Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -6472,6 +6472,13 @@
     name = "Duncan Dean";
     keys = [ { fingerprint = "9484 44FC E03B 05BA 5AB0  591E C37B 1C1D 44C7 86EE"; } ];
   };
+  DutchGerman = {
+    name = "Stefan Visser";
+    email = "stefan.visser@apm-ecampus.de";
+    github = "DutchGerman";
+    githubId = 60694691;
+    keys = [ { fingerprint = "A7C9 3DC7 E891 046A 980F  2063 F222 A13B 2053 27A5"; } ];
+  };
   dvaerum = {
     email = "nixpkgs-maintainer@varum.dk";
     github = "dvaerum";
@@ -18700,6 +18707,12 @@
     github = "pladypus";
     githubId = 56337621;
   };
+  plamper = {
+    name = "Felix Plamper";
+    email = "felix.plamper@tuta.io";
+    github = "plamper";
+    githubId = 59016721;
+  };
   plchldr = {
     email = "mail@oddco.de";
     github = "plchldr";
@@ -18879,6 +18892,12 @@
     githubId = 4201956;
     name = "pongo1231";
   };
+  poopsicles = {
+    name = "Fumnanya";
+    email = "fmowete@outlook.com";
+    github = "poopsicles";
+    githubId = 87488715;
+  };
   PopeRigby = {
     name = "PopeRigby";
     github = "poperigby";

maintainers/scripts/update.nix

@@ -16,6 +16,7 @@
   keep-going ? null,
   commit ? null,
   skip-prompt ? null,
+  order ? null,
 }:
 
 let
@@ -217,6 +218,18 @@ let
     to skip prompt:
 
         --argstr skip-prompt true
+
+    By default, the updater will update the packages in arbitrary order. Alternately, you can force a specific order based on the packages’ dependency relations:
+
+        - Reverse topological order (e.g. {"gnome-text-editor", "gimp"}, {"gtk3", "gtk4"}, {"glib"}) is useful when you want checkout each commit one by one to build each package individually but some of the packages to be updated would cause a mass rebuild for the others. Of course, this requires that none of the updated dependents require a new version of the dependency.
+
+            --argstr order reverse-topological
+
+        - Topological order (e.g. {"glib"}, {"gtk3", "gtk4"}, {"gnome-text-editor", "gimp"}) is useful when the updated dependents require a new version of updated dependency.
+
+            --argstr order topological
+
+    Note that sorting requires instantiating each package and then querying Nix store for requisites so it will be pretty slow with large number of packages.
   '';
 
   # Transform a matched package into an object for update.py.
@@ -241,7 +254,8 @@ let
     lib.optional (max-workers != null) "--max-workers=${max-workers}"
     ++ lib.optional (keep-going == "true") "--keep-going"
     ++ lib.optional (commit == "true") "--commit"
-    ++ lib.optional (skip-prompt == "true") "--skip-prompt";
+    ++ lib.optional (skip-prompt == "true") "--skip-prompt"
+    ++ lib.optional (order != null) "--order=${order}";
 
   args = [ packagesJson ] ++ optionalArgs;
 

maintainers/scripts/update.py

@@ -1,5 +1,6 @@
-from __future__ import annotations
-from typing import Dict, Generator, List, Optional, Tuple
+from graphlib import TopologicalSorter
+from pathlib import Path
+from typing import Any, Generator, Literal
 import argparse
 import asyncio
 import contextlib
@@ -10,17 +11,24 @@ import subprocess
 import sys
 import tempfile
 
+
+Order = Literal["arbitrary", "reverse-topological", "topological"]
+
+
 class CalledProcessError(Exception):
     process: asyncio.subprocess.Process
-    stderr: Optional[bytes]
+    stderr: bytes | None
+
 
 class UpdateFailedException(Exception):
     pass
 
-def eprint(*args, **kwargs):
+
+def eprint(*args: Any, **kwargs: Any) -> None:
     print(*args, file=sys.stderr, **kwargs)
 
