Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:

- pkgs/tools/package-management/nix/default.nix

.github/CODEOWNERS

@@ -336,9 +336,6 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 /pkgs/build-support/node/fetch-npm-deps         @winterqt
 /doc/languages-frameworks/javascript.section.md @winterqt
 
-# environment.noXlibs option aka NoX
-/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
-
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
 /pkgs/development/compilers/ocaml   @ulrikstrid

maintainers/maintainer-list.nix

@@ -2757,6 +2757,12 @@
     githubId = 10164833;
     name = "Birk Bohne";
   };
+  bjesus = {
+    email = "nixpkgs@yoavmoshe.com";
+    github = "bjesus";
+    githubId = 55081;
+    name = "Yo'av Moshe";
+  };
   bjornfor = {
     email = "bjorn.forsman@gmail.com";
     github = "bjornfor";

nixos/doc/manual/configuration/profiles/minimal.section.md

@@ -1,8 +1,6 @@
 # Minimal {#sec-profile-minimal}
 
 This profile defines a small NixOS configuration. It does not contain any
-graphical stuff. It's a very short file that enables
-[noXlibs](#opt-environment.noXlibs), sets
-[](#opt-i18n.supportedLocales) to
-only support the user-selected locale,
-and [disables packages' documentation](#opt-documentation.enable).
+graphical stuff. It's a very short file that sets [](#opt-i18n.supportedLocales)
+to only support the user-selected locale, and
+[disables packages' documentation](#opt-documentation.enable).

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -54,7 +54,7 @@
 - The [Xen Hypervisor](https://xenproject.org) is once again available as a virtualisation option under [`virtualisation.xen`](#opt-virtualisation.xen.enable).
   - This release includes Xen [4.17.5](https://wiki.xenproject.org/wiki/Xen_Project_4.17_Release_Notes), [4.18.3](https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes) and [4.19.0](https://wiki.xenproject.org/wiki/Xen_Project_4.19_Release_Notes), as well as support for booting the hypervisor on EFI systems.
   ::: {.warning}
-      Booting into Xen through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
+    Booting into Xen through a legacy BIOS bootloader or with the legacy script-based Stage 1 initrd have been **deprecated**. Only EFI booting and the new systemd-based Stage 1 initrd are supported.
   :::
   - There are two flavours of Xen available by default: `xen`, which includes all built-in components, and `xen-slim`, which replaces the built-in components with their Nixpkgs equivalents.
     - The `qemu-xen-traditional` component has been deprecated by upstream Xen, and is no longer available in any of the Xen packages.
@@ -151,6 +151,8 @@
 
 - [ToDesk](https://www.todesk.com/linux.html), a remote desktop applicaton. Available as [services.todesk.enable](#opt-services.todesk.enable).
 
+- [Dependency Track](https://dependencytrack.org/), an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Available as [services.dependency-track](option.html#opt-services.dependency-track).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@@ -264,6 +266,9 @@
 
 - `pkgs.nextcloud27` has been removed since it's EOL.
 
+- The `environment.noXlibs` option has been removed. It was a common source of unexpected rebuilds and breakage that was often hard to diagnose.
+  If you need to disable certain libraries, you're encouraged to add your own overlay to your configuration that targets the packages you care about.
+
 - `frigate` was updated past 0.14.0. This release includes various breaking changes, so please go read the [release notes](https://github.com/blakeblackshear/frigate/releases/tag/v0.14.0).
    Most prominently access to the webinterface and API are now protected by authentication. Retrieve the auto-created
    admin account from the `frigate.service` journal after upgrading.
@@ -531,6 +536,8 @@
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
 
+- Linux 4.19 has been removed because it will reach its end of life within the lifespan of 24.11
+
 - Unprivileged access to the kernel syslog via `dmesg` is now restricted by default. Users wanting to keep an
   unrestricted access to it can set `boot.kernel.sysctl."kernel.dmesg_restrict" = false`.
 

nixos/modules/config/no-x-libs.nix

@@ -1,91 +0,0 @@
-# This module gets rid of all dependencies on X11 client libraries
-# (including fontconfig).
-{ config, lib, ... }:
-{
-  options = {
-    environment.noXlibs = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Switch off the options in the default configuration that
-        require X11 libraries. This includes client-side font
-        configuration and SSH forwarding of X11 authentication
-        in. Thus, you probably do not want to enable this option if
-        you want to run X11 programs on this machine via SSH.
-      '';
-    };
-  };
-
-  config = lib.mkIf config.environment.noXlibs {
-    programs.ssh.setXAuthLocation = false;
-    security.pam.services.su.forwardXAuth = lib.mkForce false;
-
-    fonts.fontconfig.enable = false;
-
-    nixpkgs.overlays = lib.singleton (lib.const (super: {
-      beam = super.beam_nox;
-      cairo = super.cairo.override { x11Support = false; };
-      dbus = super.dbus.override { x11Support = false; };
-      fastfetch = super.fastfetch.override { vulkanSupport = false; waylandSupport = false; x11Support = false; };
-      ffmpeg = super.ffmpeg.override { ffmpegVariant = "headless"; };
-      ffmpeg_4 = super.ffmpeg_4.override { ffmpegVariant = "headless"; };
-      ffmpeg_6 = super.ffmpeg_6.override { ffmpegVariant = "headless"; };
-      ffmpeg_7 = super.ffmpeg_7.override { ffmpegVariant = "headless"; };
-      # dep of graphviz, libXpm is optional for Xpm support
-      gd = super.gd.override { withXorg = false; };
-      ghostscript = super.ghostscript.override { cupsSupport = false; x11Support = false; };
-      gjs = (super.gjs.override { installTests = false; }).overrideAttrs { doCheck = false; }; # avoid test dependency on gtk3
-      gobject-introspection = super.gobject-introspection.override { x11Support = false; };
-      gpg-tui = super.gpg-tui.override { x11Support = false; };
-      gpsd = super.gpsd.override { guiSupport = false; };
-      graphviz = super.graphviz-nox;
-      gst_all_1 = super.gst_all_1 // {
-        gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; };
-        gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableGl = false; enableWayland = false; enableX11 = false; };
-        gst-plugins-good = super.gst_all_1.gst-plugins-good.override { enableWayland = false; enableX11 = false; gtkSupport = false; qt5Support = false; qt6Support = false; };
-        gst-plugins-rs = super.gst_all_1.gst-plugins-rs.override { withGtkPlugins = false; };
-      };
-      imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; };
-      imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; };
-      intel-vaapi-driver = super.intel-vaapi-driver.override { enableGui = false; };
-      libdevil = super.libdevil-nox;
-      libextractor = super.libextractor.override { gtkSupport = false; };
-      libplacebo = super.libplacebo.override { vulkanSupport = false; };
-      libva = super.libva-minimal;
-      limesuite = super.limesuite.override { withGui = false; };
-      mc = super.mc.override { x11Support = false; };
-      mpv-unwrapped = super.mpv-unwrapped.override { drmSupport = false; screenSaverSupport = false; sdl2Support = false; vulkanSupport = false; waylandSupport = false; x11Support = false; };
-      msmtp = super.msmtp.override { withKeyring = false; };
-      mupdf = super.mupdf.override { enableGL = false; enableX11 = false; };
-      neofetch = super.neofetch.override { x11Support = false; };
-      networkmanager-fortisslvpn = super.networkmanager-fortisslvpn.override { withGnome = false; };
-      networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
-      networkmanager-l2tp = super.networkmanager-l2tp.override { withGnome = false; };
-      networkmanager-openconnect = super.networkmanager-openconnect.override { withGnome = false; };
-      networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
-      networkmanager-sstp = super.networkmanager-vpnc.override { withGnome = false; };
-      networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
-      pango = super.pango.override { x11Support = false; };
-      pinentry-curses = super.pinentry-curses.override { withLibsecret = false; };
-      pinentry-tty = super.pinentry-tty.override { withLibsecret = false; };
-      pipewire = super.pipewire.override { vulkanSupport = false; x11Support = false; };
-      pythonPackagesExtensions = super.pythonPackagesExtensions ++ [
-        (python-final: python-prev: {
-          # tk feature requires wayland which fails to compile
-          matplotlib = python-prev.matplotlib.override { enableTk = false; };
-        })
-      ];
-      qemu = super.qemu.override { gtkSupport = false; spiceSupport = false; sdlSupport = false; };
-      qrencode = super.qrencode.overrideAttrs (_: { doCheck = false; });
-      qt5 = super.qt5.overrideScope (lib.const (super': {
-        qtbase = super'.qtbase.override { withGtk3 = false; withQttranslation = false; };
-      }));
-      stoken = super.stoken.override { withGTK3 = false; };
-      # translateManpages -> perlPackages.po4a -> texlive-combined-basic -> texlive-core-big -> libX11
-      util-linux = super.util-linux.override { translateManpages = false; };
-      vim-full = super.vim-full.override { guiSupport = false; };
-      vte = super.vte.override { gtkVersion = null; };
-      zbar = super.zbar.override { enableVideo = false; withXorg = false; };
-    }));
-  };
-}

nixos/modules/module-list.nix

@@ -20,7 +20,6 @@
   ./config/nix-channel.nix
   ./config/nix-flakes.nix
   ./config/nix-remote-build.nix
-  ./config/no-x-libs.nix
   ./config/nsswitch.nix
   ./config/power-management.nix
   ./config/pulseaudio.nix
@@ -1397,6 +1396,7 @@
   ./services/web-apps/crabfit.nix
   ./services/web-apps/davis.nix
   ./services/web-apps/cryptpad.nix
+  ./services/web-apps/dependency-track.nix
   ./services/web-apps/dex.nix
   ./services/web-apps/discourse.nix
   ./services/web-apps/documize.nix

nixos/modules/profiles/minimal.nix

@@ -19,7 +19,7 @@ with lib;
   # Perl is a default package.
   environment.defaultPackages = mkDefault [ ];
 
-  environment.stub-ld.enable = false;
+  environment.stub-ld.enable = mkDefault false;
 
   # The lessopen package pulls in Perl.
   programs.less.lessopen = mkDefault null;
@@ -29,6 +29,8 @@ with lib;
 
   programs.command-not-found.enable = mkDefault false;
 
+  programs.ssh.setXAuthLocation = mkDefault false;
+
   services.logrotate.enable = mkDefault false;
 
   services.udisks2.enable = mkDefault false;

nixos/modules/rename.nix

@@ -21,6 +21,10 @@ in
 
     # Completely removed modules
     (mkRemovedOptionModule [ "environment" "blcr" "enable" ] "The BLCR module has been removed")
+    (mkRemovedOptionModule [ "environment" "noXlibs" ] ''
+      The environment.noXlibs option was removed, as it often caused surprising breakages for new users.
+      If you need its functionality, you can apply similar overlays in your own config.
+    '')
     (mkRemovedOptionModule [ "fonts" "fontconfig" "penultimate" ] "The corresponding package has removed from nixpkgs.")
     (mkRemovedOptionModule [ "hardware" "brightnessctl" ] ''
       The brightnessctl module was removed because newer versions of

