashing_protection"
+    "--skip=tests::keystores::migrate_some_with_slashing_protection"
+    "--skip=tests::prefer_builder_proposals_validator"
+    "--skip=tests::routes_with_invalid_auth"
+    "--skip=tests::simple_getters"
+    "--skip=tests::validator_builder_boost_factor"
+    "--skip=tests::validator_builder_boost_factor_global_builder_proposals_false"
+    "--skip=tests::validator_builder_boost_factor_global_builder_proposals_true"
+    "--skip=tests::validator_builder_boost_factor_global_prefer_builder_proposals_true"
+    "--skip=tests::validator_builder_boost_factor_global_prefer_builder_proposals_true_override"
+    "--skip=tests::validator_builder_proposals"
+    "--skip=tests::validator_derived_builder_boost_factor_with_process_defaults"
+    "--skip=tests::validator_enabling"
+    "--skip=tests::validator_exit"
+    "--skip=tests::validator_gas_limit"
+    "--skip=tests::validator_graffiti"
+    "--skip=tests::validator_graffiti_api"
+    "--skip=tests::web3signer_validator_creation"
+    "--skip=create_validators::tests::bogus_bn_url"
+    "--skip=delete_validators::test::delete_multiple_validators"
+    "--skip=import_validators::tests::create_one_validator"
+    "--skip=import_validators::tests::create_one_validator_keystore_format"
+    "--skip=import_validators::tests::create_one_validator_with_offset"
+    "--skip=import_validators::tests::create_one_validator_with_offset_keystore_format"
+    "--skip=import_validators::tests::create_three_validators"
+    "--skip=import_validators::tests::create_three_validators_with_offset"
+    "--skip=import_validators::tests::import_duplicates_when_allowed"
+    "--skip=import_validators::tests::import_duplicates_when_allowed_keystore_format"
+    "--skip=import_validators::tests::import_duplicates_when_disallowed"
+    "--skip=import_validators::tests::import_duplicates_when_disallowed_keystore_format"
+    "--skip=list_validators::test::list_all_validators"
+    "--skip=move_validators::test::no_validators"
+    "--skip=move_validators::test::one_validator_move_all"
+    "--skip=move_validators::test::one_validator_move_all_with_password_files"
+    "--skip=move_validators::test::one_validator_move_one"
+    "--skip=move_validators::test::one_validator_to_non_empty_dest"
+    "--skip=move_validators::test::one_validators_move_two_by_count"
+    "--skip=move_validators::test::three_validators_move_all"
+    "--skip=move_validators::test::three_validators_move_one"
+    "--skip=move_validators::test::three_validators_move_one_by_count"
+    "--skip=move_validators::test::three_validators_move_three"
+    "--skip=move_validators::test::three_validators_move_two"
+    "--skip=move_validators::test::three_validators_move_two_by_count"
+    "--skip=move_validators::test::two_validator_move_all_and_back_again"
+    "--skip=move_validators::test::two_validator_move_all_passwords_removed"
+    "--skip=move_validators::test::two_validator_move_all_passwords_removed_failed_password_attempt"
+    "--skip=move_validators::test::two_validators_move_all_where_one_is_a_duplicate"
+    "--skip=move_validators::test::two_validators_move_one_where_one_is_a_duplicate"
+    "--skip=move_validators::test::two_validators_move_one_with_identical_password_files"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
-    "--skip subnet_service::tests::attestation_service::test_subscribe_same_subnet_several_slots_apart"
-    "--skip subnet_service::tests::sync_committee_service::same_subscription_with_lower_until_epoch"
-    "--skip subnet_service::tests::sync_committee_service::subscribe_and_unsubscribe"
+    "--skip=subnet_service::tests::attestation_service::test_subscribe_same_subnet_several_slots_apart"
+    "--skip=subnet_service::tests::sync_committee_service::same_subscription_with_lower_until_epoch"
+    "--skip=subnet_service::tests::sync_committee_service::subscribe_and_unsubscribe"
   ];
 
   passthru = {
@@ -332,9 +337,6 @@ rustPlatform.buildRustPackage rec {
 
   enableParallelBuilding = true;
 
-  # This is needed by the unit tests.
-  FORK_NAME = "capella";
-
   meta = {
     description = "Ethereum consensus client in Rust";
     homepage = "https://lighthouse.sigmaprime.io/";

pkgs/by-name/ma/martin/package.nix

@@ -24,33 +24,33 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ];
 