-async def check_subprocess_output(*args, **kwargs):
+
+async def check_subprocess_output(*args: str, **kwargs: Any) -> bytes:
     """
     Emulate check and capture_output arguments of subprocess.run function.
     """
@@ -38,26 +46,182 @@ async def check_subprocess_output(*args, **kwargs):
 
     return stdout
 
-async def run_update_script(nixpkgs_root: str, merge_lock: asyncio.Lock, temp_dir: Optional[Tuple[str, str]], package: Dict, keep_going: bool):
-    worktree: Optional[str] = None
 
-    update_script_command = package['updateScript']
+async def nix_instantiate(attr_path: str) -> Path:
+    out = await check_subprocess_output(
+        "nix-instantiate",
+        "-A",
+        attr_path,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+    )
+    drv = out.decode("utf-8").strip().split("!", 1)[0]
+
+    return Path(drv)
+
+
+async def nix_query_requisites(drv: Path) -> list[Path]:
+    requisites = await check_subprocess_output(
+        "nix-store",
+        "--query",
+        "--requisites",
+        str(drv),
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+    )
+
+    drv_str = str(drv)
+
+    return [
+        Path(requisite)
+        for requisite in requisites.decode("utf-8").splitlines()
+        # Avoid self-loops.
+        if requisite != drv_str
+    ]
+
+
+async def attr_instantiation_worker(
+    semaphore: asyncio.Semaphore,
+    attr_path: str,
+) -> tuple[Path, str]:
+    async with semaphore:
+        eprint(f"Instantiating {attr_path}…")
+        return (await nix_instantiate(attr_path), attr_path)
+
+
+async def requisites_worker(
+    semaphore: asyncio.Semaphore,
+    drv: Path,
+) -> tuple[Path, list[Path]]:
+    async with semaphore:
+        eprint(f"Obtaining requisites for {drv}…")
+        return (drv, await nix_query_requisites(drv))
+
+
+def requisites_to_attrs(
+    drv_attr_paths: dict[Path, str],
+    requisites: list[Path],
+) -> set[str]:
+    """
+    Converts a set of requisite `.drv`s to a set of attribute paths.
+    Derivations that do not correspond to any of the packages we want to update will be discarded.
+    """
+    return {
+        drv_attr_paths[requisite]
+        for requisite in requisites
+        if requisite in drv_attr_paths
+    }
+
+
+def reverse_edges(graph: dict[str, set[str]]) -> dict[str, set[str]]:
+    """
+    Flips the edges of a directed graph.
+    """
+
+    reversed_graph: dict[str, set[str]] = {}
+    for dependent, dependencies in graph.items():
+        for dependency in dependencies:
+            reversed_graph.setdefault(dependency, set()).add(dependent)
+
+    return reversed_graph
+
+
+def get_independent_sorter(
+    packages: list[dict],
+) -> TopologicalSorter[str]:
+    """
+    Returns a sorter which treats all packages as independent,
+    which will allow them to be updated in parallel.
+    """
+
+    attr_deps: dict[str, set[str]] = {
+        package["attrPath"]: set() for package in packages
+    }
+    sorter = TopologicalSorter(attr_deps)
+    sorter.prepare()
+
+    return sorter
+
+
+async def get_topological_sorter(
+    max_workers: int,
+    packages: list[dict],
+    reverse_order: bool,
+) -> tuple[TopologicalSorter[str], list[dict]]:
+    """
+    Returns a sorter which returns packages in topological or reverse topological order,
+    which will ensure a package is updated before or after its dependencies, respectively.
+    """
+
+    semaphore = asyncio.Semaphore(max_workers)
+
+    drv_attr_paths = dict(
+        await asyncio.gather(
+            *(
+                attr_instantiation_worker(semaphore, package["attrPath"])
+                for package in packages
+            )
+        )
+    )
+
+    drv_requisites = await asyncio.gather(
+        *(requisites_worker(semaphore, drv) for drv in drv_attr_paths.keys())
+    )
+
+    attr_deps = {
+        drv_attr_paths[drv]: requisites_to_attrs(drv_attr_paths, requisites)
+        for drv, requisites in drv_requisites
+    }
+
+    if reverse_order:
+        attr_deps = reverse_edges(attr_deps)
+
+    # Adjust packages order based on the topological one
+    ordered = list(TopologicalSorter(attr_deps).static_order())
+    packages = sorted(packages, key=lambda package: ordered.index(package["attrPath"]))
+
+    sorter = TopologicalSorter(attr_deps)
+    sorter.prepare()
+
+    return sorter, packages
+
+
+async def run_update_script(
+    nixpkgs_root: str,
+    merge_lock: asyncio.Lock,
+    temp_dir: tuple[str, str] | None,
+    package: dict,
+    keep_going: bool,
+) -> None:
+    worktree: str | None = None
+
+    update_script_command = package["updateScript"]
 
