Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -379,7 +379,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.maddy` got several updates:
   - Configuration of users and their credentials using `services.maddy.ensureCredentials`.
-  - Configuration of TLS key and certificate files using `services.maddy.tls`.
+  - TLS configuration is now possible via `services.maddy.tls` with two loaders present: ACME and file based.
 
 - The `dnsmasq` service now takes configuration via the
   `services.dnsmasq.settings` attribute set. The option

nixos/modules/security/wrappers/default.nix

@@ -283,7 +283,7 @@ in
         '';
 
     ###### wrappers consistency checks
-    system.extraDependencies = lib.singleton (pkgs.runCommandLocal
+    system.checks = lib.singleton (pkgs.runCommandLocal
       "ensure-all-wrappers-paths-exist" { }
       ''
         # make sure we produce output

nixos/modules/services/databases/postgresql.nix

@@ -489,7 +489,7 @@ in
      "/share/postgresql"
     ];
 
-    system.extraDependencies = lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) configFileCheck;
+    system.checks = lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) configFileCheck;
 
     systemd.services.postgresql =
       { description = "PostgreSQL Server";

nixos/modules/services/mail/maddy.nix

@@ -206,7 +206,7 @@ in {
           Server configuration, see
           [https://maddy.email](https://maddy.email) for
           more information. The default configuration of this module will setup
-          minimal maddy instance for mail transfer without TLS encryption.
+          minimal Maddy instance for mail transfer without TLS encryption.
 
           ::: {.note}
           This should not be used in a production environment.
@@ -216,13 +216,24 @@ in {
 
       tls = {
         loader = mkOption {
-          type = with types; nullOr (enum [ "file" "off" ]);
+          type = with types; nullOr (enum [ "off" "file" "acme" ]);
           default = "off";
           description = lib.mdDoc ''
             TLS certificates are obtained by modules called "certificate
-            loaders". Currently only the file loader is supported which reads
+            loaders".
-            certificates from files specifying the options `keyPaths` and
+
-            `certPaths`.
+            The `file` loader module reads certificates from files specified by
+            the `certificates` option.
+
+            Alternatively the `acme` module can be used to automatically obtain
+            certificates using the ACME protocol.
+
+            Module configuration is done via the `tls.extraConfig` option.
+
+            Secrets such as API keys or passwords should not be supplied in
+            plaintext. Instead the `secrets` option can be used to read secrets
+            at runtime as environment variables. Secrets can be referenced with
+            `{env:VAR}`.
           '';
         };
 
@@ -261,11 +272,13 @@ in {
         extraConfig = mkOption {
           type = with types; nullOr lines;
           description = lib.mdDoc ''
-            Arguments for the specific certificate loader. Note that Maddy uses
+            Arguments for the specified certificate loader.
-            secure defaults for the TLS configuration so there is no need to
+
-            change anything in most cases.
+            In case the `tls` loader is set, the defaults are considered secure
-            See [upstream manual](https://maddy.email/reference/tls/) for
+            and there is no need to change anything in most cases.
-            available options.
+            For available options see [upstream manual](https://maddy.email/reference/tls/).
+
+            For ACME configuration, see [following page](https://maddy.email/reference/tls-acme).
           '';
           default = "";
         };
@@ -321,20 +334,41 @@ in {
         });
       };
 
+      secrets = lib.mkOption {
+        type = lib.types.path;
+        description = lib.mdDoc ''
+          A file containing the various secrets. Should be in the format
+          expected by systemd's `EnvironmentFile` directory. Secrets can be
+          referenced in the format `{env:VAR}`.
+        '';
+      };
+
     };
   };
 
   config = mkIf cfg.enable {
 
-    assertions = [{
+    assertions = [
-      assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != [];
+      {
-      message = ''
+        assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != [];
-        If maddy is configured to use TLS, tls.certificates with attribute sets
+        message = ''
-        of certPath and keyPath must be provided.
+          If Maddy is configured to use TLS, tls.certificates with attribute sets
-        Read more about obtaining TLS certificates here:
+          of certPath and keyPath must be provided.
-        https://maddy.email/tutorials/setting-up/#tls-certificates
+          Read more about obtaining TLS certificates here:
-      '';
+          https://maddy.email/tutorials/setting-up/#tls-certificates
-    }];
+        '';
+      }
+      {
+        assertion = cfg.tls.loader == "acme" -> cfg.tls.extraConfig != "";
+        message = ''
+          If Maddy is configured to obtain TLS certificates using the ACME
+          loader, extra configuration options must be supplied via
+          tls.extraConfig option.
+          See upstream documentation for more details:
+          https://maddy.email/reference/tls-acme
+        '';
+      }
+    ];
 
     systemd = {
 
@@ -345,6 +379,7 @@ in {
             User = cfg.user;
             Group = cfg.group;
             StateDirectory = [ "maddy" ];
+            EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
           };
           restartTriggers = [ config.environment.etc."maddy/maddy.conf".source ];
           wantedBy = [ "multi-user.target" ];
@@ -391,6 +426,12 @@ in {
           ) cfg.tls.certificates)} ${optionalString (cfg.tls.extraConfig != "") ''
             { ${cfg.tls.extraConfig} }
           ''}
+        '' else if (cfg.tls.loader == "acme") then ''
+          tls {
+            loader acme {
+              ${cfg.tls.extraConfig}
+            }
+          }
         '' else if (cfg.tls.loader == "off") then ''
           tls off
         '' else ""}

nixos/modules/services/matrix/mjolnir.nix

@@ -30,7 +30,7 @@ let
 
   # these config files will be merged one after the other to build the final config
   configFiles = [
-    "${pkgs.mjolnir}/share/mjolnir/config/default.yaml"
+    "${pkgs.mjolnir}/libexec/mjolnir/deps/mjolnir/config/default.yaml"
     moduleConfigFile
   ];
 
@@ -200,7 +200,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = ''${pkgs.mjolnir}/bin/mjolnir'';
+        ExecStart = ''${pkgs.mjolnir}/bin/mjolnir --mjolnir-config ./config/default.yaml'';
         ExecStartPre = [ generateConfig ];
         WorkingDirectory = cfg.dataPath;
         StateDirectory = "mjolnir";

nixos/modules/services/web-servers/varnish/default.nix

@@ -99,7 +99,7 @@ in
     environment.systemPackages = [ cfg.package ];
 
     # check .vcl syntax at compile time (e.g. before nixops deployment)
-    system.extraDependencies = mkIf cfg.enableConfigCheck [
+    system.checks = mkIf cfg.enableConfigCheck [
       (pkgs.runCommand "check-varnish-syntax" {} ''
         ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
       '')

nixos/modules/services/x11/xserver.nix

@@ -776,7 +776,7 @@ in
         xorg.xf86inputevdev.out
       ];
 
-    system.extraDependencies = singleton (pkgs.runCommand "xkb-validated" {
+    system.checks = singleton (pkgs.runCommand "xkb-validated" {
       inherit (cfg) xkbModel layout xkbVariant xkbOptions;
       nativeBuildInputs = with pkgs.buildPackages; [ xkbvalidate ];
       preferLocalBuild = true;

nixos/modules/system/activation/top-level.nix

@@ -263,8 +263,23 @@ in
       default = [];
       description = lib.mdDoc ''
         A list of packages that should be included in the system
-        closure but not otherwise made available to users. This is
+        closure but generally not visible to users.
-        primarily used by the installation tests.
+
+        This option has also been used for build-time checks, but the
+        `system.checks` option is more appropriate for that purpose as checks
+        should not leave a trace in the built system configuration.
+      '';
+    };
+
+    system.checks = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = lib.mdDoc ''
+        Packages that are added as dependencies of the system's build, usually
+        for the purpose of validating some part of the configuration.
+
+        Unlike `system.extraDependencies`, these store paths do not
+        become part of the built system configuration.
       '';
     };
 
@@ -363,7 +378,17 @@ in
           fi
         '';
 
-    system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
+    system.systemBuilderArgs = {
+      # Not actually used in the builder. `passedChecks` is just here to create
+      # the build dependencies. Checks are similar to build dependencies in the
+      # sense that if they fail, the system build fails. However, checks do not
+      # produce any output of value, so they are not used by the system builder.
+      # In fact, using them runs the risk of accidentally adding unneeded paths
+      # to the system closure, which defeats the purpose of the `system.checks`
+      # option, as opposed to `system.extraDependencies`.
+      passedChecks = concatStringsSep " " config.system.checks;
+    }
+    // lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
       inherit (config.system) forbiddenDependenciesRegex;
       closureInfo = pkgs.closureInfo { rootPaths = [
         # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
@@ -371,6 +396,7 @@ in
       ]; };
     };
 
+
     system.build.toplevel = if config.system.includeBuildDependencies then systemWithBuildDeps else system;
 
   };

nixos/tests/matrix/mjolnir.nix

@@ -32,7 +32,6 @@ import ../make-test-python.nix (
     name = "mjolnir";
     meta = with pkgs.lib; {
       maintainers = teams.matrix.members;
-      broken = true; # times out after spending many hours
     };
 
     nodes = {
@@ -99,6 +98,8 @@ import ../make-test-python.nix (
             enable = true;
             username = "mjolnir";
             passwordFile = pkgs.writeText "password.txt" "mjolnir-password";
+            # otherwise mjolnir tries to connect to ::1, which is not listened by pantalaimon
+            options.listenAddress = "127.0.0.1";
           };
           managementRoom = "#moderators:homeserver";
         };

pkgs/applications/audio/muso/default.nix

@@ -4,13 +4,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "muso";
-  version = "2.0.0";
+  version = "unstable-2021-09-02";
 
   src = fetchFromGitHub {
     owner = "quebin31";
     repo = pname;
-    rev = "68cc90869bcc0f202830a318fbfd6bb9bdb75a39";
+    rev = "6dd1c6d3a82b21d4fb2606accf2f26179eb6eaf9";
-    sha256 = "1dnfslliss173igympl7h1zc0qz0g10kf96dwrcj6aglmvvw426p";
+    hash = "sha256-09DWUER0ZWQuwfE3sjov2GjJNI7coE3D3E5iUy9mlSE=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
@@ -26,10 +26,10 @@ rustPlatform.buildRustPackage rec {
     cp share/* $out/share/muso/
   '';
 
-  cargoSha256 = "1hgdzyz005244f2mh97js9ga0a6s2hcd6iydz07f1hmhsh1j2bwy";
+  cargoHash = "sha256-+UVUejKCfjC6zdW315wmu7f3A5GmnoQ3rIk8SK6LIRI=";
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = stdenv.isDarwin;
     description = "An automatic music sorter (based on ID3 tags)";
     homepage = "https://github.com/quebin31/muso";
     license = with licenses; [ gpl3Plus ];