nixos/modules/services/web-apps/dependency-track.nix

@@ -0,0 +1,608 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.dependency-track;
+
+  settingsFormat = pkgs.formats.javaProperties { };
+
+  frontendConfigFormat = pkgs.formats.json { };
+  frontendConfigFile = frontendConfigFormat.generate "config.json" {
+    API_BASE_URL = cfg.frontend.baseUrl;
+    OIDC_ISSUER = cfg.oidc.issuer;
+    OIDC_CLIENT_ID = cfg.oidc.clientId;
+    OIDC_SCOPE = cfg.oidc.scope;
+    OIDC_FLOW = cfg.oidc.flow;
+    OIDC_LOGIN_BUTTON_TEXT = cfg.oidc.loginButtonText;
+  };
+
+  sslEnabled =
+    config.services.nginx.virtualHosts.${cfg.nginx.domain}.addSSL
+    || config.services.nginx.virtualHosts.${cfg.nginx.domain}.forceSSL
+    || config.services.nginx.virtualHosts.${cfg.nginx.domain}.onlySSL
+    || config.services.nginx.virtualHosts.${cfg.nginx.domain}.enableACME;
+
+  assertStringPath =
+    optionName: value:
+    if lib.isPath value then
+      throw ''
+        services.dependency-track.${optionName}:
+          ${toString value}
+          is a Nix path, but should be a string, since Nix
+          paths are copied into the world-readable Nix store.
+      ''
+    else
+      value;
+
+  filterNull = lib.filterAttrs (_: v: v != null);
+
+  renderSettings =
+    settings:
+    lib.mapAttrs' (
+      n: v:
+      lib.nameValuePair (lib.toUpper (lib.replaceStrings [ "." ] [ "_" ] n)) (
+        if lib.isBool v then lib.boolToString v else v
+      )
+    ) (filterNull settings);
+in
+{
+  options.services.dependency-track = {
+    enable = lib.mkEnableOption "dependency-track";
+
+    package = lib.mkPackageOption pkgs "dependency-track" { };
+
+    logLevel = lib.mkOption {
+      type = lib.types.enum [
+        "INFO"
+        "WARN"
+        "ERROR"
+        "DEBUG"
+        "TRACE"
+      ];
+      default = "INFO";
+      description = "Log level for dependency-track";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = ''
+        On which port dependency-track should listen for new HTTP connections.
+      '';
+    };
+
+    javaArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "-Xmx4G" ];
+      description = "Java options passed to JVM";
+    };
+
+    database = {
+      type = lib.mkOption {
+        type = lib.types.enum [
+          "h2"
+          "postgresql"
+          "manual"
+        ];
+        default = "postgresql";
+        description = ''
+          `h2` database is not recommended for a production setup.
+          `postgresql` this settings it recommended for production setups.
+          `manual` the module doesn't handle database settings.
+        '';
+      };
+
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether a database should be automatically created on the
+          local host. Set this to false if you plan on provisioning a
+          local database yourself.
+        '';
+      };
+
+      databaseName = lib.mkOption {
+        type = lib.types.str;
+        default = "dependency-track";
+        description = ''
+          Database name to use when connecting to an external or
+          manually provisioned database; has no effect when a local
+          database is automatically provisioned.
+
+          To use this with a local database, set {option}`services.dependency-track.database.createLocally`
+          to `false` and create the database and user.
+        '';
+      };
+
+      username = lib.mkOption {
+        type = lib.types.str;
+        default = "dependency-track";
+        description = ''
+          Username to use when connecting to an external or manually
+          provisioned database; has no effect when a local database is
+          automatically provisioned.
+
+          To use this with a local database, set {option}`services.dependency-track.database.createLocally`
+          to `false` and create the database and user.
+        '';
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.path;
+        example = "/run/keys/db_password";
+        apply = assertStringPath "passwordFile";
+        description = ''
+          The path to a file containing the database password.
+        '';
+      };
+    };
+
+    ldap.bindPasswordFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/run/keys/ldap_bind_password";
+      apply = assertStringPath "bindPasswordFile";
+      description = ''
+        The path to a file containing the LDAP bind password.
+      '';
+    };
+
+    frontend = {
+      baseUrl = lib.mkOption {
+        type = lib.types.str;
+        default = lib.optionalString cfg.nginx.enable "${
+          if sslEnabled then "https" else "http"
+        }://${cfg.nginx.domain}";
+        defaultText = lib.literalExpression ''
+          lib.optionalString config.services.dependency-track.nginx.enable "''${
+            if sslEnabled then "https" else "http"
+          }://''${config.services.dependency-track.nginx.domain}";
+        '';
+        description = ''
+          The base URL of the API server.
+
+          NOTE:
+          * This URL must be reachable by the browsers of your users.
+          * The frontend container itself does NOT communicate with the API server directly, it just serves static files.
+          * When deploying to dedicated servers, please use the external IP or domain of the API server.
+        '';
+      };
+    };
+
+    oidc = {
+      enable = lib.mkEnableOption "oidc support";
+      issuer = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Defines the issuer URL to be used for OpenID Connect.
+          See alpine.oidc.issuer property of the API server.
+        '';
+      };
+      clientId = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Defines the client ID for OpenID Connect.
+        '';
+      };
+      scope = lib.mkOption {
+        type = lib.types.str;
+        default = "openid profile email";
+        description = ''
+          Defines the scopes to request for OpenID Connect.
+          See also: https://openid.net/specs/openid-connect-basic-1_0.html#Scopes
+        '';
+      };
+      flow = lib.mkOption {
+        type = lib.types.enum [
+          "code"
+          "implicit"
+        ];
+        default = "code";
+        description = ''
+          Specifies the OpenID Connect flow to use.
+          Values other than "implicit" will result in the Code+PKCE flow to be used.
+          Usage of the implicit flow is strongly discouraged, but may be necessary when
+          the IdP of choice does not support the Code+PKCE flow.
+          See also:
+            - https://oauth.net/2/grant-types/implicit/
+            - https://oauth.net/2/pkce/
+        '';
+      };
+      loginButtonText = lib.mkOption {
+        type = lib.types.str;
+        default = "Login with OpenID Connect";
+        description = ''
+          Defines the scopes to request for OpenID Connect.
+          See also: https://openid.net/specs/openid-connect-basic-1_0.html#Scopes
+        '';
+      };
+      usernameClaim = lib.mkOption {
+        type = lib.types.str;
+        default = "name";
+        example = "preferred_username";
+        description = ''
+          Defines the name of the claim that contains the username in the provider's userinfo endpoint.
+          Common claims are "name", "username", "preferred_username" or "nickname".
+          See also: https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
+        '';
+      };
+      userProvisioning = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Specifies if mapped OpenID Connect accounts are automatically created upon successful
+          authentication. When a user logs in with a valid access token but an account has
+          not been previously provisioned, an authentication failure will be returned.
+          This allows admins to control specifically which OpenID Connect users can access the
+          system and which users cannot. When this value is set to true, a local OpenID Connect
+          user will be created and mapped to the OpenID Connect account automatically. This
+          automatic provisioning only affects authentication, not authorization.
+        '';
+      };
+      teamSynchronization = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        example = true;
+        description = ''
+          This option will ensure that team memberships for OpenID Connect users are dynamic and
+          synchronized with membership of OpenID Connect groups or assigned roles. When a team is
+          mapped to an OpenID Connect group, all local OpenID Connect users will automatically be
+          assigned to the team if they are a member of the group the team is mapped to. If the user
+          is later removed from the OpenID Connect group, they will also be removed from the team. This
+          option provides the ability to dynamically control user permissions via the identity provider.
+          Note that team synchronization is only performed during user provisioning and after successful
+          authentication.
+        '';
+      };
+      teams = {
+        claim = lib.mkOption {
+          type = lib.types.str;
+          default = "groups";
+          description = ''
+            Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint.
+            The claim must be an array of strings. Most public identity providers do not support group or role management.
+            When using a customizable / on-demand hosted identity provider, name, content, and inclusion in the userinfo endpoint
+            will most likely need to be configured.
+          '';
+        };
+        default = lib.mkOption {
+          type = lib.types.nullOr lib.types.commas;
+          default = null;
+          description = ''
+            Defines one or more team names that auto-provisioned OIDC users shall be added to.
+            Multiple team names may be provided as comma-separated list.
+
+            Has no effect when {option}`services.dependency-track.oidc.userProvisioning`=false,
+            or {option}`services.dependency-track.oidc.teamSynchronization`=true.
+          '';
+        };
+      };
+    };
+
+    nginx = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to set up an nginx virtual host.
+        '';
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "dtrack.example.com";
+        description = ''
+          The domain name under which to set up the virtual host.
+        '';
+      };
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          "alpine.data.directory" = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/dependency-track";
+            description = ''
+              Defines the path to the data directory. This directory will hold logs, keys,
+              and any database or index files along with application-specific files or
+              directories.
+            '';
+          };
+          "alpine.database.mode" = lib.mkOption {
+            type = lib.types.enum [
+              "server"
+              "embedded"
+              "external"
+            ];
+            default =
+              if cfg.database.type == "h2" then
+                "embedded"
+              else if cfg.database.type == "postgresql" then
+                "external"
+              else
+                null;
+            defaultText = lib.literalExpression ''
+              if config.services.dependency-track.database.type == "h2" then "embedded"
+              else if config.services.dependency-track.database.type == "postgresql" then "external"
+              else null
+            '';
+            description = ''
+              Defines the database mode of operation. Valid choices are:
+              'server', 'embedded', and 'external'.
+              In server mode, the database will listen for connections from remote hosts.
+              In embedded mode, the system will be more secure and slightly faster.
+              External mode should be used when utilizing an external database server
+              (i.e. mysql, postgresql, etc).
+            '';
+          };
+          "alpine.database.url" = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.database.type == "h2" then
+                "jdbc:h2:/var/lib/dependency-track/db"
+              else if cfg.database.type == "postgresql" then
+                "jdbc:postgresql:${cfg.database.databaseName}?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=/run/postgresql/.s.PGSQL.5432"
+              else
+                null;
+
+            defaultText = lib.literalExpression ''
+              if config.services.dependency-track.database.type == "h2" then "jdbc:h2:/var/lib/dependency-track/db"
+                else if config.services.dependency-track.database.type == "postgresql" then "jdbc:postgresql:''${config.services.dependency-track.database.name}?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=/run/postgresql/.s.PGSQL.5432"
+                else null
+            '';
+            description = "Specifies the JDBC URL to use when connecting to the database.";
+          };
+          "alpine.database.driver" = lib.mkOption {
+            type = lib.types.enum [
+              "org.h2.Driver"
+              "org.postgresql.Driver"
+              "com.microsoft.sqlserver.jdbc.SQLServerDriver"
+              "com.mysql.cj.jdbc.Driver"
+            ];
+            default =
+              if cfg.database.type == "h2" then
+                "org.h2.Driver"
+              else if cfg.database.type == "postgresql" then
+                "org.postgresql.Driver"
+              else
+                null;
+            defaultText = lib.literalExpression ''
+              if config.services.dependency-track.database.type == "h2" then "org.h2.Driver"
+              else if config.services.dependency-track.database.type == "postgresql" then "org.postgresql.Driver"
+              else null;
+            '';
+            description = "Specifies the JDBC driver class to use.";
+          };
+          "alpine.database.username" = lib.mkOption {
+            type = lib.types.str;
+            default = if cfg.database.createLocally then "dependency-track" else cfg.database.username;
+            defaultText = lib.literalExpression ''
+              if config.services.dependency-track.database.createLocally then "dependency-track"
+              else config.services.dependency-track.database.username
+            '';
+            description = "Specifies the username to use when authenticating to the database.";
+          };
+          "alpine.ldap.enabled" = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Defines if LDAP will be used for user authentication. If enabled,
+              alpine.ldap.* properties should be set accordingly.
+            '';
+          };
+          "alpine.oidc.enabled" = lib.mkOption {
+            type = lib.types.bool;
+            default = cfg.oidc.enable;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.enable";
+            description = ''
+              Defines if OpenID Connect will be used for user authentication.
+              If enabled, alpine.oidc.* properties should be set accordingly.
+            '';
+          };
+          "alpine.oidc.client.id" = lib.mkOption {
+            type = lib.types.str;
+            default = cfg.oidc.clientId;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.clientId";
+            description = ''
+              Defines the client ID to be used for OpenID Connect.
+              The client ID should be the same as the one configured for the frontend,
+              and will only be used to validate ID tokens.
+            '';
+          };
+          "alpine.oidc.issuer" = lib.mkOption {
+            type = lib.types.str;
+            default = cfg.oidc.issuer;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.issuer";
+            description = ''
+              Defines the issuer URL to be used for OpenID Connect.
+              This issuer MUST support provider configuration via the /.well-known/openid-configuration endpoint.
+              See also:
+              - https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+              - https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig
+            '';
+          };
+          "alpine.oidc.username.claim" = lib.mkOption {
+            type = lib.types.str;
+            default = cfg.oidc.usernameClaim;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.usernameClaim";
+            description = ''
+              Defines the name of the claim that contains the username in the provider's userinfo endpoint.
+              Common claims are "name", "username", "preferred_username" or "nickname".
+              See also: https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
+            '';
+          };
+          "alpine.oidc.user.provisioning" = lib.mkOption {
+            type = lib.types.bool;
+            default = cfg.oidc.userProvisioning;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.userProvisioning";
+            description = ''
+              Specifies if mapped OpenID Connect accounts are automatically created upon successful
+              authentication. When a user logs in with a valid access token but an account has
+              not been previously provisioned, an authentication failure will be returned.
+              This allows admins to control specifically which OpenID Connect users can access the
+              system and which users cannot. When this value is set to true, a local OpenID Connect
+              user will be created and mapped to the OpenID Connect account automatically. This
+              automatic provisioning only affects authentication, not authorization.
+            '';
+          };
+          "alpine.oidc.team.synchronization" = lib.mkOption {
+            type = lib.types.bool;
+            default = cfg.oidc.teamSynchronization;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.teamSynchronization";
+            description = ''
+              This option will ensure that team memberships for OpenID Connect users are dynamic and
+              synchronized with membership of OpenID Connect groups or assigned roles. When a team is
+              mapped to an OpenID Connect group, all local OpenID Connect users will automatically be
+              assigned to the team if they are a member of the group the team is mapped to. If the user
+              is later removed from the OpenID Connect group, they will also be removed from the team. This
+              option provides the ability to dynamically control user permissions via the identity provider.
+              Note that team synchronization is only performed during user provisioning and after successful
+              authentication.
+            '';
+          };
+          "alpine.oidc.teams.claim" = lib.mkOption {
+            type = lib.types.str;
+            default = cfg.oidc.teams.claim;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.teams.claim";
+            description = ''
+              Defines the name of the claim that contains group memberships or role assignments in the provider's userinfo endpoint.
+              The claim must be an array of strings. Most public identity providers do not support group or role management.
+              When using a customizable / on-demand hosted identity provider, name, content, and inclusion in the userinfo endpoint
+              will most likely need to be configured.
+            '';
+          };
+          "alpine.oidc.teams.default" = lib.mkOption {
+            type = lib.types.nullOr lib.types.commas;
+            default = cfg.oidc.teams.default;
+            defaultText = lib.literalExpression "config.services.dependency-track.oidc.teams.default";
+            description = ''
+              Defines one or more team names that auto-provisioned OIDC users shall be added to.
+              Multiple team names may be provided as comma-separated list.
+
+              Has no effect when {option}`services.dependency-track.oidc.userProvisioning`=false,
+              or {option}`services.dependency-track.oidc.teamSynchronization`=true.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = "See https://docs.dependencytrack.org/getting-started/configuration/#default-configuration for possible options";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = lib.mkIf cfg.nginx.enable {
+      enable = true;
+      recommendedGzipSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedProxySettings = lib.mkDefault true;
+      recommendedTlsSettings = lib.mkDefault true;
+      upstreams.dependency-track.servers."localhost:${toString cfg.port}" = { };
+      virtualHosts.${cfg.nginx.domain} = {
+        locations = {
+          "/".proxyPass = "http://dependency-track";
+          "= /static/config.json".alias = frontendConfigFile;
+        };
+      };
+    };
+
+    systemd.services.dependency-track-postgresql-init = lib.mkIf cfg.database.createLocally {
+      after = [ "postgresql.service" ];
+      before = [ "dependency-track.service" ];
+      bindsTo = [ "postgresql.service" ];
+      path = [ config.services.postgresql.package ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = "postgres";
+        Group = "postgres";
+        LoadCredential = [ "db_password:${cfg.database.passwordFile}" ];
+        PrivateTmp = true;
+      };
+      script = ''
+        set -eou pipefail
+        shopt -s inherit_errexit
+
+        # Read the password from the credentials directory and
+        # escape any single quotes by adding additional single
+        # quotes after them, following the rules laid out here:
+        # https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-CONSTANTS
+        db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
+        db_password="''${db_password//\'/\'\'}"
+
+        echo "CREATE ROLE \"dependency-track\" WITH LOGIN PASSWORD '$db_password' CREATEDB" > /tmp/create_role.sql
+        psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='dependency-track'" | grep -q 1 || psql -tA --file="/tmp/create_role.sql"
+        psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'dependency-track'" | grep -q 1 || psql -tAc 'CREATE DATABASE "dependency-track" OWNER "dependency-track"'
+      '';
+    };
+
+    services.postgresql.enable = lib.mkIf cfg.database.createLocally (lib.mkDefault true);
+
+    systemd.services."dependency-track" =
+      let
+        databaseServices =
+          if cfg.database.createLocally then
+            [
+              "dependency-track-postgresql-init.service"
+              "postgresql.service"
+            ]
+          else
+            [ ];
+      in
+      {
+        description = "Dependency Track";
+        wantedBy = [ "multi-user.target" ];
+        requires = databaseServices;
+        after = databaseServices;
+        # provide settings via env vars to allow overriding default settings.
+        environment = {
+          HOME = "%S/dependency-track";
+        } // renderSettings cfg.settings;
+        serviceConfig = {
+          User = "dependency-track";
+          Group = "dependency-track";
+          DynamicUser = true;
+          StateDirectory = "dependency-track";
+          LoadCredential =
+            [ "db_password:${cfg.database.passwordFile}" ]
+            ++ lib.optional cfg.settings."alpine.ldap.enabled"
+              "ldap_bind_password:${cfg.ldap.bindPasswordFile}";
+        };
+        script = ''
+          set -eou pipefail
+          shopt -s inherit_errexit
+
+          export ALPINE_DATABASE_PASSWORD_FILE="$CREDENTIALS_DIRECTORY/db_password"
+          ${lib.optionalString cfg.settings."alpine.ldap.enabled" ''
+            export ALPINE_LDAP_BIND_PASSWORD="$(<"$CREDENTIALS_DIRECTORY/ldap_bind_password")"
+          ''}
+
+          exec ${lib.getExe pkgs.jre_headless} ${
+            lib.escapeShellArgs (
+              cfg.javaArgs
+              ++ [
+                "-DdependencyTrack.logging.level=${cfg.logLevel}"
+                "-jar"
+                "${cfg.package}/share/dependency-track/dependency-track.jar"
+                "-port"
+                "${toString cfg.port}"
+              ]
+            )
+          }
+        '';
+      };
+  };
+
+  meta = {
+    maintainers = lib.teams.cyberus.members;
+  };
+}

nixos/tests/all-tests.nix

@@ -255,6 +255,7 @@ in {
   deepin = handleTest ./deepin.nix {};
   deluge = handleTest ./deluge.nix {};
   dendrite = handleTest ./matrix/dendrite.nix {};
+  dependency-track = handleTest ./dependency-track.nix {};
   devpi-server = handleTest ./devpi-server.nix {};
   dex-oidc = handleTest ./dex-oidc.nix {};
   dhparams = handleTest ./dhparams.nix {};

nixos/tests/dependency-track.nix

@@ -0,0 +1,65 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  let
+    dependencyTrackPort = 8081;
+  in
+  {
+    name = "dependency-track";
+    meta = {
+      maintainers = pkgs.lib.teams.cyberus.members;
+    };
+
+    nodes = {
+      server =
+        { pkgs, ... }:
+        {
+          virtualisation = {
+            cores = 2;
+            diskSize = 4096;
+          };
+
+          environment.systemPackages = with pkgs; [ curl ];
+          systemd.services.dependency-track = {
+            # source: https://github.com/DependencyTrack/dependency-track/blob/37e0ba59e8057c18a87a7a76e247a8f75677a56c/dev/scripts/data-nist-generate-dummy.sh
+            preStart = ''
+              set -euo pipefail
+
+              NIST_DIR="$HOME/.dependency-track/nist"
+
+              rm -rf "$NIST_DIR"
+              mkdir -p "$NIST_DIR"
+
+              for feed in $(seq "2024" "2002"); do
+                touch "$NIST_DIR/nvdcve-1.1-$feed.json.gz"
+                echo "9999999999999" > "$NIST_DIR/nvdcve-1.1-$feed.json.gz.ts"
+              done
+            '';
+          };
+          services.dependency-track = {
+            enable = true;
+            port = dependencyTrackPort;
+            nginx.domain = "localhost";
+            database.passwordFile = "${pkgs.writeText "dbPassword" ''hunter2'THE'''H''''E''}";
+          };
+        };
+    };
+
+    testScript = ''
+      import json
+
+      start_all()
+
+      server.wait_for_unit("dependency-track.service")
+      server.wait_until_succeeds(
+        "journalctl -o cat -u dependency-track.service | grep 'Dependency-Track is ready'"
+      )
+      server.wait_for_open_port(${toString dependencyTrackPort})
+
+      with subtest("version api returns correct version"):
+        version = json.loads(
+          server.succeed("curl http://localhost/api/version")
+        )
+        assert version["version"] == "${pkgs.dependency-track.version}"
+    '';
+  }
+)

nixos/tests/kernel-generic.nix

@@ -25,7 +25,6 @@ let
   }) args);
   kernels = pkgs.linuxKernel.vanillaPackages // {
     inherit (pkgs.linuxKernel.packages)
-      linux_4_19_hardened
       linux_5_4_hardened
       linux_5_10_hardened
       linux_5_15_hardened

pkgs/applications/audio/carla/default.nix

@@ -26,13 +26,13 @@ assert withQt -> wrapQtAppsHook != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "carla";
-  version = "2.5.8";
+  version = "2.5.9";
 
   src = fetchFromGitHub {
     owner = "falkTX";
     repo = "carla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-H15T/z/IRfgWdqToTzq2eJ7q3n9Kj44IZXsd4uaipuU=";
+    hash = "sha256-FM/6TtNhDml1V9C5VisjLcZ3CzXsuwCZrsoz4yP3kI8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/neovim/build-neovim-plugin.nix