   checkFlags = [
-    "--skip function_source_schemas"
-    "--skip function_source_tile"
-    "--skip function_source_tilejson"
-    "--skip pg_get_function_tiles"
-    "--skip pg_get_function_source_ok_rewrite"
-    "--skip pg_get_function_source_ok"
-    "--skip pg_get_composite_source_tile_minmax_zoom_ok"
-    "--skip pg_get_function_source_query_params_ok"
-    "--skip pg_get_composite_source_tile_ok"
-    "--skip pg_get_catalog"
-    "--skip pg_get_composite_source_ok"
-    "--skip pg_get_health_returns_ok"
-    "--skip pg_get_table_source_ok"
-    "--skip pg_get_table_source_rewrite"
-    "--skip pg_null_functions"
-    "--skip utils::test_utils::tests::test_bad_os_str"
-    "--skip utils::test_utils::tests::test_get_env_str"
-    "--skip pg_get_table_source_multiple_geom_tile_ok"
-    "--skip pg_get_table_source_tile_minmax_zoom_ok"
-    "--skip pg_tables_feature_id"
-    "--skip pg_get_table_source_tile_ok"
-    "--skip table_source_schemas"
-    "--skip tables_srid_ok"
-    "--skip tables_tile_ok"
-    "--skip table_source"
-    "--skip tables_tilejson"
-    "--skip tables_multiple_geom_ok"
+    "--skip=function_source_schemas"
+    "--skip=function_source_tile"
+    "--skip=function_source_tilejson"
+    "--skip=pg_get_function_tiles"
+    "--skip=pg_get_function_source_ok_rewrite"
+    "--skip=pg_get_function_source_ok"
+    "--skip=pg_get_composite_source_tile_minmax_zoom_ok"
+    "--skip=pg_get_function_source_query_params_ok"
+    "--skip=pg_get_composite_source_tile_ok"
+    "--skip=pg_get_catalog"
+    "--skip=pg_get_composite_source_ok"
+    "--skip=pg_get_health_returns_ok"
+    "--skip=pg_get_table_source_ok"
+    "--skip=pg_get_table_source_rewrite"
+    "--skip=pg_null_functions"
+    "--skip=utils::test_utils::tests::test_bad_os_str"
+    "--skip=utils::test_utils::tests::test_get_env_str"
+    "--skip=pg_get_table_source_multiple_geom_tile_ok"
+    "--skip=pg_get_table_source_tile_minmax_zoom_ok"
+    "--skip=pg_tables_feature_id"
+    "--skip=pg_get_table_source_tile_ok"
+    "--skip=table_source_schemas"
+    "--skip=tables_srid_ok"
+    "--skip=tables_tile_ok"
+    "--skip=table_source"
+    "--skip=tables_tilejson"
+    "--skip=tables_multiple_geom_ok"
   ];
 
   meta = {

pkgs/by-name/md/mdbook-pandoc/package.nix

@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
       ]
       ++ lib.optional stdenv.buildPlatform.isDarwin "pandoc::tests::five_item_deep_list";
     in
-    builtins.map (x: "--skip " + x) skippedTests;
+    builtins.map (x: "--skip=" + x) skippedTests;
 
   passthru = {
     wrapper = callPackage ./wrapper.nix { };

pkgs/by-name/md/mdserve/package.nix

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     # times out on darwin during nixpkgs-review
-    "--skip test_file_modification_updates_via_websocket"
+    "--skip=test_file_modification_updates_via_websocket"
   ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/mo/monado/package.nix

@@ -12,8 +12,7 @@
   eigen,
   elfutils,
   glslang,
-  gst-plugins-base,
-  gstreamer,
+  gst_all_1,
   hidapi,
   libbsd,
   libdrm,
@@ -94,8 +93,8 @@ stdenv.mkDerivation (finalAttrs: {
     dbus
     eigen
     elfutils
-    gst-plugins-base
-    gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
     hidapi
     libbsd
     libdrm

pkgs/by-name/mp/mprocs/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprocs";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "pvolok";
     repo = "mprocs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-77uXHlQjhIDbRbnkr3jvZKuLOcvbOIuum8FRsUv8cYw=";
+    hash = "sha256-8p8hPATAyc7ms2iXktrSEAmi6/ax85F5xwF6e7H4XRE=";
   };
 
-  cargoHash = "sha256-T8zG2Z7UP4MZUGeUypG9ugO49rbicwYrdRZiGJN3H0E=";
+  cargoHash = "sha256-wQNUHiOaq5fgZbwUEEco5MjX8xH2NoQnKCtM1cHchUQ=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/na/naja/package.nix

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "naja";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "najaeda";
     repo = "naja";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Oh1rAS20bQRp8P/8qMPjoCTC9wghBRhmRRh7J/+NG0A=";
+    hash = "sha256-VD1ObfP6EbGUsqo0D4DLwBS1svLSsxhJB1iskybt/YI=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/nc/ncps/package.nix

@@ -33,13 +33,13 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.7.2";
+    version = "0.7.3";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-qc6h1gnU7dFyb0GiBq++E2yf49K7mO86Vwdf8y3817U=";
+      hash = "sha256-6mpEe0i5NYQb5WK2/478VFkMNa6xqAIU1uwwhH2zc2M=";
     };
 
     vendorHash = "sha256-nnt4HIG4Fs7RhHjVb7mYJ39UgvFKc46Cu42cURMmr1s=";

pkgs/by-name/ni/nixseparatedebuginfod2/package.nix

@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage rec {
   passthru.tests = { inherit (nixosTests) nixseparatedebuginfod2; };
 
   # flaky tests
-  checkFlags = [ "--skip substituter::http" ];
+  checkFlags = [ "--skip=substituter::http" ];
 
   meta = {
     description = "Downloads and provides debug symbols and source code for nix derivations to gdb and other debuginfod-capable debuggers as needed";

pkgs/by-name/ox/oxker/package.nix

@@ -20,9 +20,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-X5iNAwp0DcXoT82ZLq37geifztvJ/zZgOgM3SycAazA=";
 