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -104,12 +104,12 @@
   };
   bicep = buildGrammar {
     language = "bicep";
-    version = "0.0.0+rev=b94a098";
+    version = "0.0.0+rev=3604d8c";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-bicep";
-      rev = "b94a0983b69ebb75e9129329a188199ad6ebcec0";
+      rev = "3604d8c961ab129d2bfc6dfca56419c236ccdb83";
-      hash = "sha256-YCVOgLmtCWd4FwfwmQUZhSzP2wS2ZDLwXP1BRrpE0Ls=";
+      hash = "sha256-s0BtyYtC/D8+nudkHxpd4rSPQWrA0FngH9HIX85H/Uw=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-bicep";
   };
@@ -137,12 +137,12 @@
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=2340fd6";
+    version = "0.0.0+rev=7611471";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "2340fd6b57b06ccbf24c2c6dafb15905fdccfb1f";
+      rev = "76114711aedd3f4b6e1333a7513975647930c629";
-      hash = "sha256-9acxVw5EWr/NwO5ERwy3V976NMY65vDQp60jIoDfO7k=";
+      hash = "sha256-sBpI/8SfIzPQ0aJ8tw00IZoWGFnBo6mvRcn1lKfnaTg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -225,23 +225,23 @@
   };
   cpon = buildGrammar {
     language = "cpon";
-    version = "0.0.0+rev=eedb93b";
+    version = "0.0.0+rev=f4b3cbc";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-cpon";
-      rev = "eedb93bf9e22e82ed6a67e6c57fd78731b44f591";
+      rev = "f4b3cbc8b0bd4e13035d39940fef09f1392e8739";
-      hash = "sha256-8x+oUbiwt7prGc5cli5HabHoH3q/mBnQzO1Wy2Bauac=";
+      hash = "sha256-Enxc0sdQS9vSZVvIQkkHxk/1bzT2denRk0+AZdDNnJ8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-cpon";
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=670404d";
+    version = "0.0.0+rev=70aed2e";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "670404d7c689be1c868a46f919ba2a3912f2b7ef";
+      rev = "70aed2e9e83eb7320ab7c454d3084300bf587037";
-      hash = "sha256-T+Ha2hlI7ucEsTYvDmk7xjHNEoyvnotp/1EWfyCwnWM=";
+      hash = "sha256-3gTLqz1H/7A8+2NiZmR/jBPt4Rh/Wvlcxt/aD7w8T8A=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -258,12 +258,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=a358542";
+    version = "0.0.0+rev=a27cb7b";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "a35854270463a96e79096bb854aae30a4f0e6cd2";
+      rev = "a27cb7b9d105c43205fa899f49bc0cc4cf399484";
-      hash = "sha256-8CRFEUxTge0EJQQQVabCjstUGkOIPlC1duj2jD4R89E=";
+      hash = "sha256-OXm/urF5AIxod1J5i951C6kcf6pZRj+Q+ObwD0yj55Q=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -513,12 +513,12 @@
   };
   func = buildGrammar {
     language = "func";
-    version = "0.0.0+rev=f161cfe";
+    version = "0.0.0+rev=0834e35";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-func";
-      rev = "f161cfe22452b386eeeab29ba0d2c14893f1a31f";
+      rev = "0834e35ecf8b23fbf9ad15b088af6a897e19d4a8";
-      hash = "sha256-Swyg5EdBWVT6P9vgS7h/fmK0ySRwiFlynJEZT9I10qg=";
+      hash = "sha256-2+YOp7MnwZR2qg95h/ywjJwDSLUnodtkwwpv9zuy8p8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-func";
   };
@@ -667,12 +667,12 @@
   };
   gosum = buildGrammar {
     language = "gosum";
-    version = "0.0.0+rev=14da5c2";
+    version = "0.0.0+rev=e2ac513";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-go-sum";
-      rev = "14da5c2a34861eb2d97ed89f39324156031e8878";
+      rev = "e2ac513b2240c7ff1069ae33b2df29ce90777c11";
-      hash = "sha256-PP8uj8tFMIBZtFuOQbEi25Yz/UEy5cRiEklbrlS5J+Q=";
+      hash = "sha256-2foA2sd5PQpmeX8OhXrW/dxoJaEyxDXzPWh+UD0dgzQ=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-go-sum";
   };
@@ -711,12 +711,12 @@
   };
   hare = buildGrammar {
     language = "hare";
-    version = "0.0.0+rev=f0a9e62";
+    version = "0.0.0+rev=3d4af17";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-hare";
-      rev = "f0a9e6207a8c84bbd11143c8eb0c6cf70dc6d8b4";
+      rev = "3d4af179414525a35dd069ba0208c9b71093d8b3";
-      hash = "sha256-zJxkbAzAbA3aRuSHWEF26msbVszK7OxgXP6YPZBUu8w=";
+      hash = "sha256-RRi2uAE9rf0bjQrk8Asf6z+6ZDZYhEoKaX0m8hZnI9o=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-hare";
   };
@@ -766,12 +766,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=40472c1";
+    version = "0.0.0+rev=9160427";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "40472c119b5740d9a1fa0b0dc0b013502b636708";
+      rev = "916042734060d3d3a023f6637c815a1d23814af8";
-      hash = "sha256-PfShqPSIsYVMPpW9hQhbEz378vBwDiNkBKR3rLXcIdM=";
+      hash = "sha256-FGOXqBmQXCK2G1iseYgc7CdMOQ7P9dVG7ZHEsqcnRhk=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -942,12 +942,12 @@
   };
   kdl = buildGrammar {
     language = "kdl";
-    version = "0.0.0+rev=d118f93";
+    version = "0.0.0+rev=e180e05";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-kdl";
-      rev = "d118f9376ef4f0461975289302fe74a28f073876";
+      rev = "e180e05132c4cb229a8ba679b298790ef1eca77c";
-      hash = "sha256-FxY7wqksjSJiOffb7FBcsDQ0oMr94CeGreBV8MMtFr4=";
+      hash = "sha256-XJ2thChaJQjn0N/tqotjc/eR3W4+6GrNv/FxjvScswc=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-kdl";
   };
@@ -975,12 +975,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=cd3cc49";
+    version = "0.0.0+rev=b0686a8";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "cd3cc493a92b6bac7be4b3bd6d006d35d3c36d4c";
+      rev = "b0686a83c2429cc04e6d01f067f5a0a8efc0d17b";
-      hash = "sha256-CHN54T4+eD7EGx4nzAIryAHOu8NCiBDjM2A7Njjt87w=";
+      hash = "sha256-/80/7HRLMt0p+SqO4d2wcRjHxZZCLH0ooJs4tNrw+oY=";
     };
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
   };
@@ -1008,34 +1008,34 @@
   };
   lua = buildGrammar {
     language = "lua";
-    version = "0.0.0+rev=4e94980";
+    version = "0.0.0+rev=dcc44f7";
     src = fetchFromGitHub {
       owner = "MunifTanjim";
       repo = "tree-sitter-lua";
-      rev = "4e94980e52f81f713d09be104ba32bf050000031";
+      rev = "dcc44f7473ecec4d7b99af0a9529705d98a769f1";
-      hash = "sha256-Arv627RIv0d/plfBPq5QVks737PUy3sq2kuLwLr++uM=";
+      hash = "sha256-vcss4Ux4DYJHyW8WCFBejPcq711QhemBHsVg482zNY8=";
     };
     meta.homepage = "https://github.com/MunifTanjim/tree-sitter-lua";
   };
   luadoc = buildGrammar {
     language = "luadoc";
-    version = "0.0.0+rev=1e11522";
+    version = "0.0.0+rev=978cc13";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luadoc";
-      rev = "1e1152264cc68e11d65d9e2493566f5717a13d11";
+      rev = "978cc13791c1d6e4626ee7e8db108d0be14f07e7";
-      hash = "sha256-CNSo4m5peO1WBncZ1RGmmbA3V8qefh5LJJpFYFTAlsY=";
+      hash = "sha256-59rUWQCQ7NzCe6VQJP4mWktDPbFMfUqRnPlqmbon8hU=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luadoc";
   };
   luap = buildGrammar {
     language = "luap";
-    version = "0.0.0+rev=393915d";
+    version = "0.0.0+rev=43916b0";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luap";
-      rev = "393915db4b16a792da9c60f52d11d93247d870b9";
+      rev = "43916b0f31c48a05e03783eb0bab4eec54a4ac75";
-      hash = "sha256-FLRPzU1JI8PoI8vZAKXG6DtHcnSksXCwTHAS0fb4WsY=";
+      hash = "sha256-wu2f9iCByf85/iE6j5slNruYH8GUVD19u/ygJ/yx76U=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luap";
   };
@@ -1232,6 +1232,17 @@
     generate = true;
     meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
   };
+  odin = buildGrammar {
+    language = "odin";
+    version = "0.0.0+rev=d165dbe";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-odin";
+      rev = "d165dbee27617dab2653e38737d96ede1030d14f";
+      hash = "sha256-NxF3aSDtXGMcE7v0BrYQbnUM/hophanKgsYX1ad8AFY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
+  };
   org = buildGrammar {
     language = "org";
     version = "0.0.0+rev=081179c";
@@ -1388,12 +1399,12 @@
   };
   puppet = buildGrammar {
     language = "puppet";
-    version = "0.0.0+rev=5e1bb97";
+    version = "0.0.0+rev=843868b";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-puppet";
-      rev = "5e1bb979ea71efc0860d4bc56eb3b3f7a670d6ec";
+      rev = "843868bfb909b734bfb63778a5685fae4bf2a33f";
-      hash = "sha256-7xqZ5nVAyflQ84Zah6M6yxpJ8qQooWl6tOodioXvsI8=";
+      hash = "sha256-6fJNADrLVsIoho9G8qCsMKNDB5a32gUntug7Nh8pKEg=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
   };
@@ -1608,12 +1619,12 @@
   };
   smali = buildGrammar {
     language = "smali";
-    version = "0.0.0+rev=9bf8aa6";
+    version = "0.0.0+rev=72e334b";
     src = fetchFromSourcehut {
       owner = "~yotam";
       repo = "tree-sitter-smali";
-      rev = "9bf8aa671a233ae2d2c6e9512c7144ce121b1fb6";
+      rev = "72e334b2630f5852825ba5ff9dfd872447175eb5";
-      hash = "sha256-V5JnB1JT8vV5zA+OjM0a7fBGC8CEqyPcUbeD8NoRTSE=";
+      hash = "sha256-vV+4Q2IyWyw/GN8bmgHJmSEHhpjUWHkL2yschPI9fiU=";
     };
     meta.homepage = "https://git.sr.ht/~yotam/tree-sitter-smali";
   };
@@ -1741,13 +1752,13 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=ff822fd";
+    version = "0.0.0+rev=4fca25f";
     src = fetchFromGitea {
       domain = "codeberg.org";
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "ff822fd77bb919854ba60d05f4d373d9d578d0e0";
+      rev = "4fca25fa99b6fd9ccf9cab9b6bf702a9df142ad5";
-      hash = "sha256-jHVfyp8yLaxI+Aa4iH1fXpNIzIoGLdQwo7SvRGFKbFQ=";
+      hash = "sha256-x657aMnqCw/TlS1VyC8er5GQ1QqGdGHGgfSIStUbVfQ=";
     };
     meta.homepage = "https://codeberg.org/xasc/tree-sitter-t32";
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -774,15 +774,14 @@ self: super: {
   openscad-nvim = super.openscad-nvim.overrideAttrs (old: {
     buildInputs = [ zathura htop openscad ];
 