@@ -11,13 +11,15 @@ in
   # function to create vim plugin from lua packages that are already packaged in
   # luaPackages
   {
-    # the lua attribute name that matches this vim plugin. Both should be equal
-    # in the majority of cases but we make it possible to have different attribute names
-    luaAttr ? (normalizeName attrs.pname)
+    # the lua derivation to convert into a neovim plugin
+     luaAttr ? (lua.pkgs.${normalizeName attrs.pname})
     , ...
   }@attrs:
     let
-      originalLuaDrv = lua.pkgs.${luaAttr};
+      originalLuaDrv = if (lib.typeOf luaAttr == "string") then
+        lib.warn "luaAttr as string is deprecated since September 2024. Pass a lua derivation directly ( e.g., `buildNeovimPlugin { luaAttr = lua.pkgs.plenary-nvim; }`)" lua.pkgs.${normalizeName luaAttr}
+        else luaAttr;
+
 
       luaDrv = originalLuaDrv.overrideAttrs (oa: {
         version = attrs.version or oa.version;

pkgs/applications/editors/vim/plugins/default.nix

@@ -1,7 +1,7 @@
 # TODO check that no license information gets lost
 { callPackage, config, lib, vimUtils, vim, darwin, llvmPackages
+, neovim-unwrapped
 , neovimUtils
-, luaPackages
 }:
 
 let
@@ -27,7 +27,7 @@ let
   overrides = callPackage ./overrides.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreFoundation CoreServices;
     inherit buildVimPlugin;
-    inherit llvmPackages luaPackages;
+    inherit llvmPackages;
   };
 
   aliases = if config.allowAliases then (import ./aliases.nix lib) else final: prev: {};

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -36,6 +36,7 @@
 , languagetool
 , llvmPackages
 , meson
+, neovim-unwrapped
 , nim1
 , nodePackages
 , openscad
@@ -129,10 +130,12 @@
 , # hurl dependencies
   hurl
 , # must be lua51Packages
-  luaPackages
-, luajitPackages
+  luajitPackages
 ,
 }: self: super:
+let
+  luaPackages = neovim-unwrapped.lua.pkgs;
+in
 {
   alpha-nvim = super.alpha-nvim.overrideAttrs {
     dependencies = [
@@ -452,12 +455,12 @@
 
   codesnap-nvim =
     let
-      version = "1.6.0";
+      version = "1.6.1";
       src = fetchFromGitHub {
         owner = "mistricky";
         repo = "codesnap.nvim";
         rev = "refs/tags/v${version}";
-        hash = "sha256-3z0poNmS6LOS7/qGTBhvz1Q9WpYC7Wu4rNvHsUXB5ZY=";
+        hash = "sha256-OmSgrTYDtNb2plMyzjVvxGrfXB/lGKDpUQhpRqKfAMA=";
       };
       codesnap-lib = rustPlatform.buildRustPackage {
         pname = "codesnap-lib";
@@ -465,7 +468,7 @@
 
         sourceRoot = "${src.name}/generator";
 
-        cargoHash = "sha256-u0NvChN50LIxUhmsT4mvWs5xB/TwJkMabggFePA/b1E=";
+        cargoHash = "sha256-6n37n8oHIHrz3S1+40nuD0Ud3l0iNgXig1ZwrgsnYTI=";
 
         nativeBuildInputs = [
           pkg-config
@@ -915,7 +918,7 @@
     dependencies = with self; [ nvim-treesitter ];
   };
 
-  haskell-tools-nvim = neovimUtils.buildNeovimPlugin { luaAttr = "haskell-tools-nvim"; };
+  haskell-tools-nvim = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.haskell-tools-nvim; };
 
   hex-nvim = super.hex-nvim.overrideAttrs {
     postPatch = ''
@@ -1058,7 +1061,7 @@
   };
 
   lsp-progress-nvim = neovimUtils.buildNeovimPlugin {
-    luaAttr = "lsp-progress-nvim";
+    luaAttr = luaPackages.lsp-progress-nvim;
     nvimRequireCheck = "lsp-progress";
   };
 
@@ -1066,11 +1069,11 @@
     dependencies = with self; [ luaPackages.jsregexp ];
   };
 
-  lz-n = neovimUtils.buildNeovimPlugin { luaAttr = "lz-n"; };
+  lz-n = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.lz-n; };
 
-  lze = neovimUtils.buildNeovimPlugin { luaAttr = "lze"; };
+  lze = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.lze; };
 
-  lzn-auto-require = neovimUtils.buildNeovimPlugin { luaAttr = "lzn-auto-require"; };
+  lzn-auto-require = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.lzn-auto-require; };
 
   magma-nvim-goose = buildVimPlugin {
     pname = "magma-nvim-goose";
@@ -1146,7 +1149,7 @@
   };
 
   middleclass = neovimUtils.buildNeovimPlugin {
-    luaAttr = "middleclass";
+    luaAttr = luaPackages.middleclass;
     nvimRequireCheck = "middleclass";
   };
 
@@ -1506,17 +1509,17 @@
     ];
   };
 
-  rocks-nvim = neovimUtils.buildNeovimPlugin { luaAttr = "rocks-nvim"; };
+  rocks-nvim = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.rocks-nvim; };
 
-  rocks-config-nvim = neovimUtils.buildNeovimPlugin { luaAttr = "rocks-config-nvim"; };
+  rocks-config-nvim = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.rocks-config-nvim; };
 
   roslyn-nvim = super.roslyn-nvim.overrideAttrs {
     dependencies = with self; [ nvim-lspconfig ];
   };
 
-  rtp-nvim = neovimUtils.buildNeovimPlugin { luaAttr = "rtp-nvim"; };
+  rtp-nvim = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.rtp-nvim; };
 
-  rustaceanvim = neovimUtils.buildNeovimPlugin { luaAttr = "rustaceanvim"; };
+  rustaceanvim = neovimUtils.buildNeovimPlugin { luaAttr = luaPackages.rustaceanvim; };
 
   sg-nvim = super.sg-nvim.overrideAttrs (old:
     let

pkgs/applications/editors/vim/plugins/updater.nix

@@ -33,12 +33,12 @@ buildPythonApplication {
 
     # wrap python scripts
     makeWrapperArgs+=( --prefix PATH : "${lib.makeBinPath [
-      nix nix-prefetch-git neovim-unwrapped nurl ]}" --prefix PYTHONPATH : "${./.}:${../../../../../maintainers/scripts}" )
+      nix nix-prefetch-git neovim-unwrapped nurl ]}" --prefix PYTHONPATH : "${./.}:${../../../../../maintainers/scripts/pluginupdate-py}" )
     wrapPythonPrograms
   '';
 
   shellHook = ''
-    export PYTHONPATH=pkgs/applications/editors/vim/plugins:maintainers/scripts:$PYTHONPATH
+    export PYTHONPATH=pkgs/applications/editors/vim/plugins:maintainers/scripts/pluginupdate-py:$PYTHONPATH
     '';
 
   meta.mainProgram = "vim-plugins-updater";

pkgs/applications/misc/lunatask/default.nix

@@ -1,12 +1,12 @@
 { lib, appimageTools, fetchurl }:
 
 let
-  version = "2.0.4";
+  version = "2.0.9";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-U+yelFSulAhgsn5xt45mxC7qGpQwmb3m3lt9nEW6MHU=";
+    sha256 = "sha256-tV3giMBF3DN8Aop1B1D7pGp3HYPMQlcZ52JrOhxFrEE=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/networking/cluster/kubelogin-oidc/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.29.0";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fGCllV07YustUIX1XiSvsC42obDOgl2yV5ruQMT2R0c=";
+    sha256 = "sha256-DHg46t0gMypK6Nj428gpOMtPuA+XcW4IJU39CHTVGPw=";
   };
 
   subPackages = ["."];
 
-  vendorHash = "sha256-wtxSoRSpmRwuIOdKGmCRR+QLwOvONiiltg6KL6t2cf8=";
+  vendorHash = "sha256-gr+SsC7MiLj/MZ8kca5Hcfge+7Pm4y963TfwyKHEhBY=";
 
   # Rename the binary instead of symlinking to avoid conflict with the
   # Azure version of kubelogin

pkgs/applications/networking/protonvpn-gui/default.nix

@@ -16,8 +16,6 @@
   proton-vpn-killswitch-network-manager,
   proton-vpn-logger,
   proton-vpn-network-manager,
-  proton-vpn-network-manager-openvpn,
-  proton-vpn-network-manager-wireguard,
   proton-vpn-session,
   pycairo,
   pygobject3,
@@ -67,8 +65,6 @@ buildPythonApplication rec {
     proton-vpn-killswitch-network-manager
     proton-vpn-logger
     proton-vpn-network-manager
-    proton-vpn-network-manager-openvpn
-    proton-vpn-network-manager-wireguard
     proton-vpn-session
     pycairo
     pygobject3

pkgs/applications/version-management/git-cliff/default.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    hash = "sha256-d6IawXBumA5ZJiigMTx4IZgOFrH5bNrbRsNHfT4Ik3w=";
+    hash = "sha256-GRvZ9jdooduFylTGgUQNjdnD2Aa+jT5faV0/c3GBpqw=";
   };
 
-  cargoHash = "sha256-zXcVOE+yTD4SsVNTYhXnKy6et5en9jzYXPKPVnCOixI=";
+  cargoHash = "sha256-vgVTHTEKfjWJzxDQ5w0dwp9qxyN5sgbBseXHN25bx9o=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;

pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh

@@ -60,8 +60,10 @@ composerVendorBuildHook() {
     echo "Executing composerVendorBuildHook"
 
     composer \
-        --apcu-autoloader \
-        --apcu-autoloader-prefix="$(jq -r -c 'try ."content-hash"' < composer.lock)" \
+        # The acpu-autoloader is not reproducible and has to be disabled.
+        # Upstream PR: https://github.com/composer/composer/pull/12090
+        # --apcu-autoloader \
+        # --apcu-autoloader-prefix="$(jq -r -c 'try ."content-hash"' < composer.lock)" \
         --no-interaction \
         --no-progress \
         --optimize-autoloader \

pkgs/by-name/ac/actionlint/package.nix

@@ -1,16 +1,20 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, makeWrapper
-, python3Packages
-, ronn
-, shellcheck
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  makeWrapper,
+  python3Packages,
+  ronn,
+  shellcheck,
 }:
 
-buildGoModule rec {
-  pname = "actionlint";
+let
   version = "1.7.1";
+in
+buildGoModule {
+  pname = "actionlint";
+  inherit version;
 
   subPackages = [ "cmd/actionlint" ];
 
@@ -23,23 +27,36 @@ buildGoModule rec {
 
   vendorHash = "sha256-ZREtrdHUD1B1Mogidp1y/kFTK+KR4qYJj1c/M+0utPM=";
 
-  nativeBuildInputs = [ makeWrapper ronn installShellFiles ];
+  nativeBuildInputs = [
+    makeWrapper
+    ronn
+    installShellFiles
+  ];
 
   postInstall = ''
     ronn --roff man/actionlint.1.ronn
     installManPage man/actionlint.1
     wrapProgram "$out/bin/actionlint" \
-      --prefix PATH : ${lib.makeBinPath [ python3Packages.pyflakes shellcheck ]}
+      --prefix PATH : ${
+        lib.makeBinPath [
+          python3Packages.pyflakes
+          shellcheck
+        ]
+      }
   '';
 
-  ldflags = [ "-s" "-w" "-X github.com/rhysd/actionlint.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/rhysd/actionlint.version=${version}"
+  ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://rhysd.github.io/actionlint/";
     description = "Static checker for GitHub Actions workflow files";
     changelog = "https://github.com/rhysd/actionlint/raw/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ momeemt ];
     mainProgram = "actionlint";
   };
 }

pkgs/by-name/al/algolia-cli/package.nix

@@ -1,8 +1,15 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-
-buildGoModule rec {
-  pname = "algolia-cli";
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+let
   version = "1.6.11";
+in
+buildGoModule {
+  pname = "algolia-cli";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "algolia";
@@ -17,7 +24,11 @@ buildGoModule rec {
 
   subPackages = [ "cmd/algolia" ];
 
-  ldflags = [ "-s" "-w" "-X github.com/algolia/cli/pkg/version.Version=${version}" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/algolia/cli/pkg/version.Version=${version}"
+  ];
 
   postInstall = ''
     installShellCompletion --cmd algolia \
@@ -26,11 +37,11 @@ buildGoModule rec {
       --zsh <($out/bin/algolia completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Algolia’s official CLI devtool";
     mainProgram = "algolia";
     homepage = "https://algolia.com/doc/tools/cli/";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ momeemt ];
   };
 }

pkgs/by-name/cb/cbeams/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cbeams";
+  version = "1.0.3";
+  pyproject = true;
+
+  disabled = !python3Packages.isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-8Q2sWsAc39Mu34K1wWOKOJERKzBStE4GmtuzOs2T7Kk=";
+  };
+
+  build-system = [ python3Packages.setuptools ];
+
+  postPatch = ''
+    substituteInPlace cbeams/terminal.py \
+      --replace-fail "blessings" "blessed"
+  '';
+
+  pythonRemoveDeps = [ "blessings" ];
+
+  dependencies = with python3Packages; [
+    blessed
+    docopt
+  ];
+
+  doCheck = false; # no tests
+
+  meta = {
+    homepage = "https://github.com/tartley/cbeams";
+    description = "Command-line program to draw animated colored circles in the terminal";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      oxzi
+      sigmanificient
+    ];
+  };
+}

pkgs/by-name/cr/crossplane-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "crossplane-cli";
-  version = "1.16.1";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "crossplane";
     repo = "crossplane";
     rev = "v${version}";
-    hash = "sha256-wRbQKpWEzos5fzzf1tUF2xQAlk8KIrhXJ/QZ9JKCa2M=";
+    hash = "sha256-zcORVw+6QUucxJkHx/QWOHn50fd4+Jp+ZtiGuwfEQ6I=";
   };
 