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "--skip ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_one_definition"
-    "--skip ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_two_definitions"
-    "--skip ui::draw_blocks::help::tests::test_draw_blocks_help_one_and_two_definitions"
+    "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_one_definition"
+    "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_two_definitions"
+    "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_one_and_two_definitions"
   ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/ph/phira-unwrapped/package.nix

@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-6mRb3M56G20fA+px1cZyrGpel0v54qoVAQK2ZgTzkmI=";
 
   # The developer put assets necessary for this test in gitignore, so it cannot run.
-  checkFlags = [ "--skip test_parse_chart" ];
+  checkFlags = [ "--skip=test_parse_chart" ];
 
   desktopItems = [
     (makeDesktopItem {

pkgs/by-name/ph/phpstan/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.35";
+  version = "2.1.37";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan";
     tag = finalAttrs.version;
-    hash = "sha256-1X+Z4z7VN36DbxWCOu1mvEWQaAJL9tbh3JWMAaHnT5c=";
+    hash = "sha256-Ov4wCIKHuVtVKCTLBR9d2W2yNw49U2gGZkygEPhXTRA=";
   };
 
   nativeBuildInputs = [
@@ -49,6 +49,9 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.mit;
     mainProgram = "phpstan";
-    maintainers = [ lib.maintainers.patka ];
+    maintainers = with lib.maintainers; [
+      patka
+      piotrkwiecinski
+    ];
   };
 })

pkgs/by-name/ph/phpunit/package.nix

@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "12.5.6";
+  version = "12.5.8";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-F2/LMJwLzLz7YuJPq2J6ypgtY9ps5ExiHX6UGvtKh3E=";
+    hash = "sha256-93y2V+QgsjQb1is91kTbxcu1dY8MyM474qIpGRa0pp0=";
   };
 
-  vendorHash = "sha256-YqDdlspt9hGMzSoC41pMZLucP/luv6Fo2VGQ7pPa5pk=";
+  vendorHash = "sha256-q5qTQRxxsiE+B22LU+npM4ada0ddAt2f7KNz+cb6yYY=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/pr/prek/package.nix

@@ -54,125 +54,131 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoTestFlags = [ "--no-fail-fast" ];
 
