Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -9085,6 +9085,12 @@
     githubId = 54999;
     name = "Ariel Nunez";
   };
+  interdependence = {
+    email = "git@williamvandervalk.com";
+    github = "interdependence";
+    githubId = 45567423;
+    name = "William Vandervalk";
+  };
   Intuinewin = {
     email = "antoinelabarussias@gmail.com";
     github = "Intuinewin";
@@ -13901,7 +13907,7 @@
     name = "Maciej Kazulak";
   };
   mkez = {
-    email = "matias.zwinger+nix@protonmail.com";
+    email = "matias+nix@zwinger.fi";
     github = "mk3z";
     githubId = 52108954;
     name = "Matias Zwinger";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -48,6 +48,9 @@
   If you experience any issues, please report them.
   The original Perl script can still be used for now by setting `system.switch.enableNg` to `false`.
 
+- Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
+  was added through the `boot.initrd.systemd.dmVerity` option.
+
 - The [Xen Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
   - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems.
   ::: {.warning}

nixos/modules/image/assert_uki_repart_match.py

@@ -0,0 +1,78 @@
+import json
+import sys
+
+store_verity_type = "@NIX_STORE_VERITY@"  # replaced at import by Nix
+
+
+def extract_uki_cmdline_params(ukify_json: dict) -> dict[str, str]:
+    """
+    Return a dict of the parameters in the .cmdline section of the UKI
+    Exits early if "usrhash" is not included.
+    """
+    cmdline = ukify_json.get(".cmdline", {}).get("text")
+    if cmdline is None:
+        print("Failed to get cmdline from ukify output")
+
+    params = {}
+    for param in cmdline.split():
+        key, val = param.partition("=")[::2]
+        params[key] = val
+
+    if "usrhash" not in params:
+        print(
+            f"UKI cmdline does not contain a usrhash:\n{cmdline}"
+        )
+        exit(1)
+
+    return params
+
+
+def hashes_match(partition: dict[str, str], expected: str) -> bool:
+    """
+    Checks if the value of the "roothash" key in the passed partition object matches `expected`.
+    """
+    if partition.get("roothash") != expected:
+        pretty_part = json.dumps(partition, indent=2)
+        print(
+            f"hash mismatch, expected to find roothash {expected} in:\n{pretty_part}"
+        )
+        return False
+    else:
+        return True
+
+
+def check_partitions(
+    partitions: list[dict], uki_params: dict[str, str]
+) -> bool:
+    """
+    Checks if the usrhash from `uki_params` has a matching roothash
+    for the corresponding partition in `partitions`.
+    """
+    for part in partitions:
+        if part.get("type") == store_verity_type:
+            expected = uki_params["usrhash"]
+            return hashes_match(part, expected)
+
+    return False
+
+
+def main() -> None:
+    ukify_json = json.load(sys.stdin)
+    repart_json_output = sys.argv[1]
+
+    with open(repart_json_output, "r") as r:
+        repart_json = json.load(r)
+
+    uki_params = extract_uki_cmdline_params(ukify_json)
+
+    if check_partitions(repart_json, uki_params):
+        print("UKI and repart verity hashes match")
+    else:
+        print("Compatibility check for UKI and image failed!")
+        print(f"UKI cmdline parameters:\n{uki_params}")
+        print(f"repart config: {repart_json_output}")
+        exit(1)
+
+
+if __name__ == "__main__":
+    main()

nixos/modules/image/repart-verity-store.nix

@@ -0,0 +1,209 @@
+# opinionated module that can be used to build nixos images with
+# a dm-verity protected nix store
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.image.repart.verityStore;
+
+  verityMatchKey = "store";
+
+  # TODO: make these and other arch mappings available from systemd-lib for example
+  partitionTypes = {
+    usr =
+      {
+        "x86_64" = "usr-x86-64";
+        "arm64" = "usr-arm64";
+      }
+      ."${pkgs.stdenv.hostPlatform.linuxArch}";
+
+    usr-verity =
+      {
+        "x86_64" = "usr-x86-64-verity";
+        "arm64" = "usr-arm64-verity";
+      }
+      ."${pkgs.stdenv.hostPlatform.linuxArch}";
+  };
+
+  verityHashCheck =
+    pkgs.buildPackages.writers.writePython3Bin "assert_uki_repart_match.py"
+      {
+        flakeIgnore = [ "E501" ]; # ignores PEP8's line length limit of 79 (black defaults to 88 characters)
+      }
+      (
+        builtins.replaceStrings [ "@NIX_STORE_VERITY@" ] [
+          partitionTypes.usr-verity
+        ] (builtins.readFile ./assert_uki_repart_match.py)
+      );
+in
+{
+  options.image.repart.verityStore = {
+    enable = lib.mkEnableOption "building images with a dm-verity protected nix store";
+
+    ukiPath = lib.mkOption {
+      type = lib.types.str;
+      default = "/EFI/Linux/${config.system.boot.loader.ukiFile}";
+      defaultText = "/EFI/Linux/\${config.system.boot.loader.ukiFile}";
+      description = ''
+        Specify the location on the ESP where the UKI is placed.
+      '';
+    };
+
+    partitionIds = {
+      esp = lib.mkOption {
+        type = lib.types.str;
+        default = "00-esp";
+        description = ''
+          Specify the attribute name of the ESP.
+        '';
+      };
+      store-verity = lib.mkOption {
+        type = lib.types.str;
+        default = "10-store-verity";
+        description = ''
+          Specify the attribute name of the store's dm-verity hash partition.
+        '';
+      };
+      store = lib.mkOption {
+        type = lib.types.str;
+        default = "20-store";
+        description = ''
+          Specify the attribute name of the store partition.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.initrd.systemd.dmVerity.enable = true;
+
+    image.repart.partitions = {
+      # dm-verity hash partition
+      ${cfg.partitionIds.store-verity}.repartConfig = {
+        Type = partitionTypes.usr-verity;
+        Verity = "hash";
+        VerityMatchKey = lib.mkDefault verityMatchKey;
+        Label = lib.mkDefault "store-verity";
+      };
+      # dm-verity data partition that contains the nix store
+      ${cfg.partitionIds.store} = {
+        storePaths = [ config.system.build.toplevel ];
+        repartConfig = {
+          Type = partitionTypes.usr;
+          Verity = "data";
+          Format = lib.mkDefault "erofs";
+          VerityMatchKey = lib.mkDefault verityMatchKey;
+          Label = lib.mkDefault "store";
+        };
+      };
+
+    };
+
+    system.build = {
+
+      # intermediate system image without ESP
+      intermediateImage =
+        (config.system.build.image.override {
+          # always disable compression for the intermediate image
+          compression.enable = false;
+        }).overrideAttrs
+          (
+            _: previousAttrs: {
+              # make it easier to identify the intermediate image in build logs
+              pname = "${previousAttrs.pname}-intermediate";
+
+              # do not prepare the ESP, this is done in the final image
+              systemdRepartFlags = previousAttrs.systemdRepartFlags ++ [ "--defer-partitions=esp" ];
+
+              # the image will be self-contained so we can drop references
+              # to the closure that was used to build it
+              unsafeDiscardReferences.out = true;
+            }
+          );
+
+      # UKI with embedded usrhash from intermediateImage
+      uki =
+        let
+          inherit (config.system.boot.loader) ukiFile;
+          cmdline = "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
+        in
+        # override the default UKI
+        lib.mkOverride 99 (
+          pkgs.runCommand ukiFile
+            {
+              nativeBuildInputs = [
+                pkgs.jq
+                pkgs.systemdUkify
+              ];
+            }
+            ''
+              mkdir -p $out
+
+              # Extract the usrhash from the output of the systemd-repart invocation for the intermediate image.
+              usrhash=$(jq -r \
+                '.[] | select(.type=="${partitionTypes.usr-verity}") | .roothash' \
+                ${config.system.build.intermediateImage}/repart-output.json
+              )
+
+              # Build UKI with the embedded usrhash.
+              ukify build \
+                  --config=${config.boot.uki.configFile} \
+                  --cmdline="${cmdline} usrhash=$usrhash" \
+                  --output="$out/${ukiFile}"
+            ''
+        );
+
+      # final system image that is created from the intermediate image by injecting the UKI from above
+      finalImage =
+        (config.system.build.image.override {
+          # continue building with existing intermediate image
+          createEmpty = false;
+        }).overrideAttrs
+          (
+            finalAttrs: previousAttrs:
+            let
+              copyUki = "CopyFiles=${config.system.build.uki}/${config.system.boot.loader.ukiFile}:${cfg.ukiPath}";
+            in
+            {
+              nativeBuildInputs = previousAttrs.nativeBuildInputs ++ [
+                pkgs.systemdUkify
+                verityHashCheck
+              ];
+
+              postPatch = ''
+                # add entry to inject UKI into ESP
+                echo '${copyUki}' >> $finalRepartDefinitions/${cfg.partitionIds.esp}.conf
+              '';
+
+              preBuild = ''
+                # check that we build the final image with the same intermediate image for
+                # which the injected UKI was built by comparing the UKI cmdline with the repart output
+                # of the intermediate image
+                #
+                # This is necessary to notice incompatible substitutions of
+                # non-reproducible store paths, for example when working with distributed
+                # builds, or when offline-signing the UKI.
+                ukify --json=short inspect ${config.system.build.uki}/${config.system.boot.loader.ukiFile} \
+                  | assert_uki_repart_match.py "${config.system.build.intermediateImage}/repart-output.json"
+
+                # copy the uncompressed intermediate image, so that systemd-repart picks it up
+                cp -v ${config.system.build.intermediateImage}/${config.image.repart.imageFileBasename}.raw .
+                chmod +w ${config.image.repart.imageFileBasename}.raw
+              '';
+
+              # the image will be self-contained so we can drop references
+              # to the closure that was used to build it
+              unsafeDiscardReferences.out = true;
+            }
+          );
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    nikstur
+    willibutz
+  ];
+}