-    patches = [ ./patches/openscad.nvim/program_paths.patch ];
+    patches = [
-
+      (substituteAll {
-    postPatch = ''
+        src = ./patches/openscad.nvim/program_paths.patch;
-      substituteInPlace lua/openscad.lua --replace '@zathura-path@' ${zathura}/bin/zathura
+        htop = lib.getExe htop;
-      substituteInPlace autoload/health/openscad_nvim.vim --replace '@zathura-path@' ${zathura}/bin/zathura
+        openscad = lib.getExe openscad;
-      substituteInPlace lua/openscad/terminal.lua --replace '@htop-path@' ${htop}/bin/htop
+        zathura = lib.getExe zathura;
-      substituteInPlace autoload/health/openscad_nvim.vim --replace '@htop-path@' ${htop}/bin/htop
+      })
-      substituteInPlace lua/openscad.lua --replace '@openscad-path@' ${openscad}/bin/openscad
+    ];
-    '';
   });
 
   orgmode = super.orgmode.overrideAttrs (old: {

pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch

@@ -7,7 +7,7 @@ index 9022d55..30ef53f 100644
  
  function! s:check_zathura_installed() abort
 -	if !executable('zathura')
-+	if !executable('@zathura-path@')
++	if !executable('@zathura@')
  		call health#report_error('has(zathura)','install zathura')
  	else
  		call health#report_ok("zathura is installed")
@@ -16,7 +16,7 @@ index 9022d55..30ef53f 100644
  
  function! s:check_htop_installed() abort
 -	if !executable('htop')
-+	if !executable('@htop-path@')
++	if !executable('@htop@')
  		call health#report_error('has(htop)','install htop')
  	else
  		call health#report_ok("htop is installed")
@@ -29,16 +29,16 @@ index 7dff2fb..4382003 100644
  function M.manual()
      local path = U.openscad_nvim_root_dir .. U.path_sep .. "help_source" .. U.path_sep .. "openscad-manual.pdf"
 -    api.nvim_command('silent !zathura --fork '  .. path)
-+    api.nvim_command('silent !@zathura-path@ --fork '  .. path)
++    api.nvim_command('silent !@zathura@ --fork '  .. path)
  end
  
  function M.help()
-@@ -119,7 +119,7 @@ end
+@@ -125,7 +125,7 @@ function M.exec_openscad()
+ 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. vim.fn.expand('%:p')
+ 	else
+ 		-- TODO: What about Windows?
+-		jobCommand = 'openscad ' .. vim.fn.expand('%:p')
++		jobCommand = '@oepnscad@ ' .. vim.fn.expand('%:p')
+ 	end
  
- function M.exec_openscad()
+ 	vim.fn.jobstart(jobCommand)
-     -- maybe just use api.jobstart .. instead
--    api.nvim_command[[ call jobstart('openscad ' . shellescape(expand('%:p')), {'detach':1}) ]]
-+    api.nvim_command[[ call jobstart('@openscad-path@ ' . shellescape(expand('%:p')), {'detach':1}) ]]
- end
- 
- function M.default_mappings()

pkgs/applications/networking/owncloud-client/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "owncloud-client";
-  version = "3.2.1";
+  version = "4.0.0";
 
   libregraph = callPackage ./libre-graph-api-cpp-qt-client.nix { };
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "owncloud";
     repo = "client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-39tpvzlTy3KRxg8DzCQW2VnsaLqJ+dNQRur2TqRZytE=";
+    hash = "sha256-KZ/e8ISQ4FNgT/mtKSlOCa3WQ0lRSaqNIhQn6al6NSM=";
   };
 
   nativeBuildInputs = [ pkg-config cmake extra-cmake-modules wrapQtAppsHook qttools ];
@@ -33,9 +33,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-UCMAKE_INSTALL_LIBDIR"
     "-DNO_SHIBBOLETH=1"
-    # https://github.com/owncloud/client/issues/10537#issuecomment-1447965096
-    # NB! From 4.0 it may be turned off by default
-    "-DWITH_AUTO_UPDATER=OFF"
   ];
 
   meta = with lib; {

pkgs/applications/networking/owncloud-client/libre-graph-api-cpp-qt-client.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libre-graph-api-cpp-qt-client";
-  version = "0.13.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "owncloud";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gbrA8P+ukQAiF2czC2szw3fJv1qoPJyMQ72t7PqB5/s=";
+    hash = "sha256-wbdamPi2XSLWeprrYZtBUDH1A2gdp6/5geFZv+ZqSWk=";
   };
 
   sourceRoot = "source/client";

pkgs/applications/science/electronics/fritzing/default.nix

@@ -81,5 +81,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl3 cc-by-sa-30 ];
     maintainers = with maintainers; [ robberer muscaln ];
     platforms = platforms.linux;
+    mainProgram = "Fritzing";
   };
 }

pkgs/applications/science/math/caffe/default.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = lib.optionals pythonSupport (
     # requirements.txt
     let pp = python.pkgs; in ([
-      pp.numpy pp.scipy pp.scikitimage pp.h5py
+      pp.numpy pp.scipy pp.scikit-image pp.h5py
       pp.matplotlib pp.ipython pp.networkx pp.nose
       pp.pandas pp.python-dateutil pp.protobuf pp.gflags
       pp.pyyaml pp.pillow pp.six

pkgs/applications/version-management/git-machete/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.17.3";
+  version = "3.17.4";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XBgYLrbxHE5czcEzYhX4ORQFtyKHcDw3VmZVx2TtycI=";
+    hash = "sha256-g3SEUVcyr6+nt0zMHB1F4drCwmQvPYQErOwSl9I+1Tg=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/version-management/monotone-viz/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocamlPackages, gnome2, pkg-config, makeWrapper, glib
+{ lib, stdenv, fetchurl, fetchpatch, ocamlPackages, gnome2, pkg-config, makeWrapper, glib
 , libtool, libpng, bison, expat, fontconfig, gd, pango, libjpeg, libwebp, libX11, libXaw
 }:
 # We need an old version of Graphviz for format compatibility reasons.
@@ -23,17 +23,17 @@ stdenv.mkDerivation rec {
   prePatch="ln -s . a; ln -s . b";
   patchFlags = ["-p0"];
   patches = [
-    (fetchurl {
+    (fetchpatch {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-dot.patch";
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-dot.patch";
-      sha256 = "0risfy8iqmkr209hmnvpv57ywbd3rvchzzd0jy2lfyqrrrm6zknw";
+      hash = "sha256-e348703+IzM4m/3cpe6Z9VebZgTK8+3lRLdaTfXHwSI=";
     })
-    (fetchurl {
+    (fetchpatch {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-new-stdio.patch";
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-new-stdio.patch";
-      sha256 = "16bj0ppzqd45an154dr7sifjra7lv4m9anxfw3c56y763jq7fafa";
+      hash = "sha256-9xQzJ+oYz06fDFOe1YOOisEZnwiwShqr2Rt7IXiu6Zo=";
     })
-    (fetchurl {
+    (fetchpatch {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-typefix.patch";
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-typefix.patch";
-      sha256 = "1gfp82rc7pawb5x4hh2wf7xh1l1l54ib75930xgd1y437la4703r";
+      hash = "sha256-52VGXDJKx4ZGvZRO8QCXdTGsWR0m1pqQnEOby7PMQdg=";
     })
   ];
 

pkgs/development/libraries/SDL/default.nix

@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     # Ticket: https://bugs.freedesktop.org/show_bug.cgi?id=27222
     (fetchpatch {
       name = "SDL_SetGamma.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/SDL.git/plain/SDL-1.2.15-x11-Bypass-SetGammaRamp-when-changing-gamma.patch?id=04a3a7b1bd88c2d5502292fad27e0e02d084698d";
+      url = "https://src.fedoraproject.org/rpms/SDL/raw/7a07323e5cec08bea6f390526f86a1ce5341596d/f/SDL-1.2.15-x11-Bypass-SetGammaRamp-when-changing-gamma.patch";
       sha256 = "0x52s4328kilyq43i7psqkqg7chsfwh0aawr50j566nzd7j51dlv";
     })
     # Fix a build failure on OS X Mavericks

pkgs/development/libraries/dbus-cplusplus/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dbus, glib, pkg-config, expat }:
+{ lib, stdenv, fetchurl, fetchpatch, dbus, glib, pkg-config, expat }:
 
 stdenv.mkDerivation rec {
   pname = "dbus-cplusplus";
@@ -17,23 +17,20 @@ stdenv.mkDerivation rec {
           + "dbus-c++/files/dbus-c++-0.9.0-gcc-4.7.patch";
       sha256 = "0rwcz9pvc13b3yfr0lkifnfz0vb5q6dg240bzgf37ni4s8rpc72g";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "writechar.patch"; # since gcc7
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-writechar.patch";
-          + "dbus-c++-writechar.patch?id=7f371172f5c";
       sha256 = "1kkg4gbpm4hp87l25zw2a3r9c58g7vvgzcqgiman734i66zsbb9l";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "threading.patch"; # since gcc7
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-threading.patch";
-          + "dbus-c++-threading.patch?id=7f371172f5c";
       sha256 = "1h362anx3wyxm5lq0v8girmip1jmkdbijrmbrq7k5pp47zkhwwrq";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "template-operators.patch"; # since gcc12
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-template-operators.patch";
-          + "dbus-c++-template-operators.patch?id=d3f0d8bb519c0af";
+      hash = "sha256-B8S7z/YH2YEQgaRsBJBBVTx8vHQhHW7z171TZmogpL8=";
-      sha256 = "N25Y7jXDbr0qb7MfRr2yz3zRySppgGOe+oCfNQhRvVc=";
     })
   ];
 

pkgs/development/libraries/openslp/default.nix

@@ -12,12 +12,12 @@ stdenv.mkDerivation rec {
   patches = [
     (fetchpatch {
       name = "openslp-2.0.0-null-pointer-deref.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/openslp.git/plain/openslp-2.0.0-null-pointer-deref.patch";
+      url = "https://src.fedoraproject.org/rpms/openslp/raw/696fd55ae4fcea7beda0a25131dca8bfb14bbdf9/f/openslp-2.0.0-null-pointer-deref.patch";
       sha256 = "186f3rj3z2lf5h1lpbhqk0szj2a9far1p3mjqg6422f29yjfnz6a";
     })
     (fetchpatch {
       name = "openslp-2.0.0-CVE-2016-7567.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/openslp.git/plain/openslp-2.0.0-cve-2016-7567.patch";
+      url = "https://src.fedoraproject.org/rpms/openslp/raw/696fd55ae4fcea7beda0a25131dca8bfb14bbdf9/f/openslp-2.0.0-cve-2016-7567.patch";
       sha256 = "0zp61axx93b7nrbsyhn2x4dnw7n9y6g4rys21hyqxk4khrnc2yr9";
     })
     ./CVE-2016-4912.patch

pkgs/development/python-modules/aioecowitt/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aioecowitt";
-  version = "2023.01.0";
+  version = "2023.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-xOoKrGBkMEdpeiU1r27xlZp5s5sGJzvD7Ats+w6KR/o=";
+    hash = "sha256-uEA3OA/QOQ/h6ZMnb5hGQXHyqNO+KLmDSZMQBvmRwtE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/aioesphomeapi/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "13.7.4";
+  version = "13.7.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-licFBWT6CBYHgzVj2dza5gusjapABJWgsfHO/HJafnA=";
+    hash = "sha256-HBBhKRY3nfZ8TaQeXXlvowWqHt/vrwXD9PUb1cLvHLo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/aionotion/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aionotion";
-  version = "2023.05.1";
+  version = "2023.05.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    hash = "sha256-gCHJBgPWe5aSzTvvETjfn3zoEuuCJV1s4lMQLP72a/8=";
+    hash = "sha256-iQQbLMb3Bi+BzKeN5oEHWjCJryf+TUiINueqStGyktQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aplpy/default.nix

@@ -14,7 +14,7 @@
 , pytestCheckHook
 , pythonOlder
 , reproject
-, scikitimage
+, scikit-image
 , shapely
 }:
 
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     pyavm
     pyregion
     reproject
-    scikitimage
+    scikit-image
     shapely
   ];
 

pkgs/development/python-modules/batchgenerators/default.nix

@@ -9,7 +9,7 @@
 , fetchpatch
 , scipy
 , scikit-learn
-, scikitimage
+, scikit-image
 , threadpoolctl
 }:
 
