Merge remote-tracking branch 'upstream/master' into sn-remove

maintainers/maintainer-list.nix

@@ -10842,6 +10842,15 @@
     githubId = 77865363;
     name = "Leonid Belyaev";
   };
+  leonm1 = {
+    github = "leonm1";
+    githubId = 32306579;
+    keys = [{
+      fingerprint = "C12D F14B DC9D 64E1 44C3  4D8A 755C DA4E 5923 416A";
+    }];
+    matrix = "@mattleon:matrix.org";
+    name = "Matt Leon";
+  };
   leshainc = {
     email = "leshainc@fomalhaut.me";
     github = "LeshaInc";
@@ -16589,6 +16598,11 @@
       fingerprint = "1401 1B63 393D 16C1 AA9C  C521 8526 B757 4A53 6236";
     }];
   };
+  rosehobgoblin = {
+    name = "J. L. Bowden";
+    github = "rosehobgoblin";
+    githubId = 84164410;
+  };
   rossabaker = {
     name = "Ross A. Baker";
     email = "ross@rossabaker.com";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -78,9 +78,15 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [hebbot](https://github.com/haecker-felix/hebbot), a Matrix bot to generate "This Week in X" like blog posts. Available as [services.hebbot](#opt-services.hebbot.enable).
 
+- [Python Matter Server](https://github.com/home-assistant-libs/python-matter-server), a
+  Matter Controller Server exposing websocket connections for use with other services, notably Home Assistant.
+  Available as [services.matter-server](#opt-services.matter-server.enable)
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.
 
+- [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).
+
 - [Suwayomi Server](https://github.com/Suwayomi/Suwayomi-Server), a free and open source manga reader server that runs extensions built for [Tachiyomi](https://tachiyomi.org). Available as [services.suwayomi-server](#opt-services.suwayomi-server.enable).
 
 - [ping_exporter](https://github.com/czerwonk/ping_exporter), a Prometheus exporter for ICMP echo requests. Available as [services.prometheus.exporters.ping](#opt-services.prometheus.exporters.ping.enable).

nixos/lib/make-disk-image.nix

@@ -609,6 +609,13 @@ let format' = format; in let
         ''}
 
         # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
+
+        # NOTE: systemd-boot-builder.py calls nix-env --list-generations which
+        # clobbers $HOME/.nix-defexpr/channels/nixos This would cause a  folder
+        # /homeless-shelter to show up in the final image which  in turn breaks
+        # nix builds in the target image if sandboxing is turned off (through
+        # __noChroot for example).
+        export HOME=$TMPDIR
         NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot
 
         # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images

nixos/modules/i18n/input-method/fcitx5.nix

@@ -5,7 +5,10 @@ with lib;
 let
   im = config.i18n.inputMethod;
   cfg = im.fcitx5;
-  fcitx5Package = pkgs.fcitx5-with-addons.override { inherit (cfg) addons; };
+  fcitx5Package =
+    if cfg.plasma6Support
+    then pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; }
+    else pkgs.libsForQt5.fcitx5-with-addons.override { inherit (cfg) addons; };
   settingsFormat = pkgs.formats.ini { };
 in
 {
@@ -27,6 +30,14 @@ in
           See [Using Fcitx 5 on Wayland](https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland).
         '';
       };
+      plasma6Support = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Use qt6 versions of fcitx5 packages.
+          Required for configuring fcitx5 in KDE System Settings.
+        '';
+      };
       quickPhrase = mkOption {
         type = with types; attrsOf str;
         default = { };

nixos/modules/misc/nixpkgs.nix

@@ -208,7 +208,11 @@ in
       example = { system = "x86_64-linux"; };
       # Make sure that the final value has all fields for sake of other modules
       # referring to this.
-      apply = lib.systems.elaborate;
+      apply = inputBuildPlatform:
+        let elaborated = lib.systems.elaborate inputBuildPlatform;
+        in if lib.systems.equals elaborated cfg.hostPlatform
+          then cfg.hostPlatform  # make identical, so that `==` equality works; see https://github.com/NixOS/nixpkgs/issues/278001
+          else elaborated;
       defaultText = literalExpression
         ''config.nixpkgs.hostPlatform'';
       description = lib.mdDoc ''

nixos/modules/misc/nixpkgs/test.nix

@@ -12,6 +12,10 @@ let
     nixpkgs.hostPlatform = "aarch64-linux";
     nixpkgs.buildPlatform = "aarch64-darwin";
   };
+  withSameHostAndBuild = eval {
+    nixpkgs.hostPlatform = "aarch64-linux";
+    nixpkgs.buildPlatform = "aarch64-linux";
+  };
   ambiguous = {
     _file = "ambiguous.nix";
     nixpkgs.hostPlatform = "aarch64-linux";
@@ -81,6 +85,8 @@ lib.recurseIntoAttrs {
     assert withHost._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-linux";
     assert withHostAndBuild._module.args.pkgs.stdenv.hostPlatform.system == "aarch64-linux";
     assert withHostAndBuild._module.args.pkgs.stdenv.buildPlatform.system == "aarch64-darwin";
+    assert withSameHostAndBuild.config.nixpkgs.buildPlatform == withSameHostAndBuild.config.nixpkgs.hostPlatform;
+    assert withSameHostAndBuild._module.args.pkgs.stdenv.buildPlatform == withSameHostAndBuild._module.args.pkgs.stdenv.hostPlatform;
     assert builtins.trace (lib.head (getErrors ambiguous))
       getErrors ambiguous ==
         [''

nixos/modules/module-list.nix

@@ -585,6 +585,7 @@
   ./services/home-automation/govee2mqtt.nix
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/homeassistant-satellite.nix
+  ./services/home-automation/matter-server.nix
   ./services/home-automation/zigbee2mqtt.nix
   ./services/home-automation/zwave-js.nix
   ./services/logging/SystemdJournal2Gelf.nix
@@ -786,6 +787,7 @@
   ./services/misc/tiddlywiki.nix
   ./services/misc/tp-auto-kbbl.nix
   ./services/misc/tuxclocker.nix
+  ./services/misc/transfer-sh.nix
   ./services/misc/tzupdate.nix
   ./services/misc/uhub.nix
   ./services/misc/weechat.nix

nixos/modules/security/pam.nix

@@ -1465,9 +1465,9 @@ in
         '';
       }
       {
-        assertion = config.security.pam.zfs.enable -> (config.boot.zfs.enabled || config.boot.zfs.enableUnstable);
+        assertion = config.security.pam.zfs.enable -> config.boot.zfs.enabled;
         message = ''
-          `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled` or `boot.zfs.enableUnstable`).
+          `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled`).
         '';
       }
       {

nixos/modules/services/home-automation/matter-server.nix

@@ -0,0 +1,125 @@
+{ lib
+, pkgs
+, config
+, ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.matter-server;
+  storageDir = "matter-server";
+  storagePath = "/var/lib/${storageDir}";
+  vendorId = "4939"; # home-assistant vendor ID
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ leonm1 ];
+
+  options.services.matter-server = with types; {
+    enable = mkEnableOption (lib.mdDoc "Matter-server");
+
+    package = mkPackageOptionMD pkgs "python-matter-server" { };
+
+    port = mkOption {
+      type = types.port;
+      default = 5580;
+      description = "Port to expose the matter-server service on.";
+    };
+
+    logLevel = mkOption {
+      type = types.enum [ "critical" "error" "warning" "info" "debug" ];
+      default = "info";
+      description = "Verbosity of logs from the matter-server";
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [];
+      description = ''
+        Extra arguments to pass to the matter-server executable.
+        See https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server for options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.matter-server = {
+      after = [ "network-online.target" ];
+      before = [ "home-assistant.service" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Matter Server";
+      environment.HOME = storagePath;
+      serviceConfig = {
+        ExecStart = (concatStringsSep " " [
+          "${cfg.package}/bin/matter-server"
+          "--port" (toString cfg.port)
+          "--vendorid" vendorId
+          "--storage-path" storagePath
+          "--log-level" "${cfg.logLevel}"
+          "${escapeShellArgs cfg.extraArgs}"
+        ]);
+        # Start with a clean root filesystem, and allowlist what the container
+        # is permitted to access.
+        TemporaryFileSystem = "/";
+        # Allowlist /nix/store (to allow the binary to find its dependencies)
+        # and dbus.
+        ReadOnlyPaths = "/nix/store /run/dbus";
+        # Let systemd manage `/var/lib/matter-server` for us inside the
+        # ephemeral TemporaryFileSystem.
+        StateDirectory = storageDir;
+        # `python-matter-server` writes to /data even when a storage-path is
+        # specified. This bind-mount points /data at the systemd-managed
+        # /var/lib/matter-server, so all files get dropped into the state
+        # directory.
+        BindPaths = "${storagePath}:/data";
+
+        # Hardening bits
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = concatStringsSep " " [
+          "~" # Blocklist
+          "@clock"
+          "@cpu-emulation"
+          "@debug"
+          "@module"
+          "@mount"
+          "@obsolete"
+          "@privileged"
+          "@raw-io"
+          "@reboot"
+          "@resources"
+          "@swap"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
+

nixos/modules/services/misc/transfer-sh.nix

@@ -0,0 +1,102 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.transfer-sh;
+  inherit (lib)
+    mkDefault mkEnableOption mkPackageOption mkIf mkOption
+    types mapAttrs isBool getExe boolToString mdDoc optionalAttrs;
+in
+{
+  options.services.transfer-sh = {
+    enable = mkEnableOption (mdDoc "Easy and fast file sharing from the command-line");
+
+    package = mkPackageOption pkgs "transfer-sh" { };
+
+    settings = mkOption {
+      type = types.submodule { freeformType = with types; attrsOf (oneOf [ bool int str ]); };
+      default = { };
+      example = {
+        LISTENER = ":8080";
+        BASEDIR = "/var/lib/transfer.sh";
+        TLS_LISTENER_ONLY = false;
+      };
+      description = mdDoc ''
+        Additional configuration for transfer-sh, see
+        <https://github.com/dutchcoders/transfer.sh#usage-1>
+        for supported values.
+
+        For secrets use secretFile option instead.
+      '';
+    };
+
+    provider = mkOption {
+      type = types.enum [ "local" "s3" "storj" "gdrive" ];
+      default = "local";
+      description = mdDoc "Storage providers to use";
+    };
+
+    secretFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/transfer-sh.env";
+      description = mdDoc ''
+        Path to file containing environment variables.
+        Useful for passing down secrets.
+        Some variables that can be considered secrets are:
+         - AWS_ACCESS_KEY
+         - AWS_ACCESS_KEY
+         - TLS_PRIVATE_KEY
+         - HTTP_AUTH_HTPASSWD
+      '';
+    };
+  };
+
+  config =
+    let
+      localProvider = (cfg.provider == "local");
+      stateDirectory = "/var/lib/transfer.sh";
+    in
+    mkIf cfg.enable
+      {
+        services.transfer-sh.settings = {
+          LISTENER = mkDefault ":8080";
+        } // optionalAttrs localProvider {
+          BASEDIR = mkDefault stateDirectory;
+        };
+
+        systemd.services.transfer-sh = {
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
+          serviceConfig = {
+            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            DevicePolicy = "closed";
+            DynamicUser = true;
+            ExecStart = "${getExe cfg.package} --provider ${cfg.provider}";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            PrivateDevices = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallArchitectures = [ "native" ];
+            SystemCallFilter = [ "@system-service" ];
+            StateDirectory = baseNameOf stateDirectory;
+          } // optionalAttrs (cfg.secretFile != null) {
+            EnvironmentFile = cfg.secretFile;
+          } // optionalAttrs localProvider {
+            ReadWritePaths = cfg.settings.BASEDIR;
+          };
+        };
+      };
+
+  meta.maintainers = with lib.maintainers; [ ocfox ];
+}