     if temp_dir is not None:
         worktree, _branch = temp_dir
 
         # Ensure the worktree is clean before update.
-        await check_subprocess_output('git', 'reset', '--hard', '--quiet', 'HEAD', cwd=worktree)
+        await check_subprocess_output(
+            "git",
+            "reset",
+            "--hard",
+            "--quiet",
+            "HEAD",
+            cwd=worktree,
+        )
 
         # Update scripts can use $(dirname $0) to get their location but we want to run
         # their clones in the git worktree, not in the main nixpkgs repo.
-        update_script_command = map(lambda arg: re.sub(r'^{0}'.format(re.escape(nixpkgs_root)), worktree, arg), update_script_command)
+        update_script_command = map(
+            lambda arg: re.sub(r"^{0}".format(re.escape(nixpkgs_root)), worktree, arg),
+            update_script_command,
+        )
 
     eprint(f" - {package['name']}: UPDATING ...")
 
     try:
         update_info = await check_subprocess_output(
-            'env',
+            "env",
             f"UPDATE_NIX_NAME={package['name']}",
             f"UPDATE_NIX_PNAME={package['pname']}",
             f"UPDATE_NIX_OLD_VERSION={package['oldVersion']}",
@@ -69,50 +233,77 @@ async def run_update_script(nixpkgs_root: str, merge_lock: asyncio.Lock, temp_di
         )
         await merge_changes(merge_lock, package, update_info, temp_dir)
     except KeyboardInterrupt as e:
-        eprint('Cancelling…')
+        eprint("Cancelling…")
         raise asyncio.exceptions.CancelledError()
     except CalledProcessError as e:
         eprint(f" - {package['name']}: ERROR")
-        eprint()
-        eprint(f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------")
-        eprint()
-        eprint(e.stderr.decode('utf-8'))
-        with open(f"{package['pname']}.log", 'wb') as logfile:
-            logfile.write(e.stderr)
-        eprint()
-        eprint(f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------")
+        if e.stderr is not None:
+            eprint()
+            eprint(
+                f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------"
+            )
+            eprint()
+            eprint(e.stderr.decode("utf-8"))
+            with open(f"{package['pname']}.log", "wb") as logfile:
+                logfile.write(e.stderr)
+            eprint()
+            eprint(
+                f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------"
+            )
 
         if not keep_going:
-            raise UpdateFailedException(f"The update script for {package['name']} failed with exit code {e.process.returncode}")
+            raise UpdateFailedException(
+                f"The update script for {package['name']} failed with exit code {e.process.returncode}"
+            )
+
 
 @contextlib.contextmanager
-def make_worktree() -> Generator[Tuple[str, str], None, None]:
+def make_worktree() -> Generator[tuple[str, str], None, None]:
     with tempfile.TemporaryDirectory() as wt:
-        branch_name = f'update-{os.path.basename(wt)}'
-        target_directory = f'{wt}/nixpkgs'
+        branch_name = f"update-{os.path.basename(wt)}"
+        target_directory = f"{wt}/nixpkgs"
 
-        subprocess.run(['git', 'worktree', 'add', '-b', branch_name, target_directory])
+        subprocess.run(["git", "worktree", "add", "-b", branch_name, target_directory])
         try:
             yield (target_directory, branch_name)
         finally:
-            subprocess.run(['git', 'worktree', 'remove', '--force', target_directory])
-            subprocess.run(['git', 'branch', '-D', branch_name])
+            subprocess.run(["git", "worktree", "remove", "--force", target_directory])
+            subprocess.run(["git", "branch", "-D", branch_name])
 