nixos/modules/image/repart.nix

@@ -69,6 +69,10 @@ let
   }) opts;
 in
 {
+  imports = [
+    ./repart-verity-store.nix
+  ];
+
   options.image.repart = {
 
     name = lib.mkOption {

nixos/modules/module-list.nix

@@ -1625,6 +1625,7 @@
   ./system/boot/stage-2.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/dm-verity.nix
   ./system/boot/systemd/initrd-secrets.nix
   ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix

nixos/modules/system/boot/systemd/dm-verity.nix

@@ -0,0 +1,61 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.boot.initrd.systemd.dmVerity;
+in
+{
+  options = {
+    boot.initrd.systemd.dmVerity = {
+      enable = lib.mkEnableOption "dm-verity" // {
+        description = ''
+          Mount verity-protected block devices in the initrd.
+
+          Enabling this option allows to use `systemd-veritysetup` and
+          `systemd-veritysetup-generator` in the initrd.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.boot.initrd.systemd.enable;
+        message = ''
+          'boot.initrd.systemd.dmVerity.enable' requires 'boot.initrd.systemd.enable' to be enabled.
+        '';
+      }
+    ];
+
+    boot.initrd = {
+      availableKernelModules = [
+        "dm_mod"
+        "dm_verity"
+      ];
+
+      # dm-verity needs additional udev rules from LVM to work.
+      services.lvm.enable = true;
+
+      # The additional targets and store paths allow users to integrate verity-protected devices
+      # through the systemd tooling.
+      systemd = {
+        additionalUpstreamUnits = [
+          "veritysetup-pre.target"
+          "veritysetup.target"
+          "remote-veritysetup.target"
+        ];
+
+        storePaths = [
+          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-veritysetup"
+          "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-veritysetup-generator"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    msanft
+    nikstur
+    willibutz
+  ];
+}

nixos/modules/virtualisation/incus.nix

@@ -112,12 +112,11 @@ let
 
   environment = lib.mkMerge [
     {
+      INCUS_EDK2_PATH = ovmf;
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
       INCUS_USBIDS_PATH = "${pkgs.hwdata}/share/hwdata/usb.ids";
       PATH = lib.mkForce serverBinPath;
     }
-    (lib.mkIf (lib.versionOlder cfg.package.version "6.3.0") { INCUS_OVMF_PATH = ovmf; })
-    (lib.mkIf (lib.versionAtLeast cfg.package.version "6.3.0") { INCUS_EDK2_PATH = ovmf; })
     (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
   ];
 

nixos/tests/all-tests.nix

@@ -128,6 +128,7 @@ in {
   apcupsd = handleTest ./apcupsd.nix {};
   apfs = runTest ./apfs.nix;
   appliance-repart-image = runTest ./appliance-repart-image.nix;
+  appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
   apparmor = handleTest ./apparmor.nix {};
   archi = handleTest ./archi.nix {};
   aria2 = handleTest ./aria2.nix {};

nixos/tests/appliance-repart-image-verity-store.nix

@@ -0,0 +1,130 @@
+# similar to the appliance-repart-image test but with a dm-verity
+# protected nix store and tmpfs as rootfs
+{ lib, ... }:
+
+{
+  name = "appliance-repart-image-verity-store";
+
+  meta.maintainers = with lib.maintainers; [
+    nikstur
+    willibutz
+  ];
+
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    let
+      inherit (config.image.repart.verityStore) partitionIds;
+    in
+    {
+      imports = [ ../modules/image/repart.nix ];
+
+      virtualisation.fileSystems = lib.mkVMOverride {
+        "/" = {
+          fsType = "tmpfs";
+          options = [ "mode=0755" ];
+        };
+
+        "/usr" = {
+          device = "/dev/mapper/usr";
+          # explicitly mount it read-only otherwise systemd-remount-fs will fail
+          options = [ "ro" ];
+          fsType = config.image.repart.partitions.${partitionIds.store}.repartConfig.Format;
+        };
+
+        # bind-mount the store
+        "/nix/store" = {
+          device = "/usr/nix/store";
+          options = [ "bind" ];
+        };
+      };
+
+      image.repart = {
+        verityStore = {
+          enable = true;
+          # by default the module works with systemd-boot, for simplicity this test directly boots the UKI
+          ukiPath = "/EFI/BOOT/BOOT${lib.toUpper config.nixpkgs.hostPlatform.efiArch}.EFI";
+        };
+
+        name = "appliance-verity-store-image";
+
+        partitions = {
+          ${partitionIds.esp} = {
+            # the UKI is injected into this partition by the verityStore module
+            repartConfig = {
+              Type = "esp";
+              Format = "vfat";
+              SizeMinBytes = if config.nixpkgs.hostPlatform.isx86_64 then "64M" else "96M";
+            };
+          };
+          ${partitionIds.store-verity}.repartConfig = {
+            Minimize = "best";
+          };
+          ${partitionIds.store}.repartConfig = {
+            Minimize = "best";
+          };
+        };
+      };
+
+      virtualisation = {
+        directBoot.enable = false;
+        mountHostNixStore = false;
+        useEFIBoot = true;
+      };
+
+      boot = {
+        loader.grub.enable = false;
+        initrd.systemd.enable = true;
+      };
+
+      system.image = {
+        id = "nixos-appliance";
+        version = "1";
+      };
+
+      # don't create /usr/bin/env
+      # this would require some extra work on read-only /usr
+      # and it is not a strict necessity
+      system.activationScripts.usrbinenv = lib.mkForce "";
+    };
+
+  testScript =
+    { nodes, ... }: # python
+    ''
+      import os
+      import subprocess
+      import tempfile
+
+      tmp_disk_image = tempfile.NamedTemporaryFile()
+
+      subprocess.run([
+        "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
+        "create",
+        "-f",
+        "qcow2",
+        "-b",
+        "${nodes.machine.system.build.finalImage}/${nodes.machine.image.repart.imageFile}",
+        "-F",
+        "raw",
+        tmp_disk_image.name,
+      ])
+
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+
+      machine.wait_for_unit("default.target")
+
+      with subtest("Running with volatile root"):
+        machine.succeed("findmnt --kernel --type tmpfs /")
+
+      with subtest("/nix/store is backed by dm-verity protected fs"):
+        verity_info = machine.succeed("dmsetup info --target verity usr")
+        assert "ACTIVE" in verity_info,f"unexpected verity info: {verity_info}"
+
+        backing_device = machine.succeed("df --output=source /nix/store | tail -n1").strip()
+        assert "/dev/mapper/usr" == backing_device,"unexpected backing device: {backing_device}"
+    '';
+}

pkgs/applications/blockchains/clightning/default.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "24.08";
+  version = "24.08.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    hash = "sha256-u4dkVcdduTBuRE615mPx66U8OFZSeMdL2fNJNoHbVxc=";
+    hash = "sha256-2ZKvhNuzGftKwSdmMkHOwE9UEI5Ewn5HHSyyZUcCwB4=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool

pkgs/applications/editors/vim/plugins/deprecated.json

@@ -7,10 +7,6 @@
         "date": "2021-12-07",
         "new": "cmp-tmux"
     },
-    "taskwarrior": {
-        "date": "2024-08-13",
-        "new": "taskwarrior3 or taskwarrior2"
-    },
     "fern-vim": {
         "date": "2024-05-12",
         "new": "vim-fern"
@@ -67,6 +63,10 @@
         "date": "2024-05-12",
         "new": "vim-suda"
     },
+    "taskwarrior": {
+        "date": "2024-08-13",
+        "new": "taskwarrior3 or taskwarrior2"
+    },
     "vim-fsharp": {
         "date": "2024-03-16",
         "new": "zarchive-vim-fsharp"