nixos/modules/services/networking/tailscale.nix

@@ -66,6 +66,13 @@ in {
       default = [];
       example = ["--ssh"];
     };
+
+    extraDaemonFlags = mkOption {
+      description = lib.mdDoc "Extra flags to pass to {command}`tailscaled`.";
+      type = types.listOf types.str;
+      default = [];
+      example = ["--no-logs-no-support"];
+    };
   };
 
   config = mkIf cfg.enable {
@@ -80,7 +87,7 @@ in {
       ] ++ lib.optional config.networking.resolvconf.enable config.networking.resolvconf.package;
       serviceConfig.Environment = [
         "PORT=${toString cfg.port}"
-        ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
+        ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName} ${lib.concatStringsSep " " cfg.extraDaemonFlags}"''
       ] ++ (lib.optionals (cfg.permitCertUid != null) [
         "TS_PERMIT_CERT_UID=${cfg.permitCertUid}"
       ]);

nixos/modules/system/boot/systemd.nix

@@ -97,6 +97,7 @@ let
 
       # Maintaining state across reboots.
       "systemd-random-seed.service"
+      "systemd-boot-random-seed.service"
       "systemd-backlight@.service"
       "systemd-rfkill.service"
       "systemd-rfkill.socket"
@@ -667,7 +668,6 @@ in
 
     # Don't bother with certain units in containers.
     systemd.services.systemd-remount-fs.unitConfig.ConditionVirtualization = "!container";
-    systemd.services.systemd-random-seed.unitConfig.ConditionVirtualization = "!container";
 
     # Increase numeric PID range (set directly instead of copying a one-line file from systemd)
     # https://github.com/systemd/systemd/pull/12226

nixos/modules/tasks/filesystems/zfs.nix

@@ -211,6 +211,7 @@ in
 
   imports = [
     (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "Instead set `boot.zfs.package = pkgs.zfs_unstable;`")
   ];
 
   ###### interface
@@ -219,9 +220,9 @@ in
     boot.zfs = {
       package = mkOption {
         type = types.package;
-        default = if cfgZfs.enableUnstable then pkgs.zfsUnstable else pkgs.zfs;
-        defaultText = literalExpression "if zfsUnstable is enabled then pkgs.zfsUnstable else pkgs.zfs";
-        description = lib.mdDoc "Configured ZFS userland tools package, use `pkgs.zfsUnstable` if you want to track the latest staging ZFS branch.";
+        default = pkgs.zfs;
+        defaultText = literalExpression "pkgs.zfs";
+        description = lib.mdDoc "Configured ZFS userland tools package, use `pkgs.zfs_unstable` if you want to track the latest staging ZFS branch.";
       };
 
       modulePackage = mkOption {
@@ -239,19 +240,6 @@ in
         description = lib.mdDoc "True if ZFS filesystem support is enabled";
       };
 
-      enableUnstable = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Use the unstable zfs package. This might be an option, if the latest
-          kernel is not yet supported by a published release of ZFS. Enabling
-          this option will install a development version of ZFS on Linux. The
-          version will have already passed an extensive test suite, but it is
-          more likely to hit an undiscovered bug compared to running a released
-          version of ZFS on Linux.
-          '';
-      };
-
       allowHibernation = mkOption {
         type = types.bool;
         default = false;

nixos/tests/all-tests.nix

@@ -512,6 +512,7 @@ in {
   mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; });
   pixelfed = discoverTests (import ./web-apps/pixelfed { inherit handleTestOn; });
   mate = handleTest ./mate.nix {};
+  matter-server = handleTest ./matter-server.nix {};
   matomo = handleTest ./matomo.nix {};
   matrix-appservice-irc = handleTest ./matrix/appservice-irc.nix {};
   matrix-conduit = handleTest ./matrix/conduit.nix {};
@@ -916,6 +917,7 @@ in {
   tor = handleTest ./tor.nix {};
   traefik = handleTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix {};
   trafficserver = handleTest ./trafficserver.nix {};
+  transfer-sh = handleTest ./transfer-sh.nix {};
   transmission = handleTest ./transmission.nix { transmission = pkgs.transmission; };
   transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
   # tracee requires bpf

nixos/tests/matter-server.nix

@@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+let
+  chipVersion = pkgs.python311Packages.home-assistant-chip-core.version;
+in
+
+{
+  name = "matter-server";
+  meta.maintainers = with lib.maintainers; [ leonm1 ];
+
+  nodes = {
+    machine = { config, ... }: {
+      services.matter-server = {
+        enable = true;
+        port = 1234;
+      };
+    };
+  };
+
+  testScript = /* python */ ''
+    start_all()
+
+    machine.wait_for_unit("matter-server.service")
+    machine.wait_for_open_port(1234)
+
+    with subtest("Check websocket server initialized"):
+        output = machine.succeed("echo \"\" | ${pkgs.websocat}/bin/websocat ws://localhost:1234/ws")
+        machine.log(output)
+
+    assert '"sdk_version": "${chipVersion}"' in output, (
+      'CHIP version \"${chipVersion}\" not present in websocket message'
+    )
+
+    assert '"fabric_id": 1' in output, (
+      "fabric_id not propagated to server"
+    )
+
+    with subtest("Check storage directory is created"):
+        machine.succeed("ls /var/lib/matter-server/chip.json")
+
+    with subtest("Check systemd hardening"):
+        _, output = machine.execute("systemd-analyze security matter-server.service | grep -v '✓'")
+        machine.log(output)
+  '';
+})

nixos/tests/qemu-vm-external-disk-image.nix

@@ -69,5 +69,8 @@ in
     os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
 
     machine.succeed("findmnt --kernel --source ${rootFsDevice} --target /")
+
+    # Make sure systemd boot didn't clobber this
+    machine.succeed("[ ! -e /homeless-shelter ]")
   '';
 }

nixos/tests/transfer-sh.nix

@@ -0,0 +1,20 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "transfer-sh";
+
+  meta = {
+    maintainers = with lib.maintainers; [ ocfox ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    services.transfer-sh = {
+      enable = true;
+      settings.LISTENER = ":1234";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("transfer-sh.service")
+    machine.wait_for_open_port(1234)
+    machine.succeed("curl --fail http://localhost:1234/")
+  '';
+})

nixos/tests/zfs.nix

@@ -7,14 +7,14 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
 
-  makeZfsTest = name:
+  makeZfsTest =
     { kernelPackages
     , enableSystemdStage1 ? false
     , zfsPackage
     , extraTest ? ""
     }:
     makeTest {
-      name = "zfs-" + name;
+      name = zfsPackage.kernelModuleAttribute;
       meta = with pkgs.lib.maintainers; {
         maintainers = [ elvishjerricco ];
       };
@@ -192,23 +192,23 @@ let
 in {
 
   # maintainer: @raitobezarius
-  series_2_1 = makeZfsTest "2.1-series" {
+  series_2_1 = makeZfsTest {
     zfsPackage = pkgs.zfs_2_1;
     kernelPackages = pkgs.linuxPackages;
   };
 
-  stable = makeZfsTest "stable" {
-    zfsPackage = pkgs.zfsStable;
+  series_2_2 = makeZfsTest {
+    zfsPackage = pkgs.zfs_2_2;
     kernelPackages = pkgs.linuxPackages;
   };
 
-  unstable = makeZfsTest "unstable" rec {
-    zfsPackage = pkgs.zfsUnstable;
+  unstable = makeZfsTest rec {
+    zfsPackage = pkgs.zfs_unstable;
     kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
   };
 
-  unstableWithSystemdStage1 = makeZfsTest "unstable" rec {
-    zfsPackage = pkgs.zfsUnstable;
+  unstableWithSystemdStage1 = makeZfsTest rec {
+    zfsPackage = pkgs.zfs_unstable;
     kernelPackages = zfsPackage.latestCompatibleLinuxPackages;
     enableSystemdStage1 = true;
   };

pkgs/applications/audio/monkeys-audio/default.nix

@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.49";
+  version = "10.52";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-OhTqBFNwmReMT1U11CIB7XCTohiILdd2nDFp+9nfObs=";
+    hash = "sha256-n+bQzvuCTt7dnqkPO592KKZeShmMlbp/KAXK0F2dlTg=";
     stripRoot = false;
   };
   nativeBuildInputs = [

pkgs/applications/audio/spotifywm/default.nix

@@ -1,39 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, spotify, xorg, makeWrapper }:
-stdenv.mkDerivation {
-  pname = "spotifywm-unstable";
-  version = "2022-10-26";
-
-  src = fetchFromGitHub {
-    owner = "dasJ";
-    repo = "spotifywm";
-    rev = "8624f539549973c124ed18753881045968881745";
-    sha256 = "sha256-AsXqcoqUXUFxTG+G+31lm45gjP6qGohEnUSUtKypew0=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildInputs = [ xorg.libX11 ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib}
-    install -Dm644 spotifywm.so $out/lib/
-    ln -sf ${spotify}/bin/spotify $out/bin/spotify
-
-    # wrap spotify to use spotifywm.so
-    wrapProgram $out/bin/spotify --set LD_PRELOAD "$out/lib/spotifywm.so"
-    # backwards compatibility for people who are using the "spotifywm" binary
-    ln -sf $out/bin/spotify $out/bin/spotifywm
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/dasJ/spotifywm";
-    description = "Wrapper around Spotify that correctly sets class name before opening the window";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ jqueiroz the-argus ];
-  };
-}

pkgs/applications/graphics/oculante/default.nix

@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.11";
+  version = "0.8.13";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-5nOXt2c7byO+JdVXADu2TyO4vtLyg8UBWerPFMGHcso=";
+    hash = "sha256-RbRvV3OkRZXc0n7qGzqbBtbU81wFc+/Ohg9pbVqdsw4=";
   };
 
-  cargoHash = "sha256-l1JYZxwvNnaff1PYPXniHmfNMG2Um5aPKTYuh/LCHoE=";
+  cargoHash = "sha256-qt4bHCHpiP6yOce9hquVVlLFF906ADwhss4xAP9E0fA=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/graphics/upscayl/default.nix

@@ -4,11 +4,11 @@
   lib,
 }: let
   pname = "upscayl";
-  version = "2.9.9";
+  version = "2.10.0";
 
   src = fetchurl {
     url = "https://github.com/upscayl/upscayl/releases/download/v${version}/upscayl-${version}-linux.AppImage";
-    hash = "sha256-EoTFvlLsXQYZldXfEHhP3/bHygm+NdeDsf+p138mM8w";
+    hash = "sha256-nRYNYNHIkbvvQZd1zRDCCsCadgRgV/yn9WfaKjt44O8=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/misc/calibre/default.nix