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     pillow
     scipy
     scikit-learn
-    scikitimage
+    scikit-image
     threadpoolctl
   ];
 

pkgs/development/python-modules/bellows/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.35.2";
+  version = "0.35.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-I9PXFdRXHQ7OnzCdB631nlfnkpConl+j5Z3iiH7RcA4=";
+    hash = "sha256-JpRL4RxVcH+hzz7YTlRw+FHH95RavS/m1HWyBiLLWME=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/boxx/default.nix

@@ -4,7 +4,7 @@
 , python
 , xvfb-run
 , matplotlib
-, scikitimage
+, scikit-image
 , numpy
 , pandas
 , imageio
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     matplotlib
-    scikitimage
+    scikit-image
     numpy
     pandas
     imageio

pkgs/development/python-modules/bsuite/default.nix

@@ -10,7 +10,7 @@
 , absl-py
 , dm-env
 , plotnine
-, scikitimage
+, scikit-image
 , dm-tree
 , patsy
 , tensorflow-probability
@@ -45,7 +45,7 @@ let bsuite = buildPythonPackage rec {
     pandas
     patsy
     plotnine
-    scikitimage
+    scikit-image
     scipy
     statsmodels
     termcolor

pkgs/development/python-modules/bx-py-utils/default.nix

@@ -60,6 +60,12 @@ buildPythonPackage rec {
     requests-mock
   ];
 
+  disabledTests = [
+    # too closely affected by bs4 updates
+    "test_pretty_format_html"
+    "test_assert_html_snapshot_by_css_selector"
+  ];
+
   disabledTestPaths = [
     "bx_py_utils_tests/tests/test_project_setup.py"
   ];

pkgs/development/python-modules/cheetah3/default.nix

@@ -1,19 +1,33 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
 
 buildPythonPackage rec {
-  pname = "Cheetah3";
+  pname = "cheetah3";
-  version = "3.2.6.post2";
+  version = "3.3.1";
+  format = "setuptools";
 
-  src = fetchPypi {
+  disabled = pythonOlder "3.7";
-    inherit pname version;
+
-    sha256 = "63157d7a00a273b59676b5be5aa817c75c37efc88478231f1a160f4cfb7f7878";
+  src = fetchFromGitHub {
+    owner = "CheetahTemplate3";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-op8CwYISD2Gfsh0Olr8H07yvaT1maKyizb/IN9ZHwmQ=";
   };
 
   doCheck = false; # Circular dependency
 
+  pythonImportsCheck = [
+    "Cheetah"
+  ];
+
   meta = with lib; {
-    homepage = "http://www.cheetahtemplate.org/";
     description = "A template engine and code generation tool";
+    homepage = "http://www.cheetahtemplate.org/";
+    changelog = "https://github.com/CheetahTemplate3/cheetah3/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ pjjw ];
   };

pkgs/development/python-modules/ciscoconfparse/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "ciscoconfparse";
-  version = "1.7.18";
+  version = "1.7.24";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mpenning";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-jWInSqvMuwYJTPqHnrYWhMH/HvaQc2dFRqQu4RGFr28=";
+    hash = "sha256-vL/CQdYcOP356EyRToviWylP1EBtxmeov6qkhfQNZ2Y=";
   };
 
   postPatch = ''

pkgs/development/python-modules/css-inline/default.nix

@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, rustPlatform
+
+# native darwin dependencies
+, libiconv
+, Security
+
+# tests
+, pytestCheckHook
+, hypothesis
+}:
+
+buildPythonPackage rec {
+  pname = "css-inline";
+  version = "0.8.7";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Stranger6667";
+    repo = "css-inline";
+    rev = "python-v${version}";
+    hash = "sha256-VtWvzEqozbRo9OIcObdaRRqDq9Tcp0KxXOPZWO5qTeE=";
+  };
+
+  postPatch = ''
+    cd bindings/python
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    postPatch = ''
+      cd  bindings/python
+      ln -s ${./Cargo.lock} Cargo.lock
+    '';
+    name = "${pname}-${version}";
+    hash = "sha256-S8ebg5sMK7zoG84eAeXIWqDYuRVW9Mx9GJUAaKD9mxw=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+  ];
+
+  pythonImportsCheck = [
+    "css_inline"
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Inline CSS into style attributes";
+    homepage = "https://github.com/Stranger6667/css-inline";
+    changelog = "https://github.com/Stranger6667/css-inline/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}

pkgs/development/python-modules/dask-image/default.nix

@@ -7,7 +7,7 @@
 , pims
 , pytestCheckHook
 , pythonOlder
-, scikitimage
+, scikit-image
 , scipy
 }:
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    scikitimage
+    scikit-image
   ];
 
   postPatch = ''

pkgs/development/python-modules/dj-static/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, django
+, static3
+}:
+
+buildPythonPackage rec {
+  pname = "dj-static";
+  version = "0.0.6";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "heroku-python";
+    repo = "dj-static";
+    rev = "v${version}";
+    hash = "sha256-B6TydlezbDkmfFgJjdFniZIYo/JjzPvFj43co+HYCdc=";
+  };
+
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    static3
+  ];
+
+  pythonImportsCheck = [
+    "dj_static"
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Serve production static files with Django";
+    homepage = "https://github.com/heroku-python/dj-static";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ hexa ];
+  };
+}

pkgs/development/python-modules/django-localflavor/default.nix

@@ -0,0 +1,60 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# bring your own
+, django
+
+# propagates
+, python-stdnum
+
+# tests
+, pytest-django
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "django-localflavor";
+  version = "4.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "django";
+    repo = "django-localflavor";
+    rev = "refs/tags/${version}";
+    hash = "sha256-UWp3ei1VlEsEfjbJIE+MpffSzYF4X1HEQw+z+5kZoP0=";
+  };
+
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    python-stdnum
+  ];
+
+  pythonImportsCheck = [
+    # samples
+    "localflavor.ar"
+    "localflavor.de"
+    "localflavor.fr"
+    "localflavor.my"
+    "localflavor.nl"
+    "localflavor.us"
+    "localflavor.za"
+  ];
+
+  checkInputs = [
+    pytest-django
+    pytestCheckHook
+  ];
+
+  DJANGO_SETTINGS_MODULE = "tests.settings";
+
+  meta = with lib; {
+    description = "Country-specific Django helpers";
+    homepage = "https://github.com/django/django-localflavor";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ hexa ];
+  };
+}

pkgs/development/python-modules/django-rq/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-rq";
-  version = "2.8.0";
+  version = "2.8.1";
   format = "setuptools";
   disabled = isPy27;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "rq";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-UiV9eshlUqzmoI+04BXMFVI8pm7OYQZFa9lmIQrmlRg=";
+    hash = "sha256-Rabw6FIoSg9Cj4+tRO3BmBAeo9yr8KwU5xTPFL0JkOs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/dm-haiku/tests.nix

@@ -12,7 +12,7 @@
 , bsuite
 , frozendict
 , dm-env
-, scikitimage
+, scikit-image
 , rlax
 , distrax
 , tensorflow-probability
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     pytestCheckHook
     optax
     rlax
-    scikitimage
+    scikit-image
     tensorflow
     tensorflow-probability
   ];

pkgs/development/python-modules/dvc-render/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
+, flatten-dict
 , funcy
 , matplotlib
 , tabulate
@@ -14,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-render";
-  version = "0.4.0";
+  version = "0.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +24,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-bt2jqjhgtGmJsyfYNSzETQZUHFKni/poyeqpQzIJX08=";
+    hash = "sha256-x9vb8X7p4MOMZwr91ronXB/bPZD3PqYhbzLccRewyco=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -34,6 +35,7 @@ buildPythonPackage rec {
 
   passthru.optional-dependencies = {
     table = [
+      flatten-dict
       tabulate
     ];
     markdown = [

pkgs/development/python-modules/dvclive/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "2.8.1";
+  version = "2.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Wb0347y+oDFOctKjJUYPtqIFdsRm2wt16ZlQWDgjr7g=";
+    hash = "sha256-CP3PfRarlByVTchqYZKMuTaVKupqKOZDEOkzuVViW0Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/easyocr/default.nix

@@ -9,7 +9,7 @@
 , pyclipper
 , python-bidi
 , torch
-, scikitimage
+, scikit-image
 , scipy
 , shapely
 , torchvision
@@ -34,7 +34,7 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
-    scikitimage
+    scikit-image
     hdf5
     python-bidi
     numpy

pkgs/development/python-modules/glymur/default.nix

@@ -7,7 +7,7 @@
 , openjpeg
 , pytestCheckHook
 , pythonOlder
-, scikitimage
+, scikit-image
 , setuptools
 }:
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     lxml
     pytestCheckHook
-    scikitimage
+    scikit-image
   ];
 
   postConfigure = ''

pkgs/development/python-modules/hahomematic/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.5.1";
+  version = "2023.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-YsvsT1TKAlMGS9F3zDuruXnC/COFbR5ApPFzh+hzQyE=";
+    hash = "sha256-4P4ACoXapx1FzUWGCFu8U4iBTG0fUjLTlJXF2HzKyQg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/image-match/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, pytest-runner, scikitimage }:
+{ lib, buildPythonPackage, fetchFromGitHub, pytest-runner, scikit-image }:
 
 buildPythonPackage {
   pname = "image-match";
@@ -14,7 +14,7 @@ buildPythonPackage {
   buildInputs = [ pytest-runner ];
 
   propagatedBuildInputs = [
-    scikitimage
+    scikit-image
   ];
 
   # remove elasticsearch requirement due to version incompatibility

pkgs/development/python-modules/imagecorruptions/default.nix

@@ -1,7 +1,7 @@
 { buildPythonPackage
 , fetchPypi
 , numpy
-, scikitimage
+, scikit-image
 , lib
 , opencv3
 }:
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     numpy
-    scikitimage
+    scikit-image
     opencv3
   ];
 

pkgs/development/python-modules/imgaug/default.nix

@@ -5,7 +5,7 @@
 , numpy
 , opencv3
 , pytestCheckHook
-, scikitimage
+, scikit-image
 , scipy
 , shapely
 , six
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     imagecorruptions
     numpy
     opencv3
-    scikitimage
+    scikit-image
     scipy
     shapely
     six
@@ -79,6 +79,6 @@ buildPythonPackage rec {
     platforms = platforms.linux;
     # Scikit-image 0.19 update broke API, see https://github.com/scikit-image/scikit-image/releases/tag/v0.19.0
     # and https://github.com/scikit-image/scikit-image/issues/6093
-    broken = lib.versionAtLeast scikitimage.version "0.19";
+    broken = lib.versionAtLeast scikit-image.version "0.19";
   };
 }

pkgs/development/python-modules/intensity-normalization/default.nix

@@ -10,7 +10,7 @@
 , pydicom
 , pymedio
 , scikit-fuzzy
-, scikitimage
+, scikit-image
 , scikit-learn
 , scipy
 , simpleitk
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     pydicom
     pymedio
     scikit-fuzzy
-    scikitimage
+    scikit-image
     scikit-learn
     scipy
     simpleitk

pkgs/development/python-modules/losant-rest/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.17.3";
+  version = "1.17.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    hash = "sha256-S4ypZ4yTncoyKi4INpXg0UtcD+CmKRwr3c/FuSoXVKs=";
+    hash = "sha256-/7k2IYoP4z9ub89wNzDfzyA520CNzn3L68yMWgApz34=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/mask-rcnn/default.nix