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -900,12 +900,12 @@
   };
   glsl = buildGrammar {
     language = "glsl";
-    version = "0.0.0+rev=ddc3137";
+    version = "0.0.0+rev=66aec57";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-glsl";
-      rev = "ddc3137a2d775aca93084ff997fa13cc1691058a";
-      hash = "sha256-q1xL3/4W442z1wjYL0HQNdz4sPZqqEijyLSvECHugXw=";
+      rev = "66aec57f7119c7e8e40665b723cd7af5594f15ee";
+      hash = "sha256-EO8p3BhoyemCXlWq4BI5Y1KqU04F9KpEwbn8HoZd4z4=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-glsl";
   };
@@ -966,12 +966,12 @@
   };
   gomod = buildGrammar {
     language = "gomod";
-    version = "0.0.0+rev=1f55029";
+    version = "0.0.0+rev=3b01edc";
     src = fetchFromGitHub {
       owner = "camdencheek";
       repo = "tree-sitter-go-mod";
-      rev = "1f55029bacd0a6a11f6eb894c4312d429dcf735c";
-      hash = "sha256-/sjC117YAFniFws4F/8+Q5Wrd4l4v4nBUaO9IdkixSE=";
+      rev = "3b01edce2b9ea6766ca19328d1850e456fde3103";
+      hash = "sha256-C3pPBgm68mmaPmstyIpIvvDHsx29yZ0ZX/QoUqwjb+0=";
     };
     meta.homepage = "https://github.com/camdencheek/tree-sitter-go-mod";
   };
@@ -1143,12 +1143,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=cf432a7";
+    version = "0.0.0+rev=5439302";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "cf432a7420eb71e9b40954aa829dcb8a9bf6b546";
-      hash = "sha256-LnbEEV8N9undyrC0ziH2nfbFOOEAPKVPXTyl7Xq0KG0=";
+      rev = "543930235970a04c2f0d549c9e88815847c7a74a";
+      hash = "sha256-MElmidivJtIywWm4dRslrmtc/vVwGDO1f6k/0P3gb4E=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -1220,12 +1220,12 @@
   };
   hurl = buildGrammar {
     language = "hurl";
-    version = "0.0.0+rev=fba6ed8";
+    version = "0.0.0+rev=ff07a42";
     src = fetchFromGitHub {
       owner = "pfeiferj";
       repo = "tree-sitter-hurl";
-      rev = "fba6ed8db3a009b9e7d656511931b181a3ee5b08";
-      hash = "sha256-JWFEk1R19YIeDNm3LkBmdL+mmfhtBDhHfg6GESwruU0=";
+      rev = "ff07a42d9ec95443b5c1b57ed793414bf7b79be5";
+      hash = "sha256-9uRRlJWT0knZ3vvzGEq9CjyffQnYF53rnoBnsQ68zyE=";
     };
     meta.homepage = "https://github.com/pfeiferj/tree-sitter-hurl";
   };
@@ -1473,12 +1473,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=90fd989";
+    version = "0.0.0+rev=1e4e303";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "90fd9894bebddce79f5b8041e7f82523364a619b";
-      hash = "sha256-+wUGNYpw2udCrF4+qMD/4TAPkBCB7q/49Qx/k/FQa3U=";
+      rev = "1e4e30342b7a3b3a24886a632fbac53035d98871";
+      hash = "sha256-A2uvHRoe9xtgsHSLYdZiztGLXdqXzsfw4BYeZ/Cmr4k=";
     };
     generate = true;
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
@@ -1617,24 +1617,24 @@
   };
   markdown = buildGrammar {
     language = "markdown";
-    version = "0.0.0+rev=c25b635";
+    version = "0.0.0+rev=d9287a6";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "c25b6354120182f1e0d5caa52f717b097a7e46a3";
-      hash = "sha256-OdBFhflQbHlEcl6hKHnFiwNVf6DkSvJD7FbE6uiZB58=";
+      rev = "d9287a6f36347064e55c36858e9e522eb652c1ad";
+      hash = "sha256-QFHPlvoJMTMepV1KxKXKjpiKMMmGzBO5mxxNcWKLO7s=";
     };
     location = "tree-sitter-markdown";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
   };
   markdown_inline = buildGrammar {
     language = "markdown_inline";
-    version = "0.0.0+rev=c25b635";
+    version = "0.0.0+rev=d9287a6";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "c25b6354120182f1e0d5caa52f717b097a7e46a3";
-      hash = "sha256-OdBFhflQbHlEcl6hKHnFiwNVf6DkSvJD7FbE6uiZB58=";
+      rev = "d9287a6f36347064e55c36858e9e522eb652c1ad";
+      hash = "sha256-QFHPlvoJMTMepV1KxKXKjpiKMMmGzBO5mxxNcWKLO7s=";
     };
     location = "tree-sitter-markdown-inline";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@@ -1920,12 +1920,12 @@
   };
   perl = buildGrammar {
     language = "perl";
-    version = "0.0.0+rev=70db420";
+    version = "0.0.0+rev=4659839";
     src = fetchFromGitHub {
       owner = "tree-sitter-perl";
       repo = "tree-sitter-perl";
-      rev = "70db420b20885ecd7268e5a710ebb3aeaef3a293";
-      hash = "sha256-4iatIqb2IaZ6McbkBY6JQiD2IMm3PNLz7qve+2iOrU8=";
+      rev = "465983954cae2d2f984eae82de5ed5f11ca291dc";
+      hash = "sha256-jSVmxGkumDXExLjT+Nnsu+E0IBB3z6wBb4y8hpp5IQs=";
     };
     meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
   };
@@ -2233,12 +2233,12 @@
   };
   r = buildGrammar {
     language = "r";
-    version = "0.0.0+rev=c8b6e5f";
+    version = "0.0.0+rev=4279b69";
     src = fetchFromGitHub {
       owner = "r-lib";
       repo = "tree-sitter-r";
-      rev = "c8b6e5f3f3c055cfc76471ebc912286e9e73d7d2";
-      hash = "sha256-B+pDrkXIaWd16hN5FzunrdmO/hbqQdHI6pgGUdWZYEg=";
+      rev = "4279b699c47fa87956045980c46c7d30f8c0121b";
+      hash = "sha256-9IjhdtkQNshRJq48jBW6cvDd/tVNwgYfRK2YWhdFG84=";
     };
     meta.homepage = "https://github.com/r-lib/tree-sitter-r";
   };
@@ -2442,12 +2442,12 @@
   };
   scala = buildGrammar {
     language = "scala";
-    version = "0.0.0+rev=b02af60";
+    version = "0.0.0+rev=ec13dd6";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-scala";
-      rev = "b02af60518ae1633d552ae2d0f25ca5e05f274f7";
-      hash = "sha256-mfbYjU4Xs61oLqgABV1UXR/g4Qd7KRdlawX3/lAz2jc=";
+      rev = "ec13dd674bb8dd89213e0d6b1fe45efb68d5878f";
+      hash = "sha256-ireSo04kG2RMlCZD1hf6BJcjT7eXjYdOqOsoMtQAwKQ=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
   };
@@ -2499,12 +2499,12 @@
   };
   slang = buildGrammar {
     language = "slang";
-    version = "0.0.0+rev=4a3fabd";
+    version = "0.0.0+rev=dd991eb";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-slang";
-      rev = "4a3fabd26b09efd7431ea4899e5f2d81b568a4b9";
-      hash = "sha256-SlLN4KkuSuywWtZlP8J0/bf4sFIres1er3HiK+gj4vA=";
+      rev = "dd991eb3b6957a33d9044e0f5914588f7f449a78";
+      hash = "sha256-Kt396lw3O3X4I3sEadfhoRVi598UCknOmdCPIMpqgdA=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-slang";
   };
@@ -3058,12 +3058,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=d63bc6c";
+    version = "0.0.0+rev=83b7286";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "v-analyzer";
-      rev = "d63bc6c08a88715c89f4b1b06642e130dd899aba";
-      hash = "sha256-RYYxkYGaWKFvkAgthchwxWqA3WYNzwd9dAJPv4um4jc=";
+      rev = "83b7286d8f4f33c88dff102bad22149d8e29d9eb";
+      hash = "sha256-O9NXsijpl7+7KWLYwH95Pa4QeWfik6i+wAK5OWV/xgc=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/v-analyzer";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -201,8 +201,8 @@ https://github.com/tjdevries/colorbuddy.nvim/,,
 https://github.com/lilydjwg/colorizer/,,
 https://github.com/Domeee/com.cloudedmountain.ide.neovim/,HEAD,
 https://github.com/wincent/command-t/,,
-https://github.com/numtostr/comment.nvim/,,
 https://github.com/LudoPinelli/comment-box.nvim/,HEAD,
+https://github.com/numtostr/comment.nvim/,,
 https://github.com/rhysd/committia.vim/,,
 https://github.com/hrsh7th/compe-conjure/,,
 https://github.com/GoldsteinE/compe-latex-symbols/,,
@@ -663,8 +663,8 @@ https://github.com/preservim/nerdcommenter/,,
 https://github.com/preservim/nerdtree/,,
 https://github.com/Xuyuanp/nerdtree-git-plugin/,,
 https://github.com/miversen33/netman.nvim/,HEAD,
-https://github.com/oberblastmeister/neuron.nvim/,,
 https://github.com/prichrd/netrw.nvim/,HEAD,
+https://github.com/oberblastmeister/neuron.nvim/,,
 https://github.com/fiatjaf/neuron.vim/,,
 https://github.com/Olical/nfnl/,main,
 https://github.com/chr4/nginx.vim/,,
@@ -904,7 +904,7 @@ https://github.com/AndrewRadev/sideways.vim/,,
 https://github.com/lotabout/skim.vim/,,
 https://github.com/mopp/sky-color-clock.vim/,,
 https://github.com/kovisoft/slimv/,,
-https://github.com/danielfalk/smart-open.nvim,0.2.x,
+https://github.com/danielfalk/smart-open.nvim/,0.2.x,
 https://github.com/mrjones2014/smart-splits.nvim/,,
 https://github.com/m4xshen/smartcolumn.nvim/,,
 https://github.com/gorkunov/smartpairs.vim/,,
@@ -994,6 +994,7 @@ https://github.com/natecraddock/telescope-zf-native.nvim/,HEAD,
 https://github.com/jvgrootveld/telescope-zoxide/,,
 https://github.com/nvim-telescope/telescope.nvim/,,
 https://github.com/luc-tielen/telescope_hoogle/,HEAD,
+https://github.com/joerdav/templ.vim/,HEAD,
 https://github.com/axelvc/template-string.nvim/,HEAD,
 https://github.com/jacoborus/tender.vim/,,
 https://github.com/chomosuke/term-edit.nvim/,HEAD,
@@ -1538,4 +1539,3 @@ https://github.com/ziglang/zig.vim/,,
 https://github.com/zk-org/zk-nvim/,HEAD,
 https://github.com/troydm/zoomwintab.vim/,,
 https://github.com/nanotee/zoxide.vim/,,
-https://github.com/joerdav/templ.vim,HEAD,