@@ -32,11 +32,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.5.1";
+  version = "7.6.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pGo9fWyeX5hpw5YOV05tWy/0YxHShStKN96LMPnqIiA=";
+    hash = "sha256-fD2kTwH692x6Nm93NrUQvmbcXiX9hHBpo4wvUvBqLAM=";
   };
 
   patches = [

pkgs/applications/misc/logseq/default.nix

@@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let
 
 in {
   pname = "logseq";
-  version = "0.10.6";
+  version = "0.10.7";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-OUQh+6HRnzxw8Nn/OkU+DkjPKWKpMN0xchD1vPU3KV8=";
+    hash = "sha256-EC83D7tSpoDV6h363yIdX9IrTfoMd4b0hTVdW1T0pXg=";
     name = "${pname}-${version}.AppImage";
   };
 

pkgs/applications/misc/ttdl/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttdl";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${version}";
-    sha256 = "sha256-5OYOF8SvjPn/gZf/utcpv1zVvVbB1HeB1mkMiJtBjOQ=";
+    sha256 = "sha256-fspqUzF3QqFpd16J1dbcNMdqjcR3PIiRu/s+VB4KgwQ=";
   };
 
-  cargoHash = "sha256-MLypY7Dbr1/4hJ2UYmNOVp0nNWrq3DDTEidgkL0X0AU=";
+  cargoHash = "sha256-dvzm9lbVGGM4t6KZcHSlqwo55jssxi8HyFREMaj5I0Q=";
 
   meta = with lib; {
     description = "A CLI tool to manage todo lists in todo.txt format";

pkgs/applications/misc/wofi/default.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "wofi";
-  version = "1.4";
+  version = "1.4.1";
 
   src = fetchFromSourcehut {
     repo = pname;
     owner = "~scoopta";
     rev = "v${version}";
-    sha256 = "sha256-zzBD1OPPlOjAUaJOlMf6k1tSai1w1ZvOwy2sSOWI7AM=";
+    sha256 = "sha256-aedoUhVfk8ljmQ23YxVmGZ00dPpRftW2dnRAgXmtV/w=";
     vc = "hg";
   };
 

pkgs/applications/networking/cluster/atmos/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.64.1";
+  version = "1.64.3";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QHXBvZThLi5Gnpc7fmitkvl3JU1i/g2jz8c6U4//6mU=";
+    sha256 = "sha256-Z27wFAWstsQliDiYl93yY9LDeVcGEWcrmggGJI60hxk=";
   };
 
   vendorHash = "sha256-i7m9YXPlWqHtvC4Df7v5bLWt2tqeT933t2+Xit5RQxg=";

pkgs/applications/networking/cluster/werf/default.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.294";
+  version = "1.2.295";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-A/Do2UepwV8lmT8qWir7CKR8/YeVKOEoJjvVfj9+wt0=";
+    hash = "sha256-oQDP2Tsxj4c5X2pfj4i+hfnsdjUBYcyF2p61OY04Ozg=";
   };
 
-  vendorHash = "sha256-Fb9drtVITjka83Y8+YSa9fqSBv7O4muMGqV4w3K7+Dg=";
+  vendorHash = "sha256-6q13vMxu0iQgaXS+Z6V0jjSIhxMscw6sLANzK07gAlI=";
 
   proxyVendor = true;
 

pkgs/applications/science/physics/nnpdf/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nnpdf";
-  version = "4.0.8";
+  version = "4.0.9";
 
   src = fetchFromGitHub {
     owner = "NNPDF";
     repo = pname;
     rev = version;
-    hash = "sha256-hGCA2K/fD6UZa9WD42IDmZV1oxNgjFaXkjOZKGgGSBg=";
+    hash = "sha256-PyhkHlOlzKfDxUX91NkeZWjdEzFR4PW0Yh5Yz6ZA27g=";
   };
 
   postPatch = ''

pkgs/applications/window-managers/hyprwm/hyprland/default.nix

@@ -9,6 +9,7 @@
 , cairo
 , git
 , hyprland-protocols
+, hyprlang
 , jq
 , libGL
 , libdrm
@@ -31,7 +32,7 @@
 , debug ? false
 , enableXWayland ? true
 , legacyRenderer ? false
-, withSystemd ? true
+, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , wrapRuntimeDeps ? true
   # deprecated flags
 , nvidiaPatches ? false
@@ -43,13 +44,13 @@ assert lib.assertMsg (!enableNvidiaPatches) "The option `enableNvidiaPatches` ha
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dU5m6Cd4+WQZal2ICDVf1kww/dNzo1YUWRxWeCctEig=";
+    hash = "sha256-oZe4k6jtO/0govmERGcbeyvE9EfTvXY5bnyIs6AsL9U=";
   };
 
   patches = [
@@ -92,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
       cairo
       git
       hyprland-protocols
+      hyprlang
       libGL
       libdrm
       libinput
@@ -116,10 +118,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonAutoFeatures = "disabled";
 
-  mesonFlags = builtins.concatLists [
-    (lib.optional enableXWayland "-Dxwayland=enabled")
-    (lib.optional legacyRenderer "-Dlegacy_renderer=enabled")
-    (lib.optional withSystemd "-Dsystemd=enabled")
+  mesonFlags = [
+    (lib.mesonEnable "xwayland" enableXWayland)
+    (lib.mesonEnable "legacy_renderer" legacyRenderer)
+    (lib.mesonEnable "systemd" withSystemd)
   ];
 
   postInstall = ''

pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix

@@ -5,7 +5,7 @@
 , hyprland
 }:
 let
-  mkHyprlandPlugin =
+  mkHyprlandPlugin = hyprland:
     args@{ pluginName, ... }:
     stdenv.mkDerivation (args // {
       pname = "${pluginName}";
@@ -14,23 +14,23 @@ let
         ++ hyprland.buildInputs
         ++ (args.buildInputs or [ ]);
       meta = args.meta // {
-        description = (args.meta.description or "");
-        longDescription = (args.meta.lonqDescription or "") +
+        description = args.meta.description or "";
+        longDescription = (args.meta.longDescription or "") +
           "\n\nPlugins can be installed via a plugin entry in the Hyprland NixOS or Home Manager options.";
       };
     });
 
   plugins = {
     hy3 = { fetchFromGitHub, cmake, hyprland }:
-      mkHyprlandPlugin rec {
+      mkHyprlandPlugin hyprland rec {
         pluginName = "hy3";
-        version = "0.35.0";
+        version = "unstable-2024-02-23";
 
         src = fetchFromGitHub {
           owner = "outfoxxed";
           repo = "hy3";
-          rev = "hl${version}";
-          hash = "sha256-lFe7Lf0K5ePTh4gflnvBohOGH4ayGDtNkbg/XtoNqRo=";
+          rev = "029a2001361d2a4cbbe7447968dee5d1b1880298";
+          hash = "sha256-8LKCXwNU6wA8o6O7s9T2sLWbYNHaI1tYU4YMjHkNLZQ=";
         };
 
         nativeBuildInputs = [ cmake ];
@@ -47,5 +47,4 @@ let
       };
   };
 in
-lib.mapAttrs (name: plugin: callPackage plugin { }) plugins
-
+(lib.mapAttrs (name: plugin: callPackage plugin { }) plugins) // { inherit mkHyprlandPlugin; }

pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix

@@ -9,8 +9,8 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "00b869c1a96f300a8f25da95d624524895e0ddf2";
-      hash = "sha256-5HUTG0p+nCJv3cn73AmFHRZdfRV5AD5N43g8xAePSKM=";
+      rev = "0cb091f1a2d345f37d2ee445f4ffd04f7f4ec9e5";
+      hash = "sha256-Mz6hCtommq7RQfcPnxLINigO4RYSNt23HeJHC6mVmWI=";
     };
 