-  checkFlags = map (t: "--skip ${t}") [
-    # these tests require internet access
-    "check_added_large_files_hook"
-    "check_json_hook"
-    "end_of_file_fixer_hook"
-    "mixed_line_ending_hook"
-    "install_hooks_only"
-    "install_with_hooks"
-    "golang"
-    "node"
-    "script"
-    "check_useless_excludes_remote"
-    "run_worktree"
-    "try_repo_relative_path"
-    "languages::tests::test_native_tls"
-    "rust::additional_dependencies_cli"
-    "rust::rustup_installer"
-    "rust::remote_hooks"
-    "rust::remote_hooks_with_lib_deps"
-    "unsupported::unsupported_language"
-    "remote_hook_non_workspace"
-    # "meta_hooks"
-    "reuse_env"
-    "docker::docker"
-    "docker::workspace_docker"
-    "docker_image::docker_image"
-    "pygrep::basic_case_sensitive"
-    "pygrep::case_insensitive"
-    "pygrep::case_insensitive_multiline"
-    "pygrep::complex_regex_patterns"
-    "pygrep::invalid_args"
-    "pygrep::invalid_regex"
-    "pygrep::multiline_mode"
-    "pygrep::negate_mode"
-    "pygrep::negate_multiline_mode"
-    "pygrep::pattern_not_found"
-    "pygrep::python_regex_quirks"
-    "python::additional_dependencies"
-    "python::can_not_download"
-    "python::hook_stderr"
-    "python::language_version"
-    "ruby::additional_gem_dependencies"
-    "ruby::environment_isolation"
-    "ruby::gemspec_workflow"
-    "ruby::language_version_default"
-    "ruby::local_hook_with_gemspec"
-    "ruby::native_gem_dependency"
-    "ruby::native_gem_dependency"
-    "ruby::process_files"
-    "ruby::specific_ruby_available"
-    "ruby::specific_ruby_unavailable"
-    "ruby::system_ruby"
-    # can't checkout pre-commit-hooks
-    "cjk_hook_name"
-    "fail_fast"
-    "file_types"
-    "files_and_exclude"
-    "git_commit_a"
-    "log_file"
-    "merge_conflicts"
-    "pass_env_vars"
-    "restore_on_interrupt"
-    "run_basic"
-    "run_last_commit"
-    "same_repo"
-    "skips"
-    "staged_files_only"
-    "subdirectory"
-    "check_yaml_hook"
-    "check_yaml_multiple_document"
-    "builtin_hooks_workspace_mode"
-    "fix_byte_order_marker_hook"
-    "fix_byte_order_marker"
-    "check_merge_conflict_hook"
-    "check_merge_conflict_without_assume_flag"
-    "check_symlinks_hook_unix"
-    "check_xml_hook"
-    "check_xml_with_features"
-    "detect_private_key_hook"
-    "no_commit_to_branch_hook"
-    "no_commit_to_branch_hook_with_custom_branches"
-    "no_commit_to_branch_hook_with_patterns"
-    "check_executables_have_shebangs_various_cases"
-    "check_executables_have_shebangs_hook"
-    # does not properly use TMP
-    "hook_impl"
-    # problems with environment
-    "try_repo_specific_hook"
-    "try_repo_specific_rev"
-    # lua path is hardcoded
-    "lua::additional_dependencies"
-    "lua::health_check"
-    "lua::hook_stderr"
-    "lua::lua_environment"
-    "lua::remote_hook"
-    # error message differs
-    "run_in_non_git_repo"
-    # depends on locale
-    "init_nonexistent_repo"
-    # https://github.com/astral-sh/uv/issues/8635
-    "alternate_config_file"
-    "basic_discovery"
-    "color"
-    "cookiecutter_template_directories_are_skipped"
-    "empty_entry"
-    "git_dir_respected"
-    "git_env_vars_not_leaked_to_pip_install"
-    "gitignore_respected"
-    "invalid_entry"
-    "local_python_hook"
-    "orphan_projects"
-    "run_with_selectors"
-    "run_with_stdin_closed"
-    "show_diff_on_failure"
-    "submodule_discovery"
-    "workspace_install_hooks"
-    # We don't have git info; we run versionCheckHook instead
-    "version_info"
-  ];
+  checkFlags =
+    lib.concatMap
+      (t: [
+        "--skip"
+        "${t}"
+      ])
+      [
+        # these tests require internet access
+        "check_added_large_files_hook"
+        "check_json_hook"
+        "end_of_file_fixer_hook"
+        "mixed_line_ending_hook"
+        "install_hooks_only"
+        "install_with_hooks"
+        "golang"
+        "node"
+        "script"
+        "check_useless_excludes_remote"
+        "run_worktree"
+        "try_repo_relative_path"
+        "languages::tests::test_native_tls"
+        "rust::additional_dependencies_cli"
+        "rust::rustup_installer"
+        "rust::remote_hooks"
+        "rust::remote_hooks_with_lib_deps"
+        "unsupported::unsupported_language"
+        "remote_hook_non_workspace"
+        # "meta_hooks"
+        "reuse_env"
+        "docker::docker"
+        "docker::workspace_docker"
+        "docker_image::docker_image"
+        "pygrep::basic_case_sensitive"
+        "pygrep::case_insensitive"
+        "pygrep::case_insensitive_multiline"
+        "pygrep::complex_regex_patterns"
+        "pygrep::invalid_args"
+        "pygrep::invalid_regex"
+        "pygrep::multiline_mode"
+        "pygrep::negate_mode"
+        "pygrep::negate_multiline_mode"
+        "pygrep::pattern_not_found"
+        "pygrep::python_regex_quirks"
+        "python::additional_dependencies"
+        "python::can_not_download"
+        "python::hook_stderr"
+        "python::language_version"
+        "ruby::additional_gem_dependencies"
+        "ruby::environment_isolation"
+        "ruby::gemspec_workflow"
+        "ruby::language_version_default"
+        "ruby::local_hook_with_gemspec"
+        "ruby::native_gem_dependency"
+        "ruby::native_gem_dependency"
+        "ruby::process_files"
+        "ruby::specific_ruby_available"
+        "ruby::specific_ruby_unavailable"
+        "ruby::system_ruby"
+        # can't checkout pre-commit-hooks
+        "cjk_hook_name"
+        "fail_fast"
+        "file_types"
+        "files_and_exclude"
+        "git_commit_a"
+        "log_file"
+        "merge_conflicts"
+        "pass_env_vars"
+        "restore_on_interrupt"
+        "run_basic"
+        "run_last_commit"
+        "same_repo"
+        "skips"
+        "staged_files_only"
+        "subdirectory"
+        "check_yaml_hook"
+        "check_yaml_multiple_document"
+        "builtin_hooks_workspace_mode"
+        "fix_byte_order_marker_hook"
+        "fix_byte_order_marker"
+        "check_merge_conflict_hook"
+        "check_merge_conflict_without_assume_flag"
+        "check_symlinks_hook_unix"
+        "check_xml_hook"
+        "check_xml_with_features"
+        "detect_private_key_hook"
+        "no_commit_to_branch_hook"
+        "no_commit_to_branch_hook_with_custom_branches"
+        "no_commit_to_branch_hook_with_patterns"
+        "check_executables_have_shebangs_various_cases"
+        "check_executables_have_shebangs_hook"
+        # does not properly use TMP
+        "hook_impl"
+        # problems with environment
+        "try_repo_specific_hook"
+        "try_repo_specific_rev"
+        # lua path is hardcoded
+        "lua::additional_dependencies"
+        "lua::health_check"
+        "lua::hook_stderr"
+        "lua::lua_environment"
+        "lua::remote_hook"
+        # error message differs
+        "run_in_non_git_repo"
+        # depends on locale
+        "init_nonexistent_repo"
+        # https://github.com/astral-sh/uv/issues/8635
+        "alternate_config_file"
+        "basic_discovery"
+        "color"
+        "cookiecutter_template_directories_are_skipped"
+        "empty_entry"
+        "git_dir_respected"
+        "git_env_vars_not_leaked_to_pip_install"
+        "gitignore_respected"
+        "invalid_entry"
+        "local_python_hook"
+        "orphan_projects"
+        "run_with_selectors"
+        "run_with_stdin_closed"
+        "show_diff_on_failure"
+        "submodule_discovery"
+        "workspace_install_hooks"
+        # We don't have git info; we run versionCheckHook instead
+        "version_info"
+      ];
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/pr/prmt/package.nix