-async def commit_changes(name: str, merge_lock: asyncio.Lock, worktree: str, branch: str, changes: List[Dict]) -> None:
+
+async def commit_changes(
+    name: str,
+    merge_lock: asyncio.Lock,
+    worktree: str,
+    branch: str,
+    changes: list[dict],
+) -> None:
     for change in changes:
         # Git can only handle a single index operation at a time
         async with merge_lock:
-            await check_subprocess_output('git', 'add', *change['files'], cwd=worktree)
-            commit_message = '{attrPath}: {oldVersion} -> {newVersion}'.format(**change)
-            if 'commitMessage' in change:
-                commit_message = change['commitMessage']
-            elif 'commitBody' in change:
-                commit_message = commit_message + '\n\n' + change['commitBody']
-            await check_subprocess_output('git', 'commit', '--quiet', '-m', commit_message, cwd=worktree)
-            await check_subprocess_output('git', 'cherry-pick', branch)
+            await check_subprocess_output("git", "add", *change["files"], cwd=worktree)
+            commit_message = "{attrPath}: {oldVersion} -> {newVersion}".format(**change)
+            if "commitMessage" in change:
+                commit_message = change["commitMessage"]
+            elif "commitBody" in change:
+                commit_message = commit_message + "\n\n" + change["commitBody"]
+            await check_subprocess_output(
+                "git",
+                "commit",
+                "--quiet",
+                "-m",
+                commit_message,
+                cwd=worktree,
+            )
+            await check_subprocess_output("git", "cherry-pick", branch)
 
-async def check_changes(package: Dict, worktree: str, update_info: str):
-    if 'commit' in package['supportedFeatures']:
+
+async def check_changes(
+    package: dict,
+    worktree: str,
+    update_info: bytes,
+) -> list[dict]:
+    if "commit" in package["supportedFeatures"]:
         changes = json.loads(update_info)
     else:
         changes = [{}]
@@ -120,133 +311,289 @@ async def check_changes(package: Dict, worktree: str, update_info: str):
     # Try to fill in missing attributes when there is just a single change.
     if len(changes) == 1:
         # Dynamic data from updater take precedence over static data from passthru.updateScript.
-        if 'attrPath' not in changes[0]:
+        if "attrPath" not in changes[0]:
             # update.nix is always passing attrPath
-            changes[0]['attrPath'] = package['attrPath']
+            changes[0]["attrPath"] = package["attrPath"]
 
-        if 'oldVersion' not in changes[0]:
+        if "oldVersion" not in changes[0]:
             # update.nix is always passing oldVersion
-            changes[0]['oldVersion'] = package['oldVersion']
+            changes[0]["oldVersion"] = package["oldVersion"]
 
-        if 'newVersion' not in changes[0]:
-            attr_path = changes[0]['attrPath']
-            obtain_new_version_output = await check_subprocess_output('nix-instantiate', '--expr', f'with import ./. {{}}; lib.getVersion {attr_path}', '--eval', '--strict', '--json', stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, cwd=worktree)
-            changes[0]['newVersion'] = json.loads(obtain_new_version_output.decode('utf-8'))
+        if "newVersion" not in changes[0]:
+            attr_path = changes[0]["attrPath"]
+            obtain_new_version_output = await check_subprocess_output(
+                "nix-instantiate",
+                "--expr",
+                f"with import ./. {{}}; lib.getVersion {attr_path}",
+                "--eval",
+                "--strict",
+                "--json",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                cwd=worktree,
+            )
+            changes[0]["newVersion"] = json.loads(
+                obtain_new_version_output.decode("utf-8")
+            )
 
-        if 'files' not in changes[0]:
-            changed_files_output = await check_subprocess_output('git', 'diff', '--name-only', 'HEAD', stdout=asyncio.subprocess.PIPE, cwd=worktree)
+        if "files" not in changes[0]:
+            changed_files_output = await check_subprocess_output(
+                "git",
+                "diff",
+                "--name-only",
+                "HEAD",
+                stdout=asyncio.subprocess.PIPE,
+                cwd=worktree,
+            )
             changed_files = changed_files_output.splitlines()
-            changes[0]['files'] = changed_files
+            changes[0]["files"] = changed_files
 
             if len(changed_files) == 0:
                 return []
 
     return changes
 
-async def merge_changes(merge_lock: asyncio.Lock, package: Dict, update_info: str, temp_dir: Optional[Tuple[str, str]]) -> None:
+
+async def merge_changes(
+    merge_lock: asyncio.Lock,
+    package: dict,
+    update_info: bytes,
+    temp_dir: tuple[str, str] | None,
+) -> None:
     if temp_dir is not None:
         worktree, branch = temp_dir
         changes = await check_changes(package, worktree, update_info)
 
         if len(changes) > 0:
-            await commit_changes(package['name'], merge_lock, worktree, branch, changes)
+            await commit_changes(package["name"], merge_lock, worktree, branch, changes)
         else:
             eprint(f" - {package['name']}: DONE, no changes.")
     else:
         eprint(f" - {package['name']}: DONE.")
 