     patches = [ ]; # don't inherit old.patches

pkgs/by-name/README.md

@@ -118,3 +118,83 @@ $ ./pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh master
 ```
 
 See [here](../../.github/workflows/check-by-name.yml) for more info.
+
+## Recommendation for new packages with multiple versions
+
+These checks of the `pkgs/by-name` structure can cause problems in combination:
+1. New top-level packages using `callPackage` must be defined via `pkgs/by-name`.
+2. Packages in `pkgs/by-name` cannot refer to files outside their own directory.
+
+This means that outside `pkgs/by-name`, multiple already-present top-level packages can refer to some common file.
+If you open a PR to another instance of such a package, CI will fail check 1,
+but if you try to move the package to `pkgs/by-name`, it will fail check 2.
+
+This is often the case for packages with multiple versions, such as
+
+```nix
+  foo_1 = callPackage ../tools/foo/1.nix { };
+  foo_2 = callPackage ../tools/foo/2.nix { };
+```
+
+The best way to resolve this is to not use `callPackage` directly, such that check 1 doesn't trigger.
+This can be done by using `inherit` on a local package set:
+```nix
+  inherit
+    ({
+      foo_1 = callPackage ../tools/foo/1.nix { };
+      foo_2 = callPackage ../tools/foo/2.nix { };
+    })
+    foo_1
+    foo_2
+    ;
+```
+
+While this may seem pointless, this can in fact help with future package set refactorings,
+because it establishes a clear connection between related attributes.
+
+### Further possible refactorings
+
+This is not required, but the above solution also allows refactoring the definitions into a separate file:
+
+```nix
+  inherit (import ../tools/foo pkgs)
+    foo_1 foo_2;
+```
+
+```nix
+# pkgs/tools/foo/default.nix
+pkgs: {
+  foo_1 = callPackage ./1.nix { };
+  foo_2 = callPackage ./2.nix { };
+}
+```
+
+Alternatively using [`callPackages`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.customisation.callPackagesWith)
+if `callPackage` isn't used underneath and you want the same `.override` arguments for all attributes:
+
+```nix
+  inherit (callPackages ../tools/foo { })
+    foo_1 foo_2;
+```
+
+```nix
+# pkgs/tools/foo/default.nix
+{
+  stdenv
+}: {
+  foo_1 = stdenv.mkDerivation { /* ... */ };
+  foo_2 = stdenv.mkDerivation { /* ... */ };
+}
+```
+
+### Exposing the package set
+
+This is not required, but the above solution also allows exposing the package set as an attribute:
+
+```nix
+  foo-versions = import ../tools/foo pkgs;
+  # Or using callPackages
+  # foo-versions = callPackages ../tools/foo { };
+
+  inherit (foo-versions) foo_1 foo_2;
+```

pkgs/by-name/ap/apt/package.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.7.12";
+  version = "2.7.13";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-5G0Wa1/Ih8LZvKet1+DM2lR7lit2LhJyoIwEJrqpnK8=";
+    hash = "sha256-xCq1XpHXvuX8v3/4w1hHFMusqgNl8JHn5gT3+Ek8fjU=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/co/codeium/package.nix

@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-3B1TEToovw4C8rLsJv0Y3OPg8ZjMZ3Y29IzIs9Wm6II=";
-    aarch64-linux = "sha256-kD0yMHoJejKpK1cX/OPQLjPB8cXBp/aXy66YDxXINRw=";
-    x86_64-darwin = "sha256-DxyxR1t4UrqTn/ORrDiOryWCQ1L0DWXmlh2Hnm7kMS4=";
-    aarch64-darwin = "sha256-Ckbg/bZxeMpt2xtrLhJXo9DJTLluuWPVdGRRwiO1ZY8=";
+    x86_64-linux = "sha256-+SdAippxuJ0LvT+w6xSvTpzCv5EPjxXJKH4mcmnxu9Y=";
+    aarch64-linux = "sha256-cX+P0WcT+0oYDAcUJJ0+SRWPQCdv4rhrBf5BdPrF1Hg=";
+    x86_64-darwin = "sha256-eQjwViY5OsFzFtKkjLbrQgGNVBBpNNJjlfu8t/F37hI=";
+    aarch64-darwin = "sha256-xfB81SLuVa1wKcIGJZFxjdCSPmPXg0vYXtkCftiXBtU=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.6.39";
+  version = "1.8.0";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";

pkgs/by-name/co/composefs/package.nix

@@ -16,6 +16,7 @@
 , fsverity-utils
 , nix-update-script
 , testers
+, nixosTests
 
 , fuseSupport ? lib.meta.availableOn stdenv.hostPlatform fuse3
 , enableValgrindCheck ? false
@@ -23,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "composefs";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "composefs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ViZkmuLFV5DN1nqWKGl+yaqhYUEOztZ1zGpxjr1U/dw=";
+    hash = "sha256-YmredtZZKMjzJW/kxiTUmdgO/1iPIKzJsuJz8DeEdGM=";
   };
 
   strictDeps = true;
@@ -69,7 +70,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests = {
+      # Broken on aarch64 unrelated to this package: https://github.com/NixOS/nixpkgs/issues/291398
+      inherit (nixosTests) activation-etc-overlay-immutable activation-etc-overlay-mutable;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
   };
 
   meta = {

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.172.0";
+  version = "0.173.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-DzbCtTXeoERV9ceUsZ+srATIyviJp+oNyB7EE/iHe6g=";
+    hash = "sha256-PVBt+AoYd8fMYHzBpgQ261TGlkmyooN7UKX9ooXaRYA=";
   };
 
-  vendorHash = "sha256-P+T+ynSkG3KEmJsrzJusCPBD1ClaVK/VIHD+2xkGswQ=";
+  vendorHash = "sha256-5bHZt+Oze7JiaY0dKjoMNDdU6wzMphgZ3W3NveRKGy0=";
 
   doCheck = false;
 

pkgs/by-name/fc/fcitx5-rose-pine/package.nix

@@ -0,0 +1,34 @@
+{ stdenvNoCC
+, fetchFromGitHub
+, lib
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "fcitx5-rose-pine";
+  version = "0-unstable-2024-03-01";
+
+  src = fetchFromGitHub {
+    owner = "rose-pine";
+    repo = "fcitx5";
+    rev = "148de09929c2e2f948376bb23bc25d72006403bc";
+    hash = "sha256-SpQ5ylHSDF5KCwKttAlXgrte3GA1cCCy/0OKNT1a3D8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/share/fcitx5/themes/
+    cp -rv rose-pine* $out/share/fcitx5/themes/
+
+    runHook postInstall
+  '';
+
+
+  meta = {
+    description = "Fcitx5 themes based on Rosé Pine";
+    homepage = "https://github.com/rose-pine/fcitx5";
+    maintainers = with lib.maintainers; [ rosehobgoblin ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.unfree;
+  };
+}

pkgs/by-name/hu/hugo/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.123.4";
+  version = "0.123.6";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AJ/uK2eunQgsCcXR8FcQ9TVvMXs56J0gpfXRQCX78qY=";
+    hash = "sha256-gLow1AcUROid6skLDdaJ9E3mPi99KPoOO/ZFdLBineU=";
   };
 
-  vendorHash = "sha256-6qNICaj+P0VRl/crbiucZ7CpBG1vwFURkvOdaH6WidU=";
+  vendorHash = "sha256-V7YRrC+6fOIjXOu7E0kIOZZt++4oFLPhmHeWmOVU3Xw=";
 
   doCheck = false;
 

pkgs/by-name/li/libvpl/opengl-driver-lib.patch

@@ -0,0 +1,19 @@
+--- a/libvpl/src/mfx_dispatcher_vpl_loader.cpp
++++ b/libvpl/src/mfx_dispatcher_vpl_loader.cpp
+@@ -548,6 +548,16 @@ mfxStatus LoaderCtxVPL::BuildListOfCandidateLibs() {
+         it++;
+     }
+
++    // fourth priority
++    searchDirList.clear();
++    searchDirList.push_back("@driverLink@/lib");
++    it = searchDirList.begin();
++    while (it != searchDirList.end()) {
++        STRING_TYPE nextDir = (*it);
++        sts                 = SearchDirForLibs(nextDir, m_libInfoList, LIB_PRIORITY_05);
++        it++;
++    }
++
+     // lowest priority: legacy MSDK installation
+     searchDirList.clear();
+     GetSearchPathsLegacy(searchDirList);

pkgs/by-name/li/libvpl/package.nix

@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
+, substituteAll
+, addDriverRunpath
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,6 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
       "-DBUILD_TOOLS=OFF"
   ];
 
+  patches = [
+    (substituteAll {
+      src = ./opengl-driver-lib.patch;
+      inherit (addDriverRunpath) driverLink;
+    })
+  ];
+
   meta = with lib; {
     description = "Intel Video Processing Library";
     homepage = "https://intel.github.io/libvpl/";

pkgs/by-name/li/live555/package.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "live555";
-  version = "2023.11.30";
+  version = "2024.02.23";
 
   src = fetchurl {
     urls = [
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
       "https://download.videolan.org/contrib/live555/live.${finalAttrs.version}.tar.gz"
       "mirror://sourceforge/slackbuildsdirectlinks/live.${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-xue+9YtdAM2XkzAY6dU2PZ3n6bvPwlULIHqBqc8wuSU=";
+    hash = "sha256-85JWXfsPAvocX5PiKXw9Xkd4zm2akzxMeETsZ3xm2wg=";
   };
 
   patches = [

pkgs/by-name/lt/ltris/package.nix

@@ -1,18 +1,18 @@
 { lib
-, stdenv
-, fetchurl
 , SDL
 , SDL_mixer
 , directoryListingUpdater
+, fetchurl
+, stdenv
 }:
 
-stdenv.mkDerivation rec {
-  pname = "ltris";
-  version = "1.2.7";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lgames-ltris";
+  version = "1.2.8";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lgames/${pname}-${version}.tar.gz";
-    hash = "sha256-EpHGpkLQa57hU6wKLnhVosmD6DnGGPGilN8E2ClSXLA=";
+    url = "mirror://sourceforge/lgames/ltris-${finalAttrs.version}.tar.gz";
+    hash = "sha256-2e5haaU2pqkBk82qiF/3HQgSBVPHP09UwW+TQqpGUqA=";
   };
 
   buildInputs = [
@@ -23,17 +23,18 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   passthru.updateScript = directoryListingUpdater {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     url = "https://lgames.sourceforge.io/LTris/";
     extraRegex = "(?!.*-win(32|64)).*";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://lgames.sourceforge.io/LTris/";
     description = "Tetris clone from the LGames series";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ciil ];
+    license = with lib.licenses; [ gpl2Plus ];
+    mainProgram = "ltris";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     inherit (SDL.meta) platforms;
     broken = stdenv.isDarwin;
   };
-}
+})

pkgs/by-name/md/mdsh/package.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdsh";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "zimbatm";
     repo = "mdsh";
     rev = "v${version}";
-    hash = "sha256-Y8ss/aw01zpgM6Z6fCGshP21kcdSOTVG/VqL8H3tlls=";
+    hash = "sha256-ammLbKEKXDSuZMr4DwPpcRSkKh7BzNC+4ZRCqTNNCQk=";
   };
 
-  cargoSha256 = "sha256-8o4gN6mqUU+o80IqlAYAD5qpZBSQ/FY5HoNbpwzTm0A=";
+  cargoHash = "sha256-wLHMccxk3ceZyGK27t5Kyal48yj9dQNgmEHjH9hR9Pc=";
 
   meta = with lib; {
     description = "Markdown shell pre-processor";

pkgs/by-name/ni/nixfmt-rfc-style/date.txt

@@ -1 +1 @@
-2024-01-31
+2024-03-01

pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix

@@ -8,8 +8,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.5.0";
   src = fetchzip {
-    url = "https://github.com/piegamesde/nixfmt/archive/d6930fd0c62c4d7ec9e4a814adc3d2f590d96271.tar.gz";
-    sha256 = "1ijrdzdwricv4asmy296j7gzvhambv96nlxi3qrxb4lj1by6a34m";
+    url = "https://github.com/piegamesde/nixfmt/archive/2b5ee820690bae64cb4003e46917ae43541e3e0b.tar.gz";
+    sha256 = "1i1jbc1q4gd7fpilwy6s3a583yl5l8d8rlmipygj61mpclg9ihqg";
   };
   isLibrary = true;
   isExecutable = true;

pkgs/by-name/op/opengist/package.nix

@@ -0,0 +1,70 @@
+{ lib, buildGoModule, buildNpmPackage, fetchFromGitHub, moreutils, jq, git }:
+let
+  # finalAttrs when 🥺 (buildGoModule does not support them)
+  # https://github.com/NixOS/nixpkgs/issues/273815
+  version = "1.6.1";