pkgs/applications/science/math/eigenmath/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "3.27-unstable-2024-08-24";
+  version = "3.27-unstable-2024-09-15";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "92ae1a3f9c9f6808f3faefa10ae66c0ff480dab2";
-    hash = "sha256-AHZ9p7yyYENHywNppsSTfaM3KFqpX5ehxfjPwocHv5Q=";
+    rev = "ba00d77289f1c9ce64108b1bbcee02c71ce48633";
+    hash = "sha256-yFzsMNVjQK64uQSfjQKC8LbdQu7/97hDolRMBc4Womc=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/by-name/ba/backrest/package.nix

@@ -0,0 +1,65 @@
+{
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  lib,
+  restic,
+  util-linux,
+}:
+let
+  pname = "backrest";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "garethgeorge";
+    repo = "backrest";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qxEZkRKkwKZ+EZ3y3aGcX2ioKOz19SRdi3+9mjF1LpE=";
+  };
+
+  frontend = buildNpmPackage {
+    inherit version;
+    pname = "${pname}-webui";
+    src = "${src}/webui";
+
+    npmDepsHash = "sha256-mS8G3+JuASaOkAYi+vgWztrSIIu7vfaasu+YeRJjWZw=";
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist/* $out
+      runHook postInstall
+    '';
+  };
+in
+buildGoModule {
+  inherit pname src version;
+
+  vendorHash = "sha256-YukcHnXa/QimfX3nDtQI6yfPkEK9j5SPXOPIT++eWsU=";
+
+  preBuild = ''
+    mkdir -p ./webui/dist
+    cp -r ${frontend}/* ./webui/dist
+  '';
+
+  nativeCheckInputs = [ util-linux ];
+
+  # Fails with handler returned wrong content encoding
+  checkFlags = [ "-skip=TestServeIndex" ];
+
+  preCheck = ''
+    # Use restic from nixpkgs, otherwise download fails in sandbox
+    export BACKREST_RESTIC_COMMAND="${restic}/bin/restic"
+    export HOME=$(pwd)
+  '';
+
+  meta = {
+    description = "Web UI and orchestrator for restic backup";
+    homepage = "https://github.com/garethgeorge/backrest";
+    changelog = "https://github.com/garethgeorge/backrest/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ interdependence ];
+    mainProgram = "backrest";
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/br/bruno/package.nix

@@ -26,20 +26,20 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.28.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-SLND+eEEMFVHE5XPt2EKkJ+BjENqvUSrWkqnC6ghUBI=";
+    hash = "sha256-UXxMHTunsKXXt0NX5fuyzQbtp4AUzLXnFHqe8Is6Cmc=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-RFn7Bbx1xMm4gt++lhPflXjEfTIgmls2TkrJ8Ta2qpI=";
+  npmDepsHash = "sha256-p3kdYuDiPZ9SmtrFajXd76Ohd+VUqn/Y8SpAPFrTBZA=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs =

pkgs/by-name/di/disko/package.nix

@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "disko";
-  version = "1.7.0";
+  version = "1.8.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tqoAO8oT6zEUDXte98cvA1saU9+1dLJQe3pMKLXv8ps=";
+    hash = "sha256-5zShvCy9S4tuISFjNSjb+TWpPtORqPbRZ0XwbLbPLho=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];

pkgs/by-name/in/incus/generic.nix

@@ -128,8 +128,8 @@ buildGoModule rec {
 
     ui = callPackage ./ui.nix { };
 
-    updateScript = writeScript "ovs-update.nu" ''
-      ${./update.nu} ${updateScriptArgs}
+    updateScript = writeScript "ovs-update.py" ''
+      ${./update.py} ${updateScriptArgs}
     '';
   };
 

pkgs/by-name/in/incus/lts.nix

@@ -1,13 +1,12 @@
 import ./generic.nix {
-  hash = "sha256-8GgzMiXn/78HkMuJ49cQA9BEQVAzPbG7jOxTScByR6Q=";
-  version = "6.0.1";
-  vendorHash = "sha256-dFg3LSG/ao73ODWcPDq5s9xUjuHabCMOB2AtngNCrlA=";
+  hash = "sha256-roPBHqy5toYF0X9mATl6QYb5GGlgPoGZYOC9vKpca88=";
+  version = "6.0.2";
+  vendorHash = "sha256-TP1NaUpsHF54mWQDcHS4uabfRJWu3k51ANNPdA4k1Go=";
   patches = [
     # qemu 9.1 compat, remove when added to LTS
     ./572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch
-    ./58eeb4eeee8a9e7f9fa9c62443d00f0ec6797078.patch
     ./0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch
   ];
   lts = true;
-  updateScriptArgs = "--lts=true --regex '6.0.*'";
+  updateScriptArgs = "--lts --regex '6.0.*'";
 }

pkgs/by-name/in/incus/update.nu

@@ -1,29 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts gnused
-
-def main [--lts = false, --regex: string] {
-  let attr = $"incus(if $lts {"-lts"})"
-  let file = $"(pwd)/pkgs/by-name/in/incus/(if $lts { "lts" } else { "package" }).nix"
-
-  let tags = list-git-tags --url=https://github.com/lxc/incus | lines | sort --natural | str replace v ''
-  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
-  let current_version = nix eval --raw -f default.nix $"($attr).version" | str trim
-
-  if $latest_tag != $current_version {
-    print $"Updating: new ($latest_tag) != old ($current_version)"
-    update-source-version $attr $latest_tag $"--file=($file)"
-
-    let oldVendorHash = nix-instantiate . --eval --strict -A $"($attr).goModules.drvAttrs.outputHash" --json | from json
-    let checkBuild = do { nix-build -A $"($attr).goModules" } | complete
-    let vendorHash = $checkBuild.stderr | lines | str trim | find --regex 'got:[[:space:]]*sha256' | split row ' ' | last
-
-    if $vendorHash != null {
-      open $file | str replace $oldVendorHash $vendorHash | save --force $file
-    } else {
-      print $checkBuild.stderr
-      exit 1
-    }
-  }
-
-  {"lts?": $lts, before: $current_version, after: $latest_tag}
-}

pkgs/by-name/in/incus/update.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 python3Packages.looseversion common-updater-scripts nurl
+
+import argparse
+import json
+import os
+import re
+from looseversion import LooseVersion
+from subprocess import run
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--lts", action="store_true")
+parser.add_argument("--regex")
+args = parser.parse_args()
+
+nixpkgs_path = os.environ["PWD"]
+
+attr = "incus"
+file = f"pkgs/by-name/in/incus/package.nix"
+if args.lts:
+    attr = "incus-lts"
+    file = f"pkgs/by-name/in/incus/lts.nix"
+
+tags = (
+    run(["list-git-tags", "--url=https://github.com/lxc/incus"], capture_output=True)
+    .stdout.decode("utf-8")
+    .splitlines()
+)
+tags = [t.lstrip("v") for t in tags]
+
+latest_version = "0"
+for tag in tags:
+    if args.regex != None and not re.match(args.regex, tag):
+        continue
+
+    if LooseVersion(tag) > LooseVersion(latest_version):
+        latest_version = tag
+
+current_version = (
+    run(
+        ["nix", "eval", "--raw", "-f", "default.nix", f"{attr}.version"],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+)
+
+if LooseVersion(latest_version) <= LooseVersion(current_version):
+    print("No update available")
+    exit(0)
+
+print(f"Found new version {latest_version} > {current_version}")
+
+run(["update-source-version", attr, latest_version, f"--file={file}"])
+
+current_vendor_hash = (
+    run(
+        [
+            "nix-instantiate",
+            ".",
+            "--eval",
+            "--strict",
+            "-A",
+            f"{attr}.goModules.drvAttrs.outputHash",
+            "--json",
+        ],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+    .strip('"')
+)
+
+latest_vendor_hash = (
+    run(
+        ["nurl", "--expr", f"(import {nixpkgs_path} {{}}).{attr}.goModules"],
+        capture_output=True,
+    )
+    .stdout.decode("utf-8")
+    .strip()
+)
+
+with open(file, "r+") as f:
+    file_content = f.read()
+    file_content = re.sub(current_vendor_hash, latest_vendor_hash, file_content)
+    f.seek(0)
+    f.write(file_content)

pkgs/by-name/lx/lxc/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lxc";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxc";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-fJMNdMXlV1z9q1pMDh046tNmLDuK6zh6uPahTWzWMvc=";
+    hash = "sha256-qc60oSs2KahQJpSmhrctXpV2Zumv7EvlnGFaOCSCX/E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/lx/lxcfs/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxcfs";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = "v${version}";
-    hash = "sha256-kJ9QaNI8v03E0//UyU6fsav1YGOlKGMxsbE8Pr1Dtic=";
+    hash = "sha256-5r1X/yUXTMC/2dNhpI+BVYeClIydefg2lurCGt7iA8Y=";
   };
 
   patches = [

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -15,21 +15,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "matrix-authentication-service";
-  version = "0.10.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
-    owner = "matrix-org";
+    owner = "element-hq";
     repo = "matrix-authentication-service";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cZJ9ibBtxVBBVCBTGhtfM6lQTFvgUnO1WPO1WmDGuks=";
+    hash = "sha256-QLtyYxV2yXHJtwWgGcyi7gRcKypYoy9Z8bkEuTopVXc=";
   };
 