-async def updater(nixpkgs_root: str, temp_dir: Optional[Tuple[str, str]], merge_lock: asyncio.Lock, packages_to_update: asyncio.Queue[Optional[Dict]], keep_going: bool, commit: bool):
+
+async def updater(
+    nixpkgs_root: str,
+    temp_dir: tuple[str, str] | None,
+    merge_lock: asyncio.Lock,
+    packages_to_update: asyncio.Queue[dict | None],
+    keep_going: bool,
+    commit: bool,
+) -> None:
     while True:
         package = await packages_to_update.get()
         if package is None:
             # A sentinel received, we are done.
             return
 
-        if not ('commit' in package['supportedFeatures'] or 'attrPath' in package):
+        if not ("commit" in package["supportedFeatures"] or "attrPath" in package):
             temp_dir = None
 
         await run_update_script(nixpkgs_root, merge_lock, temp_dir, package, keep_going)
 
-async def start_updates(max_workers: int, keep_going: bool, commit: bool, packages: List[Dict]):
+        packages_to_update.task_done()
+
+
+async def populate_queue(
+    attr_packages: dict[str, dict],
+    sorter: TopologicalSorter[str],
+    packages_to_update: asyncio.Queue[dict | None],
+    num_workers: int,
+) -> None:
+    """
+    Keeps populating the queue with packages that can be updated
+    according to ordering requirements. If topological order
+    is used, the packages will appear in waves, as packages with
+    no dependencies are processed and removed from the sorter.
+    With `order="none"`, all packages will be enqueued simultaneously.
+    """
+
+    # Fill up an update queue,
+    while sorter.is_active():
+        ready_packages = list(sorter.get_ready())
+        eprint(f"Enqueuing group of {len(ready_packages)} packages")
+        for package in ready_packages:
+            await packages_to_update.put(attr_packages[package])
+        await packages_to_update.join()
+        sorter.done(*ready_packages)
+
+    # Add sentinels, one for each worker.
+    # A worker will terminate when it gets a sentinel from the queue.
+    for i in range(num_workers):
+        await packages_to_update.put(None)
+
+
+async def start_updates(
+    max_workers: int,
+    keep_going: bool,
+    commit: bool,
+    attr_packages: dict[str, dict],
+    sorter: TopologicalSorter[str],
+) -> None:
     merge_lock = asyncio.Lock()
-    packages_to_update: asyncio.Queue[Optional[Dict]] = asyncio.Queue()
+    packages_to_update: asyncio.Queue[dict | None] = asyncio.Queue()
 
     with contextlib.ExitStack() as stack:
-        temp_dirs: List[Optional[Tuple[str, str]]] = []
+        temp_dirs: list[tuple[str, str] | None] = []
 
         # Do not create more workers than there are packages.
-        num_workers = min(max_workers, len(packages))
+        num_workers = min(max_workers, len(attr_packages))
 
-        nixpkgs_root_output = await check_subprocess_output('git', 'rev-parse', '--show-toplevel', stdout=asyncio.subprocess.PIPE)
-        nixpkgs_root = nixpkgs_root_output.decode('utf-8').strip()
+        nixpkgs_root_output = await check_subprocess_output(
+            "git",
+            "rev-parse",
+            "--show-toplevel",
+            stdout=asyncio.subprocess.PIPE,
+        )
+        nixpkgs_root = nixpkgs_root_output.decode("utf-8").strip()
 
         # Set up temporary directories when using auto-commit.
         for i in range(num_workers):
             temp_dir = stack.enter_context(make_worktree()) if commit else None
             temp_dirs.append(temp_dir)
 