+  src = fetchFromGitHub {
+    owner = "thomiceli";
+    repo = "opengist";
+    rev = "v${version}";
+    hash = "sha256-rJ8oiH08kSSFNgPHKGo68Oi1i3L1SEJyHuzoxKMOZME=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "opengist-frontend";
+    inherit version src;
+
+    nativeBuildInputs = [ moreutils jq ];
+
+    # npm complains of "invalid package". shrug. we can give it a version.
+    preBuild = ''
+      jq '.version = "${version}"' package.json | sponge package.json
+    '';
+
+    # copy pasta from the Makefile upstream, seems to be a workaround of sass
+    # issues, unsure why it is not done in vite:
+    # https://github.com/thomiceli/opengist/blob/05eccfa8e728335514a40476cd8116cfd1ca61dd/Makefile#L16-L19
+    postBuild = ''
+      EMBED=1 npx postcss 'public/assets/embed-*.css' -c public/postcss.config.js --replace
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -R public $out
+    '';
+
+    npmDepsHash = "sha256-Sy321tIQOOrypk+EOGGixEzrPdhA9U8Hak+DOS+d00A=";
+  };
+in
+buildGoModule {
+  pname = "opengist";
+  inherit version src;
+  vendorHash = "sha256-IorqXJKzUTUL5zfKRipZaJtRlwVOmTwolJXFG/34Ais=";
+  tags = [
+    "fs_embed"
+  ];
+
+  # required for tests
+  nativeCheckInputs = [
+    git
+  ];
+
+  # required for tests to not try to write into $HOME and fail
+  preCheck = ''
+    export OG_OPENGIST_HOME=$(mktemp -d)
+  '';
+
+  postPatch = ''
+    cp -R ${frontend}/public/{manifest.json,assets} public/
+  '';
+
+  passthru.frontend = frontend;
+
+  meta = {
+    description = "Self-hosted pastebin powered by Git";
+    homepage = "https://github.com/thomiceli/opengist";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ lf- ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/pt/ptcollab/package.nix

@@ -1,40 +1,39 @@
-{ mkDerivation
+{ stdenv
 , lib
-, stdenv
 , fetchFromGitHub
 , nix-update-script
+, libsForQt5
 , libvorbis
 , pkg-config
-, qmake
-, qtbase
-, qttools
-, qtmultimedia
 , rtmidi
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ptcollab";
-  version = "0.6.4.7";
+  version = "0.6.4.8";
 
   src = fetchFromGitHub {
     owner = "yuxshao";
     repo = "ptcollab";
-    rev = "v${version}";
-    hash = "sha256-KYNov/HbKM2d8VVO8iyWA3XWFDE9iWeKkRCNC1xlPNw=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9u2K79QJRfYKL66e1lsRrQMEqmKTWbK+ucal3/u4rP4=";
   };
 
   nativeBuildInputs = [
     pkg-config
+  ] ++ (with libsForQt5; [
     qmake
     qttools
-  ];
+    wrapQtAppsHook
+  ]);
 
   buildInputs = [
     libvorbis
+    rtmidi
+  ] ++ (with libsForQt5; [
     qtbase
     qtmultimedia
-    rtmidi
-  ];
+  ]);
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Move appbundles to Applications before wrapping happens
@@ -54,8 +53,9 @@ mkDerivation rec {
   meta = with lib; {
     description = "Experimental pxtone editor where you can collaborate with friends";
     homepage = "https://yuxshao.github.io/ptcollab/";
+    changelog = "https://github.com/yuxshao/ptcollab/releases/tag/v${finalAttrs.version}";
     license = licenses.mit;
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
   };
-}
+})

pkgs/by-name/rs/rsgain/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
     pname = "rsgain";
-    version = "3.4";
+    version = "3.5";
 
     src = fetchFromGitHub {
       owner = "complexlogic";
       repo = "rsgain";
       rev = "v${version}";
-      sha256 = "sha256-AiNjsrwTF6emcwXo2TPMbs8mLavGS7NsvytAppMGKfY=";
+      sha256 = "sha256-qIRtdgfGDNbZk9TQ3GC3lYetRqjOk8QPhAb4MuFuN0U=";
     };
 
     cmakeFlags = ["-DCMAKE_BUILD_TYPE='Release'"];

pkgs/by-name/sp/spotifywm/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libX11,
+  lndir,
+  makeBinaryWrapper,
+  spotify,
+}:
+stdenv.mkDerivation {
+  pname = "spotifywm";
+  version = "0-unstable-2022-10-25";
+
+  src = fetchFromGitHub {
+    owner = "dasJ";
+    repo = "spotifywm";
+    rev = "8624f539549973c124ed18753881045968881745";
+    hash = "sha256-AsXqcoqUXUFxTG+G+31lm45gjP6qGohEnUSUtKypew0=";
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    lndir
+  ];
+
+  buildInputs = [ libX11 ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+
+    lndir -silent ${spotify} $out
+
+    install -Dm644 spotifywm.so $out/lib/spotifywm.so
+
+    wrapProgram $out/bin/spotify \
+      --suffix LD_PRELOAD : "$out/lib/spotifywm.so"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/dasJ/spotifywm";
+    description = "Wrapper around Spotify that correctly sets class name before opening the window";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ jqueiroz the-argus ];
+    mainProgram = "spotify";
+  };
+}

pkgs/by-name/ti/tippecanoe/package.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.46.0";
+  version = "2.47.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-UsQb90DKK05JByF3rh6kcvSaugEemU2Gg4c/owImNVs=";
+    hash = "sha256-tkecrbrkwYJU0eZMzU+7rJGAn+S/vnh/rw5co0x1m5M=";
   };
 
   buildInputs = [ sqlite zlib ];
@@ -32,5 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd2;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
+    mainProgram = "tippecanoe";
   };
 })

pkgs/by-name/tr/transfer-sh/package.nix

@@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, nix-update-script
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "transfer-sh";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "dutchcoders";
+    repo = "transfer.sh";
+    rev = "v${version}";
+    hash = "sha256-V8E6RwzxKB6KeGPer5074e7y6XHn3ZD24PQMwTxw5lQ=";
+  };
+
+  vendorHash = "sha256-C8ZfUIGT9HiQQiJ2hk18uwGaQzNCIKp/Jiz6ePZkgDQ=";
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) transfer-sh;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Easy and fast file sharing and pastebin server with access from the command-line";
+    homepage = "https://github.com/dutchcoders/transfer.sh";
+    changelog = "https://github.com/dutchcoders/transfer.sh/releases";
+    mainProgram = "transfer.sh";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ocfox pinpox ];
+  };
+}

pkgs/by-name/wa/waycheck/package.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y8fuy2ed2yPRiqusMZBD7mzFBDavmdByBzEaI6P5byk=";
+    hash = "sha256-kwkdTMA15oJHz9AXEkBGeuzYdEUpNuv/xnhzoKOHCE4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ya/yamlscript/package.nix

@@ -0,0 +1,40 @@
+{ lib, buildGraalvmNativeImage, fetchurl }:
+
+buildGraalvmNativeImage rec {
+  pname = "yamlscript";
+  version = "0.1.38";
+
+  src = fetchurl {
+    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
+    hash = "sha256-cdRMmeJTlkEmF4jbElrXgobSU+VIvh/k9Lr9WkOSTl8=";
+  };
+
+  executable = "ys";
+
+  extraNativeImageBuildArgs = [
+    "--native-image-info"
+    "--no-fallback"
+    "--initialize-at-build-time"
+    "--enable-preview"
+    "-H:+ReportExceptionStackTraces"
+    "-H:IncludeResources=SCI_VERSION"
+    "-H:Log=registerResource:"
+    "-J-Dclojure.spec.skip-macros=true"
+    "-J-Dclojure.compiler.direct-linking=true"
+  ];
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/ys  -e 'say: (+ 1 2)' | fgrep 3
+  '';
+
+  meta = with lib; {
+    description = "Programming in YAML";
+    homepage = "https://github.com/yaml/yamlscript";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.mit;
+    mainProgram = "ys";
+    maintainers = with maintainers; [ sgo ];
+  };
+}

pkgs/development/compilers/sbcl/default.nix

@@ -24,12 +24,12 @@ let
       sha256 = "189gjqzdz10xh3ybiy4ch1r98bsmkcb4hpnrmggd4y2g5kqnyx4y";
     };
 
-    "2.4.0" = {
-      sha256 = "sha256-g9i3TwjSJUxZuXkLwfZp4JCZRXuIRyDs7L9F9LRtF3Y=";
-    };
     "2.4.1" = {
       sha256 = "sha256-2k+UhvrUE9OversbCSaTJf20v/fnuI8hld3udDJjz34=";
     };
+    "2.4.2" = {
+      sha256 = "sha256-/APLUtEqr+h1nmMoRQogG73fibFwcaToPznoC0Pd7w8=";
+    };
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If CLISP (or any other
@@ -96,10 +96,9 @@ stdenv.mkDerivation (self: rec {
   );
   buildInputs = lib.optionals coreCompression [ zstd ];
 
-  patches = [
+  patches = lib.optionals (lib.versionOlder self.version "2.4.2") [
+    # Fixed in 2.4.2
     ./search-for-binaries-in-PATH.patch
-  ] ++ lib.optionals (version == "2.4.0") [
-    ./fix-2.4.0-aarch64-darwin.patch
   ];
 
   # I don’t know why these are failing (on ofBorg), and I’d rather just disable

pkgs/development/libraries/CGAL/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cgal";
-  version = "5.5.3";
+  version = "5.6.1";
 
   src = fetchurl {
     url = "https://github.com/CGAL/cgal/releases/download/v${version}/CGAL-${version}.tar.xz";
-    hash = "sha256-CgT2YmkyVjKLBbq/q7XjpbfbL1pY1S48Ug350IKN3XM=";
+    hash = "sha256-zbFefuMeBmNYnTEHp5mIo3t7FxnfPSTyBYVF0bzdWDc=";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;

pkgs/development/libraries/audio/vamp-plugin-sdk/default.nix

@@ -8,10 +8,10 @@ stdenv.mkDerivation rec {
   version = "2.10";
 
   src = fetchFromGitHub {
-    owner = "c4dm";
+    owner = "vamp-plugins";
     repo = "vamp-plugin-sdk";
     rev = "vamp-plugin-sdk-v${version}";
-    sha256 = "1lhmskcyk7qqfikmasiw7wjry74gc8g5q6a3j1iya84yd7ll0cz6";
+    hash = "sha256-5jNA6WmeIOVjkEMZXB5ijxyfJT88alVndBif6dnUFdI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/libraries/libime/default.nix

@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libime";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     rev = version;
-    hash = "sha256-AvlQOpjrHSifUtWSTft2bywlWhwka26VcqqReqAlcv8=";
+    hash = "sha256-PhzJtAGmSkMeXMSe2uR/JKHKlZtL0e3tPDZVoRCvAis=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/nng/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nng";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "nanomsg";
     repo = "nng";
     rev = "v${version}";
-    hash = "sha256-CG6Gw/Qrbi96koF2VxKMYPMPT2Zj9U97vNk2JdrfRro=";
+    hash = "sha256-oP7hO3wCXNPW7877wK+HpGsw7j+U0q4i8aTRVi1v0r0=";
   };
 
   nativeBuildInputs = [ cmake ninja ]

pkgs/development/libraries/xcb-imdkit/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xcb-imdkit";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "xcb-imdkit";
     rev = version;
-    sha256 = "sha256-1+x4KE2xh6KWbdCBlPxDvHvcKUEj4hiW4fEPCeYfTwc=";
+    sha256 = "sha256-trfKWCMIuYV0XyCcIsNP8LCTc0MYotXvslRvp76YnKU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/zlog/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "1.2.17";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ckpDMRLxObpl8N539DC5u2bPpmD7jM+KugurUfta6tg=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-22857.patch";
+      url = "https://github.com/HardySimpson/zlog/commit/c47f781a9f1e9604f5201e27d046d925d0d48ac4.patch";
+      hash = "sha256-3FAAHJ2R/OpNpErWXptjEh0x370/jzvK2VhuUuyaOjE=";
+    })
+  ];
+
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {

pkgs/development/php-packages/psalm/composer.lock

@@ -1192,46 +1192,47 @@
         },
         {
             "name": "symfony/console",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "c5010d50f1ee4b25cfa0201d9915cf1b14071456"