-  cargoHash = "sha256-mUHN1uEc1qM1Bm/J7qf0zyMKaJvyt9YbQ8TxvxG+vcM=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+       "sea-query-0.32.0-rc.1" = "sha256-Q/NFiIBu8L5rQj4jwcIo8ACmAhLBy4HSTcJv06UdK8E=";
+     };
+  };
 
   npmDeps = fetchNpmDeps {
     name = "${pname}-${version}-npm-deps";
     src = "${src}/${npmRoot}";
-    hash = "sha256-CMdnHS3sj9gXLpVlmuKvqFJ28+7fddG2Ld6t2nSFp24=";
+    hash = "sha256-EfDxbdjzF0yLQlueIYKmdpU4v9dx7g8bltU63mIWfo0=";
   };
 
   npmRoot = "frontend";
@@ -75,7 +80,7 @@ rustPlatform.buildRustPackage rec {
     (cd "$npmRoot" && npm run build)
   '';
 
-  # Adopted from https://github.com/matrix-org/matrix-authentication-service/blob/main/Dockerfile
+  # Adopted from https://github.com/element-hq/matrix-authentication-service/blob/main/Dockerfile
   postInstall = ''
     install -Dm444 -t "$out/share/$pname"        "policies/policy.wasm"
     install -Dm444 -t "$out/share/$pname/assets" "$npmRoot/dist/"*
@@ -83,12 +88,12 @@ rustPlatform.buildRustPackage rec {
     cp -r translations   "$out/share/$pname/translations"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "OAuth2.0 + OpenID Provider for Matrix Homeservers";
-    homepage = "https://github.com/matrix-org/matrix-authentication-service";
-    changelog = "https://github.com/matrix-org/matrix-authentication-service/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ teutat3s ];
+    homepage = "https://github.com/element-hq/matrix-authentication-service";
+    changelog = "https://github.com/element-hq/matrix-authentication-service/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ teutat3s ];
     mainProgram = "mas-cli";
   };
 }

pkgs/by-name/ni/nix-store-veritysetup-generator/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  systemd,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nix-store-veritysetup-generator";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "nikstur";
+    repo = "nix-store-veritysetup-generator";
+    rev = version;
+    hash = "sha256-kQ+mFBnvxmEH2+z1sDaehGInEsBpfZu8LMAseGjZ3/I=";
+  };
+
+  sourceRoot = "${src.name}/rust";
+
+  cargoHash = "sha256-NCxPLsBJX4Dp8LcWrjVrocqDBvWc587DF3WPXZg1uFY=";
+
+  env = {
+    SYSTEMD_VERITYSETUP_PATH = "${systemd}/lib/systemd/systemd-veritysetup";
+    SYSTEMD_ESCAPE_PATH = "${systemd}/bin/systemd-escape";
+  };
+
+  # Use a fake path in tests so that they are not dependent on specific Nix
+  # Store paths and thus don't break on different Nixpkgs invocations. This is
+  # relevant so that this package can be compiled on different architectures.
+  preCheck = ''
+    export SYSTEMD_VERITYSETUP_PATH="systemd-veritysetup";
+  '';
+
+  stripAllList = [ "bin" ];
+
+  meta = with lib; {
+    description = "Systemd unit generator for a verity protected Nix Store";
+    homepage = "https://github.com/nikstur/nix-store-veritysetup-generator";
+    license = licenses.mit;
+    maintainers = with lib.maintainers; [ nikstur ];
+  };
+}

pkgs/by-name/ni/nixos-anywhere/package.nix

@@ -30,12 +30,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixos-anywhere";
-  version = "1.3.0";
+  version = "1.4.0";
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-anywhere";
     rev = finalAttrs.version;
-    hash = "sha256-AdSrhQhJb9ObCgM1iXnoIBBl+6cjRbuTST4Lt02AP5Q=";
+    hash = "sha256-ssx6Y665uoOO3PX6Mp9NAF8sqoGb7Ezfw+bTY69aGlE=";
   };
   nativeBuildInputs = [ makeWrapper ];
   installPhase = ''

pkgs/by-name/po/polenum/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "polenum";
+  version = "1.6.1-unstable-2024-07-30";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "Wh1t3Fox";
+    repo = "polenum";
+    rev = "6f95ce0f9936d8c20820e199a4bb1ea68d2f061f";
+    hash = "sha256-aCX7dByfkUSFHjhRAjrFhbbeIgYNGixnB5pHE/lftng=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    impacket
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD $pname.py $out/bin/$pname
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tool to get the password policy from a windows machine";
+    homepage = "https://github.com/Wh1t3Fox/polenum";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ exploitoverload ];
+    mainProgram = "polenum";
+  };
+}

pkgs/by-name/ru/ruff-lsp/package.nix

@@ -15,14 +15,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ruff-lsp";
-  version = "0.0.56";
+  version = "0.0.57";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff-lsp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-L5bfGW5R9kDCK8zcFh+a/zquJefwKxOB0JdYDTyPFuQ=";
+    hash = "sha256-w9NNdsDD+YLrCw8DHDhVx62MdwLhcN8QSmb/2rqlb5g=";
   };
 
   postPatch = ''

pkgs/by-name/tr/trealla/package.nix

@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.55.41";
+  version = "2.56.15";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-T1FE8CZNOk3FKnykEwgEhScu6aNbcd5BQlXZOaAxjEo=";
+    hash = "sha256-PpFZvUyRBOhQuXvnMnaqYgrxPh4owWpv9Y8SHEIu9ck=";
   };
 
   postPatch = ''

pkgs/development/lua-modules/generated-packages.nix

@@ -273,14 +273,14 @@ buildLuarocksPackage {
 compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
-  version = "0.13-1";
+  version = "0.14.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/compat53-0.13-1.rockspec";
-    sha256 = "10gmhd526a5q0dl4dvjq7a5c7f3i7hcdla8hpygl79dhgbm649i3";
+    url    = "mirror://luarocks/compat53-0.14.3-1.rockspec";
+    sha256 = "0c50x5nprcfafjnb4gzy23xszmr97mspy1g9m6pyj81c2648288n";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.13.zip";
-    sha256 = "06kpx5qyk1zki2r2g6z3alwhvmays50670z7mbl55h7s0kff2cpz";
+    url    = "https://github.com/lunarmodules/lua-compat-5.3/archive/v0.14.3.zip";
+    sha256 = "00qgfl5n2rfp1gikky03dmc30jy4piz0js8d7zznaclxsq2nyp2x";
   };
 
   disabled = luaOlder "5.1" || luaAtLeast "5.5";
@@ -387,23 +387,23 @@ buildLuarocksPackage {
   };
 }) {};
 
-digestif = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl, lpeg, luaOlder }:
+digestif = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl, lpeg, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "digestif";
-  version = "0.5.1-1";
+  version = "0.6-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/digestif-0.5.1-1.rockspec";
-    sha256 = "03hhzpq1szdw43slq38wbndwh8knv71q9pgwd7hvvkp9wykzjhwr";
+    url    = "mirror://luarocks/digestif-0.6-1.rockspec";
+    sha256 = "0hp7r97b6ivywaxb02cbnm23gjz71mak5ag6m3hi7f3mjqxxxh8k";
   }).outPath;
   src = fetchFromGitHub {
     owner = "astoff";
     repo = "digestif";
-    rev = "v0.5.1";
-    hash = "sha256-8QTc4IKD1tjRlyrSZy7cyUzRkvm6IHwlOXchPf2BaMk=";
+    rev = "v0.6";
+    hash = "sha256-sGwKt9suRVNrbRJlhNMHzc5r4sK/fvUc7smxmxmrn8Y=";
   };
 
   disabled = luaOlder "5.3";
-  propagatedBuildInputs = [ lpeg ];
+  propagatedBuildInputs = [ lpeg luafilesystem ];
 
   meta = {
     homepage = "https://github.com/astoff/digestif/";
@@ -555,14 +555,14 @@ buildLuarocksPackage {
 fzf-lua = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "fzf-lua";
-  version = "0.0.1415-1";
+  version = "0.0.1457-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fzf-lua-0.0.1415-1.rockspec";
-    sha256 = "039hy10ml25z2kvm5xiayvswx42rj4di119vgl2ncrfvlr5lnxdf";
+    url    = "mirror://luarocks/fzf-lua-0.0.1457-1.rockspec";
+    sha256 = "1b1bad930cyicv9g0rd9k5hzk93kgxqk9gqw7adr7a9srb5gm431";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/ibhagwan/fzf-lua/archive/e9413dc2b6e8ab7f62385c972df1dceba483492d.zip";
-    sha256 = "09bh0rjx9g96vz0zfnpi4ych64qawrj1rgrpznkjn1cph8qayj35";
+    url    = "https://github.com/ibhagwan/fzf-lua/archive/f513524561060f2b9e3bd6d36ff046bfa03ca114.zip";
+    sha256 = "0rqh2bvh1bp5i4y1xrvggi0d27a6qbpkvcinrq0c6s9k8g84d7wy";
   };
 