-  vendorHash = "sha256-XzIDLtEP4wrz23Cewz1QFuS62F/XQr7JNoaPAQfanEs=";
+  vendorHash = "sha256-de9xt3aFmGDddwMO2GgKKKmSfvsfnpit3wUrBme//fI=";
 
   ldflags = [
     "-s"

pkgs/by-name/de/dependency-track/0000-remove-frontend-download.patch

@@ -0,0 +1,44 @@
+diff --git a/pom.xml b/pom.xml
+index 9988e765..906917c0 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -660,38 +660,13 @@
+                         <artifactId>maven-antrun-plugin</artifactId>
+                         <version>3.1.0</version>
+                         <executions>
+-                            <execution>
+-                                <id>frontend-download</id>
+-                                <phase>prepare-package</phase>
+-                                <configuration>
+-                                    <target>
+-                                        <get src="https://github.com/DependencyTrack/frontend/releases/download/${frontend.version}/frontend-dist.zip" dest="${project.build.directory}" verbose="true"/>
+-                                    </target>
+-                                </configuration>
+-                                <goals>
+-                                    <goal>run</goal>
+-                                </goals>
+-                            </execution>
+-                            <execution>
+-                                <id>frontend-extract</id>
+-                                <phase>prepare-package</phase>
+-                                <configuration>
+-                                    <target>
+-                                        <unzip src="${project.build.directory}/frontend-dist.zip" dest="${project.build.directory}/frontend">
+-                                        </unzip>
+-                                    </target>
+-                                </configuration>
+-                                <goals>
+-                                    <goal>run</goal>
+-                                </goals>
+-                            </execution>
+                             <execution>
+                                 <id>frontend-resource-deploy</id>
+                                 <phase>prepare-package</phase>
+                                 <configuration>
+                                     <target>
+                                         <copy todir="${project.build.directory}/${project.artifactId}">
+-                                            <fileset dir="${project.build.directory}/frontend/dist">
++                                            <fileset dir="${project.basedir}/frontend/dist">
+                                                 <include name="**/*"/>
+                                             </fileset>
+                                         </copy>

pkgs/by-name/de/dependency-track/0001-add-junixsocket.patch

@@ -0,0 +1,17 @@
+diff --git a/pom.xml b/pom.xml
+index 9988e765..f69576b4 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -457,6 +457,12 @@
+             <version>${lib.testcontainers.version}</version>
+             <scope>test</scope>
+         </dependency>
++        <dependency>
++            <groupId>com.kohlschutter.junixsocket</groupId>
++            <artifactId>junixsocket-core</artifactId>
++            <version>2.10.0</version>
++            <type>pom</type>
++        </dependency>
+     </dependencies>
+ 
+     <build>

pkgs/by-name/de/dependency-track/package.nix

@@ -0,0 +1,113 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  jre_headless,
+  cyclonedx-cli,
+  makeWrapper,
+  maven,
+  nix-update-script,
+  nixosTests,
+}:
+let
+  version = "4.11.7";
+
+  frontend = buildNpmPackage {
+    pname = "dependency-track-frontend";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "DependencyTrack";
+      repo = "frontend";
+      rev = version;
+      hash = "sha256-hgBDzzG90gunnlZeektzdBIdatNjbkDVmNLbxjyxAXE=";
+    };
+
+    npmDepsHash = "sha256-veyt7fn4g/eh/+2CapQxlEssZP8cQXONpI6sSW299tk=";
+    forceGitDeps = true;
+    makeCacheWritable = true;
+
+    # The prepack script runs the build script, which we'd rather do in the build phase.
+    npmPackFlags = [ "--ignore-scripts" ];
+  };
+in
+
+maven.buildMavenPackage rec {
+  inherit version;
+  pname = "dependency-track";
+
+  src = fetchFromGitHub {
+    owner = "DependencyTrack";
+    repo = "dependency-track";
+    rev = version;
+    hash = "sha256-BMkn9WnUGs4RxH5I1QQ2UDrlo32JcbfjfFcOG5YogLI=";
+  };
+
+  patches = [
+    ./0000-remove-frontend-download.patch
+    ./0001-add-junixsocket.patch
+  ];
+
+  mvnJdk = jre_headless;
+  mvnHash = "sha256-c/JwBiKsXuWbCm1dTCrVc+V/1G7Eii1mUW8xDyewyLs=";
+  manualMvnArtifacts = [ "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1" ];
+  buildOffline = true;
+
+  mvnDepsParameters = lib.escapeShellArgs [
+    "-Dmaven.test.skip=true"
+    "-P enhance"
+    "-P embedded-jetty"
+  ];
+
+  mvnParameters = lib.escapeShellArgs [
+    "-Dmaven.test.skip=true"
+    "-P enhance"
+    "-P embedded-jetty"
+    "-P bundle-ui"
+    "-Dservices.bom.merge.skip=false"
+    "-Dlogback.configuration.file=${src}/src/main/docker/logback.xml"
+    "-Dcyclonedx-cli.path=${lib.getExe cyclonedx-cli}"
+  ];
+
+  preBuild = ''
+    mkdir -p frontend
+    cp -r ${frontend}/lib/node_modules/@dependencytrack/frontend/dist frontend/
+  '';
+
+  afterDepsSetup = ''
+    mvn cyclonedx:makeBom -Dmaven.repo.local=$mvnDeps/.m2 \
+      org.codehaus.mojo:exec-maven-plugin:exec@merge-services-bom
+  '';
+
+  doCheck = false;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 target/dependency-track-*.jar $out/share/dependency-track/dependency-track.jar
+    makeWrapper ${jre_headless}/bin/java $out/bin/dependency-track \
+      --add-flags "-jar $out/share/dependency-track/dependency-track.jar"
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    # passthru for nix-update
+    inherit (frontend) npmDeps;
+    tests = {
+      inherit (nixosTests) dependency-track;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain";
+    homepage = "https://github.com/DependencyTrack/dependency-track";
+    license = lib.licenses.asl20;
+    maintainers = lib.teams.cyberus.members;
+    mainProgram = "dependency-track";
+    inherit (jre_headless.meta) platforms;
+  };
+}

pkgs/by-name/fi/fittrackee/package.nix

@@ -2,6 +2,7 @@
   fetchFromGitHub,
   fetchPypi,
   lib,
+  stdenv,
   postgresql,
   postgresqlTestHook,
   python3,
@@ -27,14 +28,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "fittrackee";
-  version = "0.8.8";
+  version = "0.8.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SamR1";
     repo = "FitTrackee";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IO6M+HXAR3Gn0/71KwkaQr6sB0eCQzmnqHYgO+mzIZM=";
+    hash = "sha256-raN6Ef/Z/JbdJDMKBIaBL8nmvFwvuZFX4rfC0ZgWgKI=";
   };
 
   build-system = [
@@ -47,6 +48,8 @@ python.pkgs.buildPythonApplication rec {
     "gunicorn"
     "pyjwt"
     "pyopenssl"
+    "pytz"
+    "sqlalchemy"
   ];
 
   dependencies =
@@ -95,8 +98,10 @@ python.pkgs.buildPythonApplication rec {
     export DATABASE_TEST_URL=postgresql://$PGUSER/$PGDATABASE?host=$PGHOST
   '';
 
+  doCheck = !stdenv.isDarwin; # tests are a bit flaky on darwin
+
   preCheck = ''
-    export TMP=$(mktemp -d)
+    export TMP=$TMPDIR
   '';
 
   meta = {
@@ -104,7 +109,6 @@ python.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/SamR1/FitTrackee";
     changelog = "https://github.com/SamR1/FitTrackee/blob/${src.rev}/CHANGELOG.md";
     license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ traxys ];
   };
 }

pkgs/by-name/ha/halo/package.nix

@@ -7,10 +7,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.19.2";
+  version = "2.19.3";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-+mp195Yyj4O5k/WxnAllVHbeTt/ZzR7olPG27xfUrlQ=";
+    hash = "sha256-Re0L+2P/Sxzj+fnuZi5uK2Hk72d8EvQGdjhglVbt41M=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/he/hello/package.nix

@@ -31,12 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = {
     version = testers.testVersion { package = hello; };
-
-    invariant-under-noXlibs =
-      testers.testEqualDerivation
-        "hello must not be rebuilt when environment.noXlibs is set."
-        hello
-        (nixos { environment.noXlibs = true; }).pkgs.hello;
   };
 
   passthru.tests.run = callPackage ./test.nix { hello = finalAttrs.finalPackage; };

pkgs/by-name/hy/hyprwayland-scanner/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprwayland-scanner";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprwayland-scanner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JPdL+Qul+jEueAn8CARfcWP83eJgwkhMejQYfDvrgvU=";
+    hash = "sha256-HIPEXyRRVZoqD6U+lFS1B0tsIU7p83FaB9m7KT/x6mQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ja/jan/package.nix

@@ -5,10 +5,10 @@
 
 let
   pname = "jan";
-  version = "0.5.3";
+  version = "0.5.4";
   src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-lfN5ant3oS7uschxyCxmiKNLJUJiqWVZLaJ8djqNKzQ=";
+    hash = "sha256-BrNfpf9v8yAs4y3vaPlqtOI9SE7IFfZm/CYegcuZT3c=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/lu/luarocks-packages-updater/package.nix

@@ -4,10 +4,6 @@
 , lib
 , nix-prefetch-scripts
 , luarocks-nix
-, lua5_1
-, lua5_2
-, lua5_3
-, lua5_4
 , pluginupdate
 }:
 let
@@ -16,52 +12,44 @@ let
     nix nix-prefetch-scripts luarocks-nix
   ];
 
-  luaversions = [
-    lua5_1
-    lua5_2
-    lua5_3
-    lua5_4
-  ];
-
+  attrs = builtins.fromTOML (builtins.readFile ./pyproject.toml);
+  pname = attrs.project.name;
+  inherit (attrs.project) version;
 in
+
 python3Packages.buildPythonApplication {
-  pname = "luarocks-packages-updater";
-  version = "0.1";
+  inherit pname version;
+  pyproject = true;
 
-  format = "other";
+  src = lib.cleanSource ./.;
 
-  nativeBuildInputs = [
-    makeWrapper
-    python3Packages.wrapPython
+  build-system = [
+    python3Packages.setuptools
   ];
-  propagatedBuildInputs = [
+
+  dependencies = [
     python3Packages.gitpython
   ];
 
-  dontUnpack = true;
-
-  installPhase =
-    ''
-    mkdir -p $out/bin $out/lib
-    cp ${./updater.py} $out/bin/luarocks-packages-updater
-    cp ${pluginupdate} $out/lib/pluginupdate.py
-
-    # wrap python scripts
-    makeWrapperArgs+=( --prefix PATH : "${path}" --prefix PYTHONPATH : "$out/lib" \
-      --set LUA_51 ${lua5_1} \
-      --set LUA_52 ${lua5_2} \
-      --set LUA_53 ${lua5_3} \
-      --set LUA_54 ${lua5_4}
-    )
-    wrapPythonProgramsIn "$out"
+  postFixup = ''
+    echo "pluginupdate folder ${pluginupdate}"
+    wrapProgram $out/bin/luarocks-packages-updater \
+     --prefix PYTHONPATH : "${pluginupdate}" \
+     --prefix PATH : "${path}"
   '';
 
   shellHook = ''
-    export PYTHONPATH="maintainers/scripts:$PYTHONPATH"
+    export PYTHONPATH="maintainers/scripts/pluginupdate-py:$PYTHONPATH"
     export PATH="${path}:$PATH"
   '';
 
-  meta.mainProgram = "luarocks-packages-updater";
+  meta = {
+    inherit (attrs.project) description;
+    license = lib.licenses.gpl3Only;
+    homepage = attrs.project.urls.Homepage;
+    mainProgram = "luarocks-packages-updater";
+    maintainers = with lib.maintainers; [ teto ];
+  };
 }
 
 

pkgs/by-name/lu/luarocks-packages-updater/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+build-backend = "setuptools.build_meta"
+requires = [ "setuptools" ]
+
+[project]
+name = "luarocks-packages-updater"
+version = "0.0.1"
+description = """
+Module to update luarocks-packages"""
+
+[project.urls]
+Homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/lu/luarocks-packages-updater"
+
+[project.scripts]
+luarocks-packages-updater = "updater:main"
+
+[tool.ruff]
+line-length = 120
+indent-width = 4

pkgs/by-name/lu/luarocks-packages-updater/updater.py

@@ -50,7 +50,7 @@ class LuaPlugin:
     name: str
     """Name of the plugin, as seen on luarocks.org"""
     rockspec: str
-    """Full path towards the rockspec"""
+    """Full URI towards the rockspec"""
     ref: Optional[str]
     """git reference (branch name/tag)"""
     version: Optional[str]
@@ -60,7 +60,7 @@ class LuaPlugin:
     Its value can be 'http://luarocks.org/dev'
     """
     luaversion: Optional[str]
-    """Attribue of the lua interpreter if a package is available only for a specific lua version"""
+    """lua version if a package is available only for a specific lua version"""
     maintainers: Optional[str]
     """ Optional string listing maintainers separated by spaces"""
 

pkgs/by-name/ma/manifold/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "2.5.1-unstable-2024-09-06";
+  version = "2.5.1-unstable-2024-09-15";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
-    rev = "6f009ca13fab71e53f118179742cc2bb40455721";
-    hash = "sha256-McP/Rdxss93YHZcPSSWaRjyGgUiQJ3mZXgzcHWldORU=";
+    rev = "22c66051dfdbcefa2012e30dd12c9b5a20f89a01";
+    hash = "sha256-Fbev5dTgXjXdC7fzWfHnypTBel++DiMns8OzN1bH1OA=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -49,5 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
       hzeller
       pca006132
     ];
+    platforms = lib.platforms.linux; # currently issues with Darwin
   };
 })

pkgs/by-name/ma/maven/build-maven-package.nix

@@ -93,6 +93,7 @@ stdenv.mkDerivation (builtins.removeAttrs args [ "mvnFetchExtraArgs" ] // {
     runHook preBuild
 
     mvnDeps=$(cp -dpR ${fetchedMavenDeps}/.m2 ./ && chmod +w -R .m2 && pwd)
+    runHook afterDepsSetup
     mvn package -o -nsu "-Dmaven.repo.local=$mvnDeps/.m2" ${mvnSkipTests} ${mvnParameters}
 
     runHook postBuild

pkgs/by-name/pi/pipet/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule rec {
+  pname = "pipet";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "bjesus";
+    repo = "pipet";
+    rev = version;
+    hash = "sha256-PqOx/aFI5gHt78th1nkSKlTGw/r1eU7Ggz5kvtjMCmI=";
+  };
+
+  vendorHash = "sha256-jNIjF5jxcpNLAjuWo7OG/Ac4l6NpQNCKzYUgdAoL+C4=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.currentSha=${src.rev}"
+  ];
+
+  doCheck = false; # Requires network
+
+  meta = {
+    homepage = "https://github.com/bjesus/pipet";
+    description = "Scraping and extracting data from online assets";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bjesus ];
+    mainProgram = "pipet";
+  };
+}

pkgs/by-name/pm/pmtiles/package.nix

@@ -1,16 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "pmtiles";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "protomaps";
     repo = "go-pmtiles";
     rev = "v${version}";
-    hash = "sha256-scicNAl1Lu8oD/g/63CXLeys+yorpH6Unhk5p4V78eY=";
+    hash = "sha256-r3gp0f771Cfy4JNekilnct+FKu4nOb+8y+B1A+anJ5Y=";
   };
 
-  vendorHash = "sha256-8HShM4YznUAc6rJyDbdL5vv0dOk+d4IRKQpmEhWiNjo=";
+  vendorHash = "sha256-5oKcq1eTrcjQKWySDOsEFFbKkld9g494D5Tg9Bej8JQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=v${version}" ];
 

pkgs/by-name/ru/ruff/Cargo.lock

@@ -2083,9 +2083,7 @@ dependencies = [
  "countme",
  "hashbrown",
  "insta",
- "once_cell",
  "ordermap",
- "path-slash",
  "ruff_db",
  "ruff_index",
  "ruff_python_ast",
@@ -2094,6 +2092,7 @@ dependencies = [
  "ruff_python_stdlib",
  "ruff_source_file",
  "ruff_text_size",
+ "ruff_vendored",
  "rustc-hash 2.0.0",
  "salsa",
  "smallvec",
@@ -2102,8 +2101,6 @@ dependencies = [
  "test-case",
  "thiserror",
  "tracing",
- "walkdir",
- "zip",
 ]
 
 [[package]]
@@ -2159,6 +2156,7 @@ dependencies = [
  "ruff_db",
  "ruff_python_ast",
  "ruff_text_size",
+ "ruff_vendored",
  "rustc-hash 2.0.0",
  "salsa",
  "tempfile",
@@ -2255,7 +2253,7 @@ dependencies = [
 
 [[package]]
 name = "ruff"
-version = "0.6.6"
+version = "0.6.7"
 dependencies = [
  "anyhow",
  "argfile",
@@ -2450,15 +2448,18 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
+ "once_cell",
  "red_knot_python_semantic",
  "ruff_cache",
  "ruff_db",
  "ruff_linter",
  "ruff_macros",
  "ruff_python_ast",
+ "ruff_python_parser",
  "salsa",
  "schemars",
  "serde",
+ "zip",
 ]
 