@@ -11,7 +11,7 @@
 , numpy
 , opencv3
 , pillow
-, scikitimage
+, scikit-image
 , scipy
 , tensorflow
 }:
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     numpy
     opencv3
     pillow
-    scikitimage
+    scikit-image
     scipy
     tensorflow
   ];

pkgs/development/python-modules/moviepy/default.nix

@@ -12,7 +12,7 @@
   # Advanced image processing (triples size of output)
 , advancedProcessing ? false
 , opencv3
-, scikitimage
+, scikit-image
 , scikit-learn
 , scipy
 , matplotlib
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     proglog
   ] ++ lib.optionals advancedProcessing [
     opencv3
-    scikitimage
+    scikit-image
     scikit-learn
     scipy
     matplotlib

pkgs/development/python-modules/napari/default.nix

@@ -22,7 +22,7 @@
 , pillow
 , pythonOlder
 , pyyaml
-, scikitimage
+, scikit-image
 , scipy
 , setuptools-scm
 , sphinx
@@ -84,7 +84,7 @@ mkDerivationWith buildPythonPackage rec {
     pydantic
     pyopengl
     pyyaml
-    scikitimage
+    scikit-image
     scipy
     sphinx
     superqt

pkgs/development/python-modules/ome-zarr/default.nix

@@ -9,7 +9,7 @@
 , fsspec
 , numpy
 , requests
-, scikitimage
+, scikit-image
 , s3fs
 , toolz
 , zarr
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     aiohttp
     requests
     s3fs
-    scikitimage
+    scikit-image
     toolz
   ];
 

pkgs/development/python-modules/pims/default.nix

@@ -5,7 +5,7 @@
 , numpy
 , pytestCheckHook
 , pythonOlder
-, scikitimage
+, scikit-image
 , slicerator
 }:
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    scikitimage
+    scikit-image
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/psd-tools/default.nix

@@ -4,7 +4,7 @@
 , pythonOlder
 , docopt
 , pillow
-, scikitimage
+, scikit-image
 , aggdraw
 , pytestCheckHook
 , ipython
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     docopt
     ipython
     pillow
-    scikitimage
+    scikit-image
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/python-gvm/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "23.4.2";
+  version = "23.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ONCPC05NYyymTKiJZaDTdcShLLy4+K+JwROVVXBkz+o=";
+    hash = "sha256-84MTr9aTMB5MUj84bqbSGfX8JLA1KQ8pRE8Nr2RmoJw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyvicare/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyvicare";
-  version = "2.27.2";
+  version = "2.28.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "somm15";
     repo = "PyViCare";
     rev = "refs/tags/${version}";
-    hash = "sha256-BLvHZRIHj+HysdGcq51Ry3unbT2BQd7lwslAo9n9SdY=";
+    hash = "sha256-6tyFSKD8Igai9A5wn7vRJdTryy+lv2MkxaskNpCwqV8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/pywick/default.nix

@@ -13,7 +13,7 @@
 , pyyaml
 , scipy
 , requests
-, scikitimage
+, scikit-image
 , six
 , tabulate
 , torch
@@ -52,7 +52,7 @@ buildPythonPackage rec {
     pyyaml
     scipy
     requests
-    scikitimage
+    scikit-image
     tabulate
     torch
     torchvision

pkgs/development/python-modules/ray/default.nix

@@ -43,7 +43,7 @@
 , pyyaml
 , redis
 , requests
-, scikitimage
+, scikit-image
 , scipy
 , setproctitle
 , smart-open
@@ -103,7 +103,7 @@ buildPythonPackage rec {
       gym
       lz4
       matplotlib
-      scikitimage
+      scikit-image
       pyyaml
       scipy
     ];

pkgs/development/python-modules/slicedimage/default.nix

@@ -8,7 +8,7 @@
 , pathlib
 , numpy
 , requests
-, scikitimage
+, scikit-image
 , six
 , pytestCheckHook
 , isPy27
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     packaging
     numpy
     requests
-    scikitimage
+    scikit-image
     six
     tifffile
   ] ++ lib.optionals isPy27 [ pathlib enum34 ];

pkgs/development/python-modules/stytra/default.nix

@@ -25,7 +25,7 @@
 , pythonOlder
 , qdarkstyle
 , qimage2ndarray
-, scikitimage
+, scikit-image
 , scipy
 , tables
 }:
@@ -57,7 +57,7 @@ buildPythonPackage rec {
     pandas
     tables
     git
-    scikitimage
+    scikit-image
     matplotlib
     qdarkstyle
     gitpython

pkgs/development/python-modules/sunpy/default.nix

@@ -21,7 +21,7 @@
 , pytest-mock
 , python-dateutil
 , pythonOlder
-, scikitimage
+, scikit-image
 , scipy
 , setuptools-scm
 , sqlalchemy
@@ -62,7 +62,7 @@ buildPythonPackage rec {
       sqlalchemy
     ];
     image = [
-      scikitimage
+      scikit-image
       scipy
     ];
     net = [

pkgs/development/python-modules/tensorflow-datasets/default.nix

@@ -29,7 +29,7 @@
 , pytest-xdist
 , pytestCheckHook
 , requests
-, scikitimage
+, scikit-image
 , scipy
 , six
 , tensorflow
@@ -96,7 +96,7 @@ buildPythonPackage rec {
     pydub
     pytest-xdist
     pytestCheckHook
-    scikitimage
+    scikit-image
     scipy
     tensorflow
     tifffile

pkgs/development/python-modules/torchmetrics/default.nix

@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , cloudpickle
 , scikit-learn
-, scikitimage
+, scikit-image
 , packaging
 , psutil
 , py-deprecate
@@ -40,7 +40,7 @@ buildPythonPackage {
   nativeCheckInputs = [
     pytorch-lightning
     scikit-learn
-    scikitimage
+    scikit-image
     cloudpickle
     psutil
     pytestCheckHook

pkgs/development/python-modules/wandb/default.nix

@@ -29,6 +29,7 @@
 , protobuf
 , psutil
 , pydantic
+, pyfakefs
 , pytest-mock
 , pytest-xdist
 , pytestCheckHook
@@ -50,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "wandb";
-  version = "0.15.0";
+  version = "0.15.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -59,7 +60,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-UULsvvk9BsWUrJ8eD7uD2UnUJqmPrmjrJvCA7WRC/Cw=";
+    hash = "sha256-cAmX3r6XhCBUnC/fNNPakZUNEcDFke0DJMi2PW7sOho=";
   };
 
   patches = [
@@ -111,6 +112,7 @@ buildPythonPackage rec {
     pandas
     parameterized
     pydantic
+    pyfakefs
     pytest-mock
     pytest-xdist
     pytestCheckHook
@@ -131,6 +133,7 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     # Tests that try to get chatty over sockets or spin up servers, not possible in the nix build environment.
+    "tests/pytest_tests/system_tests/test_notebooks/test_notebooks.py"
     "tests/pytest_tests/unit_tests_old/test_cli.py"
     "tests/pytest_tests/unit_tests_old/test_data_types.py"
     "tests/pytest_tests/unit_tests_old/test_file_stream.py"
@@ -156,7 +159,6 @@ buildPythonPackage rec {
     "tests/pytest_tests/unit_tests_old/tests_launch/test_launch_docker.py"
     "tests/pytest_tests/unit_tests_old/tests_launch/test_launch_kubernetes.py"
     "tests/pytest_tests/unit_tests_old/tests_launch/test_launch.py"
-    "tests/pytest_tests/unit_tests_old/tests_s_nb/test_notebooks.py"
     "tests/pytest_tests/unit_tests/test_cli.py"
     "tests/pytest_tests/unit_tests/test_data_types.py"
     "tests/pytest_tests/unit_tests/test_internal_api.py"
@@ -206,9 +208,11 @@ buildPythonPackage rec {
     "tests/pytest_tests/system_tests/test_importers/test_import_mlflow.py"
     "tests/pytest_tests/system_tests/test_sweep/test_public_api.py"
     "tests/pytest_tests/system_tests/test_sweep/test_sweep_scheduler.py"
+    "tests/pytest_tests/system_tests/test_sweep/test_sweep_utils.py"
     "tests/pytest_tests/system_tests/test_sweep/test_wandb_agent_full.py"
     "tests/pytest_tests/system_tests/test_sweep/test_wandb_agent.py"
     "tests/pytest_tests/system_tests/test_sweep/test_wandb_sweep.py"
+    "tests/pytest_tests/system_tests/test_system_metrics/test_open_metrics.py"
     "tests/pytest_tests/system_tests/tests_launch/test_github_reference.py"
     "tests/pytest_tests/system_tests/tests_launch/test_job.py"
     "tests/pytest_tests/system_tests/tests_launch/test_launch_add.py"
@@ -216,6 +220,7 @@ buildPythonPackage rec {
     "tests/pytest_tests/system_tests/tests_launch/test_launch_kubernetes.py"
     "tests/pytest_tests/system_tests/tests_launch/test_launch_local_container.py"
     "tests/pytest_tests/system_tests/tests_launch/test_launch_run.py"
+    "tests/pytest_tests/system_tests/tests_launch/test_launch_sweep_cli.py"
     "tests/pytest_tests/system_tests/tests_launch/test_launch_sweep.py"
     "tests/pytest_tests/system_tests/tests_launch/test_launch.py"
     "tests/pytest_tests/system_tests/tests_launch/test_wandb_reference.py"

pkgs/development/tools/misc/coreboot-toolchain/default.nix

@@ -19,12 +19,12 @@ let
 
     stdenvNoCC.mkDerivation rec {
       pname = "coreboot-toolchain-${arch}";
-      version = "4.19";
+      version = "4.20";
 
       src = fetchgit {
         url = "https://review.coreboot.org/coreboot";
-        rev = version;
+        rev = "465fbbe93ee01b4576689a90b7ddbeec23cdace2";
-        sha256 = "sha256-pGS+bfX2k/ot7sHL9aiaQpA0wtbHHZEObJ/h2JGF5/4=";
+        hash = "sha256-vzXOl+Z8VYh9Iq6+AMNb3apMv185J3mODauKMinSOI4=";
         fetchSubmodules = false;
         leaveDotGit = true;
         postFetch = ''