-        # Fill up an update queue,
-        for package in packages:
-            await packages_to_update.put(package)
-
-        # Add sentinels, one for each worker.
-        # A workers will terminate when it gets sentinel from the queue.
-        for i in range(num_workers):
-            await packages_to_update.put(None)
+        queue_task = populate_queue(
+            attr_packages,
+            sorter,
+            packages_to_update,
+            num_workers,
+        )
 
         # Prepare updater workers for each temp_dir directory.
         # At most `num_workers` instances of `run_update_script` will be running at one time.
-        updaters = asyncio.gather(*[updater(nixpkgs_root, temp_dir, merge_lock, packages_to_update, keep_going, commit) for temp_dir in temp_dirs])
+        updater_tasks = [
+            updater(
+                nixpkgs_root,
+                temp_dir,
+                merge_lock,
+                packages_to_update,
+                keep_going,
+                commit,
+            )
+            for temp_dir in temp_dirs
+        ]
+
+        tasks = asyncio.gather(
+            *updater_tasks,
+            queue_task,
+        )
 
         try:
             # Start updater workers.
-            await updaters
+            await tasks
         except asyncio.exceptions.CancelledError:
             # When one worker is cancelled, cancel the others too.
-            updaters.cancel()
+            tasks.cancel()
         except UpdateFailedException as e:
             # When one worker fails, cancel the others, as this exception is only thrown when keep_going is false.
-            updaters.cancel()
+            tasks.cancel()
             eprint(e)
             sys.exit(1)
 
-def main(max_workers: int, keep_going: bool, commit: bool, packages_path: str, skip_prompt: bool) -> None:
+
+async def main(
+    max_workers: int,
+    keep_going: bool,
+    commit: bool,
+    packages_path: str,
+    skip_prompt: bool,
+    order: Order,
+) -> None:
     with open(packages_path) as f:
         packages = json.load(f)
 
+    if order != "arbitrary":
+        eprint("Sorting packages…")
+        reverse_order = order == "reverse-topological"
+        sorter, packages = await get_topological_sorter(
+            max_workers,
+            packages,
+            reverse_order,
+        )
+    else:
+        sorter = get_independent_sorter(packages)
+
+    attr_packages = {package["attrPath"]: package for package in packages}
+
     eprint()
-    eprint('Going to be running update for following packages:')
+    eprint("Going to be running update for following packages:")
     for package in packages:
         eprint(f" - {package['name']}")
     eprint()
 
-    confirm = '' if skip_prompt else input('Press Enter key to continue...')
+    confirm = "" if skip_prompt else input("Press Enter key to continue...")
 
-    if confirm == '':
+    if confirm == "":
         eprint()
-        eprint('Running update for:')
+        eprint("Running update for:")
 
-        asyncio.run(start_updates(max_workers, keep_going, commit, packages))
+        await start_updates(max_workers, keep_going, commit, attr_packages, sorter)
 
         eprint()
-        eprint('Packages updated!')
+        eprint("Packages updated!")
         sys.exit()
     else:
-        eprint('Aborting!')
+        eprint("Aborting!")
         sys.exit(130)
 
-parser = argparse.ArgumentParser(description='Update packages')
-parser.add_argument('--max-workers', '-j', dest='max_workers', type=int, help='Number of updates to run concurrently', nargs='?', default=4)
-parser.add_argument('--keep-going', '-k', dest='keep_going', action='store_true', help='Do not stop after first failure')
-parser.add_argument('--commit', '-c', dest='commit', action='store_true', help='Commit the changes')
-parser.add_argument('packages', help='JSON file containing the list of package names and their update scripts')
-parser.add_argument('--skip-prompt', '-s', dest='skip_prompt', action='store_true', help='Do not stop for prompts')
 