+                "reference": "0d9e4eb5ad413075624378f474c4167ea202de78"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/c5010d50f1ee4b25cfa0201d9915cf1b14071456",
-                "reference": "c5010d50f1ee4b25cfa0201d9915cf1b14071456",
+                "url": "https://api.github.com/repos/symfony/console/zipball/0d9e4eb5ad413075624378f474c4167ea202de78",
+                "reference": "0d9e4eb5ad413075624378f474c4167ea202de78",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2",
+                "php": ">=8.1",
+                "symfony/deprecation-contracts": "^2.5|^3",
                 "symfony/polyfill-mbstring": "~1.0",
                 "symfony/service-contracts": "^2.5|^3",
-                "symfony/string": "^6.4|^7.0"
+                "symfony/string": "^5.4|^6.0|^7.0"
             },
             "conflict": {
-                "symfony/dependency-injection": "<6.4",
-                "symfony/dotenv": "<6.4",
-                "symfony/event-dispatcher": "<6.4",
-                "symfony/lock": "<6.4",
-                "symfony/process": "<6.4"
+                "symfony/dependency-injection": "<5.4",
+                "symfony/dotenv": "<5.4",
+                "symfony/event-dispatcher": "<5.4",
+                "symfony/lock": "<5.4",
+                "symfony/process": "<5.4"
             },
             "provide": {
                 "psr/log-implementation": "1.0|2.0|3.0"
             },
             "require-dev": {
                 "psr/log": "^1|^2|^3",
-                "symfony/config": "^6.4|^7.0",
-                "symfony/dependency-injection": "^6.4|^7.0",
-                "symfony/event-dispatcher": "^6.4|^7.0",
+                "symfony/config": "^5.4|^6.0|^7.0",
+                "symfony/dependency-injection": "^5.4|^6.0|^7.0",
+                "symfony/event-dispatcher": "^5.4|^6.0|^7.0",
                 "symfony/http-foundation": "^6.4|^7.0",
                 "symfony/http-kernel": "^6.4|^7.0",
-                "symfony/lock": "^6.4|^7.0",
-                "symfony/messenger": "^6.4|^7.0",
-                "symfony/process": "^6.4|^7.0",
-                "symfony/stopwatch": "^6.4|^7.0",
-                "symfony/var-dumper": "^6.4|^7.0"
+                "symfony/lock": "^5.4|^6.0|^7.0",
+                "symfony/messenger": "^5.4|^6.0|^7.0",
+                "symfony/process": "^5.4|^6.0|^7.0",
+                "symfony/stopwatch": "^5.4|^6.0|^7.0",
+                "symfony/var-dumper": "^5.4|^6.0|^7.0"
             },
             "type": "library",
             "autoload": {
@@ -1265,7 +1266,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v7.0.3"
+                "source": "https://github.com/symfony/console/tree/v6.4.4"
             },
             "funding": [
                 {
@@ -1281,24 +1282,91 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-02-22T20:27:10+00:00"
         },
         {
-            "name": "symfony/filesystem",
-            "version": "v7.0.3",
+            "name": "symfony/deprecation-contracts",
+            "version": "v3.4.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/symfony/filesystem.git",
-                "reference": "2890e3a825bc0c0558526c04499c13f83e1b6b12"
+                "url": "https://github.com/symfony/deprecation-contracts.git",
+                "reference": "7c3aff79d10325257a001fcf92d991f24fc967cf"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/filesystem/zipball/2890e3a825bc0c0558526c04499c13f83e1b6b12",
-                "reference": "2890e3a825bc0c0558526c04499c13f83e1b6b12",
+                "url": "https://api.github.com/repos/symfony/deprecation-contracts/zipball/7c3aff79d10325257a001fcf92d991f24fc967cf",
+                "reference": "7c3aff79d10325257a001fcf92d991f24fc967cf",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2",
+                "php": ">=8.1"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-main": "3.4-dev"
+                },
+                "thanks": {
+                    "name": "symfony/contracts",
+                    "url": "https://github.com/symfony/contracts"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "function.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "A generic function and convention to trigger deprecation notices",
+            "homepage": "https://symfony.com",
+            "support": {
+                "source": "https://github.com/symfony/deprecation-contracts/tree/v3.4.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2023-05-23T14:45:45+00:00"
+        },
+        {
+            "name": "symfony/filesystem",
+            "version": "v6.4.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/filesystem.git",
+                "reference": "7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/filesystem/zipball/7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb",
+                "reference": "7f3b1755eb49297a0827a7575d5d2b2fd11cc9fb",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
                 "symfony/polyfill-ctype": "~1.8",
                 "symfony/polyfill-mbstring": "~1.8"
             },
@@ -1328,7 +1396,7 @@
             "description": "Provides basic utilities for the filesystem",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/filesystem/tree/v7.0.3"
+                "source": "https://github.com/symfony/filesystem/tree/v6.4.3"
             },
             "funding": [
                 {
@@ -1344,7 +1412,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-01-23T14:51:35+00:00"
         },
         {
             "name": "symfony/polyfill-ctype",
@@ -1748,20 +1816,20 @@
         },
         {
             "name": "symfony/string",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/string.git",
-                "reference": "524aac4a280b90a4420d8d6a040718d0586505ac"
+                "reference": "4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/524aac4a280b90a4420d8d6a040718d0586505ac",
-                "reference": "524aac4a280b90a4420d8d6a040718d0586505ac",
+                "url": "https://api.github.com/repos/symfony/string/zipball/4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9",
+                "reference": "4e465a95bdc32f49cf4c7f07f751b843bbd6dcd9",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2",
+                "php": ">=8.1",
                 "symfony/polyfill-ctype": "~1.8",
                 "symfony/polyfill-intl-grapheme": "~1.0",
                 "symfony/polyfill-intl-normalizer": "~1.0",
@@ -1771,11 +1839,11 @@
                 "symfony/translation-contracts": "<2.5"
             },
             "require-dev": {
-                "symfony/error-handler": "^6.4|^7.0",
-                "symfony/http-client": "^6.4|^7.0",
-                "symfony/intl": "^6.4|^7.0",
+                "symfony/error-handler": "^5.4|^6.0|^7.0",
+                "symfony/http-client": "^5.4|^6.0|^7.0",
+                "symfony/intl": "^6.2|^7.0",
                 "symfony/translation-contracts": "^2.5|^3.0",
-                "symfony/var-exporter": "^6.4|^7.0"
+                "symfony/var-exporter": "^5.4|^6.0|^7.0"
             },
             "type": "library",
             "autoload": {
@@ -1814,7 +1882,7 @@
                 "utf8"
             ],
             "support": {
-                "source": "https://github.com/symfony/string/tree/v7.0.3"
+                "source": "https://github.com/symfony/string/tree/v6.4.4"
             },
             "funding": [
                 {
@@ -1830,7 +1898,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-01-29T15:41:16+00:00"
+            "time": "2024-02-01T13:16:41+00:00"
         },
         {
             "name": "webmozart/assert",
@@ -4448,20 +4516,20 @@
         },
         {
             "name": "symfony/process",
-            "version": "v7.0.3",
+            "version": "v6.4.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/process.git",
-                "reference": "937a195147e0c27b2759ade834169ed006d0bc74"
+                "reference": "710e27879e9be3395de2b98da3f52a946039f297"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/937a195147e0c27b2759ade834169ed006d0bc74",
-                "reference": "937a195147e0c27b2759ade834169ed006d0bc74",
+                "url": "https://api.github.com/repos/symfony/process/zipball/710e27879e9be3395de2b98da3f52a946039f297",
+                "reference": "710e27879e9be3395de2b98da3f52a946039f297",
                 "shasum": ""
             },
             "require": {
-                "php": ">=8.2"
+                "php": ">=8.1"
             },
             "type": "library",
             "autoload": {
@@ -4489,7 +4557,7 @@
             "description": "Executes commands in sub-processes",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/process/tree/v7.0.3"
+                "source": "https://github.com/symfony/process/tree/v6.4.4"
             },
             "funding": [
                 {
@@ -4505,7 +4573,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-01-23T15:02:46+00:00"
+            "time": "2024-02-20T12:31:00+00:00"
         },
         {
             "name": "theseer/tokenizer",

pkgs/development/php-packages/psalm/default.nix

@@ -17,7 +17,7 @@ php.buildComposerProject (finalAttrs: {
   # Missing `composer.lock` from the repository.
   # Issue open at https://github.com/vimeo/psalm/issues/10446
   composerLock = ./composer.lock;
-  vendorHash = "sha256-URPyV1V/8BP8fbJqyYLf+XKG786hY2BbAzUphzPyPCs=";
+  vendorHash = "sha256-AgvAaHcCYosS3yRrp9EFdqTjg6NzQRCr8ELSza9DvZ8=";
 
   meta = {
     changelog = "https://github.com/vimeo/psalm/releases/tag/${finalAttrs.version}";

pkgs/development/python-modules/aioairzone-cloud/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.3.8";
+  version = "0.4.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-h9WUHehTXg73qqpw+sMxoQMzOV+io2GvjwXlr4gF2ns=";
+    hash = "sha256-G+tzA4VEdpRFVouj8Uv7BJLgSTOO5eKkNntVL1bIzXY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aioautomower/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioautomower";
-  version = "2024.2.9";
+  version = "2024.2.10";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Thomas55555";
     repo = "aioautomower";
     rev = "refs/tags/${version}";
-    hash = "sha256-vjg7y+9E4R1Q7h+ao/ttuRbvui4u5hESR8tImWSO04U=";
+    hash = "sha256-NRcLyuU5FFIKJALUrx5iVSihzgO6ljqaqlhbs+y2E4Q=";
   };
 
   postPatch = ''

pkgs/development/python-modules/aiomysensors/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aiomysensors";
-  version = "0.3.12";
+  version = "0.3.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiomysensors";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9M5WuBoezbZr7OwJaM0m2CqibziJVwqANGOhiJrqfxA=";
+    hash = "sha256-2i2QodEWOZ/nih6ap5ovWuKxILB5arusnqOiOlb4xWM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/aiounittest/default.nix

@@ -3,7 +3,7 @@
 , fetchFromGitHub
 , pythonAtLeast
 , setuptools
-, nose
+, pynose
 , coverage
 , wrapt
 }:
@@ -13,9 +13,6 @@ buildPythonPackage rec {
   version = "1.4.2";