   disabled = luaOlder "5.1";
@@ -606,8 +606,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "lewis6991";
     repo = "gitsigns.nvim";
-    rev = "562dc47189ad3c8696dbf460d38603a74d544849";
-    hash = "sha256-NNoqXn24Fzkopx1/Xwcv41EpqHwpcMPrQWLfXcPtha4=";
+    rev = "1ef74b546732f185d0f806860fa5404df7614f28";
+    hash = "sha256-s3y8ZuLV00GIhizcK/zqsJOTKecql7Xn3LGYmH7NLsQ=";
   };
 
   disabled = lua.luaversion != "5.1";
@@ -622,14 +622,14 @@ buildLuarocksPackage {
 haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "4.0.0-1";
+  version = "4.0.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-4.0.0-1.rockspec";
-    sha256 = "1iz7bgy7a0zclsg31rmf6hcrjxnikhqwzh5blirif3m9bdi9mv6v";
+    url    = "mirror://luarocks/haskell-tools.nvim-4.0.1-1.rockspec";
+    sha256 = "1kz93jm9fx5qga4nszb0g3rgravzrz4qb8fbns87hl5qidrh20rq";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/4.0.0.zip";
-    sha256 = "0k6kw42n4c2hc7mqjv8ahwcwqia7wdgmszy1np96sc9dd0bkiqx9";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/4.0.1.zip";
+    sha256 = "160mnzjf6f5aw2k9fb2g416wxj3fqhpig1myppglp1586hm7b3fl";
   };
 
   disabled = luaOlder "5.1";
@@ -2088,14 +2088,14 @@ buildLuarocksPackage {
 luarocks-build-treesitter-parser = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "luarocks-build-treesitter-parser";
-  version = "4.1.0-1";
+  version = "5.0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luarocks-build-treesitter-parser-4.1.0-1.rockspec";
-    sha256 = "sha256-PIvmRtzb9YEkuwXfLfY3w+DrOZZRjGSAvPsnK3dDeWQ=";
+    url    = "mirror://luarocks/luarocks-build-treesitter-parser-5.0.2-1.rockspec";
+    sha256 = "037rap1aar6xx25xgnlknkkszarkbflpdfp1jaasq5py397gc61a";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser/archive/v4.1.0.zip";
-    sha256 = "sha256-KNU/opkfKTZnCYfMOXVuGvb9J+iqfworQ0t2YcHAaKA=";
+    url    = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser/archive/v5.0.2.zip";
+    sha256 = "03f17sljq1f7nqrdjn94p9p2j67bs5si2nl0xlv1njj326rby324";
   };
 
   disabled = luaOlder "5.1";
@@ -2112,14 +2112,14 @@ buildLuarocksPackage {
 luarocks-build-treesitter-parser-cpp = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "luarocks-build-treesitter-parser-cpp";
-  version = "2.0.3-1";
+  version = "2.0.4-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luarocks-build-treesitter-parser-cpp-2.0.3-1.rockspec";
-    sha256 = "1pn8kn1kf9ak4b7hba1nd358dh146sr993gf8r10s3ywcnihmnw0";
+    url    = "mirror://luarocks/luarocks-build-treesitter-parser-cpp-2.0.4-1.rockspec";
+    sha256 = "0hrqy1s9c1naad43bri4icf5y139h5wk52yv4f0dxbvsfqbf8isb";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser-cpp/archive/v2.0.3.zip";
-    sha256 = "1dcjy1vy76vszm9r1ck42w8a1xw0ls0vs9xg5wzh3wnk2d1y54m3";
+    url    = "https://github.com/nvim-neorocks/luarocks-build-treesitter-parser-cpp/archive/v2.0.4.zip";
+    sha256 = "0r7mvc1f7wgmb4xgknmr38cv35chwdyxmj1fxw4xsdjrvb1qyvi6";
   };
 
   disabled = luaOlder "5.1";
@@ -2259,16 +2259,16 @@ buildLuarocksPackage {
 luasystem = callPackage({ buildLuarocksPackage, fetchFromGitHub, fetchurl, luaOlder }:
 buildLuarocksPackage {
   pname = "luasystem";
-  version = "0.4.2-1";
+  version = "0.4.4-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasystem-0.4.2-1.rockspec";
-    sha256 = "15z4n7pbggg1wy397k9mx0jls31snvw0dgr9yklwi4sayfcva3ip";
+    url    = "mirror://luarocks/luasystem-0.4.4-1.rockspec";
+    sha256 = "0gk489qwxfvc5qwmj9fgwi60qnjnqasc665bg8iiggapdwcl5ny4";
   }).outPath;
   src = fetchFromGitHub {
     owner = "lunarmodules";
     repo = "luasystem";
-    rev = "v0.4.2";
-    hash = "sha256-xYfHK/OtOFtGHAZTPDp/BTywAcCqJIx8+zt3/HPon0w=";
+    rev = "v0.4.4";
+    hash = "sha256-Lxp3o94QxtsgBMilKBG21mFneh0ux7wRKDyPwMTDDUA=";
   };
 
   disabled = luaOlder "5.1";
@@ -2407,8 +2407,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "rktjmp";
     repo = "lush.nvim";
-    rev = "6a254139d077ad53be7e4f3602c8da0c84447fd9";
-    hash = "sha256-gutr36WJRktDxmRjNo0v5tn030nMsAe8vRWx/vKFa2o=";
+    rev = "45a79ec4acb5af783a6a29673a999ce37f00497e";
+    hash = "sha256-meUCXjJ9kHOOpRd4TR2dc7Ai97zOQX35hYFEDZseiSk=";
   };
 
   disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -2492,14 +2492,14 @@ buildLuarocksPackage {
 lz-n = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "lz.n";
-  version = "2.5.2-1";
+  version = "2.6.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lz.n-2.5.2-1.rockspec";
-    sha256 = "1sr6yhkq5bwp8bkqx206cr8ignz5z82a6j1dw4qgwdlvzs5kr0vs";
+    url    = "mirror://luarocks/lz.n-2.6.1-1.rockspec";
+    sha256 = "01zg2hhwy8fd60h8akh7rc3b4wmdjrn0hxm11gqrnla80dvww91c";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/lz.n/archive/v2.5.2.zip";
-    sha256 = "0pkw6wrrkzv6vl9jxx7qlr8yjghnkr1s7jy66dsw5yzfb8gz8kpd";
+    url    = "https://github.com/nvim-neorocks/lz.n/archive/v2.6.1.zip";
+    sha256 = "0j4pbaibf6zry4m15rb5xkx6ivycdfkfq0x2hdiwi82abir3ycaz";
   };
 
   disabled = luaOlder "5.1";
@@ -2721,14 +2721,14 @@ buildLuarocksPackage {
 neotest = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio, plenary-nvim }:
 buildLuarocksPackage {
   pname = "neotest";
-  version = "5.4.0-1";
+  version = "5.4.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/neotest-5.4.0-1.rockspec";
-    sha256 = "0bk5z3p2v6m2nwxh82xk0xsqb23xa9i13vfgnd9h9qy3r42jqmmj";
+    url    = "mirror://luarocks/neotest-5.4.1-1.rockspec";
+    sha256 = "0js7f2z6bsww9wlzzc1xrimrzz35nxhsn01hj3yhn4m0x7da20wi";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neotest/neotest/archive/32ff2ac21135a372a42b38ae131e531e64833bd3.zip";
-    sha256 = "144wzzadhrg48fkihffk6jf9c0ij8dg9gng6mcxq5z8mdcvz0124";
+    url    = "https://github.com/nvim-neotest/neotest/archive/808cc4e2290c5e7c2440d32876ca15d580b01d04.zip";
+    sha256 = "1xc9mmpkjcxv64rx0b73mm3wlniyyiyhs73s7n6pl4cxc93f2vpl";
   };
 
   disabled = luaOlder "5.1";
@@ -2836,14 +2836,14 @@ buildLuarocksPackage {
 pathlib-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio }:
 buildLuarocksPackage {
   pname = "pathlib.nvim";
-  version = "2.2.2-1";
+  version = "2.2.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/pathlib.nvim-2.2.2-1.rockspec";
-    sha256 = "04dklc0ibl6dbfckmkpj2s1gvjfmr0k2hyagw37rxypifncrffkr";
+    url    = "mirror://luarocks/pathlib.nvim-2.2.3-1.rockspec";
+    sha256 = "0qwsjcsl6760d8d5k1lxlykh78g6v7xcr9caq3yh75yn76mwrl4i";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/pysan3/pathlib.nvim/archive/v2.2.2.zip";
-    sha256 = "10jhbdffaw1rh1qppzllmy96dbsn741bk46mph5kxpjq4ldx27hz";
+    url    = "https://github.com/pysan3/pathlib.nvim/archive/v2.2.3.zip";
+    sha256 = "1z3nwy83r3zbll9wc2wyvg60z0dqc5hm2xdfvqh3hwm5s9w8j432";
   };
 