@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-Vc2uCFD3A3huSFaYbgZHRWgiQnxXkz7BzvmdT7AsnoY=";
 
   # Fail to run in sandbox environment
-  checkFlags = map (t: "--skip ${t}") [
+  checkFlags = map (t: "--skip=${t}") [
     "modules::path::tests::relative_path_inside_home_renders_tilde"
     "modules::path::tests::relative_path_with_shared_prefix_is_not_tilde"
     "test_git_module"

pkgs/by-name/ro/roc/package.nix

@@ -86,12 +86,12 @@ rustPlatform.buildRustPackage {
   checkPhase =
     lib.optionalString stdenv.isLinux ''
       runHook preCheck
-      NIX_GLIBC_PATH=${glibc.out}/lib NIX_LIBGCC_S_PATH=${stdenv.cc.cc.lib}/lib cargo test --release --workspace --exclude test_mono --exclude uitest -- --skip glue_cli_tests --skip test_snapshots
+      NIX_GLIBC_PATH=${glibc.out}/lib NIX_LIBGCC_S_PATH=${stdenv.cc.cc.lib}/lib cargo test --release --workspace --exclude test_mono --exclude uitest -- --skip=glue_cli_tests --skip=test_snapshots
       runHook postCheck
     ''
     + lib.optionalString (!stdenv.isLinux) ''
       runHook preCheck
-      cargo test --release --workspace --exclude test_mono --exclude uitest -- --skip glue_cli_tests --skip test_snapshots
+      cargo test --release --workspace --exclude test_mono --exclude uitest -- --skip=glue_cli_tests --skip=test_snapshots
       runHook postCheck
     '';
 

pkgs/by-name/sh/sheldon/package.nix

@@ -35,27 +35,27 @@ rustPlatform.buildRustPackage rec {
 
   # Needs network connection
   checkFlags = [
-    "--skip lock::plugin::tests::external_plugin_lock_git_with_matches"
-    "--skip lock::plugin::tests::external_plugin_lock_git_with_matches_not_each"
-    "--skip lock::plugin::tests::external_plugin_lock_git_with_uses"
-    "--skip lock::plugin::tests::external_plugin_lock_remote"
-    "--skip lock::source::git::tests::git_checkout_resolve_branch"
-    "--skip lock::source::git::tests::git_checkout_resolve_rev"
-    "--skip lock::source::git::tests::git_checkout_resolve_tag"
-    "--skip lock::source::git::tests::lock_git_and_reinstall"
-    "--skip lock::source::git::tests::lock_git_https_with_checkout"
-    "--skip lock::source::local::tests::lock_local"
-    "--skip lock::source::remote::tests::lock_remote_and_reinstall"
-    "--skip lock::source::tests::lock_with_git"
-    "--skip lock::source::tests::lock_with_remote"
-    "--skip lock::tests::locked_config_clean"
-    "--skip directories_default"
-    "--skip directories_old"
-    "--skip directories_xdg_from_env"
-    "--skip lock_and_source_github"
-    "--skip lock_and_source_hooks"
-    "--skip lock_and_source_inline"
-    "--skip lock_and_source_profiles"
+    "--skip=lock::plugin::tests::external_plugin_lock_git_with_matches"
+    "--skip=lock::plugin::tests::external_plugin_lock_git_with_matches_not_each"
+    "--skip=lock::plugin::tests::external_plugin_lock_git_with_uses"
+    "--skip=lock::plugin::tests::external_plugin_lock_remote"
+    "--skip=lock::source::git::tests::git_checkout_resolve_branch"
+    "--skip=lock::source::git::tests::git_checkout_resolve_rev"
+    "--skip=lock::source::git::tests::git_checkout_resolve_tag"
+    "--skip=lock::source::git::tests::lock_git_and_reinstall"
+    "--skip=lock::source::git::tests::lock_git_https_with_checkout"
+    "--skip=lock::source::local::tests::lock_local"
+    "--skip=lock::source::remote::tests::lock_remote_and_reinstall"
+    "--skip=lock::source::tests::lock_with_git"
+    "--skip=lock::source::tests::lock_with_remote"
+    "--skip=lock::tests::locked_config_clean"
+    "--skip=directories_default"
+    "--skip=directories_old"
+    "--skip=directories_xdg_from_env"
+    "--skip=lock_and_source_github"
+    "--skip=lock_and_source_hooks"
+    "--skip=lock_and_source_inline"
+    "--skip=lock_and_source_profiles"
   ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''