pkgs/development/tools/misc/coreboot-toolchain/stable.nix

@@ -7,38 +7,38 @@
     };
   }
   {
-    name = "mpfr-4.1.1.tar.xz";
+    name = "mpfr-4.2.0.tar.xz";
     archive = fetchurl {
-      sha256 = "0gf3ibi7kzz39zj72qc9r607clyhm80gs8wbp71zzfkxasyrblgz";
+      sha256 = "14yr4sf4mys64nzbgnd997l6l4n8l9vsjnnvnb0lh4jh2ggpi8q6";
-      url = "mirror://gnu/mpfr/mpfr-4.1.1.tar.xz";
+      url = "mirror://gnu/mpfr/mpfr-4.2.0.tar.xz";
     };
   }
   {
-    name = "mpc-1.2.1.tar.gz";
+    name = "mpc-1.3.1.tar.gz";
     archive = fetchurl {
-      sha256 = "0n846hqfqvmsmim7qdlms0qr86f1hck19p12nq3g3z2x74n3sl0p";
+      sha256 = "1f2rqz0hdrrhx4y1i5f8pv6yv08a876k1dqcm9s2p26gyn928r5b";
-      url = "mirror://gnu/mpc/mpc-1.2.1.tar.gz";
+      url = "mirror://gnu/mpc/mpc-1.3.1.tar.gz";
     };
   }
   {
-    name = "gcc-11.2.0.tar.xz";
+    name = "gcc-11.3.0.tar.xz";
     archive = fetchurl {
-      sha256 = "12zs6vd2rapp42x154m479hg3h3lsafn3xhg06hp5hsldd9xr3nh";
+      sha256 = "0fdclcwf728wbq52vphfcjywzhpsjp3kifzj3pib3xcihs0z4z5l";
-      url = "mirror://gnu/gcc/gcc-11.2.0/gcc-11.2.0.tar.xz";
+      url = "mirror://gnu/gcc/gcc-11.3.0/gcc-11.3.0.tar.xz";
     };
   }
   {
-    name = "binutils-2.37.tar.xz";
+    name = "binutils-2.40.tar.xz";
     archive = fetchurl {
-      sha256 = "0b53hhgfnafw27y0c3nbmlfidny2cc5km29pnfffd8r0y0j9f3c2";
+      sha256 = "1qfqr7gw9k5hhaj6sllmis109qxq5354l2nivrlz65vz5lklr2hg";
-      url = "mirror://gnu/binutils/binutils-2.37.tar.xz";
+      url = "mirror://gnu/binutils/binutils-2.40.tar.xz";
     };
   }
   {
     name = "R10_20_22.tar.gz";
     archive = fetchurl {
       sha256 = "11iv3jrz27g7bv7ffyxsrgm4cq60cld2gkkl008p3lcwfyqpx88s";
-      url = "https://github.com/acpica/acpica/archive/refs/tags//R10_20_22.tar.gz";
+      url = "https://github.com/acpica/acpica/archive/refs/tags/R10_20_22.tar.gz";
     };
   }
   {

pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json

@@ -15918,7 +15918,7 @@
     "cython",
     "setuptools"
   ],
-  "scikitimage": [
+  "scikit-image": [
     "cython",
     "setuptools"
   ],

pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch

@@ -0,0 +1,21 @@
+--- a/lib/maple_tree.c
++++ b/lib/maple_tree.c
+@@ -5317,15 +5317,9 @@
+ 
+ 	mt = mte_node_type(mas->node);
+ 	pivots = ma_pivots(mas_mn(mas), mt);
+-	if (offset)
+-		mas->min = pivots[offset - 1] + 1;
+-
+-	if (offset < mt_pivots[mt])
+-		mas->max = pivots[offset];
+-
+-	if (mas->index < mas->min)
+-		mas->index = mas->min;
+-
++	min = mas_safe_min(mas, pivots, offset);
++	if (mas->index < min)
++		mas->index = min;
+ 	mas->last = mas->index + size - 1;
+ 	return 0;
+ }

pkgs/os-specific/linux/kernel/patches.nix

@@ -58,6 +58,12 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
+  # https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/patch/?id=39bf07d812b888b23983a9443ad967ca9b61551d
+  make-maple-state-reusable-after-mas_empty_area = {
+    name = "make-maple-state-reusable-after-mas_empty_area";
+    patch = ./make-maple-state-reusable-after-mas_empty_area.patch;
+  };
+
   fix-em-ice-bonding = {
     name = "fix-em-ice-bonding";
     patch = ./fix-em-ice-bonding.patch;

pkgs/servers/home-assistant/component-packages.nix

@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.5.2";
+  version = "2023.5.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];

pkgs/servers/home-assistant/default.nix

@@ -321,7 +321,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.5.2";
+  hassVersion = "2023.5.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -337,7 +337,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vBDYNnwx+9fjiVkMelDoaDtYwBKEq5BibLEs8iwIIFo=";
+    hash = "sha256-ivsXZU48RxDJWngefAkg6MWOD5mJHgKxuB6H4EuVths=";
   };
 
   # Secondary source is git for tests
@@ -345,7 +345,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-4YvGxBr8YmOz5kzPJ9ve7mlWxwe9BfkQgLxjst4IIJ8=";
+    hash = "sha256-bJz+rZ+ihBCaVUMh8FN79fKULo5myR1maNxO23za6yA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/servers/home-assistant/stubs.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.5.2";
+  version = "2023.5.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-JWPVubhKLXwY877fbRej04g27vaJTM8qgScLq9IjdiE=";
+    hash = "sha256-iT2dDW+Kj/HGcOAFUbnCEYL3PUNN4avs6ALzySzpmRs=";
   };
 
   nativeBuildInputs = [

pkgs/servers/mjolnir/default.nix

@@ -1,67 +1,56 @@
 { lib
-, nixosTests
+, mkYarnPackage
-, stdenv
 , fetchFromGitHub
+, fetchYarnDeps
+, matrix-sdk-crypto-nodejs
 , makeWrapper
 , nodejs
-, pkgs
+, nixosTests
 }:
 
-stdenv.mkDerivation rec {
+mkYarnPackage rec {
   pname = "mjolnir";
-  version = "1.5.0";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "mjolnir";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "YmP+r9W5e63Aw66lSQeTTbYwSF/vjPyHkoehJxtcRNw=";
+    hash = "sha256-/vnojWLpu/fktqPUhAdL1QTESxDwFrBVYAkyF79Fj9w=";
   };
 
-  nativeBuildInputs = [
+  packageJSON = ./package.json;
-    nodejs
-    makeWrapper
-  ];
 
-  buildPhase =
+  offlineCache = fetchYarnDeps {
-    let
+    yarnLock = src + "/yarn.lock";
-      nodeDependencies = ((import ./node-composition.nix {
+    hash = "sha256-B4s0CYr5Ihoh4gkckwZ3z0Nb4LMET48WvRXuhk3fpQM=";
-        inherit pkgs nodejs;
+  };
-        inherit (stdenv.hostPlatform) system;
-      }).nodeDependencies.override (old: {
-        # access to path '/nix/store/...-source' is forbidden in restricted mode
-        src = src;
-        dontNpmInstall = true;
-      }));
-    in
-    ''
-      runHook preBuild
 
-      ln -s ${nodeDependencies}/lib/node_modules .
+  packageResolutions = {
-      export HOME=$(mktemp -d)
+    "@matrix-org/matrix-sdk-crypto-nodejs" = "${matrix-sdk-crypto-nodejs}/lib/node_modules/@matrix-org/matrix-sdk-crypto-nodejs";
-      export PATH="${nodeDependencies}/bin:$PATH"
+  };
-      npm run build
 
-      runHook postBuild
+  nativeBuildInputs = [ makeWrapper ];
-    '';
 
-  installPhase = ''
+  buildPhase = ''
-    runHook preInstall
+    runHook preBuild
 
-    mkdir -p $out/share
+    pushd deps/${pname}
-    cp -a . $out/share/mjolnir
+    yarn run build
+    popd
 
-    makeWrapper ${nodejs}/bin/node $out/bin/mjolnir \
+    runHook postBuild
-      --add-flags $out/share/mjolnir/lib/index.js
+  '';
 
-    runHook postInstall
+  postInstall = ''
+    makeWrapper ${nodejs}/bin/node "$out/bin/mjolnir" \
+      --add-flags "$out/libexec/mjolnir/deps/mjolnir/lib/index.js"
   '';
 
   passthru = {
     tests = {
       inherit (nixosTests) mjolnir;
     };
-    updateScript = ./update.sh;
   };
 
   meta = with lib; {

pkgs/servers/mjolnir/node-composition.nix

@@ -1,17 +0,0 @@
-# This file has been generated by node2nix 1.11.1. Do not edit!
-
-{pkgs ? import <nixpkgs> {
-    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
-
-let
-  nodeEnv = import ./node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
-    inherit pkgs nodejs;
-    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
-  };
-in
-import ./node-deps.nix {
-  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
-  inherit nodeEnv;
-}