   disabled = luaOlder "5.1";
@@ -2949,21 +2949,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua-curl, luaOlder, mimetypes, nvim-nio, xml2lua }:
+rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, fidget-nvim, luaOlder, mimetypes, nvim-nio, xml2lua }:
 buildLuarocksPackage {
   pname = "rest.nvim";
-  version = "2.0.1-1";
+  version = "3.7.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rest.nvim-2.0.1-1.rockspec";
-    sha256 = "1ra76wnhi4nh56amyd8zqmg0mpsnhp3m41m3iyiq4hp1fah6nbqb";
+    url    = "mirror://luarocks/rest.nvim-3.7.0-1.rockspec";
+    sha256 = "192vhinbvnj040xn6zclrf147f6ymiqah5lc8ijmx1yd8p0f730w";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/rest-nvim/rest.nvim/archive/v2.0.1.zip";
-    sha256 = "09rs04d5h061zns1kdfycryx4ll8ix15q3ybpmqsdyp2gn8l77df";
+    url    = "https://github.com/rest-nvim/rest.nvim/archive/v3.7.0.zip";
+    sha256 = "03sfij7k1myz0nb6hy16wan3s64dk1vhq24akpmgw7xb1dasn3ay";
   };
 
   disabled = luaOlder "5.1";
-  propagatedBuildInputs = [ lua-curl mimetypes nvim-nio xml2lua ];
+  propagatedBuildInputs = [ fidget-nvim mimetypes nvim-nio xml2lua ];
 
   meta = {
     homepage = "https://github.com/rest-nvim/rest.nvim";
@@ -2976,14 +2976,14 @@ buildLuarocksPackage {
 rocks-config-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, rocks-nvim }:
 buildLuarocksPackage {
   pname = "rocks-config.nvim";
-  version = "2.2.0-1";
+  version = "2.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks-config.nvim-2.2.0-1.rockspec";
-    sha256 = "129zvspn6ln9yzsxfcgai8vyz7jysxvdf08yy19zdqj0q7swh1iq";
+    url    = "mirror://luarocks/rocks-config.nvim-2.3.1-1.rockspec";
+    sha256 = "01pk8k2a81rxg5raysw3wbs0azk10ghh1f2nk2k4khnzw0b6xzpp";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks-config.nvim/archive/v2.2.0.zip";
-    sha256 = "0vchi7274j4yhs0mv1j2na8k1240xj42kz6787s0vf05xcnywbh6";
+    url    = "https://github.com/nvim-neorocks/rocks-config.nvim/archive/v2.3.1.zip";
+    sha256 = "0arvwb7c55mhcmngh3x2j56qbxfx9vp87nsxyzrsvd31ldgbsqdn";
   };
 
   disabled = luaOlder "5.1";
@@ -3000,14 +3000,14 @@ buildLuarocksPackage {
 rocks-dev-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio, rocks-nvim, rtp-nvim }:
 buildLuarocksPackage {
   pname = "rocks-dev.nvim";
-  version = "1.3.0-1";
+  version = "1.7.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks-dev.nvim-1.3.0-1.rockspec";
-    sha256 = "0s8k4kvd7j72ja6qwwxdsqjffkja8pdp95vml5wy9mqwxgvcb5c6";
+    url    = "mirror://luarocks/rocks-dev.nvim-1.7.0-1.rockspec";
+    sha256 = "0jc8nxxbr7m3vw4lcyxi8wm4w0nz1ml54sbs96z4kj0p6mm9fds6";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks-dev.nvim/archive/v1.3.0.zip";
-    sha256 = "1fhd4mjbwizszxq3wrcdsczljgssgswqi4ibi8kdmnd9biyvbx65";
+    url    = "https://github.com/nvim-neorocks/rocks-dev.nvim/archive/v1.7.0.zip";
+    sha256 = "13n9dkv5217qd8dhj54d1rfqp6mx5jir319fmsln47jv83x7micz";
   };
 
   disabled = luaOlder "5.1";
@@ -3024,14 +3024,14 @@ buildLuarocksPackage {
 rocks-git-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio, rocks-nvim }:
 buildLuarocksPackage {
   pname = "rocks-git.nvim";
-  version = "2.0.1-1";
+  version = "2.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks-git.nvim-2.0.1-1.rockspec";
-    sha256 = "0r341vg7x49lnmx77smab5hpjpzwih7jmchfh24xhnv6319d70yx";
+    url    = "mirror://luarocks/rocks-git.nvim-2.2.0-1.rockspec";
+    sha256 = "07pfqirhyphz283b5hs6ggwb2xlnigj3vj17hwhmb2fcv9ib3f61";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks-git.nvim/archive/v2.0.1.zip";
-    sha256 = "121x32915sr8il95jjpza2awvh4jknhgb99c091sb4vmdkg3pj24";
+    url    = "https://github.com/nvim-neorocks/rocks-git.nvim/archive/v2.2.0.zip";
+    sha256 = "10cp3bdy04m4x0yrcivkgnqbs65rcrkgf14awc87wn727drs68sz";
   };
 
   disabled = luaOlder "5.1";
@@ -3048,14 +3048,14 @@ buildLuarocksPackage {
 rocks-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, fidget-nvim, fzy, luaOlder, luarocks, nvim-nio, rtp-nvim, toml-edit }:
 buildLuarocksPackage {
   pname = "rocks.nvim";
-  version = "2.36.1-1";
+  version = "2.40.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rocks.nvim-2.36.1-1.rockspec";
-    sha256 = "165kij3rk0inh9g3d3jpczhji9bjc7biz5r30xgw9q5xnafy4q38";
+    url    = "mirror://luarocks/rocks.nvim-2.40.0-1.rockspec";
+    sha256 = "11cjx1cm4nynrs099r556a5yhkah9hxpylx5r6sqy0vwccvwplxp";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rocks.nvim/archive/v2.36.1.zip";
-    sha256 = "0zsrvngwwj9qxsxfbfgfin73aacs763sygixgiibq8rrl6gannxs";
+    url    = "https://github.com/nvim-neorocks/rocks.nvim/archive/v2.40.0.zip";
+    sha256 = "00x5mn83w19ssahwg1bsmn3m5j4pmlg1caqlfpgx3b2hczas1v7l";
   };
 
   disabled = luaOlder "5.1";
@@ -3063,7 +3063,7 @@ buildLuarocksPackage {
 
   meta = {
     homepage = "https://github.com/nvim-neorocks/rocks.nvim";
-    description = "Neovim plugin management inspired by Cargo, powered by luarocks";
+    description = "🌒 Neovim plugin management inspired by Cargo, powered by luarocks";
     maintainers = with lib.maintainers; [ mrcjkb ];
     license.fullName = "GPL-3.0";
   };
@@ -3072,14 +3072,14 @@ buildLuarocksPackage {
 rtp-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "rtp.nvim";
-  version = "1.1.0-1";
+  version = "1.2.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rtp.nvim-1.1.0-1.rockspec";
-    sha256 = "1wmg2rqw8jph4ymmc33j8r47p2ni7fdd3dmiiwp19symslcw71js";
+    url    = "mirror://luarocks/rtp.nvim-1.2.0-1.rockspec";
+    sha256 = "0is9ssi3pwvshm88lnp4hkig4f0ckgl2f3a1axwci89y8lla50iv";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorocks/rtp.nvim/archive/v1.1.0.zip";
-    sha256 = "0n3ydd1n0mbc0m81rdbs73gpdr3m6qj735sjqdf36qv52gjcisj8";
+    url    = "https://github.com/nvim-neorocks/rtp.nvim/archive/v1.2.0.zip";
+    sha256 = "1b6hx50nr2s2mnhsx9zy54pjdq7f78mi394v2b2c9v687s45nqln";
   };
 
   disabled = luaOlder "5.1";
@@ -3095,14 +3095,14 @@ buildLuarocksPackage {
 rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "rustaceanvim";
-  version = "5.2.0-1";
+  version = "5.4.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-5.2.0-1.rockspec";
-    sha256 = "15pz9m5livp0n2bhal8wmg8hbhvyb6195ayzjcm3xsivplc4drns";
+    url    = "mirror://luarocks/rustaceanvim-5.4.2-1.rockspec";
+    sha256 = "114ydzvchla7vam2ijihr66x88p5ww3r58zdb3fgc6dbbpcxjnrb";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/5.2.0.zip";
-    sha256 = "1mswi4fy0ggikl3cpwhx1lar5pb8zcfp9az8zb9cn00cmzf749s4";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/5.4.2.zip";
+    sha256 = "1nq9s0fnqjgbj1vcwf15512lp6i3w0axmca2hskmalyj65k157y1";
   };
 
   disabled = luaOlder "5.1";
@@ -3314,8 +3314,8 @@ buildLuarocksPackage {
   src = fetchFromGitHub {
     owner = "nvim-telescope";
     repo = "telescope.nvim";
-    rev = "3b1600d0fd5172ad9fae00987362ca0ef3d8895d";
-    hash = "sha256-F5TGzfPSDQY+AOzaDXStswHjkGQvnLeTWW5/xdBalpo=";
+    rev = "927c10f748e49c543b2d544c321a1245302ff324";
+    hash = "sha256-dF6O5elMbm5JOeMI7UAyrwhq8Ng52/yBwpNJRWNAizQ=";
   };
 