 [[package]]
@@ -2471,7 +2472,7 @@ dependencies = [
 
 [[package]]
 name = "ruff_linter"
-version = "0.6.6"
+version = "0.6.7"
 dependencies = [
  "aho-corasick",
  "annotate-snippets 0.9.2",
@@ -2789,9 +2790,20 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "ruff_vendored"
+version = "0.0.0"
+dependencies = [
+ "once_cell",
+ "path-slash",
+ "ruff_db",
+ "walkdir",
+ "zip",
+]
+
 [[package]]
 name = "ruff_wasm"
-version = "0.6.6"
+version = "0.6.7"
 dependencies = [
  "console_error_panic_hook",
  "console_log",

pkgs/by-name/ru/ruff/package.nix

@@ -14,13 +14,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/${version}";
-    hash = "sha256-8EKOBlF6bgjgB5t3KP4AcWU7YkLaiFoAj+wuJWEOAic=";
+    hash = "sha256-1udxvl98RveGJmnG8kwlecWD9V+BPadA/YE8jbt9jNo=";
   };
 
   cargoLock = {

pkgs/by-name/sm/smatch/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  sqlite,
+  openssl,
+  buildllvmsparse ? false,
+  buildc2xml ? false,
+  libllvm,
+  libxml2,
+}:
+let
+  version = "1.73";
+in
+stdenv.mkDerivation {
+  pname = "smatch";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "error27";
+    repo = "smatch";
+    rev = version;
+    sha256 = "sha256-Pv3bd2cjnQKnhH7TrkYWfDEeaq6u/q/iK1ZErzn6bME=";
+  };
+
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [
+    "-Wno-incompatible-function-pointer-types"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    sqlite
+    openssl
+  ] ++ lib.optionals buildllvmsparse [ libllvm ] ++ lib.optionals buildc2xml [ libxml2.dev ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+  ];
+
+  meta = {
+    description = "Semantic analysis tool for C";
+    homepage = "https://sparse.docs.kernel.org/";
+    maintainers = with lib.maintainers; [ momeemt ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/sn/snyk/package.nix

@@ -1,14 +1,18 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
-, stdenv
-, testers
-, snyk
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  stdenv,
+  testers,
+  snyk,
 }:
 
-buildNpmPackage rec {
-  pname = "snyk";
+let
   version = "1.1293.1";
+in
+buildNpmPackage {
+  pname = "snyk";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "snyk";
@@ -26,7 +30,9 @@ buildNpmPackage rec {
 
   env.NIX_CFLAGS_COMPILE =
     # Fix error: no member named 'aligned_alloc' in the global namespace
-    lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
+    lib.optionalString (
+      stdenv.isDarwin && stdenv.isx86_64
+    ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
 
   npmBuildScript = "build:prod";
 
@@ -34,12 +40,12 @@ buildNpmPackage rec {
     package = snyk;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Scans and monitors projects for security vulnerabilities";
     homepage = "https://snyk.io";
     changelog = "https://github.com/snyk/cli/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ momeemt ];
     mainProgram = "snyk";
   };
 }

pkgs/by-name/st/stalwart-mail/package.nix

@@ -26,7 +26,7 @@ let
   # See upstream issue for rocksdb 9.X support
   # https://github.com/stalwartlabs/mail-server/issues/407
   rocksdb = rocksdb_8_11;
-  version = "0.9.4";
+  version = "0.10.0";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -36,11 +36,11 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GDi7kRwI0GujQBJXItQpYZT1I1Hz3DUMyTixJ/lQySY=";
+    hash = "sha256-9qk7+LJntEmCIuxp0707OOHBVkywlAJA1QmWllR9ZHg=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-7gJi6sykmKRuZZ8svXWlktHnwr78zaE2jxVIt+sZPHg=";
+  cargoHash = "sha256-O1LuEHH5VD/6875Psfp5N/oWYlo1cuTlHzwcgG9RrpI=";
 
   patches = [
     # Remove "PermissionsStartOnly" from systemd service files,
@@ -140,6 +140,10 @@ rustPlatform.buildRustPackage {
     # thread 'smtp::queue::concurrent::concurrent_queue' panicked at tests/src/smtp/inbound/mod.rs:65:9:
     # assertion `left == right` failed
     "--skip=smtp::queue::concurrent::concurrent_queue"
+    # Failed to read system DNS config: io error: No such file or directory (os error 2)
+    "--skip=smtp::inbound::auth::auth"
+    # Failed to read system DNS config: io error: No such file or directory (os error 2)
+    "--skip=smtp::inbound::vrfy::vrfy_expn"
   ];
 
   doCheck = !(stdenv.isLinux && stdenv.isAarch64);

pkgs/by-name/wi/wireguard-ui/package.nix

@@ -0,0 +1,81 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarn,
+  fixup-yarn-lock,
+  nodejs,
+  fetchpatch2,
+}:
+
+buildGoModule rec {
+  pname = "wireguard-ui";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "ngoduykhanh";
+    repo = "wireguard-ui";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fK7l9I2s0zSxG1g1oQ1KjJZUcypwS9DxnNN7lhVI+1s=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/ngoduykhanh/wireguard-ui/commit/2fdafd34ca6c8f7f1415a3a1d89498bb575a7171.patch?full_index=1";
+      hash = "sha256-nq/TX+TKDB29NcPQ3pLWD0jcXubULuwqisn9IcEW8B8=";
+    })
+  ];
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-ps/GtdtDKA3y5o1GZpRG+z08lSzk8d9zgxb95kjr/gc=";
+  };
+
+  vendorHash = "sha256-FTjZ6wf0ym6kFJ58Z3E3shmbq9SaMwlXWeueHQXwkX4=";
+
+  nativeBuildInputs = [
+    yarn
+    fixup-yarn-lock
+    nodejs
+  ];
+
+  ldflags = [
+    "-X main.appVersion=v${version}"
+  ];
+
+  preConfigure = ''
+    # This is what prepare_assets.sh do.
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+    yarn --offline install
+
+    mkdir -p "./assets/dist/js" "./assets/dist/css" && \
+    cp -r "./node_modules/admin-lte/dist/js/adminlte.min.js" "./assets/dist/js/adminlte.min.js" && \
+    cp -r "./node_modules/admin-lte/dist/css/adminlte.min.css" "./assets/dist/css/adminlte.min.css"
+
+    cp -r "./custom" "./assets"
+
+    mkdir -p "./assets/plugins" && \
+    cp -r "./node_modules/admin-lte/plugins/jquery" \
+    "./node_modules/admin-lte/plugins/fontawesome-free" \
+    "./node_modules/admin-lte/plugins/bootstrap" \
+    "./node_modules/admin-lte/plugins/icheck-bootstrap" \
+    "./node_modules/admin-lte/plugins/toastr" \
+    "./node_modules/admin-lte/plugins/jquery-validation" \
+    "./node_modules/admin-lte/plugins/select2" \
+    "./node_modules/jquery-tags-input" \
+    "./assets/plugins/"
+  '';
+
+  meta = {
+    description = "Web user interface to manage your WireGuard setup";
+    changelog = "https://github.com/ngoduykhanh/wireguard-ui/releases/tag/v${version}";
+    homepage = "https://github.com/ngoduykhanh/wireguard-ui";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "wireguard-ui";
+  };
+}

pkgs/by-name/ws/wstunnel/package.nix

@@ -2,9 +2,11 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
+  stdenv,
   nixosTests,
   nix-update-script,
   versionCheckHook,
+  darwin,
 }:
 
 let
@@ -25,6 +27,9 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-3b+pX/qQuhOY1OYr+CfT5wtiJcEJ8CJJsQZ4QOcYv74=";
 
   nativeBuildInputs = [ versionCheckHook ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.apple_sdk.frameworks.CoreServices
+  ];
 
   doInstallCheck = true;
 

pkgs/by-name/xt/xtf/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "xtf";
-  version = "0-unstable-2024-08-30";
+  version = "0-unstable-2024-09-13";
 
   outputs = [
     "out" # xtf-runner and test suite.
@@ -20,8 +20,8 @@ stdenv.mkDerivation {
 
   src = fetchgit {
     url = "https://xenbits.xenproject.org/git-http/xtf.git";
-    rev = "f503efe8e5cf8858ec0704f1aaa82d0bf50891a5";
-    hash = "sha256-ccI9FcrK7T4Zrv3przZ7qZhJ/ZsPPi+1KOIVCdFKKdc=";
+    rev = "c9a5e404e70c21c7621db4b8cabdf68261db7e1c";
+    hash = "sha256-FMFbAdgH5KCpocAzUXb7nM3wpn4xs/gk/0M8AUVxXv0=";
   };
 
   nativeBuildInputs =

pkgs/data/themes/adw-gtk3/default.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "adw-gtk3";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DpJLX9PJX1Q8dDOx7YOXQzgNECsKp5uGiCVTX6iSlbI=";
+    sha256 = "sha256-FwODgA3BK5O1WoNNbn27H18Epuqwcsnoc3hZUB59+Wg=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/cairo/default.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cairo";
-  version = "2.8.0";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "starkware-libs";
     repo = "cairo";
     rev = "v${version}";
-    hash = "sha256-zQ+kc4c8YI9vURUEQNqX55mTJBcc2NLp4K8kab3ZjEs=";
+    hash = "sha256-vBdIGkdQa/csqsu4DbgIYitVbDLDUAFmIUytZ7IcxNk=";
   };
 
-  cargoHash = "sha256-3ah6cHyCppkLJ2e73aGhVemyMRBl9R5a6ufWHmrJHSk=";
+  cargoHash = "sha256-w3kzEM34HYQ6KgILaDpmZbCgAh8Ql24DRe12woUAhVI=";
 
   # openssl crate requires perl during build process
   nativeBuildInputs = [

pkgs/development/compilers/llvm/common/bolt/default.nix

@@ -12,6 +12,7 @@
   python3,
   buildLlvmTools,
   patches ? [ ],
+  devExtraCmakeFlags ? [ ],
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,9 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
     libxml2
   ];
 
-  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmTools.llvm}/bin/llvm-tblgen")
-  ];
+  cmakeFlags =
+    lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmTools.llvm}/bin/llvm-tblgen")
+    ]
+    ++ devExtraCmakeFlags;
 
   postUnpack = ''
     chmod -R u+w -- $sourceRoot/..

pkgs/development/compilers/llvm/common/clang/default.nix

@@ -17,6 +17,7 @@
 , fixDarwinDylibNames
 , enableManpages ? false
 , clang-tools-extra_src ? null
+, devExtraCmakeFlags ? []
 }:
 
 let
@@ -69,7 +70,9 @@ let
       # `clang-pseudo-gen`: https://github.com/llvm/llvm-project/commit/cd2292ef824591cc34cc299910a3098545c840c7
       "-DCLANG_TIDY_CONFUSABLE_CHARS_GEN=${buildLlvmTools.libclang.dev}/bin/clang-tidy-confusable-chars-gen"
       "-DCLANG_PSEUDO_GEN=${buildLlvmTools.libclang.dev}/bin/clang-pseudo-gen"
-    ]) ++ lib.optional (stdenv.targetPlatform.useLLVM or false) "-DCLANG_DEFAULT_CXX_STDLIB=ON";
+    ]) ++ lib.optionals (stdenv.targetPlatform.useLLVM or false) [
+      "-DCLANG_DEFAULT_CXX_STDLIB=ON"
+    ] ++ devExtraCmakeFlags;
 
     postPatch = ''
       # Make sure clang passes the correct location of libLTO to ld64

pkgs/development/compilers/llvm/common/compiler-rt/default.nix

@@ -28,6 +28,7 @@
 # `libcompiler_rt` library, at least under certain configurations. Some
 # platforms stil expect this, however, so we symlink one into place.
 , forceLinkCompilerRt ? stdenv.hostPlatform.isOpenBSD
+, devExtraCmakeFlags ? []
 }:
 
 let
@@ -134,9 +135,9 @@ stdenv.mkDerivation ({
     "-DCOMPILER_RT_ENABLE_IOS=OFF"
   ]) ++ lib.optionals (lib.versionAtLeast version "19" && stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
     "-DSANITIZER_MIN_OSX_VERSION=10.10"
-  ]  ++ lib.optionals (noSanitizers && lib.versionAtLeast release_version "19") [
+  ] ++ lib.optionals (noSanitizers && lib.versionAtLeast release_version "19") [
     "-DCOMPILER_RT_BUILD_CTX_PROFILE=OFF"
-  ];
+  ] ++ devExtraCmakeFlags;
 
   outputs = [ "out" "dev" ];
 

pkgs/development/compilers/llvm/common/default.nix

@@ -27,6 +27,9 @@
   officialRelease ? null,
   monorepoSrc ? null,
   version ? null,
+  # Allows passthrough to packages via newScope. This makes it possible to
+  # do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+  # an llvmPackages whose packages are overridden in an internally consistent way.
   ...
 }@args:
 

pkgs/development/compilers/llvm/common/libcxx/default.nix

@@ -16,6 +16,7 @@
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then freebsd.libcxxrt else null
 , libunwind
 , enableShared ? !stdenv.hostPlatform.isStatic
+, devExtraCmakeFlags ? []
 }:
 
 # external cxxabi is not supported on Darwin as the build will not link libcxx
@@ -103,7 +104,8 @@ let
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DUNIX=ON" # Required otherwise libc++ fails to detect the correct linker
   ] ++ cxxCMakeFlags
-    ++ lib.optionals (cxxabi == null) cxxabiCMakeFlags;
+    ++ lib.optionals (cxxabi == null) cxxabiCMakeFlags
+    ++ devExtraCmakeFlags;
 
 in
 

pkgs/development/compilers/llvm/common/libunwind/default.nix

@@ -12,6 +12,7 @@
 , python3
 , libcxx
 , enableShared ? !stdenv.hostPlatform.isStatic
+, devExtraCmakeFlags ? []
 }:
 let
   pname = "libunwind";
@@ -68,7 +69,8 @@ stdenv.mkDerivation (rec {
   ];
 
   cmakeFlags = lib.optional (lib.versionAtLeast release_version "15") "-DLLVM_ENABLE_RUNTIMES=libunwind"
-    ++ lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF";
+    ++ lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF"
+    ++ devExtraCmakeFlags;
 
   meta = llvm_meta // {
     # Details: https://github.com/llvm/llvm-project/blob/main/libunwind/docs/index.rst

pkgs/development/compilers/llvm/common/lld/default.nix

@@ -13,6 +13,7 @@
 , libxml2
 , libllvm
 , version
+, devExtraCmakeFlags ? []
 }:
 let
   pname = "lld";
@@ -55,7 +56,7 @@ stdenv.mkDerivation (rec {
     "-DLLD_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/lld"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
-  ];
+  ] ++ devExtraCmakeFlags;
 
   # Musl's default stack size is too small for lld to be able to link Firefox.
   LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";

pkgs/development/compilers/llvm/common/lldb.nix

@@ -23,6 +23,7 @@
 , monorepoSrc ? null
 , patches ? [ ]
 , enableManpages ? false
+, devExtraCmakeFlags ? [ ]
 , ...
 }:
 