-if __name__ == '__main__':
+parser = argparse.ArgumentParser(description="Update packages")
+parser.add_argument(
+    "--max-workers",
+    "-j",
+    dest="max_workers",
+    type=int,
+    help="Number of updates to run concurrently",
+    nargs="?",
+    default=4,
+)
+parser.add_argument(
+    "--keep-going",
+    "-k",
+    dest="keep_going",
+    action="store_true",
+    help="Do not stop after first failure",
+)
+parser.add_argument(
+    "--commit",
+    "-c",
+    dest="commit",
+    action="store_true",
+    help="Commit the changes",
+)
+parser.add_argument(
+    "--order",
+    dest="order",
+    default="arbitrary",
+    choices=["arbitrary", "reverse-topological", "topological"],
+    help="Sort the packages based on dependency relation",
+)
+parser.add_argument(
+    "packages",
+    help="JSON file containing the list of package names and their update scripts",
+)
+parser.add_argument(
+    "--skip-prompt",
+    "-s",
+    dest="skip_prompt",
+    action="store_true",
+    help="Do not stop for prompts",
+)
+
+if __name__ == "__main__":
     args = parser.parse_args()
 
     try:
-        main(args.max_workers, args.keep_going, args.commit, args.packages, args.skip_prompt)
+        asyncio.run(
+            main(
+                args.max_workers,
+                args.keep_going,
+                args.commit,
+                args.packages,
+                args.skip_prompt,
+                args.order,
+            )
+        )
     except KeyboardInterrupt as e:
         # Let’s cancel outside of the main loop too.
         sys.exit(130)

maintainers/team-list.nix

@@ -64,6 +64,7 @@ with lib.maintainers;
     # Edits to this list should only be done by an already existing member.
     members = [
       wolfgangwalther
+      DutchGerman
     ];
   };
 