pkgs/servers/mjolnir/node-env.nix

@@ -1,598 +0,0 @@
-# This file originates from node2nix
-
-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
-
-let
-  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
-  utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
-
-  python = if nodejs ? python then nodejs.python else python2;
-
-  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
-  tarWrapper = runCommand "tarWrapper" {} ''
-    mkdir -p $out/bin
-
-    cat > $out/bin/tar <<EOF
-    #! ${stdenv.shell} -e
-    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
-    EOF
-
-    chmod +x $out/bin/tar
-  '';
-
-  # Function that generates a TGZ file from a NPM project
-  buildNodeSourceDist =
-    { name, version, src, ... }:
-
-    stdenv.mkDerivation {
-      name = "node-tarball-${name}-${version}";
-      inherit src;
-      buildInputs = [ nodejs ];
-      buildPhase = ''
-        export HOME=$TMPDIR
-        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
-      '';
-      installPhase = ''
-        mkdir -p $out/tarballs
-        mv $tgzFile $out/tarballs
-        mkdir -p $out/nix-support
-        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
-      '';
-    };
-
-  # Common shell logic
-  installPackage = writeShellScript "install-package" ''
-    installPackage() {
-      local packageName=$1 src=$2
-
-      local strippedName
-
-      local DIR=$PWD
-      cd $TMPDIR
-
-      unpackFile $src
-
-      # Make the base dir in which the target dependency resides first
-      mkdir -p "$(dirname "$DIR/$packageName")"
-
-      if [ -f "$src" ]
-      then
-          # Figure out what directory has been unpacked
-          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
-
-          # Restore write permissions to make building work
-          find "$packageDir" -type d -exec chmod u+x {} \;
-          chmod -R u+w "$packageDir"
-
-          # Move the extracted tarball into the output folder
-          mv "$packageDir" "$DIR/$packageName"
-      elif [ -d "$src" ]
-      then
-          # Get a stripped name (without hash) of the source directory.
-          # On old nixpkgs it's already set internally.
-          if [ -z "$strippedName" ]
-          then
-              strippedName="$(stripHash $src)"
-          fi
-
-          # Restore write permissions to make building work
-          chmod -R u+w "$strippedName"
-
-          # Move the extracted directory into the output folder
-          mv "$strippedName" "$DIR/$packageName"
-      fi
-
-      # Change to the package directory to install dependencies
-      cd "$DIR/$packageName"
-    }
-  '';
-
-  # Bundle the dependencies of the package
-  #
-  # Only include dependencies if they don't exist. They may also be bundled in the package.
-  includeDependencies = {dependencies}:
-    lib.optionalString (dependencies != []) (
-      ''
-        mkdir -p node_modules
-        cd node_modules
-      ''
-      + (lib.concatMapStrings (dependency:
-        ''
-          if [ ! -e "${dependency.packageName}" ]; then
-              ${composePackage dependency}
-          fi
-        ''
-      ) dependencies)
-      + ''
-        cd ..
-      ''
-    );
-
-  # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
-    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
-      installPackage "${packageName}" "${src}"
-      ${includeDependencies { inherit dependencies; }}
-      cd ..
-      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-    '';
-
-  pinpointDependencies = {dependencies, production}:
-    let
-      pinpointDependenciesFromPackageJSON = writeTextFile {
-        name = "pinpointDependencies.js";
-        text = ''
-          var fs = require('fs');
-          var path = require('path');
-
-          function resolveDependencyVersion(location, name) {
-              if(location == process.env['NIX_STORE']) {
-                  return null;
-              } else {
-                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
-
-                  if(fs.existsSync(dependencyPackageJSON)) {
-                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
-
-                      if(dependencyPackageObj.name == name) {
-                          return dependencyPackageObj.version;
-                      }
-                  } else {
-                      return resolveDependencyVersion(path.resolve(location, ".."), name);
-                  }
-              }
-          }
-
-          function replaceDependencies(dependencies) {
-              if(typeof dependencies == "object" && dependencies !== null) {
-                  for(var dependency in dependencies) {
-                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
-
-                      if(resolvedVersion === null) {
-                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
-                      } else {
-                          dependencies[dependency] = resolvedVersion;
-                      }
-                  }
-              }
-          }
-
-          /* Read the package.json configuration */
-          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
-
-          /* Pinpoint all dependencies */
-          replaceDependencies(packageObj.dependencies);
-          if(process.argv[2] == "development") {
-              replaceDependencies(packageObj.devDependencies);
-          }
-          replaceDependencies(packageObj.optionalDependencies);
-
-          /* Write the fixed package.json file */
-          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
-        '';
-      };
-    in
-    ''
-      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
-
-      ${lib.optionalString (dependencies != [])
-        ''
-          if [ -d node_modules ]
-          then
-              cd node_modules
-              ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
-              cd ..
-          fi
-        ''}
-    '';
-
-  # Recursively traverses all dependencies of a package and pinpoints all
-  # dependencies in the package.json file to the versions that are actually
-  # being used.
-
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
-    ''
-      if [ -d "${packageName}" ]
-      then
-          cd "${packageName}"
-          ${pinpointDependencies { inherit dependencies production; }}
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-      fi
-    '';
-
-  # Extract the Node.js source code which is used to compile packages with
-  # native bindings
-  nodeSources = runCommand "node-sources" {} ''
-    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
-    mv node-* $out
-  '';
-
-  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
-  addIntegrityFieldsScript = writeTextFile {
-    name = "addintegrityfields.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      function augmentDependencies(baseDir, dependencies) {
-          for(var dependencyName in dependencies) {
-              var dependency = dependencies[dependencyName];
-
-              // Open package.json and augment metadata fields
-              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
-              var packageJSONPath = path.join(packageJSONDir, "package.json");
-
-              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
-                  console.log("Adding metadata fields to: "+packageJSONPath);
-                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
-
-                  if(dependency.integrity) {
-                      packageObj["_integrity"] = dependency.integrity;
-                  } else {
-                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
-                  }
-
-                  if(dependency.resolved) {
-                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
-                  } else {
-                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
-                  }
-
-                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
-                      packageObj["_from"] = dependency.from;
-                  }
-
-                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
-              }
-
-              // Augment transitive dependencies
-              if(dependency.dependencies !== undefined) {
-                  augmentDependencies(packageJSONDir, dependency.dependencies);
-              }
-          }
-      }
-
-      if(fs.existsSync("./package-lock.json")) {
-          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
-
-          if(![1, 2].includes(packageLock.lockfileVersion)) {
-            process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
-            process.exit(1);
-          }
-
-          if(packageLock.dependencies !== undefined) {
-              augmentDependencies(".", packageLock.dependencies);
-          }
-      }
-    '';
-  };
-
-  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
-  reconstructPackageLock = writeTextFile {
-    name = "addintegrityfields.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      var packageObj = JSON.parse(fs.readFileSync("package.json"));
-
-      var lockObj = {
-          name: packageObj.name,
-          version: packageObj.version,
-          lockfileVersion: 1,
-          requires: true,
-          dependencies: {}
-      };
-
-      function augmentPackageJSON(filePath, dependencies) {
-          var packageJSON = path.join(filePath, "package.json");
-          if(fs.existsSync(packageJSON)) {
-              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
-              dependencies[packageObj.name] = {
-                  version: packageObj.version,
-                  integrity: "sha1-000000000000000000000000000=",
-                  dependencies: {}
-              };
-              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
-          }
-      }
-
-      function processDependencies(dir, dependencies) {
-          if(fs.existsSync(dir)) {
-              var files = fs.readdirSync(dir);
-
-              files.forEach(function(entry) {
-                  var filePath = path.join(dir, entry);
-                  var stats = fs.statSync(filePath);
-
-                  if(stats.isDirectory()) {
-                      if(entry.substr(0, 1) == "@") {
-                          // When we encounter a namespace folder, augment all packages belonging to the scope
-                          var pkgFiles = fs.readdirSync(filePath);
-
-                          pkgFiles.forEach(function(entry) {
-                              if(stats.isDirectory()) {
-                                  var pkgFilePath = path.join(filePath, entry);
-                                  augmentPackageJSON(pkgFilePath, dependencies);
-                              }
-                          });
-                      } else {
-                          augmentPackageJSON(filePath, dependencies);
-                      }
-                  }
-              });
-          }
-      }
-
-      processDependencies("node_modules", lockObj.dependencies);
-
-      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
-    '';
-  };
-
-  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
-    let
-      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
-    in
-    ''
-        # Pinpoint the versions of all dependencies to the ones that are actually being used
-        echo "pinpointing versions of dependencies..."
-        source $pinpointDependenciesScriptPath
-
-        # Patch the shebangs of the bundled modules to prevent them from
-        # calling executables outside the Nix store as much as possible
-        patchShebangs .
-
-        # Deploy the Node.js package by running npm install. Since the
-        # dependencies have been provided already by ourselves, it should not
-        # attempt to install them again, which is good, because we want to make
-        # it Nix's responsibility. If it needs to install any dependencies
-        # anyway (e.g. because the dependency parameters are
-        # incomplete/incorrect), it fails.
-        #
-        # The other responsibilities of NPM are kept -- version checks, build
-        # steps, postprocessing etc.
-
-        export HOME=$TMPDIR
-        cd "${packageName}"
-        runHook preRebuild
-
-        ${lib.optionalString bypassCache ''
-          ${lib.optionalString reconstructLock ''
-            if [ -f package-lock.json ]
-            then
-                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
-                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
-                rm package-lock.json
-            else
-                echo "No package-lock.json file found, reconstructing..."
-            fi
-
-            node ${reconstructPackageLock}
-          ''}
-
-          node ${addIntegrityFieldsScript}
-        ''}
-
-        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
-
-        if [ "''${dontNpmInstall-}" != "1" ]
-        then
-            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
-            rm -f npm-shrinkwrap.json
-
-            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
-        fi
-    '';
-
-  # Builds and composes an NPM package including all its dependencies
-  buildNodePackage =
-    { name
-    , packageName
-    , version ? null
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , preRebuild ? ""
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , meta ? {}
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
-    in
-    stdenv.mkDerivation ({
-      name = "${name}${if version == null then "" else "-${version}"}";
-      buildInputs = [ tarWrapper python nodejs ]
-        ++ lib.optional (stdenv.isLinux) utillinux
-        ++ lib.optional (stdenv.isDarwin) libtool
-        ++ buildInputs;
-
-      inherit nodejs;
-
-      inherit dontStrip; # Stripping may fail a build for some package deployments
-      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
-
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
-
-      installPhase = ''
-        source ${installPackage}
-
-        # Create and enter a root node_modules/ folder
-        mkdir -p $out/lib/node_modules
-        cd $out/lib/node_modules
-
-        # Compose the package and all its dependencies
-        source $compositionScriptPath
-
-        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-        # Create symlink to the deployed executable folder, if applicable
-        if [ -d "$out/lib/node_modules/.bin" ]
-        then
-            ln -s $out/lib/node_modules/.bin $out/bin
-
-            # Patch the shebang lines of all the executables
-            ls $out/bin/* | while read i
-            do
-                file="$(readlink -f "$i")"
-                chmod u+rwx "$file"
-                patchShebangs "$file"
-            done
-        fi
-
-        # Create symlinks to the deployed manual page folders, if applicable
-        if [ -d "$out/lib/node_modules/${packageName}/man" ]
-        then
-            mkdir -p $out/share
-            for dir in "$out/lib/node_modules/${packageName}/man/"*
-            do
-                mkdir -p $out/share/man/$(basename "$dir")
-                for page in "$dir"/*
-                do
-                    ln -s $page $out/share/man/$(basename "$dir")
-                done
-            done
-        fi
-
-        # Run post install hook, if provided
-        runHook postInstall
-      '';
-
-      meta = {
-        # default to Node.js' platforms
-        platforms = nodejs.meta.platforms;
-      } // meta;
-    } // extraArgs);
-
-  # Builds a node environment (a node_modules folder and a set of binaries)
-  buildNodeDependencies =
-    { name
-    , packageName
-    , version ? null
-    , src
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
-    in
-      stdenv.mkDerivation ({
-        name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
-
-        buildInputs = [ tarWrapper python nodejs ]
-          ++ lib.optional (stdenv.isLinux) utillinux
-          ++ lib.optional (stdenv.isDarwin) libtool
-          ++ buildInputs;
-
-        inherit dontStrip; # Stripping may fail a build for some package deployments
-        inherit dontNpmInstall unpackPhase buildPhase;
-
-        includeScript = includeDependencies { inherit dependencies; };
-        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
-
-        installPhase = ''
-          source ${installPackage}
-
-          mkdir -p $out/${packageName}
-          cd $out/${packageName}
-
-          source $includeScriptPath
-
-          # Create fake package.json to make the npm commands work properly
-          cp ${src}/package.json .
-          chmod 644 package.json
-          ${lib.optionalString bypassCache ''
-            if [ -f ${src}/package-lock.json ]
-            then
-                cp ${src}/package-lock.json .
-                chmod 644 package-lock.json
-            fi
-          ''}
-
-          # Go to the parent folder to make sure that all packages are pinpointed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-          # Expose the executables that were installed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          mv ${packageName} lib
-          ln -s $out/lib/node_modules/.bin $out/bin
-        '';
-      } // extraArgs);
-
-  # Builds a development shell
-  buildNodeShell =
-    { name
-    , packageName
-    , version ? null
-    , src
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      nodeDependencies = buildNodeDependencies args;
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
-    in
-    stdenv.mkDerivation ({
-      name = "node-shell-${name}${if version == null then "" else "-${version}"}";
-
-      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
-      buildCommand = ''
-        mkdir -p $out/bin
-        cat > $out/bin/shell <<EOF
-        #! ${stdenv.shell} -e
-        $shellHook
-        exec ${stdenv.shell}
-        EOF
-        chmod +x $out/bin/shell
-      '';
-
-      # Provide the dependencies in a development shell through the NODE_PATH environment variable
-      inherit nodeDependencies;
-      shellHook = lib.optionalString (dependencies != []) ''
-        export NODE_PATH=${nodeDependencies}/lib/node_modules
-        export PATH="${nodeDependencies}/bin:$PATH"
-      '';
-    } // extraArgs);
-in
-{
-  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
-  buildNodePackage = lib.makeOverridable buildNodePackage;
-  buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
-  buildNodeShell = lib.makeOverridable buildNodeShell;
-}