   pyproject = true;
 
-  # requires the imp module
-  disabled = pythonAtLeast "3.12";
-
   src = fetchFromGitHub {
     owner = "kwarunek";
     repo = pname;
@@ -32,12 +29,12 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    nose
+    pynose
     coverage
   ];
 
   checkPhase = ''
-    nosetests
+    nosetests -e test_specific_test
   '';
 
   pythonImportsCheck = [ "aiounittest" ];

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -365,14 +365,14 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.52";
+  version = "1.34.53";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gjxBBZ+DbWh32qocvSD4E8jxp4uf3ykLwLhTEn4Se6M=";
+    hash = "sha256-/zGbNI+nsNbkD2hTeClyZvk5A4wG0E4JGKpazy5TLCw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.52";
+  version = "1.34.53";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-pRtsofyprNqp6AQS83FTaQ//rX7SJ3Q8xTCAmSDSoAk=";
+    hash = "sha256-41fme2SpxtfeEOdmzSxmWJJkJXRG26bl7hwt/Ltjvlw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cyclonedx-python-lib/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cyclonedx-python-lib";
-  version = "6.4.1";
+  version = "6.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IhiH1Vk/Wf6cTxijxE1erkQozY+vOVd5pu6tAVUoDJM=";
+    hash = "sha256-uDppmYJiQt2Yix5vaWYqMDbPcHOEPz2pBK11lUZ54fI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/fairseq/default.nix

@@ -96,6 +96,7 @@ buildPythonPackage rec {
   disabledTests = [
     # this test requires xformers
     "test_xformers_single_forward_parity"
+    "test_mask_for_xformers"
     # this test requires iopath
     "test_file_io_async"
     # these tests require network access
@@ -105,6 +106,8 @@ buildPythonPackage rec {
     "test_waitk_checkpoint"
     "test_sotasty_es_en_600m_checkpoint"
     "test_librispeech_s2t_conformer_s_checkpoint"
+    # TODO research failure
+    "test_multilingual_translation_latent_depth"
   ];
 
   disabledTestPaths = [
@@ -117,6 +120,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/pytorch/fairseq";
     license = licenses.mit;
     platforms = platforms.linux;
+    hydraPlatforms = [];
     maintainers = with maintainers; [ happysalada ];
   };
 }

pkgs/development/python-modules/huggingface-hub/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.21.2";
+  version = "0.21.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0Nr6qs9rzuBQo8SGuQ2Ai2Q+E+Gs4DT/AMrYf7dYM/E=";
+    hash = "sha256-DtKb/mR01vifclDalZiZV4/A4XpTKBcT9bCiLZkRCZY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jaxtyping/default.nix

@@ -3,6 +3,7 @@
 , pythonOlder
 , fetchFromGitHub
 , hatchling
+, pythonRelaxDepsHook
 , numpy
 , typeguard
 , typing-extensions
@@ -19,7 +20,7 @@
 let
   self = buildPythonPackage rec {
     pname = "jaxtyping";
-    version = "0.2.25";
+    version = "0.2.26";
     pyproject = true;
 
     disabled = pythonOlder "3.9";
@@ -28,16 +29,12 @@ let
       owner = "google";
       repo = "jaxtyping";
       rev = "refs/tags/v${version}";
-      hash = "sha256-+JqpI5xrM7o73LG6oMix88Jr5aptmWYjJQcqUNo7icg=";
+      hash = "sha256-2QDTRNH2/9FPU5xrQx7yZRHwEWqj0PUNzcCuKwY4yNg=";
     };
 
-    postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace "typeguard>=2.13.3,<3" "typeguard"
-    '';
-
     nativeBuildInputs = [
       hatchling
+      pythonRelaxDepsHook
     ];
 
     propagatedBuildInputs = [
@@ -46,6 +43,10 @@ let
       typing-extensions
     ];
 
+    pythonRelaxDeps = [
+      "typeguard"
+    ];
+
     nativeCheckInputs = [
       cloudpickle
       equinox

pkgs/development/python-modules/mmengine/default.nix

@@ -69,6 +69,10 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # AttributeError
     "tests/test_fileio/test_backends/test_petrel_backend.py"
+    # Freezes forever?
+    "tests/test_runner/test_activation_checkpointing.py"
+    # missing dependencies
+    "tests/test_visualizer/test_vis_backend.py"
   ];
 
   disabledTests = [

pkgs/development/python-modules/openai/default.nix

@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "1.13.2";
+  version = "1.13.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7.1";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3otPmMVV/Wx7k/oec5c1r6GcZGzhMSKifJB8S5nBSZw=";
+    hash = "sha256-8SHXUrPLZ7lgvB0jqZlcvKq5Zv2d2UqXjJpgiBpR8P8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/py-serializable/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-serializable";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "madpah";
     repo = "serializable";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OsgFzT5qGyszO4jFYWIAgGY41s0ZBEMwCbWZeY189h4=";
+    hash = "sha256-RhipoPTewPaYwspTnywLr5FvFVUaFixfRQk6aUMvB4w=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyctr/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyctr";
-  version = "0.7.4";
+  version = "0.7.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1nPP+rz/8BiFHu3nGcHuqCPwyyR55LUhoBprHFTudWQ=";
+    hash = "sha256-fiDJWcypFabnUoS313f56ypDuDrLASHrkk0Em8bymmw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyoverkiz/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.13.7";
+  version = "1.13.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wH4LCfjnxAwub/BCe27osyJVUZSOMDjjxItv0aEa8Ic=";
+    hash = "sha256-tvS7aPfBTs75Rq1WGslWDMv1pOTVt7MtwpXPRJtqbuk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/python-heatclient/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "python-heatclient";
-  version = "3.4.0";
+  version = "3.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ggfhDJW2qn0o4Wi5cdPsEpoHb9miZbr4Ba8mgLkStvI=";
+    hash = "sha256-B1F40HYHFF91mkxwySR/kqCvlwLLtBgqwUvw2byOc9g=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/python-ironicclient/default.nix

@@ -20,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "python-ironicclient";
-  version = "5.4.0";
+  version = "5.5.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q9yGuYf9TS7RCo9aV1hnNSrHoll7AOUiSpzRYxi+JXU=";
+    hash = "sha256-JlO487QSPsBJZqPYRhsQYFA7noIN2q/stH4eZXAFLnY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/python-matter-server/default.nix

@@ -2,6 +2,8 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, stdenvNoCC
+, substituteAll
 
 # build
 , setuptools
@@ -28,6 +30,29 @@
 , pytestCheckHook
 }:
 
+let
+  paaCerts = stdenvNoCC.mkDerivation rec {
+    pname = "matter-server-paa-certificates";
+    version = "1.2.0.1";
+
+    src = fetchFromGitHub {
+      owner = "project-chip";
+      repo = "connectedhomeip";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-p3P0n5oKRasYz386K2bhN3QVfN6oFndFIUWLEUWB0ss=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp $src/credentials/development/paa-root-certs/* $out/
+
+      runHook postInstall
+    '';
+  };
+in
+
 buildPythonPackage rec {
   pname = "python-matter-server";
   version = "5.7.0b2";
@@ -42,6 +67,13 @@ buildPythonPackage rec {
     hash = "sha256-fMtvVizHeAzLdou0U1tqbmQATIBLK4w9I7EwMlzB8QA=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./link-paa-root-certs.patch;
+      paacerts = paaCerts;
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace 'version = "0.0.0"' 'version = "${version}"' \

pkgs/development/python-modules/python-matter-server/link-paa-root-certs.patch

@@ -0,0 +1,126 @@
+diff --git a/matter_server/server/const.py b/matter_server/server/const.py
+index b6cd839..f9f798f 100644
+--- a/matter_server/server/const.py
++++ b/matter_server/server/const.py
+@@ -5,14 +5,4 @@ from typing import Final
+ # The minimum schema version (of a client) the server can support
+ MIN_SCHEMA_VERSION = 5
+ 
+-# the paa-root-certs path is hardcoded in the sdk at this time
+-# and always uses the development subfolder
+-# regardless of anything you pass into instantiating the controller
+-# revisit this once matter 1.1 is released
+-PAA_ROOT_CERTS_DIR: Final[pathlib.Path] = (
+-    pathlib.Path(__file__)
+-    .parent.resolve()
+-    .parent.resolve()
+-    .parent.resolve()
+-    .joinpath("credentials/development/paa-root-certs")
+-)
++PAA_ROOT_CERTS_DIR: Final[pathlib.Path] = pathlib.Path("@paacerts@")
+diff --git a/matter_server/server/helpers/paa_certificates.py b/matter_server/server/helpers/paa_certificates.py
+index 9ac5a10..25230c1 100644
+--- a/matter_server/server/helpers/paa_certificates.py
++++ b/matter_server/server/helpers/paa_certificates.py
+@@ -58,84 +58,14 @@ async def fetch_dcl_certificates(
+     fetch_production_certificates: bool = True,
+ ) -> int:
+     """Fetch DCL PAA Certificates."""
+-    LOGGER.info("Fetching the latest PAA root certificates from DCL.")
+-    if not PAA_ROOT_CERTS_DIR.is_dir():
+-        loop = asyncio.get_running_loop()
+-        await loop.run_in_executor(None, makedirs, PAA_ROOT_CERTS_DIR)
+-    fetch_count: int = 0
+-    base_urls = set()
+-    # determine which url's need to be queried.
+-    # if we're going to fetch both prod and test, do test first
+-    # so any duplicates will be overwritten/preferred by the production version
+-    # NOTE: While Matter is in BETA we fetch the test certificates by default
+-    if fetch_test_certificates:
+-        base_urls.add(TEST_URL)
+-    if fetch_production_certificates:
+-        base_urls.add(PRODUCTION_URL)
+ 
+-    try:
+-        async with ClientSession(raise_for_status=True) as http_session:
+-            for url_base in base_urls:
+-                # fetch the paa certificates list
+-                async with http_session.get(
+-                    f"{url_base}/dcl/pki/root-certificates"
+-                ) as response:
+-                    result = await response.json()
+-                paa_list = result["approvedRootCertificates"]["certs"]
+-                # grab each certificate
+-                for paa in paa_list:
+-                    # do not fetch a certificate if we already fetched it
+-                    if paa["subjectKeyId"] in LAST_CERT_IDS:
+-                        continue
+-                    async with http_session.get(
+-                        f"{url_base}/dcl/pki/certificates/{paa['subject']}/{paa['subjectKeyId']}"
+-                    ) as response:
+-                        result = await response.json()
+-
+-                    certificate_data: dict = result["approvedCertificates"]["certs"][0]
+-                    certificate: str = certificate_data["pemCert"]
+-                    subject = certificate_data["subjectAsText"]
+-                    certificate = certificate.rstrip("\n")
+-
+-                    await write_paa_root_cert(
+-                        certificate,
+-                        subject,
+-                    )
+-                    LAST_CERT_IDS.add(paa["subjectKeyId"])
+-                    fetch_count += 1
+-    except ClientError as err:
+-        LOGGER.warning(
+-            "Fetching latest certificates failed: error %s", err, exc_info=err
+-        )
+-    else:
+-        LOGGER.info("Fetched %s PAA root certificates from DCL.", fetch_count)
+-
+-    return fetch_count
++    return 0