@@ -142,7 +143,7 @@ stdenv.mkDerivation (rec {
   ]) ++ lib.optionals doCheck [
     "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
-  ];
+  ] ++ devExtraCmakeFlags;
 
   doCheck = false;
   doInstallCheck = lib.versionOlder release_version "15";

pkgs/development/compilers/llvm/common/llvm/default.nix

@@ -40,6 +40,7 @@
   && !stdenv.hostPlatform.isAarch
 , enablePolly ? lib.versionAtLeast release_version "14"
 , enableTerminfo ? true
+, devExtraCmakeFlags ? []
 }:
 
 let
@@ -399,7 +400,7 @@ stdenv.mkDerivation (rec {
         nativeInstallFlags
       ])
     )
-  ];
+  ] ++ devExtraCmakeFlags;
 
   postInstall = ''
     mkdir -p $python/share

pkgs/development/compilers/llvm/common/mlir/default.nix

@@ -10,6 +10,7 @@
 , libllvm
 , version
 , doCheck ? (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
+, devExtraCmakeFlags ? []
 }:
 
 stdenv.mkDerivation rec {
@@ -63,7 +64,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     "-DMLIR_TABLEGEN_EXE=${buildLlvmTools.mlir}/bin/mlir-tblgen"
-  ];
+  ] ++ devExtraCmakeFlags;
 
   outputs = [ "out" "dev" ];
 

pkgs/development/compilers/llvm/common/openmp/default.nix

@@ -15,6 +15,7 @@
 , perl
 , pkg-config
 , version
+, devExtraCmakeFlags ? []
 }:
 let
   pname = "openmp";
@@ -60,7 +61,7 @@ stdenv.mkDerivation (rec {
     "-DCLANG_TOOL=${clang-unwrapped}/bin/clang"
     "-DOPT_TOOL=${llvm}/bin/opt"
     "-DLINK_TOOL=${llvm}/bin/llvm-link"
-  ];
+  ] ++ devExtraCmakeFlags;
 
   meta = llvm_meta // {
     homepage = "https://openmp.llvm.org/";

pkgs/development/compilers/llvm/default.nix

@@ -14,7 +14,12 @@
   bootBintoolsNoLibc ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintoolsNoLibc,
   bootBintools ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintools,
   llvmVersions ? { },
-}:
+  # Allows passthrough to packages via newScope in ./common/default.nix.
+  # This makes it possible to do
+  # `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+  # an llvmPackages whose packages are overridden in an internally consistent way.
+  ...
+}@packageSetArgs:
 let
   versions = {
     "13.0.1".officialRelease.sha256 = "06dv6h5dmvzdxbif2s8njki6h32796v368dyb5945x8gjj72xh7k";
@@ -53,25 +58,29 @@ let
     in
     lib.nameValuePair attrName (
       recurseIntoAttrs (
-        callPackage ./common {
-          inherit (stdenvAdapters) overrideCC;
-          buildLlvmTools = buildPackages."llvmPackages_${attrName}".tools;
-          targetLlvmLibraries =
-            targetPackages."llvmPackages_${attrName}".libraries or llvmPackages."${attrName}".libraries;
-          targetLlvm = targetPackages."llvmPackages_${attrName}".llvm or llvmPackages."${attrName}".llvm;
-          stdenv =
-            if (lib.versions.major release_version == "13" && stdenv.cc.cc.isGNU or false) then
-              gcc12Stdenv
-            else
-              stdenv; # does not build with gcc13
-          inherit bootBintoolsNoLibc bootBintools;
-          inherit
-            officialRelease
-            gitRelease
-            monorepoSrc
-            version
-            ;
-        }
+        callPackage ./common (
+          {
+            inherit (stdenvAdapters) overrideCC;
+            buildLlvmTools = buildPackages."llvmPackages_${attrName}".tools;
+            targetLlvmLibraries =
+              targetPackages."llvmPackages_${attrName}".libraries or llvmPackages."${attrName}".libraries;
+            targetLlvm = targetPackages."llvmPackages_${attrName}".llvm or llvmPackages."${attrName}".llvm;
+            inherit
+              officialRelease
+              gitRelease
+              monorepoSrc
+              version
+              ;
+          }
+          // packageSetArgs # Allow overrides.
+          // {
+            stdenv =
+              if (lib.versions.major release_version == "13" && stdenv.cc.cc.isGNU or false) then
+                gcc12Stdenv
+              else
+                stdenv; # does not build with gcc13
+          }
+        )
       )
     );
 

pkgs/development/libraries/mongoc/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mongoc";
-  version = "1.27.6";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-c-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-771DZ+8cr0iHHcs4TZVEkTP6qWK1bMzOxlG4OS14t28=";
+    hash = "sha256-cfet+A2i33iHbVRouPS4Ul8TmHolrcIMTRba6Olqfeg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ansible-compat/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-compat";
-  version = "24.9.0";
+  version = "24.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "ansible_compat";
     inherit version;
-    hash = "sha256-xaQqVt0hJiXPyx0x5RpuD1JZNpG94f5KeIgeixt4prg=";
+    hash = "sha256-n/ICReG9nemyOjZ5AlJKsOEfvPt0GDGZbaXaW2Crld8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/blessings/default.nix

@@ -1,35 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  six,
-  nose,
-}:
-
-buildPythonPackage rec {
-  pname = "blessings";
-  version = "1.7";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "98e5854d805f50a5b58ac2333411b0482516a8210f23f43308baeb58d77c157d";
-  };
-
-  # 4 failing tests, 2to3
-  doCheck = false;
-
-  propagatedBuildInputs = [ six ];
-  nativeCheckInputs = [ nose ];
-
-  checkPhase = ''
-    nosetests
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/erikrose/blessings";
-    description = "Thin, practical wrapper around terminal coloring, styling, and positioning";
-    license = licenses.mit;
-    maintainers = with maintainers; [ domenkozar ];
-  };
-}

pkgs/development/python-modules/clarifai-grpc/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "10.8.4";
+  version = "10.8.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python-grpc";
     rev = "refs/tags/${version}";
-    hash = "sha256-5HDPEFn43JQyNTp9nJapBpoigoFtgyPZ5HXulMsjc8s=";
+    hash = "sha256-lCFjZcPp4ih2fKaRXQxyxBkgRRPSaTOawiMqeXg25cg=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/clustershell/default.nix

@@ -3,9 +3,11 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
+  distutils,
   pyyaml,
   openssh,
-  nose,
+  unittestCheckHook,
   bc,
   hostname,
   bash,
@@ -14,6 +16,7 @@
 buildPythonPackage rec {
   pname = "clustershell";
   version = "1.9.2";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "ClusterShell";
@@ -21,30 +24,29 @@ buildPythonPackage rec {
     hash = "sha256-rsF/HG4GNBC+N49b+sDO2AyUI1G44wJNBUwQNPzShD0=";
   };
 
+  build-system = [
+    setuptools
+    distutils
+  ];
+
   postPatch = ''
     substituteInPlace lib/ClusterShell/Worker/Ssh.py \
-      --replace '"ssh"' '"${openssh}/bin/ssh"' \
-      --replace '"scp"' '"${openssh}/bin/scp"'
+      --replace-fail '"ssh"' '"${openssh}/bin/ssh"' \
+      --replace-fail '"scp"' '"${openssh}/bin/scp"'
 
     substituteInPlace lib/ClusterShell/Worker/fastsubprocess.py \
-      --replace '"/bin/sh"' '"${bash}/bin/sh"'
+      --replace-fail '"/bin/sh"' '"${bash}/bin/sh"'
 
     for f in tests/*; do
       substituteInPlace $f \
-        --replace '/bin/hostname'   '${hostname}/bin/hostname' \
-        --replace '/bin/sleep'      'sleep' \
-        --replace '/bin/echo'       'echo' \
-        --replace '/bin/uname'      'uname' \
-        --replace '/bin/false'      'false' \
-        --replace '/bin/true'       'true' \
-        --replace '/usr/bin/printf' 'printf'
+        --replace-quiet '/bin/hostname'   '${hostname}/bin/hostname' \
+        --replace-quiet '/bin/sleep'      'sleep' \
+        --replace-quiet '/bin/echo'       'echo' \
+        --replace-quiet '/bin/uname'      'uname' \
+        --replace-quiet '/bin/false'      'false' \
+        --replace-quiet '/bin/true'       'true' \
+        --replace-quiet '/usr/bin/printf' 'printf'
     done
-
-    # Fix warnings
-    substituteInPlace lib/ClusterShell/Task.py \
-      --replace "notifyAll" "notify_all"
-    substituteInPlace tests/TaskPortTest.py lib/ClusterShell/Task.py \
-      --replace "currentThread" "current_thread"
   '';
 
   propagatedBuildInputs = [ pyyaml ];
@@ -52,18 +54,22 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     bc
     hostname
-    nose
+    unittestCheckHook
   ];
 
   pythonImportsCheck = [ "ClusterShell" ];
 
-  doCheck = false; # tests often get stuck
+  unittestFlagsArray = [
+    "tests"
+    "-p"
+    "'*Test.py'"
+  ];
 
   # Many tests want to open network connections
   # https://github.com/cea-hpc/clustershell#test-suite
   #
   # Several tests fail on Darwin
-  checkPhase = ''
+  preCheck = ''
     rm tests/CLIClushTest.py
     rm tests/TreeWorkerTest.py
     rm tests/TaskDistantMixin.py
@@ -72,29 +78,6 @@ buildPythonPackage rec {
     rm tests/TaskDistantPdshTest.py
     rm tests/TaskRLimitsTest.py
     rm tests/TreeGatewayTest.py
-
-    nosetests -v \
-      -e test_fromall_grouplist \
-      -e test_rank_placeholder \
-      -e test_engine_on_the_fly_launch \
-      -e test_ev_pickup_fanout \
-      -e test_ev_pickup_fanout_legacy \
-      -e test_timeout \
-      -e test_008_broken_pipe_on_write \
-      -e testLocalBufferRCGathering \
-      -e testLocalBuffers \
-      -e testLocalErrorBuffers \
-      -e testLocalFanout \
-      -e testLocalRetcodes \
-      -e testLocalRCBufferGathering \
-      -e testLocalSingleLineBuffers \
-      -e testLocalWorkerFanout \
-      -e testSimpleMultipleCommands \
-      -e testClushConfigSetRlimit  \
-      -e testTimerInvalidateInHandler \
-      -e testTimerSetNextFireInHandler \
-      -e test_node_placeholder \
-    tests/*.py
   '';
 
   meta = with lib; {

pkgs/development/python-modules/datadog/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.50.0";
+  version = "0.50.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OljoX42kfEpHiTtCx1lXC6AoDNISQT2bckbLj8uG9YY=";
+    hash = "sha256-V51NtUvW75GMUlAhftsVuAt7EVgrjiT85DcCdow/Li0=";
   };
 
   nativeBuildInputs = [ hatchling ];

pkgs/development/python-modules/invocations/default.nix

@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  blessings,
+  blessed,
   fetchFromGitHub,
   invoke,
   pythonOlder,
@@ -10,6 +10,11 @@
   tabulate,
   tqdm,
   twine,
+  pytestCheckHook,
+  pytest-relaxed,
+  pytest-mock,
+  icecream,
+  pip,
 }:
 
 buildPythonPackage rec {
@@ -26,13 +31,15 @@ buildPythonPackage rec {
     hash = "sha256-JnhdcxhBNsYgDMcljtGKjOT1agujlao/66QifGuh6I0=";
   };
 
+  patches = [ ./replace-blessings-with-blessed.patch ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace "semantic_version>=2.4,<2.7" "semantic_version"
   '';
 
   propagatedBuildInputs = [
-    blessings
+    blessed
     invoke
     releases
     semantic-version
@@ -41,11 +48,27 @@ buildPythonPackage rec {
     twine
   ];
 
-  # There's an error loading the test suite. See https://github.com/pyinvoke/invocations/issues/29.
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-relaxed
+    pytest-mock
+    icecream
+    pip
+  ];
 
   pythonImportsCheck = [ "invocations" ];
 
+  disabledTests = [
+    # invoke.exceptions.UnexpectedExit
+    "autodoc_"
+
+    # ValueError: Call either Version('1.2.3') or Version(major=1, ...)
+    "component_state_enums_contain_human_readable_values"
+    "load_version_"
+    "prepare_"
+    "status_"
+  ];
+
   meta = with lib; {
     description = "Common/best-practice Invoke tasks and collections";
     homepage = "https://invocations.readthedocs.io/";

pkgs/development/python-modules/invocations/replace-blessings-with-blessed.patch

@@ -0,0 +1,26 @@
+diff --git a/invocations/packaging/release.py b/invocations/packaging/release.py
+index 54322c3..81ac173 100644
+--- a/invocations/packaging/release.py
++++ b/invocations/packaging/release.py
+@@ -23,7 +23,7 @@ from shutil import rmtree
+ 
+ from invoke.vendor.lexicon import Lexicon
+ 
+-from blessings import Terminal
++from blessed import Terminal
+ from docutils.utils import Reporter
+ from enum import Enum
+ from invoke import Collection, task, Exit
+diff --git a/setup.py b/setup.py
+index 78ae28b..c78a74c 100644
+--- a/setup.py
++++ b/setup.py
+@@ -16,7 +16,7 @@ requirements = [
+     # time if missing), but that got hairy fast, and these are all
+     # pure-Python packages, so it shouldn't be a huge burden for users to
+     # obtain them.
+-    "blessings>=1.6",
++    "blessed",
+     "releases>=1.6",
+     "semantic_version>=2.4,<2.7",
+     "tabulate>=0.7.5",

pkgs/development/python-modules/langsmith/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.120";
+  version = "0.1.125";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-K8QIlyQnaTKCBoRCsTQ26KovIIw8uK6HBynEplrB6wI=";
+    hash = "sha256-0/ych7iP7G75R2kGaXzsxSy4jRYCvxeqd8aBq4QhRgI=";
   };
 
   sourceRoot = "${src.name}/python";

pkgs/development/python-modules/libretranslate/default.nix

@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "libretranslate";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LibreTranslate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QH+H1UubDDv2SZa/razs+JYu4BbZzWHh7DLWfZEWCes=";
+    hash = "sha256-c/MbO8KST2QnP32Y2FfXjJcfh6O7hqQFcZOn1U0FqRM=";
   };
 
   build-system = [

pkgs/development/python-modules/mhcflurry/default.nix

@@ -1,29 +1,34 @@
 {
-  appdirs,
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # dependencies
+  appdirs,
   keras,
-  lib,
   mhcgnomes,
-  nose,
   pandas,
-  pytestCheckHook,
   pyyaml,
   scikit-learn,
   tensorflow,
+  tf-keras,
   tqdm,
+
+  # tests
+  nose,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "mhcflurry";
-  version = "2.1.1";
+  version = "2.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvax";
     repo = "mhcflurry";
     rev = "refs/tags/v${version}";
-    hash = "sha256-absIKvcFo6I1Uu0t+l8OLOU/AQ4kD295P4+KVwMAWMc=";
+    hash = "sha256-Xz3Myd+pifNQMTH1BC2qsQEy7UorYNQNj+7ysMVmCOs=";
   };
 
   # keras and tensorflow are not in the official setup.py requirements but are required for the CLI utilities to run.
@@ -35,6 +40,7 @@ buildPythonPackage rec {
     pyyaml
     scikit-learn
     tensorflow
+    tf-keras
     tqdm
   ];
 