pkgs/by-name/so/sourcepawn-studio/package.nix

@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   checkFlags = [
     # requires rustup and rustfmt
-    "--skip tests::sourcegen::generate_node_kinds"
+    "--skip=tests::sourcegen::generate_node_kinds"
   ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/su/supercell-wx/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  gcc14Stdenv,
   fetchFromGitHub,
   replaceVars,
   tracy,
@@ -33,6 +34,8 @@
   zlib,
 }:
 let
+  buildStdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
+
   gtestSkip = [
     # Skip tests requiring network access
     "AwsLevel*DataProvider.FindKeyFixed"
@@ -54,7 +57,7 @@ let
     "MarkerModelTest.*"
   ];
 in
-stdenv.mkDerivation (finalAttrs: {
+buildStdenv.mkDerivation (finalAttrs: {
   pname = "supercell-wx";
   version = "0.5.3";
 

pkgs/by-name/ta/tattoy/package.nix

@@ -40,16 +40,22 @@ rustPlatform.buildRustPackage (attrs: {
     watch
   ];
 
-  checkFlags = [
-    # e2e tests currently fail
-    # see https://github.com/tattoy-org/tattoy/pull/104/files for discussion
-    # re-enable after PR merged
-    "--skip e2e"
-    "--skip gpu"
-  ];
-
   useNextest = true;
 
+  checkFlags =
+    lib.concatMap
+      (t: [
+        "--skip"
+        "${t}"
+      ])
+      [
+        # e2e tests currently fail
+        # see https://github.com/tattoy-org/tattoy/pull/104/files for discussion
+        # re-enable after PR merged
+        "e2e"
+        "gpu"
+      ];
+
   meta = {
     description = "Text-based compositor for modern terminals";
     homepage = "https://github.com/tattoy-org/tattoy";

pkgs/by-name/tl/tldr/package.nix

@@ -1,47 +1,42 @@
 {
-  stdenv,
   lib,
+  stdenv,
+  python3Packages,
   fetchFromGitHub,
   installShellFiles,
-  python3Packages,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "tldr";
-  version = "3.3.0";
+  version = "3.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tldr-pages";
     repo = "tldr-python-client";
-    tag = version;
-    hash = "sha256-lc0Jen8vW4BNg784td1AZa2GTYvXC1d83FnAe5RZqpY=";
+    tag = finalAttrs.version;
+    hash = "sha256-YdVmgV7N67XswcGlUN1hhXpRXGMHhY34VBxfr7i/MBs=";
   };
 
   build-system = with python3Packages; [
-    setuptools
-    wheel
+    hatchling
   ];
 
   dependencies = with python3Packages; [
     termcolor
-    colorama
     shtab
   ];
 
   nativeBuildInputs = [ installShellFiles ];
 
   nativeCheckInputs = with python3Packages; [
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    pytest -k 'not test_error_message'
-    runHook postCheck
-  '';
-
-  doCheck = true;
+  disabledTests = [
+    # Requires internet access
+    "test_error_message"
+  ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tldr \
@@ -56,7 +51,7 @@ python3Packages.buildPythonApplication rec {
       through a man page for the correct flags.
     '';
     homepage = "https://tldr.sh";
-    changelog = "https://github.com/tldr-pages/tldr-python-client/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/tldr-pages/tldr-python-client/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       taeer
@@ -65,4 +60,4 @@ python3Packages.buildPythonApplication rec {
     ];
     mainProgram = "tldr";
   };
-}
+})

pkgs/by-name/ty/typescript-go/package.nix

@@ -10,13 +10,13 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2026-01-21";
+  version = "0-unstable-2026-01-28";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "01cac67dfdfcce7262431f282e6f515861897ed0";
-    hash = "sha256-6Ukhujb0EVJr3PYVTuM3MKPMpzshMy1NphSsgXsHRgQ=";
+    rev = "463b6b461f23114073ccc0c4071a7f2a21477ac2";
+    hash = "sha256-ozCm3O8ObaecE7TN7vYyeyjA3gGD8FprB93aJcDwSw0=";
     fetchSubmodules = false;
   };
 

pkgs/by-name/uv/uv/package.nix

@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.9.26";
+  version = "0.9.27";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-qvfMB62/0Hvc7m5h+QitvUcS6YZWAV1uGPg8JpCKPNU=";
+    hash = "sha256-2ArneGmQZhEcFlPm5hlQkHR8wnok7bEzTYBkeR+Gk6U=";
   };
 
-  cargoHash = "sha256-3ncKhauappl1MR3EG1bwYVrwhM7gCFRcRyRvYrsDaok=";
+  cargoHash = "sha256-Qx1oEqmYVpf2M36dsDCIn+xbkjkxlcAHCC+Vlokybf0=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/xw/xwin/package.nix