   disabled = lua.luaversion != "5.1";
@@ -3406,14 +3406,14 @@ buildLuarocksPackage {
 tree-sitter-norg = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luarocks-build-treesitter-parser-cpp }:
 buildLuarocksPackage {
   pname = "tree-sitter-norg";
-  version = "0.2.5-1";
+  version = "0.2.6-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/tree-sitter-norg-0.2.5-1.rockspec";
-    sha256 = "1w3hns9n92ygc7x3wxq3pd2kjs2nfp1arxq9zda75h2alwapjink";
+    url    = "mirror://luarocks/tree-sitter-norg-0.2.6-1.rockspec";
+    sha256 = "1s0wj59v4zjgimws742ybzy7nhnnkz8nas4y5k96c2z5z54ynxmq";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/nvim-neorg/tree-sitter-norg/archive/1aab69c95bd9d5e7c0e172ecbe5d29bcf5834612.zip";
-    sha256 = "12s4lvs2iw3v9hwfcql0phi8gxgpwfj3i6443f0mss5zn7f6w50g";
+    url    = "https://github.com/nvim-neorg/tree-sitter-norg/archive/v0.2.6.zip";
+    sha256 = "077rds0rq10wjywpj4hmmq9dd6qp6sfwbdjyh587laldrfl7jy6g";
   };
 
   nativeBuildInputs = [ luarocks-build-treesitter-parser-cpp ];
@@ -3452,16 +3452,16 @@ buildLuarocksPackage {
 vusted = callPackage({ buildLuarocksPackage, busted, fetchFromGitHub, fetchurl, luasystem }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.3.4-1";
+  version = "2.5.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.3.4-1.rockspec";
-    sha256 = "1yzdr0xgsjfr4a80a2zrj58ls0gmms407q4h1dx75sszppzvm1wc";
+    url    = "mirror://luarocks/vusted-2.5.0-1.rockspec";
+    sha256 = "05jv8kl0hy3pyrknafmynifrqyrcc5q9qkd4ly1vmxgmmbm30nqz";
   }).outPath;
   src = fetchFromGitHub {
     owner = "notomo";
     repo = "vusted";
-    rev = "v2.3.4";
-    hash = "sha256-Zh54mHNrbFH5qygzsXVv+Vc7oUP+RIQXBvK+UvaGvxY=";
+    rev = "v2.5.0";
+    hash = "sha256-1/fZ8OAw9NZoY1YDN6OhOJRqwRDWps5JJDIsvWg1Nr4=";
   };
 
   propagatedBuildInputs = [ busted luasystem ];

pkgs/development/lua-modules/overrides.nix

@@ -776,7 +776,7 @@ in
   });
 
   sqlite = prev.sqlite.overrideAttrs (drv: {
-    doCheck = true;
+    doCheck = stdenv.isLinux;
     nativeCheckInputs = [ final.plenary-nvim neovim-unwrapped ];
 
     # the plugin loads the library from either the LIBSQLITE env

pkgs/development/python-modules/braceexpand/default.nix

@@ -3,13 +3,14 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "braceexpand";
   version = "0.1.7";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -18,15 +19,20 @@ buildPythonPackage rec {
     sha256 = "01gpcnksnqv6np28i4x8s3wkngawzgs99zvjfia57spa42ykkrg6";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "braceexpand" ];
 
-  meta = with lib; {
+  meta = {
     description = "Bash-style brace expansion for Python";
     homepage = "https://github.com/trendels/braceexpand";
     changelog = "https://github.com/trendels/braceexpand/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ newam ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      newam
+      pbsds
+    ];
   };
 }

pkgs/development/python-modules/robotframework-seleniumlibrary/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "robotframework-seleniumlibrary";
-  version = "6.5.0";
+  version = "6.6.1";
   pyproject = true;
 
   # no tests included in PyPI tarball
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "robotframework";
     repo = "SeleniumLibrary";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-sB2lWFFpCGgF0XFes84fBBvR8GF+S8aWWJoih+xBmW8=";
+    sha256 = "sha256-ULY0FH1RFQIlhS45LU3vUKi6urZJHiDgi6NdqU5tV2g=";
   };
 
   build-system = [ setuptools ];
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     mkdir utest/output_dir
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     changelog = "https://github.com/robotframework/SeleniumLibrary/blob/${src.rev}/docs/SeleniumLibrary-${version}.rst";
     description = "Web testing library for Robot Framework";

pkgs/development/python-modules/sentence-transformers/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "UKPLab";
     repo = "sentence-transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Kp0B3+1zK45KypCaxH02U/JdzTBGwFAoxtmzek94QNI=";
+    hash = "sha256-YtAgv0vH2aL7UX3ETVfwDEQYEWYo5Pj/R45CeH7T3BU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/web/flyctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.3.1";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-5P6B52ekrAupoQh2K3LhC4ydwuKOTPfpjOVlGiDxQb0=";
+    hash = "sha256-Wj9omHywqXYEaap4w4C6wtwRs0QyKx4kp+QAkmK07fE=";
   };
 
-  vendorHash = "sha256-QfequNmKLbZqMKcwhRXKaTflQYWKu8ucjaGcBM7Jn6g=";
+  vendorHash = "sha256-Z9qbrFctUv6F8374qyJ7Fw4HU/7BIhEfHfrwoFUXM4Q=";
 
   subPackages = [ "." ];
 

pkgs/servers/monitoring/grafana-agent/default.nix

@@ -15,21 +15,21 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-qSxm00zC1Ms9C5R077Zn5FKluEqFs8KYUPnDUaMvMs8=";
+    hash = "sha256-0pwsZONhouGuypGTP64oJd3+nq8VMlyulb/WUJj0qGw=";
   };
 
-  vendorHash = "sha256-rC8iqCZ6tzXVCOHNqH+jAMDh2yTAR88zj45HcgJ2lSg=";
+  vendorHash = "sha256-vz65gr56wj6PNiQwmfz1wg9SVmRUnrv7ZeWQkqdA4WI=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = src + "/internal/web/ui/yarn.lock";
-    hash = "sha256-FvrfWcuKld242YfZ8CixF5GGFRp8iFWZ3Vkef3Kf4ag=";
+    hash = "sha256-bnJL7W7VfJIrJKvRt9Q6kdEyjLH/IJoCi0TENxz7SUE=";
   };
 
   ldflags = let

pkgs/servers/monitoring/prometheus/prom2json.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "prom2json";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus";
     repo = "prom2json";
-    sha256 = "sha256-oOnrIGtNQqS/7XCKcFtzXskv7N6syNyS52pZMwrY5wU=";
+    sha256 = "sha256-cKz+ZFQYjsL7dFfXXCrl4T8OuvQkdqVAotG9HRNtN7o=";
   };
 
-  vendorHash = "sha256-d+/38wUMFChuLlVb84DELRQylCDIqopzk2bw/yd5B/E=";
+  vendorHash = "sha256-pCy4oECZnvoODezUD1+lOT46yWUr78zvnHgEB2BJN3c=";
 
   meta = with lib; {
     description = "Tool to scrape a Prometheus client and dump the result as JSON";

pkgs/stdenv/generic/make-derivation.nix

@@ -57,7 +57,7 @@ let
     :::{.note}
     This is used as the fundamental building block of most other functions in Nixpkgs for creating derivations.
 
-    Most Arguments are transparently forwarded to [`builtins.derivation`](https://nixos.org/manual/nix/stable/language/derivations).
+    Most arguments are also passed through to the underlying call of [`builtins.derivation`](https://nixos.org/manual/nix/stable/language/derivations).
     :::
   */
   mkDerivation =

pkgs/tools/package-management/nix-serve/default.nix

@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , bzip2
-, nix
+, nixVersions
 , perl
 , makeWrapper
 , nixosTests
@@ -12,6 +12,7 @@
 let
   rev = "77ffa33d83d2c7c6551c5e420e938e92d72fec24";
   sha256 = "sha256-MJRdVO2pt7wjOu5Hk0eVeNbk5bK5+Uo/Gh9XfO4OlMY=";
+  nix = nixVersions.nix_2_24;
 in
 
 stdenv.mkDerivation {

pkgs/tools/typesetting/bibtex-tidy/default.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "bibtex-tidy";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "FlamingTempura";
     repo = "bibtex-tidy";
-    rev = "9658d907d990fd80d25ab37d9aee120451bf5d19";
-    hash = "sha256-4TrEabxIVB0Vu/E1ClKwk7lXcnPgoVh3RjLYsPwH2yQ=";
+    rev = "v${version}";
+    hash = "sha256-sMgy29deEfc3DFSC0Z4JZCeNAFpBKNYj+mJnFI1pSY4=";
   };
 
-  npmDepsHash = "sha256-VzzHGmW7Rb6dEdBxd84GXKSPasqfTkn+5rNw9C2lt8k=";
+  npmDepsHash = "sha256-FKde5/ZZcS5g0fUaDjhRlKGLiS8kk1PvkZw9PUmvAAE=";
 
   env = {
     PUPPETEER_SKIP_DOWNLOAD = true;