@@ -88,7 +94,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/openvax/mhcflurry/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ samuela ];
-    # ModuleNotFoundError: No module named 'keras.api._v2' as tensorflow is too outdated
-    broken = true;
+    # Requires a recent version of tensorflow
+    broken = lib.versionOlder tensorflow.version "2.15.0";
   };
 }

pkgs/development/python-modules/n3fit/default.nix

@@ -1,51 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  hyperopt,
-  keras,
-  nnpdf,
-  psutil,
-  tensorflow,
-  validphys2,
-}:
-
-buildPythonPackage rec {
-  pname = "n3fit";
-  version = "4.0";
-  format = "setuptools";
-
-  inherit (nnpdf) src;
-
-  prePatch = ''
-    cd n3fit
-  '';
-
-  postPatch = ''
-    substituteInPlace src/n3fit/version.py \
-      --replace '= __give_git()' '= "'$version'"'
-  '';
-
-  propagatedBuildInputs = [
-    hyperopt
-    keras
-    psutil
-    tensorflow
-    validphys2
-  ];
-
-  postInstall = ''
-    for prog in "$out"/bin/*; do
-      wrapProgram "$prog" --set PYTHONPATH "$PYTHONPATH:$(toPythonPath "$out")"
-    done
-  '';
-
-  doCheck = false; # no tests
-  pythonImportsCheck = [ "n3fit" ];
-
-  meta = with lib; {
-    description = "NNPDF fitting framework";
-    homepage = "https://docs.nnpdf.science";
-    inherit (nnpdf.meta) license;
-    maintainers = with maintainers; [ veprbl ];
-  };
-}

pkgs/development/python-modules/proton-vpn-network-manager-openvpn/default.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  gobject-introspection,
-  setuptools,
-  proton-core,
-  proton-vpn-network-manager,
-  pytestCheckHook,
-  pytest-cov-stub,
-}:
-
-buildPythonPackage rec {
-  pname = "proton-vpn-network-manager-openvpn";
-  version = "0.1.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "ProtonVPN";
-    repo = "python-proton-vpn-network-manager-openvpn";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-eDBcpuz37crfAFX6oysB4FCkSmVLyfLJ0R2L0cZgjRo=";
-  };
-
-  nativeBuildInputs = [
-    # Solves Namespace NM not available
-    gobject-introspection
-  ];
-
-  build-system = [
-    setuptools
-  ];
-
-  dependencies = [
-    proton-core
-    proton-vpn-network-manager
-  ];
-
-  pythonImportsCheck = [ "proton.vpn.backend.linux.networkmanager.protocol" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-cov-stub
-  ];
-
-  meta = {
-    description = "Adds support for the OpenVPN protocol using NetworkManager";
-    homepage = "https://github.com/ProtonVPN/python-proton-vpn-network-manager-openvpn";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ sebtm ];
-  };
-}

pkgs/development/python-modules/proton-vpn-network-manager-wireguard/default.nix

@@ -1,57 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  gobject-introspection,
-  setuptools,
-  proton-core,
-  proton-vpn-killswitch-network-manager-wireguard,
-  proton-vpn-network-manager,
-  pytestCheckHook,
-  pytest-cov-stub,
-}:
-
-buildPythonPackage rec {
-  pname = "proton-vpn-network-manager-wireguard";
-  version = "0.4.1";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "ProtonVPN";
-    repo = "python-proton-vpn-network-manager-wireguard";
-    rev = "v${version}";
-    hash = "sha256-DZXixcm2VwXhbN4buABlkybDgXIg/mbeUVHOpdoj0Kw=";
-  };
-
-  nativeBuildInputs = [
-    # Solves Namespace NM not available
-    gobject-introspection
-  ];
-
-  build-system = [
-    setuptools
-  ];
-
-  dependencies = [
-    proton-core
-    proton-vpn-killswitch-network-manager-wireguard
-    proton-vpn-network-manager
-  ];
-
-  preCheck = ''
-    # Needed for Permission denied: '/homeless-shelter'
-    export HOME=$(mktemp -d)
-  '';
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-cov-stub
-  ];
-
-  meta = {
-    description = "Adds support for the Wireguard protocol using NetworkManager";
-    homepage = "https://github.com/ProtonVPN/python-proton-vpn-network-manager-wireguard";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ sebtm ];
-  };
-}

pkgs/development/python-modules/proton-vpn-network-manager/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-network-manager";
-  version = "0.5.2";
+  version = "0.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hTJE9sUjPMsE9d0fIA/OhoasumtfsWuFwn0aTm10PN4=";
+    hash = "sha256-fbA3kvhU3l20+7irThiTk/fDe60yR4aWxhE3Ol2K7ow=";
   };
 
   nativeBuildInputs = [
@@ -54,6 +54,11 @@ buildPythonPackage rec {
     pytest-asyncio
   ];
 
+  preCheck = ''
+    # Needed for Permission denied: '/homeless-shelter'
+    export HOME=$(mktemp -d)
+  '';
+
   meta = {
     description = "Provides the necessary functionality for other ProtonVPN components to interact with NetworkManager";
     homepage = "https://github.com/ProtonVPN/python-proton-vpn-network-manager";

pkgs/development/python-modules/pytest-relaxed/default.nix

@@ -3,7 +3,6 @@
   buildPythonPackage,
   decorator,
   fetchPypi,
-  invocations,
   invoke,
   pytest,
   pytestCheckHook,
@@ -27,7 +26,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ decorator ];
 
   nativeCheckInputs = [
-    invocations
     invoke
     pytestCheckHook
   ];

pkgs/development/python-modules/reolink-aio/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.9.9";
+  version = "0.9.10";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-Zv81F7EvukrmA2uLFizJX6EIH4OBJICC7H9k8EtIumI=";
+    hash = "sha256-wN2rWoRuxP5uLl2TkSnxlEwl29z6C8dDo9UkJ7amExo=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/reportengine/default.nix

@@ -1,57 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  flit,
-  jinja2,
-  ruamel-yaml,
-  matplotlib,
-  pandas,
-  pandoc,
-  pygments,
-  blessings,
-  curio,
-  hypothesis,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "reportengine";
-  version = "0.31";
-  format = "pyproject";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-jrt+ml8o1PUidV1bY0hCyNgcPaVTBloW574/i5Pl7iE=";
-  };
-
-  nativeBuildInputs = [ flit ];
-
-  propagatedBuildInputs = [
-    jinja2
-    ruamel-yaml
-    matplotlib
-    pandas
-    pygments
-    blessings
-    curio
-  ];
-
-  nativeCheckInputs = [
-    hypothesis
-    pandoc
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "reportengine" ];
-
-  meta = with lib; {
-    description = "Framework for declarative data analysis";
-    homepage = "https://github.com/NNPDF/reportengine/";
-    license = with licenses; [ gpl2Only ];
-    maintainers = with maintainers; [ veprbl ];
-    # Incompatibility with ruamel >= 0.18
-    # https://github.com/NNPDF/reportengine/issues/60
-    broken = versionAtLeast ruamel-yaml.version "0.18";
-  };
-}

pkgs/development/python-modules/ronin/default.nix

@@ -1,34 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  blessings,
-  colorama,
-  glob2,
-}:
-
-buildPythonPackage rec {
-  pname = "ronin";
-  version = "1.1.1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit version pname;
-    hash = "sha256-5gZ8S0NR4JzKBIdi/xYtVmFg9ObbCSkT7sz+OKWnK/U=";
-  };
-
-  propagatedBuildInputs = [
-    blessings
-    colorama
-    glob2
-  ];
-
-  pythonImportsCheck = [ "ronin" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/tliron/ronin/";
-    description = "Straightforward but powerful build system based on Ninja and Python";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ AndersonTorres ];
-  };
-}

pkgs/development/python-modules/rx/default.nix

@@ -3,13 +3,14 @@
   fetchPypi,
   buildPythonPackage,
   pythonOlder,
-  nose,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "rx";
   version = "3.2.0";
-  format = "setuptools";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   # Use fetchPypi to avoid the updater script to migrate it to `reactivex` which
@@ -20,12 +21,9 @@ buildPythonPackage rec {
     sha256 = "b657ca2b45aa485da2f7dcfd09fac2e554f7ac51ff3c2f8f2ff962ecd963d91c";
   };
 
-  nativeCheckInputs = [ nose ];
+  build-system = [ setuptools ];
 
-  # Some tests are nondeterministic. (`grep sleep -r tests`)
-  # test_timeout_schedule_action_cancel: https://hydra.nixos.org/build/74954646
-  # test_new_thread_scheduler_timeout: https://hydra.nixos.org/build/74949851
-  doCheck = false;
+  doCheck = false; # PyPI tarball does not provides tests
 
   pythonImportsCheck = [ "rx" ];
 

pkgs/development/python-modules/sqlalchemy/1_4.nix

@@ -36,21 +36,18 @@
 
 buildPythonPackage rec {
   pname = "sqlalchemy";
-  version = "1.4.53";
+  version = "1.4.54";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-CpFvL0W/X7/4N/FpufAdud5o11LHBuox8m+8EailqXg=";
+    hash = "sha256-6qAjyqMVrugABHssAQuql3z1YHTAOSm5hARJuJXJJvo=";
   };
 
   postPatch = ''
     sed -i '/tag_build = dev/d' setup.cfg
-
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=44,<69.3" "setuptools"
   '';
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/validphys2/default.nix

@@ -1,48 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  lhapdf,
-  nnpdf,
-  prompt-toolkit,
-  reportengine,
-  requests,
-  seaborn,
-  validobj,
-}:
-
-buildPythonPackage rec {
-  pname = "validphys2";
-  version = "4.0";
-  format = "setuptools";
-
-  inherit (nnpdf) src;
-
-  prePatch = ''
-    cd validphys2
-  '';
-
-  postPatch = ''
-    substituteInPlace src/validphys/version.py \
-      --replace '= __give_git()' '= "'$version'"'
-  '';
-
-  propagatedBuildInputs = [
-    lhapdf
-    nnpdf
-    prompt-toolkit
-    reportengine
-    requests
-    seaborn
-    validobj
-  ];
-
-  doCheck = false; # no tests
-  pythonImportsCheck = [ "validphys" ];
-
-  meta = with lib; {
-    description = "NNPDF analysis framework";
-    homepage = "https://data.nnpdf.science/validphys-docs/guide.html";
-    inherit (nnpdf.meta) license;
-    maintainers = with maintainers; [ veprbl ];
-  };
-}

pkgs/development/tools/analysis/smatch/default.nix

@@ -1,43 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, sqlite
-, openssl
-, buildllvmsparse ? false
-, buildc2xml ? false
-, libllvm
-, libxml2
-}:
-
-stdenv.mkDerivation rec {
-  pname = "smatch";
-  version = "1.73";
-
-  src = fetchFromGitHub {
-    owner = "error27";
-    repo = "smatch";
-    rev = version;
-    sha256 = "sha256-Pv3bd2cjnQKnhH7TrkYWfDEeaq6u/q/iK1ZErzn6bME=";
-  };
-
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [
-    "-Wno-incompatible-function-pointer-types"
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ sqlite openssl ]
-    ++ lib.optionals buildllvmsparse [ libllvm ]
-    ++ lib.optionals buildc2xml [ libxml2.dev ];
-
-  makeFlags = [ "PREFIX=${placeholder "out"}" "CXX=${stdenv.cc.targetPrefix}c++" ];
-
-  meta = with lib; {
-    description = "Semantic analysis tool for C";
-    homepage = "https://sparse.docs.kernel.org/";
-    maintainers = [ ];
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
-  };
-}

pkgs/development/tools/dump_syms/default.nix

@@ -17,7 +17,7 @@
 
 let
   pname = "dump_syms";
-  version = "2.3.3";
+  version = "2.3.4";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -26,10 +26,10 @@ rustPlatform.buildRustPackage {
     owner = "mozilla";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pZlWA7LZeMb+ZhnfQh9MzvDDlre1kkPc6aSVNZcVi/w=";
+    hash = "sha256-6VDuZ5rw2N4z6wOVbaOKO6TNaq8QA5RstsIzmuE3QrI=";
   };
 
-  cargoHash = "sha256-srphb7jFSJB08hSShk3f5QYPoYu8UwbUzkzn0zpMqyg=";
+  cargoHash = "sha256-ndRw5z4CfuX0KNqNgpA4yohG8p/cUR/Op2fIunuO6GM=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/go-mockery/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.45.1";
+  version = "2.46.0";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-9zekTcbojUtVaiA6JiWhY78qyDleNIreFwO3kTmffFg=";
+    sha256 = "sha256-qPE4hzdu5soGVfw6mLJLWvjiXxdkUAT+kpOCWMO1sL8=";
   };
 
   preCheck = ''

pkgs/development/tools/zed/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bafX3i6jEMqYB4YCpIX4z4SgQbJjryGmZ6pvqtVrk3A=";
+    sha256 = "sha256-NCoeTeOkxkCsj/nRBhMJeEshFuwozOXNJvgp8vyCQDk=";
   };
 
-  vendorHash = "sha256-X1rE6/sgpB6jeTjLZJL/a7ghjRJYTXSQDHB4PmEFUmU=";
+  vendorHash = "sha256-E9CXS3BQAglJV36BPgwhkb9SswxAj/yBcGqJ+XXwTmE=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 

pkgs/misc/cbeams/default.nix

@@ -1,21 +0,0 @@
-{ lib, buildPythonApplication, fetchPypi, isPy3k, blessings, docopt }:
-
-buildPythonApplication rec {
-  pname = "cbeams";
-  version = "1.0.3";
-  disabled = !isPy3k;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1agcjg6kmcyvk834xd2j60mi349qi9iw3dc2vwpd7pqwq1daq3gi";
-  };
-
-  propagatedBuildInputs = [ blessings docopt ];
-
-  meta = with lib; {
-    homepage = "https://github.com/tartley/cbeams";
-    description = "Command-line program to draw animated colored circles in the terminal";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ oxzi ];
-  };
-}

pkgs/os-specific/linux/kernel/common-config.nix

@@ -33,15 +33,12 @@ let
 
     debug = {
       # Necessary for BTF
-      DEBUG_INFO                = lib.mkMerge [
-        (whenOlder "5.2" (if (features.debug or false) then yes else no))
-        (whenBetween "5.2" "5.18" yes)
-      ];
+      DEBUG_INFO                = whenOlder "5.18" yes;
       DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
       # Reduced debug info conflict with BTF and have been enabled in
       # aarch64 defconfig since 5.13
       DEBUG_INFO_REDUCED        = whenAtLeast "5.13" (option no);
-      DEBUG_INFO_BTF            = whenAtLeast "5.2" (option yes);
+      DEBUG_INFO_BTF            = option yes;
       # Allow loading modules with mismatched BTFs
       # FIXME: figure out how to actually make BTFs reproducible instead
       # See https://github.com/NixOS/nixpkgs/pull/181456 for details.
@@ -86,7 +83,7 @@ let
       # ACPI Firmware Performance Data Table Support
       ACPI_FPDT                        = whenAtLeast "5.12" (option yes);
       # ACPI Heterogeneous Memory Attribute Table Support
-      ACPI_HMAT                        = whenAtLeast "5.2" (option yes);
+      ACPI_HMAT                        = option yes;
       # ACPI Platform Error Interface
       ACPI_APEI                        = (option yes);
       # APEI Generic Hardware Error Source
@@ -128,7 +125,7 @@ let
       PWM                              = yes;
     } // lib.optionalAttrs (stdenv.hostPlatform.isx86) {
       INTEL_IDLE                       = yes;
-      INTEL_RAPL                       = whenAtLeast "5.3" module;
+      INTEL_RAPL                       = module;
       X86_INTEL_LPSS                   = yes;
       X86_INTEL_PSTATE                 = yes;
       X86_AMD_PSTATE                   = whenAtLeast "5.17" yes;
@@ -202,15 +199,15 @@ let
       IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP  = yes; # required by CFQ"
       BLK_CGROUP_IOLATENCY = yes;
-      BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
+      BLK_CGROUP_IOCOST = yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = yes;
       BFQ_GROUP_IOSCHED = yes;
       MQ_IOSCHED_KYBER = yes;
       IOSCHED_BFQ = module;
       # Enable CPU utilization clamping for RT tasks
-      UCLAMP_TASK = whenAtLeast "5.3" yes;
-      UCLAMP_TASK_GROUP = whenAtLeast "5.4" yes;
+      UCLAMP_TASK = yes;
+      UCLAMP_TASK_GROUP = yes;
     };
 
 
@@ -244,7 +241,7 @@ let
       HAVE_EBPF_JIT      = whenPlatformHasEBPFJit yes;
       BPF_STREAM_PARSER  = yes;
       XDP_SOCKETS        = yes;
-      XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
+      XDP_SOCKETS_DIAG   = yes;
       WAN                = yes;
       TCP_CONG_ADVANCED  = yes;
       TCP_CONG_CUBIC     = yes; # This is the default congestion control algorithm since 2.6.19
@@ -306,8 +303,7 @@ let
       # IPv6: Netfilter Configuration
       NF_TABLES_IPV6              = yes;
       # Bridge Netfilter Configuration
-      NF_TABLES_BRIDGE            = lib.mkMerge [ (whenOlder "5.3" yes)
-                                              (whenAtLeast "5.3" module) ];
+      NF_TABLES_BRIDGE            = module;
       # Expose some debug info
       NF_CONNTRACK_PROCFS         = yes;
       NF_FLOW_TABLE_PROCFS        = whenAtLeast "6.0" yes;
@@ -377,9 +373,9 @@ let
       ATH10K_DFS_CERTIFIED        = option yes;
       B43_PHY_HT                  = option yes;
       BCMA_HOST_PCI               = option yes;
-      RTW88                       = whenAtLeast "5.2" module;
-      RTW88_8822BE                = lib.mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
-      RTW88_8822CE                = lib.mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88                       = module;
+      RTW88_8822BE                = lib.mkMerge [ (whenOlder "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE                = lib.mkMerge [ (whenOlder "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -415,7 +411,7 @@ let
     };
 
     video = let
-      whenHasDevicePrivate = lib.mkIf (!stdenv.isx86_32 && lib.versionAtLeast version "5.1");
+      whenHasDevicePrivate = lib.mkIf (!stdenv.isx86_32);
     in {
       # compile in DRM so simpledrm can load before initrd if necessary
       AGP = yes;
@@ -423,7 +419,7 @@ let
 