@@ -36,8 +36,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doCheck = true;
   # Requires network access
   checkFlags = [
-    "--skip verify_compiles"
-    "--skip verify_deterministic"
+    "--skip=verify_compiles"
+    "--skip=verify_deterministic"
   ];
 
   doInstallCheck = true;

pkgs/by-name/ya/yaralyzer/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "yaralyzer";
-  version = "1.0.14";
+  version = "1.3.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michelcrypt4d4mus";
     repo = "yaralyzer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MhfZ/8JJaWDiDVUA4av32LzqfQmJr9L9x6AdCU0jo2c=";
+    hash = "sha256-OhZ1TG1dqxlUoW+OI+BFn0LsujLytqg6L7aNdYnfRPQ=";
   };
 
   build-system = with python3.pkgs; [ poetry-core ];

pkgs/development/compilers/openjdk/25/source.json

@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-t5eUiWhAst3Aa16YVx7sMaHK6BHwLWyvxGfTq0C+Z4M=",
+  "hash": "sha256-MtvWyxN+4Dhv/VWYIYB0eH4LrsdvfGxoW3hkpikZSg0=",
   "owner": "openjdk",
   "repo": "jdk25u",
-  "rev": "refs/tags/jdk-25.0.1+8"
+  "rev": "refs/tags/jdk-25.0.2+10"
 }

pkgs/development/libraries/openssl/default.nix

@@ -429,8 +429,8 @@ in
   };
 
   openssl_3 = common {
-    version = "3.0.18";
-    hash = "sha256-2Aw09c+QLczx8bXfXruG0DkuNwSeXXPfGzq65y5P/os=";
+    version = "3.0.19";
+    hash = "sha256-+lpBQ7iq4YvlPvLzyvKaLgdHQwuLx00y2IM1uUq2MHI=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:

pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch

@@ -3,11 +3,11 @@ index 329ef62..9a8df64 100644
 --- a/include/internal/cryptlib.h
 +++ b/include/internal/cryptlib.h
 @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM);
- # ifndef OPENSSL_SYS_VMS
- #  define X509_CERT_AREA          OPENSSLDIR
- #  define X509_CERT_DIR           OPENSSLDIR "/certs"
--#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
-+#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
- #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
- #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
- # else
+ #ifndef OPENSSL_SYS_VMS
+ #define X509_CERT_AREA OPENSSLDIR
+ #define X509_CERT_DIR OPENSSLDIR "/certs"
+-#define X509_CERT_FILE OPENSSLDIR "/cert.pem"
++#define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+ #define X509_PRIVATE_DIR OPENSSLDIR "/private"
+ #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
+ #else

pkgs/development/libraries/openssl/use-etc-ssl-certs.patch

@@ -3,11 +3,11 @@ index 329ef62..9a8df64 100644
 --- a/include/internal/cryptlib.h
 +++ b/include/internal/cryptlib.h
 @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM);
- # ifndef OPENSSL_SYS_VMS
- #  define X509_CERT_AREA          OPENSSLDIR
- #  define X509_CERT_DIR           OPENSSLDIR "/certs"
--#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
-+#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt"
- #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
- #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
- # else
+ #ifndef OPENSSL_SYS_VMS
+ #define X509_CERT_AREA OPENSSLDIR
+ #define X509_CERT_DIR OPENSSLDIR "/certs"
+-#define X509_CERT_FILE OPENSSLDIR "/cert.pem"
++#define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt"
+ #define X509_PRIVATE_DIR OPENSSLDIR "/private"
+ #define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf"
+ #else

pkgs/development/ocaml-modules/eio/default.nix

@@ -42,13 +42,13 @@ let
     }
     ."${version}";
 in
-buildDunePackage rec {
+buildDunePackage {
   pname = "eio";
   inherit version;
   inherit (param) minimalOCamlVersion;
 
   src = fetchurl {
-    url = "https://github.com/ocaml-multicore/${pname}/releases/download/v${version}/${pname}-${version}.tbz";
+    url = "https://github.com/ocaml-multicore/eio/releases/download/v${version}/eio-${version}.tbz";
     inherit (param) hash;
   };
 
@@ -75,8 +75,8 @@ buildDunePackage rec {
   ];
 
   meta = {
-    homepage = "https://github.com/ocaml-multicore/${pname}";
-    changelog = "https://github.com/ocaml-multicore/${pname}/raw/v${version}/CHANGES.md";
+    homepage = "https://github.com/ocaml-multicore/eio";
+    changelog = "https://github.com/ocaml-multicore/eio/raw/v${version}/CHANGES.md";
     description = "Effects-Based Parallel IO for OCaml";
     license = with lib.licenses; [ isc ];
     maintainers = with lib.maintainers; [ toastal ];

pkgs/development/python-modules/aioguardian/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioguardian";
-  version = "2026.01.0";
+  version = "2026.01.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "bachya";
     repo = "aioguardian";
     tag = finalAttrs.version;
-    hash = "sha256-p0rSN00CxTJsoo5iD3jsnTPUIl3G/fDc6tMjj0H0MuE=";
+    hash = "sha256-55jMGJ4pRMjvSAYsXIclzzMcz+PqS/334Fd7hoY8YTk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/aiosmtplib/default.nix