+ 
+ 
+ async def fetch_git_certificates() -> int:
+     """Fetch Git PAA Certificates."""
+-    fetch_count = 0
+-    LOGGER.info("Fetching the latest PAA root certificates from Git.")
+-    try:
+-        async with ClientSession(raise_for_status=True) as http_session:
+-            for cert in GIT_CERTS:
+-                if cert in LAST_CERT_IDS:
+-                    continue
+ 
+-                async with http_session.get(f"{GIT_URL}/{cert}.pem") as response:
+-                    certificate = await response.text()
+-                await write_paa_root_cert(certificate, cert)
+-                LAST_CERT_IDS.add(cert)
+-                fetch_count += 1
+-    except ClientError as err:
+-        LOGGER.warning(
+-            "Fetching latest certificates failed: error %s", err, exc_info=err
+-        )
+-
+-    LOGGER.info("Fetched %s PAA root certificates from Git.", fetch_count)
+-
+-    return fetch_count
++    return 0
+ 
+ 
+ async def fetch_certificates(
+@@ -144,12 +74,4 @@ async def fetch_certificates(
+ ) -> int:
+     """Fetch PAA Certificates."""
+ 
+-    fetch_count = await fetch_dcl_certificates(
+-        fetch_test_certificates=fetch_test_certificates,
+-        fetch_production_certificates=fetch_production_certificates,
+-    )
+-
+-    if fetch_test_certificates:
+-        fetch_count += await fetch_git_certificates()
+-
+-    return fetch_count
++    return 0
+

pkgs/development/python-modules/python-novaclient/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.4.0";
+  version = "18.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a2tq4sEescEI469V6qchGw/JGZk1oimmuj4N5RTBK1A=";
+    hash = "sha256-4j7kQMDI6uK1OvqIHTCsrsBof8660kY5HsKblsVDA40=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/python-swiftclient/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "python-swiftclient";
-  version = "4.4.0";
+  version = "4.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-p32Xqw5AEsZ4cy5XW9/u0oKzSJuRdegsRqR6yEke7oQ=";
+    hash = "sha256-8qCIflo5KXq8BDJRrj+QiRTOFEei+NLcpWcWGGCBQr0=";
   };
 
   # remove duplicate script that will be created by setuptools from the

pkgs/development/python-modules/remotezip/default.nix

@@ -1,36 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , requests
 , tabulate
 , pytestCheckHook
 , requests-mock
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "remotezip";
-  version = "0.12.2";
-  format = "setuptools";
+  version = "0.12.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gtsystem";
     repo = "python-remotezip";
-    # upstream does not tag releases, determined with git blame
-    # pypi archive lacks files for tests
-    rev = "3723724d6d877d3166d52f4528ffa7bd5bf6627f";
-    hash = "sha256-iYxHW8RdLFrpjkcEvpfF/NWBnw7Dd5cx2ghpof2XFn4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TNEM7Dm4iH4Z/P/PAqjJppbn1CKmyi9Xpq/sU9O8uxg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
-    tabulate
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
-
-  checkInputs = [
     requests-mock
   ];
 

pkgs/development/python-modules/spyder-kernels/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "spyder-kernels";
-  version = "2.5.0";
+  version = "2.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M2hCbARFfgIRiE6SdPpH61ViUrpMBz3ydeg8Zd97oqE=";
+    hash = "sha256-BQQqP5eyXxfN+o11AR/Xmq8CdSM0ip3/8PWiC92wubA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1094";
+  version = "3.0.1098";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-h2p9auD8bTDbagAmjsmV06Z75I93LB6h+/ZYyt17ow0=";
+    hash = "sha256-5BG5WizkBP/KYHS00v949uQgiCChR3DWW0MnMXRBDAs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/textnets/default.nix

@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , cairocffi
-, cython
+, cython_3
 , fetchPypi
 , igraph
 , leidenalg
@@ -9,6 +9,7 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , scipy
 , setuptools
 , spacy
@@ -21,22 +22,25 @@
 
 buildPythonPackage rec {
   pname = "textnets";
-  version = "0.9.3";
+  version = "0.9.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fx2S43IqpSMsfJow26jB/D27dyUFQ1PlXP1rbUIZPPQ=";
+    hash = "sha256-4154ytzo1QpwhKA1BkVMss9fNIkysnClW/yfSVlX33M=";
   };
 
   nativeBuildInputs = [
-    cython
+    pythonRelaxDepsHook
+    cython_3
     poetry-core
     setuptools
   ];
 
+  pythonRelaxDeps = [ "igraph" "leidenalg" ];
+
   propagatedBuildInputs = [
     cairocffi
     igraph
@@ -59,10 +63,14 @@ buildPythonPackage rec {
     "textnets"
   ];
 
+  # Enables the package to find the cythonized .so files during testing. See #255262
+  preCheck = ''
+    rm -r textnets
+  '';
+
   disabledTests = [
-    # Test fails: A warning is triggered because of a deprecation notice by pandas.
-    # TODO: Try to re-enable it when pandas is updated to 2.1.1
-    "test_corpus_czech"
+    # Test fails: Throws a UserWarning asking the user to install `textnets[fca]`.
+    "test_context"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/transformers/default.nix

@@ -53,7 +53,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.38.1";
+  version = "4.38.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -62,7 +62,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-92WmvSFZYCCG4qJprPT7clYa7ePuvyaCvxni/spDhSw=";
+    hash = "sha256-/rt2XHN46NcFwlM9MOygVvpQkfPVu2eCNybYmSj711M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-awscrt/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.20.4";
+  version = "0.20.5";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-ECRVcMcoXpSTYrSucQxUvyhdZKJ0U9QnYkd7zuXNd6M=";
+    hash = "sha256-YYEbv03pUkiTn5J2pDS+k9K5X2zP6KqU5WmZ6XeM/MI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/types-pyopenssl/default.nix

@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyopenssl";
-  version = "24.0.0.20240130";
+  version = "24.0.0.20240228";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-pyOpenSSL";
     inherit version;
-    hash = "sha256-yBLlwcNSSfde9ZNXCLKpl9Yqv5dFviIuX5S5WVRyqyU=";
+    hash = "sha256-zZkHF9iqN0PvDnPg9GLmS1TZDDBCSSMtSP7OTw98PGo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/uncertainties/default.nix

@@ -1,6 +1,9 @@
-{ lib, fetchPypi, buildPythonPackage
-, nose, numpy, future
-, pythonOlder
+{ lib
+, buildPythonPackage
+, fetchPypi
+, future
+, numpy
+, pynose
 }:
 
 buildPythonPackage rec {
@@ -14,14 +17,10 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [ future ];
-
-  # uses removed lib2to3.tests
-  doCheck = pythonOlder "3.12";
-
-  nativeCheckInputs = [ nose numpy ];
+  nativeCheckInputs = [ pynose numpy ];
 
   checkPhase = ''
-    nosetests -sv
+    nosetests -sve test_1to2
   '';
 
   meta = with lib; {

pkgs/development/python-modules/weconnect/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.60.1";
+  version = "0.60.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hvV4pbCyzAbi3bKXClzpiyhp+4qnuIj5pViUe7pEq64=";
+    hash = "sha256-VM4qCe+VMnfKXioUHTjOeBSniwpq44fvbN1k1jG6puk=";
   };
 
   postPatch = ''

pkgs/development/r-modules/default.nix

@@ -405,7 +405,7 @@ let
     rjags = [ pkgs.jags ];
     rJava = with pkgs; [ zlib bzip2.dev icu xz.dev pcre.dev jdk libzip ];
     Rlibeemd = [ pkgs.gsl ];
-    rmatio = [ pkgs.zlib.dev ];
+    rmatio = [ pkgs.zlib.dev pkgs.pkg-config ];
     Rmpfr = with pkgs; [ gmp mpfr.dev ];
     Rmpi = [ pkgs.mpi ];
     RMySQL = with pkgs; [ zlib libmysqlclient openssl.dev ];
@@ -946,7 +946,7 @@ let
       cargoDeps = pkgs.rustPlatform.fetchCargoTarball {
         src = attrs.src;
         sourceRoot = "gifski/src/myrustlib";
-        hash = "sha256-vBrTQ+5JZA8554Aasbqw7mbaOfJNQjrOpG00IXAcamI=";
+        hash = "sha256-e6nuiQU22GiO2I+bu0muyICGrdkCLSZUDHDz2mM2hz0=";
       };
 
       cargoRoot = "src/myrustlib";

pkgs/development/tools/analysis/snyk/default.nix

@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "snyk";
-  version = "1.1280.1";
+  version = "1.1281.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-bwEekB/jifSRktblvq98C3t2xSTTPn4NOftQs/T090U=";
+    hash = "sha256-QxmYArH9HRq2vkGzfhWlCPLS++UiwdzAStUQxhGF85Q=";
   };
 
-  npmDepsHash = "sha256-TtWc+Zy6yMHbDdsw5rVKK+RiCZ8ZuXyU+SfcPRgToiA=";
+  npmDepsHash = "sha256-JxX4r1I/F3PEzg9rLfFNEIa4Q8jwuUWC6krH1oSoc8s=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "1.0.0-monorepo"' '"version": "${version}"'

pkgs/development/tools/build-managers/apache-maven/build-package.nix

@@ -13,6 +13,7 @@
 , mvnFetchExtraArgs ? { }
 , mvnDepsParameters ? ""
 , manualMvnArtifacts ? [ ]
+, manualMvnSources ? [ ]
 , mvnParameters ? ""
 , ...
 } @args:
@@ -39,6 +40,14 @@ let
         echo "downloading manual $artifactId"
         mvn dependency:get -Dartifact="$artifactId" -Dmaven.repo.local=$out/.m2
       done
+
+      for artifactId in ${builtins.toString manualMvnSources}
+      do
+        group=$(echo $artifactId | cut -d':' -f1)
+        artifact=$(echo $artifactId | cut -d':' -f2)
+        echo "downloading manual sources $artifactId"
+        mvn dependency:sources -DincludeGroupIds="$group" -DincludeArtifactIds="$artifact" -Dmaven.repo.local=$out/.m2
+      done
     '' + lib.optionalString (!buildOffline) ''
       mvn package -Dmaven.repo.local=$out/.m2 ${mvnParameters}
     '' + ''

pkgs/development/tools/language-servers/ruff-lsp/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ruff-lsp";
-  version = "0.0.52";
+  version = "0.0.53";
   pyproject = true;
   disabled = pythonOlder "3.7";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "astral-sh";
     repo = "ruff-lsp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-T18c0vKy/RUWiDjX2oScVxgVIhlj7t3M/+IoKsQ0N4w=";
+    hash = "sha256-gtMqIsgGCzSBo5D4+Ne8tUloDV9+MufYkN96yr7XVd4=";
   };
 
   postPatch = ''

pkgs/development/tools/misc/act/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.59";
+  version = "0.2.60";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Y8g+eVZ0c0YPVL8E/JAqD6EheQX6sBHpw1tT88BkbtI=";
+    hash = "sha256-FFSnxxqKAFYPuX4NJahiBS65Goj6se2U5WdPiKpNXDo=";
   };
 
-  vendorHash = "sha256-0Sjj9+YJcIkigvJOXxtDVcUylZmVY/Xv/IYpEBN46Is=";
+  vendorHash = "sha256-FLomnHVhpvbM+O3OGwjXfrtTVbegnzry8Sl+4a3uw08=";
 
   doCheck = false;
 

pkgs/development/tools/misc/devspace/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "devspace";
-  version = "6.3.11";
+  version = "6.3.12";
 
   src = fetchFromGitHub {
     owner = "devspace-sh";
     repo = "devspace";
     rev = "v${version}";
-    hash = "sha256-g+M34y7GTbQ8FyO4BieNYgo68ZE5x3hyXiMJrx6Nqug=";
+    hash = "sha256-tnkMXB0BWavSZF3HEdvtCE42zgcHNRGI5CdK3RDvv9c=";
   };
 
   vendorHash = null;

pkgs/development/tools/misc/kool/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kool";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "kool-dev";
     repo = "kool";
     rev = version;
-    hash = "sha256-apecHILrtvzD1bAOuyhSokDqBB2UgCavQXOw4dQSPwc=";
+    hash = "sha256-oMPzDU5MNIgxg7E2lgvgXEfO4W+VrFlLThOC9OEqhWo=";
   };
 
   vendorHash = "sha256-PmS96KVhe9TDmtYBx2hROLCbGMQ0OY3MN405dUmxPzk=";