       DRM_LEGACY = whenOlder "6.8" no;
 
-      NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
+      NOUVEAU_LEGACY_CTX_SUPPORT = whenOlder "6.3" no;
 
       # Enable simpledrm and use it for generic framebuffer
       # Technically added in 5.14, but adding more complex configuration is not worth it
@@ -446,8 +442,8 @@ let
       DRM_DISPLAY_DP_AUX_CHARDEV = whenAtLeast "6.10" yes;
       # amdgpu display core (DC) support
       DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
-      DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
-      DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
+      DRM_AMD_DC_DCN2_0 = whenOlder "5.6" yes;
+      DRM_AMD_DC_DCN2_1 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
       DRM_AMD_DC_DCN = whenBetween "5.11" "6.4" yes;
       DRM_AMD_DC_FP = whenAtLeast "6.4" yes;
@@ -578,7 +574,7 @@ let
 
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (lib.versionAtLeast version "5.1") then yes else option module;
+      FS_ENCRYPTION   = yes;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -589,7 +585,6 @@ let
 
       EXT4_FS_POSIX_ACL = yes;
       EXT4_FS_SECURITY  = yes;
-      EXT4_ENCRYPTION   = whenOlder "5.1" yes;
 
       NTFS_FS            = whenBetween "5.15" "6.9" no;
       NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
@@ -618,7 +613,6 @@ let
 
       F2FS_FS             = module;
       F2FS_FS_SECURITY    = option yes;
-      F2FS_FS_ENCRYPTION  = whenOlder "5.1" yes;
       F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
       UDF_FS              = module;
 
@@ -640,7 +634,6 @@ let
       CIFS_FSCACHE      = yes;
       CIFS_WEAK_PW_HASH = whenOlder "5.15" yes;
       CIFS_UPCALL       = yes;
-      CIFS_ACL          = whenOlder "5.3" yes;
       CIFS_DFS_UPCALL   = yes;
 
       CEPH_FSCACHE      = yes;
@@ -668,7 +661,7 @@ let
 
       DEVTMPFS = yes;
 
-      UNICODE = whenAtLeast "5.2" yes; # Casefolding support for filesystems
+      UNICODE = yes; # Casefolding support for filesystems
     };
 
     security = {
@@ -687,7 +680,6 @@ let
       STRICT_MODULE_RWX                = yes;
       STRICT_DEVMEM                    = lib.mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = lib.mkDefault yes;
-      SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
 
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
@@ -705,17 +697,17 @@ let
       SECURITY_DMESG_RESTRICT          = yes;
 
       RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
-      RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
+      RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" yes; # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
       # Depends on MODULE_SIG and only really helps when you sign your modules
       # and enforce signatures which we don't do by default.
-      SECURITY_LOCKDOWN_LSM = whenAtLeast "5.4" no;
+      SECURITY_LOCKDOWN_LSM = no;
 
       # provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis
       PERSISTENT_KEYRINGS              = yes;
       # enable temporary caching of the last request_key() result
-      KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
+      KEYS_REQUEST_CACHE               = yes;
       # randomized slab caches
       RANDOM_KMALLOC_CACHES            = whenAtLeast "6.6" yes;
 
@@ -732,9 +724,9 @@ let
       # Enable support for page poisoning. Still needs to be enabled on the command line to actually work.
       PAGE_POISONING                   = yes;
       # Randomize page allocator when page_alloc.shuffle=1
-      SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
+      SHUFFLE_PAGE_ALLOCATOR = yes;
 
-      INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
+      INIT_ON_ALLOC_DEFAULT_ON = yes;
 
       # Enable stack smashing protections in schedule()
       # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
@@ -848,7 +840,7 @@ let
 
       VFIO_PCI_VGA = lib.mkIf stdenv.is64bit yes;
 
-      UDMABUF = whenAtLeast "4.20" yes;
+      UDMABUF = yes;
 
       # VirtualBox guest drivers in the kernel conflict with the ones in the
       # official additions package and prevent the vboxsf module from loading,
@@ -872,7 +864,6 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
       VIRTIO_MMIO_CMDLINE_DEVICES = yes;
@@ -1034,7 +1025,7 @@ let
       SERIAL_DEV_BUS = yes; # enables support for serial devices
       SERIAL_DEV_CTRL_TTYPORT = yes; # enables support for TTY serial devices
 
-      BT_HCIBTUSB_MTK = whenAtLeast "5.3" yes; # MediaTek protocol support
+      BT_HCIBTUSB_MTK = yes; # MediaTek protocol support
 
       BT_HCIUART        = module; # required for BT devices with serial port interface (QCA6390)
       BT_HCIUART_BCM    = option yes; # Broadcom Bluetooth support
@@ -1074,12 +1065,10 @@ let
       IDE                 = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14
       IDLE_PAGE_TRACKING  = yes;
 
-      JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
-      JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
       JOYSTICK_XPAD_FF    = option yes; # X-Box gamepad rumble support
       JOYSTICK_XPAD_LEDS  = option yes; # LED Support for Xbox360 controller 'BigX' LED
 
-      KEYBOARD_APPLESPI = whenAtLeast "5.3" module;
+      KEYBOARD_APPLESPI = module;
 
       KEXEC_FILE      = option yes;
       KEXEC_JUMP      = option yes;
@@ -1109,9 +1098,9 @@ let
       NVME_TARGET_AUTH = whenAtLeast "6.0" yes;
       NVME_TARGET_TCP_TLS = whenAtLeast "6.7" yes;
 
-      PCI_P2PDMA = lib.mkIf (stdenv.hostPlatform.is64bit && lib.versionAtLeast version "4.20") yes;
+      PCI_P2PDMA = lib.mkIf (stdenv.hostPlatform.is64bit) yes;
 
-      PSI = whenAtLeast "4.20" yes;
+      PSI = yes;
 
       MOUSE_ELAN_I2C_SMBUS = yes;
       MOUSE_PS2_ELANTECH = yes; # Elantech PS/2 protocol extension
@@ -1168,17 +1157,17 @@ let
       # Disable the firmware helper fallback, udev doesn't implement it any more
       FW_LOADER_USER_HELPER_FALLBACK = option no;
 
-      FW_LOADER_COMPRESS = whenAtLeast "5.3" yes;
+      FW_LOADER_COMPRESS = yes;
       FW_LOADER_COMPRESS_ZSTD = whenAtLeast "5.19" yes;
 
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
 
       # Enable AMD's ROCm GPU compute stack
-      HSA_AMD =     lib.mkIf stdenv.hostPlatform.is64bit (whenAtLeast "4.20" yes);
-      ZONE_DEVICE = lib.mkIf stdenv.hostPlatform.is64bit (whenAtLeast "5.3" yes);
-      HMM_MIRROR = whenAtLeast "5.3" yes;
-      DRM_AMDGPU_USERPTR = whenAtLeast "5.3" yes;
+      HSA_AMD =     lib.mkIf stdenv.hostPlatform.is64bit (yes);
+      ZONE_DEVICE = lib.mkIf stdenv.hostPlatform.is64bit (yes);
+      HMM_MIRROR = yes;
+      DRM_AMDGPU_USERPTR = yes;
 
       PREEMPT = no;
       PREEMPT_VOLUNTARY = yes;
@@ -1239,13 +1228,13 @@ let
       NR_CPUS = freeform "384";
 
       # Enable LEDS to display link-state status of PHY devices (i.e. eth lan/wan interfaces)
-      LED_TRIGGER_PHY = whenAtLeast "4.10" yes;
+      LED_TRIGGER_PHY = yes;
     } // lib.optionalAttrs (stdenv.hostPlatform.system == "armv7l-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enables support for the Allwinner Display Engine 2.0
       SUN8I_DE2_CCU = yes;
 
       # See comments on https://github.com/NixOS/nixpkgs/commit/9b67ea9106102d882f53d62890468071900b9647
-      CRYPTO_AEGIS128_SIMD = whenAtLeast "5.4" no;
+      CRYPTO_AEGIS128_SIMD = no;
 
       # Distros should configure the default as a kernel option.
       # We previously defined it on the kernel command line as cma=
@@ -1279,7 +1268,7 @@ let
       #  differently when run under aarch64 kernels compared to when
       #  it is run under an aarch32 kernel.
       COMPAT_ALIGNMENT_FIXUPS = lib.mkIf (stdenv.hostPlatform.system == "aarch64-linux") (whenAtLeast "6.1" yes);
-    } // lib.optionalAttrs (lib.versionAtLeast version "5.4" && (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux")) {
+    } // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Required for various hardware features on Chrome OS devices
       CHROME_PLATFORMS = yes;
       CHROMEOS_TBMC = module;
@@ -1294,10 +1283,10 @@ let
       CROS_KBD_LED_BACKLIGHT = module;
 
       TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
-    } // lib.optionalAttrs (lib.versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
+    } // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       CHROMEOS_LAPTOP = module;
       CHROMEOS_PSTORE = module;
-    } // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
+
       # Enable x86 resource control
       X86_CPU_RESCTRL = whenAtLeast "5.0" yes;
 

pkgs/os-specific/linux/kernel/modinst-arg-list-too-long.patch

@@ -1,14 +0,0 @@
-diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
-index 07650ee..934a7a8 100644
---- a/scripts/Makefile.modinst
-+++ b/scripts/Makefile.modinst
-@@ -9,7 +9,8 @@ include scripts/Kbuild.include
- 
- #
- 
--__modules := $(sort $(shell grep -h '\.ko$$' /dev/null $(wildcard $(MODVERDIR)/*.mod)))
-+__modules := $(sort $(foreach f,$(wildcard $(MODVERDIR)/*.mod),$(shell \
-+    grep -h '\.ko$$' '$f')))
- modules := $(patsubst %.o,%.ko,$(wildcard $(__modules:.ko=.o)))
- 
- PHONY += $(modules)

pkgs/os-specific/linux/kernel/patches.nix

@@ -39,11 +39,6 @@
       patch = ./request-key-helper-updated.patch;
     };
 
-  modinst_arg_list_too_long =
-    { name = "modinst-arglist-too-long";
-      patch = ./modinst-arg-list-too-long.patch;
-    };
-
   hardened = let
     mkPatch = kernelVersion: { version, sha256, patch }: let src = patch; in {
       name = lib.removeSuffix ".patch" src.name;

pkgs/os-specific/linux/kernel/perf/default.nix

@@ -57,13 +57,12 @@ in
 
 stdenv.mkDerivation {
   pname = "perf-linux";
-  version = kernel.version;
+  inherit (kernel) version src;
 
-  inherit (kernel) src;
-
-  # Fix 6.10.0 holding pkg-config completely wrong.
-  # Patches from perf-tools-next, should be in 6.11 or hopefully backported.
-  patches = lib.optionals (lib.versions.majorMinor kernel.version == "6.10") [
+  patches = [
+    # fix wrong path to dmesg
+    ./fix-dmesg-path.diff
+  ] ++ lib.optionals (lib.versions.majorMinor kernel.version == "6.10") [
     (fetchpatch {
       url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=0f0e1f44569061e3dc590cd0b8cb74d8fd53706b";
       hash = "sha256-9u/zhbsDgwOr4T4k9td/WJYRuSHIfbtfS+oNx8nbOlM=";

pkgs/os-specific/linux/kernel/perf/fix-dmesg-path.diff

@@ -0,0 +1,11 @@
+--- a/tools/perf/util/evsel.c	2023-10-20 15:50:53.011023294 +0200
++++ b/tools/perf/util/evsel.c	2023-10-20 15:51:03.205997633 +0200
+@@ -3076,7 +3076,7 @@
+ 
+ 	return scnprintf(msg, size,
+ 	"The sys_perf_event_open() syscall returned with %d (%s) for event (%s).\n"
+-	"/bin/dmesg | grep -i perf may provide additional information.\n",
++	"\"dmesg | grep -i perf\" may provide additional information.\n",
+ 			 err, str_error_r(err, sbuf, sizeof(sbuf)), evsel__name(evsel));
+ }
+ 

pkgs/servers/matrix-synapse/default.nix

@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.114.0";
+  version = "1.115.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-AvUc6vE2gjsUEbRLaexDbvEPwJio7W3YMyN3fJvr4c0=";
+    hash = "sha256-R7TAuAdEGvk/cAttxbrOZkZfsfbrsPujt0zVcp3aDZQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-cAGTEi7UwNVfTzckWBpjxfEMWXZRZDdkXIhx/HjAiTg=";
+    hash = "sha256-h84Hp+vhGfunbD3nRb1EXPnGhnMXncjk3ASKdRr805Y=";
   };
 
   postPatch = ''

pkgs/servers/web-apps/wiki-js/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiki-js";
-  version = "2.5.303";
+  version = "2.5.304";
 
   src = fetchurl {
     url = "https://github.com/Requarks/wiki/releases/download/v${version}/${pname}.tar.gz";
-    sha256 = "sha256-Jpv4D+ldGPvJz+8cwNhrmC+Ii5dG0UOTC5JIWPwUzvk=";
+    sha256 = "sha256-w89+X3sqZPlX7EuK/g2oATHqlpx1br/Njh81vZt8zYM=";
   };
 
   sourceRoot = ".";

pkgs/tools/filesystems/garage/default.nix

@@ -11,7 +11,7 @@
 , nixosTests
 }:
 let
-  generic = { version, sha256, cargoHash, cargoPatches ? [], eol ? false, broken ? false }: rustPlatform.buildRustPackage {
+  generic = { version, hash, cargoHash, cargoPatches ? [], eol ? false, broken ? false }: rustPlatform.buildRustPackage {
     pname = "garage";
     inherit version;
 
@@ -20,7 +20,7 @@ let
       owner = "Deuxfleurs";
       repo = "garage";
       rev = "v${version}";
-      inherit sha256;
+      inherit hash;
     };
 
     postPatch = ''
@@ -96,33 +96,32 @@ rec {
 
   garage_0_8_7 = generic {
     version = "0.8.7";
-    sha256 = "sha256-2QGbR6YvMQeMxN3n1MMJ5qfBcEJ5hjXARUOfEn+m4Jc=";
+    hash = "sha256-2QGbR6YvMQeMxN3n1MMJ5qfBcEJ5hjXARUOfEn+m4Jc=";
     cargoHash = "sha256-1cGlJP/RRgxt3GGMN1c+7Y5lLHJyvHEnpLsR35R5FfI=";
     cargoPatches = [ ./update-time-0.8.patch ];
     broken = stdenv.isDarwin;
   };
 
-  garage_0_8 = garage_0_8_7;
-
   garage_0_9_4 = generic {
     version = "0.9.4";
-    sha256 = "sha256-2ZaxenwaVGYYUjUJaGgnGpZNQprQV9+Jns2sXM6cowk=";
+    hash = "sha256-2ZaxenwaVGYYUjUJaGgnGpZNQprQV9+Jns2sXM6cowk=";
     cargoHash = "sha256-1Hrip4R5dr31czOcFMGW4ZvVfVwvdd7LkwukwNpS3o4=";
     cargoPatches = [ ./update-time.patch ];
     broken = stdenv.isDarwin;
   };
 
-  garage_1_0_0 = generic {
-    version = "1.0.0";
-    sha256 = "sha256-5W5cXylFCrDup+HOOUVPWBJUSphOp8szgtpvRIv82b8=";
-    cargoHash = "sha256-zol9P01bwlvl1Wap4EekgVpC45izNCt2uKs7x+EEA/E=";
-    cargoPatches = [ ./update-time.patch ];
+  garage_1_0_1 = generic {
+    version = "1.0.1";
+    hash = "sha256-f6N2asycN04I6U5XQ5LEAqYu/v5jYZiFCxZ8YQ32XyM=";
+    cargoHash = "sha256-jpc/vaygC5WNSkVA3P01mCRk9Nx/CUumE893tHWoe34=";
     broken = stdenv.isDarwin;
   };
 
+  garage_0_8 = garage_0_8_7;
+
   garage_0_9 = garage_0_9_4;
 
-  garage_1_x = garage_1_0_0;
+  garage_1_x = garage_1_0_1;
 
   garage = garage_1_x;
 }