@@ -10,16 +10,16 @@
   trustme,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiosmtplib";
-  version = "5.0.0";
+  version = "5.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cole";
     repo = "aiosmtplib";
-    tag = "v${version}";
-    hash = "sha256-ICG7yVH2UcvQAsVGbxu7LibWUj/NEPV/f5iDc25XuzU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+aMtU8ea8yy1jxPPQGSu4kW3PX9N9qYQ90CSduPPgYc=";
   };
 
   build-system = [ hatchling ];
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module which provides a SMTP client";
     homepage = "https://github.com/cole/aiosmtplib";
-    changelog = "https://github.com/cole/aiosmtplib/releases/tag/v${version}";
+    changelog = "https://github.com/cole/aiosmtplib/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/cpe-search/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cpe-search";
-  version = "0.2.4";
+  version = "0.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "cpe_search";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wnUKLJUUj3idQLv3FSpcUZksa0FvwMxKDId6/hjpEZw=";
+    hash = "sha256-GZzMS1zmI7w8L2qVa57KtY3sb/quULyXrPQYTcPFxTI=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/mkdocstrings/default.nix

@@ -13,21 +13,21 @@
   dirty-equals,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mkdocstrings";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "mkdocstrings";
-    tag = version;
-    hash = "sha256-dRDelPj2zO31gZzPDh7BxdBemGNaTPbzhlmWH1JYmaM=";
+    tag = finalAttrs.version;
+    hash = "sha256-fdWHcg6WijOXsE6+03iPRineUHtMDU/Yfra3S9lkMWs=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
+      --replace-fail 'dynamic = ["version"]' 'version = "${finalAttrs.version}"'
   '';
 
   build-system = [ pdm-backend ];
@@ -65,8 +65,8 @@ buildPythonPackage rec {
   meta = {
     description = "Automatic documentation from sources for MkDocs";
     homepage = "https://github.com/mkdocstrings/mkdocstrings";
-    changelog = "https://github.com/mkdocstrings/mkdocstrings/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/mkdocstrings/mkdocstrings/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/prophet/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "prophet";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "prophet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rG21Q4V0XQjReIHd7vV/aFOUvnLEw/dm8AobXRDUfuA=";
+    hash = "sha256-Bu+ztg6sj1jh2iair6v1CdbF0Fi4b+h8yLzB3xTMD3Y=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";

pkgs/development/python-modules/roadrecon/default.nix

@@ -17,12 +17,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "roadrecon";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-fvfwgUqVr74JdL3dteX0UXbALva3vWQWEpotk8QQAiI=";
+    hash = "sha256-k800N0IN3I6liqgVbsgyywkg013/8GNWsShDPkK214w=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/scikit-base/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-base";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sktime";
     repo = "skbase";
     tag = "v${version}";
-    hash = "sha256-fZytQprnp4WAxTJxXp+AAe7xDRfcxaCAELPS6eAfK4g=";
+    hash = "sha256-aprudD39bcQrCQbDU/IYcOZykKvSv6ZpakAwTCwCtGA=";
   };
 
   build-system = [ setuptools ];

pkgs/servers/sql/postgresql/ext/pgmq.nix

@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgmq";
-  version = "1.8.1";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "tembo-io";
     repo = "pgmq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iPls5ABcpYUXd/Lqk0U8GFzM4iq0lqMbJO4v4z27tNI=";
+    hash = "sha256-Rgs3iZfnKAijz8mk9A2tM1WuL8uMFYE3IRa+JgWk0LE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pgmq-extension";

pkgs/tools/text/mdcat/default.nix

@@ -41,14 +41,14 @@ rustPlatform.buildRustPackage rec {
   nativeCheckInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.
   checkFlags = [
-    "--skip magic::tests::detect_mimetype_of_larger_than_magic_param_bytes_max_length"
-    "--skip magic::tests::detect_mimetype_of_magic_param_bytes_max_length"
-    "--skip magic::tests::detect_mimetype_of_png_image"
-    "--skip magic::tests::detect_mimetype_of_svg_image"
-    "--skip resources::tests::read_url_with_http_url_fails_when_size_limit_is_exceeded"
-    "--skip resources::tests::read_url_with_http_url_fails_when_status_404"
-    "--skip resources::tests::read_url_with_http_url_returns_content_when_status_200"
-    "--skip iterm2_tests_render_md_samples_images_md"
+    "--skip=magic::tests::detect_mimetype_of_larger_than_magic_param_bytes_max_length"
+    "--skip=magic::tests::detect_mimetype_of_magic_param_bytes_max_length"
+    "--skip=magic::tests::detect_mimetype_of_png_image"
+    "--skip=magic::tests::detect_mimetype_of_svg_image"
+    "--skip=resources::tests::read_url_with_http_url_fails_when_size_limit_is_exceeded"
+    "--skip=resources::tests::read_url_with_http_url_fails_when_status_404"
+    "--skip=resources::tests::read_url_with_http_url_returns_content_when_status_200"
+    "--skip=iterm2_tests_render_md_samples_images_md"
   ];
 
   postInstall = ''

pkgs/top-level/all-packages.nix

@@ -1943,10 +1943,6 @@ with pkgs;
     mobilizon-frontend = callPackage ../servers/mobilizon/frontend.nix { };
   };
 
-  monado = callPackage ../by-name/mo/monado/package.nix {
-    inherit (gst_all_1) gstreamer gst-plugins-base;
-  };
-
   nltk-data = recurseIntoAttrs (callPackage ../tools/text/nltk-data { });
 
   seabios-coreboot = seabios.override { ___build-type = "coreboot"; };