pkgs/servers/mjolnir/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "mjolnir",
+  "version": "1.6.3",
+  "description": "A moderation tool for Matrix",
+  "main": "lib/index.js",
+  "repository": "git@github.com:matrix-org/mjolnir.git",
+  "author": "The Matrix.org Foundation C.I.C.",
+  "license": "Apache-2.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "postbuild": "rm -rf lib/test/ && cp -r lib/src/* lib/ && rm -rf lib/src/",
+    "lint": "tslint --project ./tsconfig.json -t stylish",
+    "start:dev": "yarn build && node --async-stack-traces lib/index.js",
+    "test": "ts-mocha --project ./tsconfig.json test/commands/**/*.ts",
+    "test:integration": "NODE_ENV=harness ts-mocha --async-stack-traces --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json \"test/integration/**/*Test.ts\"",
+    "test:integration:single": "NODE_ENV=harness npx ts-mocha --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json",
+    "test:appservice:integration": "NODE_ENV=harness ts-mocha --async-stack-traces --timeout 300000 --project ./tsconfig.json \"test/appservice/integration/**/*Test.ts\"",
+    "test:appservice:integration:single": "NODE_ENV=harness npx ts-mocha --timeout 300000 --project ./tsconfig.json",
+    "test:manual": "NODE_ENV=harness ts-node test/integration/manualLaunchScript.ts",
+    "version": "sed -i '/# version automated/s/[0-9][0-9]*\\.[0-9][0-9]*\\.[0-9][0-9]*/'$npm_package_version'/' synapse_antispam/setup.py && git add synapse_antispam/setup.py && cat synapse_antispam/setup.py"
+  },
+  "devDependencies": {
+    "@types/config": "^3.3.0",
+    "@types/crypto-js": "^4.0.2",
+    "@types/express": "^4.17.13",
+    "@types/html-to-text": "^8.0.1",
+    "@types/humanize-duration": "^3.27.1",
+    "@types/js-yaml": "^4.0.5",
+    "@types/jsdom": "^16.2.11",
+    "@types/mocha": "^9.0.0",
+    "@types/nedb": "^1.8.12",
+    "@types/node": "^16.7.10",
+    "@types/pg": "^8.6.5",
+    "@types/request": "^2.48.8",
+    "@types/shell-quote": "1.7.1",
+    "crypto-js": "^4.1.1",
+    "eslint": "^7.32",
+    "expect": "^27.0.6",
+    "mocha": "^9.0.1",
+    "ts-mocha": "^9.0.2",
+    "tslint": "^6.1.3",
+    "typescript": "^4.8.4",
+    "typescript-formatter": "^7.2"
+  },
+  "dependencies": {
+    "@sentry/node": "^7.17.2",
+    "@sentry/tracing": "^7.17.2",
+    "await-lock": "^2.2.2",
+    "body-parser": "^1.20.1",
+    "config": "^3.3.8",
+    "express": "^4.17",
+    "html-to-text": "^8.0.0",
+    "humanize-duration": "^3.27.1",
+    "humanize-duration-ts": "^2.1.1",
+    "js-yaml": "^4.1.0",
+    "jsdom": "^16.6.0",
+    "matrix-appservice-bridge": "8.0.0",
+    "parse-duration": "^1.0.2",
+    "pg": "^8.8.0",
+    "prom-client": "^14.1.0",
+    "shell-quote": "^1.7.3",
+    "ulidx": "^0.3.0",
+    "yaml": "^2.1.1"
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  }
+}

pkgs/servers/mjolnir/update.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts nodePackages.node2nix gnused nix coreutils jq
-
-set -euo pipefail
-
-latestVersion="$(curl -s "https://api.github.com/repos/matrix-org/mjolnir/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; mjolnir.version or (lib.getVersion mjolnir)" | tr -d '"')
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-  echo "mjolnir is up-to-date: $currentVersion"
-  exit 0
-fi
-
-update-source-version mjolnir 0 0000000000000000000000000000000000000000000000000000000000000000
-update-source-version mjolnir "$latestVersion"
-
-# use patched source
-store_src="$(nix-build . -A mjolnir.src --no-out-link)"
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-node2nix \
-  --nodejs-14 \
-  --development \
-  --node-env ./node-env.nix \
-  --output ./node-deps.nix \
-  --input "$store_src/package.json" \
-  --composition ./node-composition.nix
-

pkgs/tools/misc/mlxbf-bootctl/default.nix

@@ -0,0 +1,31 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mlxbf-bootctl";
+  version = "1.1-6";
+
+  src = fetchFromGitHub {
+    owner = "Mellanox";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-F49ZZtty+NARXA/doAFLhsQn4XkPW6GWLXGy4waIaM0=";
+  };
+
+  installPhase = ''
+    install -D mlxbf-bootctl $out/bin/mlxbf-bootctl
+  '';
+
+  meta = with lib; {
+    description = "Control BlueField boot partitions";
+    homepage = "https://github.com/Mellanox/mlxbf-bootctl";
+    license = licenses.bsd2;
+    changelog = "https://github.com/Mellanox/mlxbf-bootctl/releases/tag/${pname}-${version}";
+    # This package is supposed to only run on a BlueField. Thus aarch64-linux
+    # is the only relevant platform.
+    platforms = [ "aarch64-linux" ];
+    maintainers = with maintainers; [ nikstur ];
+  };
+}

pkgs/tools/misc/shopware-cli/default.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.1.62";
+  version = "0.1.70";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-Vxg3hYUCN4UdBGHN57VXDlGdp+qzq8tbUDPAl/Bse44=";
+    hash = "sha256-lDEpPzoNc6oGqGXdpj3QratjV/JxUlce5R5tqUfgweE=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
-  vendorSha256 = "sha256-O3dJX2w+J9TABkytaJ0ubFg9edVpmo7iPArc+Qqh3M4=";
+  vendorSha256 = "sha256-uWXTT8iCPRRmsJhVDwtOvA4sR0Pm0n50nPq3i7ZRwbo=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"

pkgs/tools/networking/networkd-notify/default.nix

@@ -0,0 +1,49 @@
+{ lib
+, fetchFromGitLab
+, buildPythonApplication
+, dbus-python
+, pygobject3
+, systemd
+, wirelesstools
+}:
+
+buildPythonApplication rec {
+  pname = "networkd-notify";
+  version = "unstable-2022-11-29";
+  # There is no setup.py, just a single Python script.
+  format = "other";
+
+  src = fetchFromGitLab {
+    owner = "wavexx";
+    repo = pname;
+    rev = "c2f3e71076a0f51c097064b1eb2505a361c7cc0e";
+    sha256 = "sha256-fanP1EWERT2Jy4OnMo8OMdR9flginYUgMw+XgmDve3o=";
+  };
+
+  propagatedBuildInputs = [
+    dbus-python
+    pygobject3
+  ];
+
+  patchPhase = ''
+    sed -i \
+      -e '/^NETWORKCTL = /c\NETWORKCTL = ["${systemd}/bin/networkctl"]' \
+      -e '/^IWCONFIG = /c\IWCONFIG = ["${wirelesstools}/bin/iwconfig"]' \
+      networkd-notify
+  '';
+
+  dontBuild = true;
+
+  installPhase = ''
+    install -D networkd-notify -t "$out/bin/"
+    install -D -m0644 networkd-notify.desktop -t "$out/share/applications/"
+  '';
+
+  meta = with lib; {
+    description = "Desktop notification integration for systemd-networkd";
+    homepage = "https://gitlab.com/wavexx/networkd-notify";
+    maintainers = with maintainers; [ danc86 ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/security/kubescape/default.nix

@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-TMK+9C1L+pNIjWg/lahVQk1G4CdfgRLH68XKAfszTys=";
+    hash = "sha256-yzuez5yFarybEW/AtWifdL4DTxGFD/zgSHEVBn0ug24=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-SPIMI9HJRF9r5wZfdynwcTTZiZ7SxuJjfcfPg6dMsGo=";
+  vendorHash = "sha256-tHFwseR6vQ78MX+YOiShW5/mQ7dyG2JxGOluy/Vo8ME=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/top-level/all-packages.nix

@@ -1639,6 +1639,10 @@ with pkgs;
 
   mpy-utils = python3Packages.callPackage ../tools/misc/mpy-utils { };
 
+  networkd-notify = python3Packages.callPackage ../tools/networking/networkd-notify {
+    systemd = pkgs.systemd;
+  };
+
   nominatim = callPackage ../servers/nominatim { };
 
   ocs-url = libsForQt5.callPackage ../tools/misc/ocs-url { };
@@ -32901,6 +32905,8 @@ with pkgs;
 
   mlocate = callPackage ../tools/misc/mlocate { };
 
+  mlxbf-bootctl = callPackage ../tools/misc/mlxbf-bootctl { };
+
   plocate = callPackage ../tools/misc/plocate { };
 
   mypaint = callPackage ../applications/graphics/mypaint { };

pkgs/top-level/linux-kernels.nix

@@ -178,6 +178,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.make-maple-state-reusable-after-mas_empty_area
         kernelPatches.fix-em-ice-bonding
       ];
     };
@@ -186,6 +187,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.make-maple-state-reusable-after-mas_empty_area
         kernelPatches.fix-em-ice-bonding
         kernelPatches.export-rt-sched-migrate
         kernelPatches.CVE-2023-32233
@@ -196,6 +198,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.make-maple-state-reusable-after-mas_empty_area
         kernelPatches.fix-em-ice-bonding
       ];
     };
@@ -204,6 +207,7 @@ in {
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
+        kernelPatches.make-maple-state-reusable-after-mas_empty_area
         kernelPatches.fix-em-ice-bonding
       ];
     };
@@ -213,6 +217,7 @@ in {
         kernelPatches = [
           kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
+          kernelPatches.make-maple-state-reusable-after-mas_empty_area
         ];
       };
       latest = packageAliases.linux_latest.kernel;

pkgs/top-level/pkg-config/tests.nix

@@ -9,7 +9,7 @@ let
   # unsupported platform problems.
   allPkgs = import ../default.nix {
     system = stdenv.hostPlatform.system;
-    localSystem = stdenv.hostPlatform.system;
+    localSystem = stdenv.buildPlatform.system;
     config = {
       allowUnsupportedSystem = true;
     };

pkgs/top-level/python-aliases.nix

@@ -265,6 +265,7 @@ mapAliases ({
   ruamel_yaml_clib = ruamel-yaml-clib; # added 2021-11-01
   runway-python = throw "SDK has been deprecated and was archived by upstream"; # added 2023-05-03
   sapi-python-client = kbcstorage; # added 2022-04-20
+  scikitimage = scikit-image; # added 2023-05-14
   scikitlearn = scikit-learn; # added 2021-07-21
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
   setuptools_scm = setuptools-scm; # added 2021-06-03

pkgs/top-level/python-packages.nix

@@ -2169,6 +2169,11 @@ self: super: with self; {
 
   css-html-js-minify = callPackage ../development/python-modules/css-html-js-minify { };
 
+  css-inline = callPackage ../development/python-modules/css-inline {
+    inherit (pkgs.darwin) libiconv;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
+  };
+
   css-parser = callPackage ../development/python-modules/css-parser { };
 
   cssselect2 = callPackage ../development/python-modules/cssselect2 { };
@@ -2711,6 +2716,8 @@ self: super: with self; {
 
   django-login-required-middleware = callPackage ../development/python-modules/django-login-required-middleware { };
 
+  django-localflavor = callPackage ../development/python-modules/django-localflavor { };
+
   django-mailman3 = callPackage ../development/python-modules/django-mailman3 { };
 
   django-markup = callPackage ../development/python-modules/django-markup { };
@@ -2843,6 +2850,8 @@ self: super: with self; {
 
   dj-search-url = callPackage ../development/python-modules/dj-search-url { };
 
+  dj-static = callPackage ../development/python-modules/dj-static { };
+
   dkimpy = callPackage ../development/python-modules/dkimpy { };
 
   dlib = callPackage ../development/python-modules/dlib {
@@ -10774,7 +10783,7 @@ self: super: with self; {
 
   scikit-hep-testdata = callPackage ../development/python-modules/scikit-hep-testdata { };
 
-  scikitimage = callPackage ../development/python-modules/scikit-image { };
+  scikit-image = callPackage ../development/python-modules/scikit-image { };
 
   scikit-learn = callPackage ../development/python-modules/scikit-learn {
     inherit (pkgs) gfortran glibcLocales;