nixos/doc/manual/configuration/x-windows.chapter.md

@@ -114,6 +114,54 @@ using lightdm for a user `alice`:
 }
 ```
 
+## Running X without a display manager  {#sec-x11-startx}
+
+It is possible to avoid a display manager entirely and starting the X server
+manually from a virtual terminal. Add to your configuration
+```nix
+{
+  services.xserver.displayManager.startx = {
+    enable = true;
+    generateScript = true;
+  };
+}
+```
+then you can start the X server with the `startx` command.
+
+The second option will generate a base `xinitrc` script that will run your
+window manager and set up the systemd user session.
+You can extend the script using the [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) for example:
+```nix
+{
+  services.xserver.displayManager.startx = {
+    generateScript = true;
+    extraCommands = ''
+      xrdb -load .Xresources
+      xsetroot -solid '#666661'
+      xsetroot -cursor_name left_ptr
+    '';
+  };
+}
+```
+or, alternatively, you can write your own from scratch in `~/.xinitrc`.
+
+In this case, remember you're responsible for starting the window manager, for
+example
+```shell
+sxhkd &
+bspwm &
+```
+and if you have enabled some systemd user service, you will probably want to
+also add these lines too:
+```shell
+# import required env variables from the current shell
+systemctl --user import-environment DISPLAY XDG_SESSION_ID
+# start all graphical user services
+systemctl --user start nixos-fake-graphical-session.target
+# start the user dbus daemon
+dbus-daemon --session --address="unix:path=/run/user/$(id -u)/bus" &
+```
+
 ## Intel Graphics drivers {#sec-x11--graphics-cards-intel}
 
 The default and recommended driver for Intel Graphics in X.org is `modesetting`

nixos/doc/manual/redirects.json

@@ -272,6 +272,9 @@
   "sec-x11-auto-login": [
     "index.html#sec-x11-auto-login"
   ],
+  "sec-x11-startx": [
+    "index.html#sec-x11-startx"
+  ],
   "sec-x11--graphics-cards-intel": [
     "index.html#sec-x11--graphics-cards-intel"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -206,9 +206,6 @@
 
 - `pkgs.nextcloud28` has been removed since it's out of support upstream.
 
-- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
-  Environment variables have to be passed via the `env` attribute.
-
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.
 
   Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.
@@ -559,6 +556,10 @@
 
 - For matrix homeserver Synapse we are now following the upstream recommendation to enable jemalloc as the memory allocator by default.
 
+- In `dovecot` package removed hard coding path to module directory.
+
+- `services.dovecot2.modules` have been removed, now need to use `environment.systemPackages` to load additional Dovecot modules.
+
 - `services.kmonad` now creates a determinate symlink (in `/dev/input/by-id/`) to each of KMonad virtual devices.
 
 - `services.gitea` now supports CAPTCHA usage through the `services.gitea.captcha` variable.

nixos/modules/programs/xss-lock.nix

@@ -49,10 +49,5 @@ in
       );
       serviceConfig.Restart = "always";
     };
-
-    warnings = lib.mkIf (config.services.xserver.displayManager.startx.enable) [
-      "xss-lock service only works if a displayManager is set; it doesn't work when services.xserver.displayManager.startx.enable = true"
-    ];
-
   };
 }

nixos/modules/services/mail/dovecot.nix

@@ -111,6 +111,7 @@ let
       base_dir = ${baseDir}
       protocols = ${concatStringsSep " " cfg.protocols}
       sendmail_path = /run/wrappers/bin/sendmail
+      mail_plugin_dir = /run/current-system/sw/lib/dovecot/modules
       # defining mail_plugins must be done before the first protocol {} filter because of https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#variable-expansion
       mail_plugins = $mail_plugins ${concatStringsSep " " cfg.mailPlugins.globally.enable}
     ''
@@ -207,13 +208,6 @@ let
     cfg.extraConfig
   ];
 
-  modulesDir = pkgs.symlinkJoin {
-    name = "dovecot-modules";
-    paths = map (pkg: "${pkg}/lib/dovecot") (
-      [ dovecotPkg ] ++ map (module: module.override { dovecot = dovecotPkg; }) cfg.modules
-    );
-  };
-
   mailboxConfig =
     mailbox:
     ''
@@ -280,6 +274,11 @@ in
 {
   imports = [
     (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+    (mkRemovedOptionModule [
+      "services"
+      "dovecot2"
+      "modules"
+    ] "Now need to use `environment.systemPackages` to load additional Dovecot modules")
     (mkRenamedOptionModule
       [ "services" "dovecot2" "sieveScripts" ]
       [ "services" "dovecot2" "sieve" "scripts" ]
@@ -409,17 +408,6 @@ in
         default = true;
       };
 
-    modules = mkOption {
-      type = types.listOf types.package;
-      default = [ ];
-      example = literalExpression "[ pkgs.dovecot_pigeonhole ]";
-      description = ''
-        Symlinks the contents of lib/dovecot of every given package into
-        /etc/dovecot/modules. This will make the given modules available
-        if a dovecot package with the module_dir patch applied is being used.
-      '';
-    };
-
     sslCACert = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -702,7 +690,6 @@ in
         ${cfg.mailGroup} = { };
       };
 
-    environment.etc."dovecot/modules".source = modulesDir;
     environment.etc."dovecot/dovecot.conf".source = cfg.configFile;
 
     systemd.services.dovecot2 = {
@@ -712,7 +699,6 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [
         cfg.configFile
-        modulesDir
       ];
 
       startLimitIntervalSec = 60; # 1 min

nixos/modules/services/misc/evremap.nix

@@ -10,7 +10,7 @@ let
   settings = lib.attrsets.filterAttrs (n: v: v != null) cfg.settings;
   configFile = format.generate "evremap.toml" settings;
 
-  key = lib.types.strMatching "(BTN|KEY)_[[:upper:]]+" // {
+  key = lib.types.strMatching "(BTN|KEY)_[[:upper:][:digit:]_]+" // {
     description = "key ID prefixed with BTN_ or KEY_";
   };
 

nixos/modules/services/x11/display-managers/startx.nix

@@ -5,12 +5,16 @@
   ...
 }:
 
-with lib;
-
 let
 
   cfg = config.services.xserver.displayManager.startx;
 
+  # WM session script
+  # Note: this assumes a single WM has been enabled
+  sessionScript = lib.concatMapStringsSep "\n" (
+    i: i.start
+  ) config.services.xserver.windowManager.session;
+
 in
 
 {
@@ -19,40 +23,93 @@ in
 
   options = {
     services.xserver.displayManager.startx = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
-          Whether to enable the dummy "startx" pseudo-display manager,
-          which allows users to start X manually via the "startx" command
-          from a vt shell. The X server runs under the user's id, not as root.
-          The user must provide a ~/.xinitrc file containing session startup
-          commands, see {manpage}`startx(1)`. This is not automatically generated
-          from the desktopManager and windowManager settings.
+          Whether to enable the dummy "startx" pseudo-display manager, which
+          allows users to start X manually via the `startx` command from a
+          virtual terminal.
+
+          ::: {.note}
+          The X server will run under the current user, not as root.
+          :::
         '';
       };
+
+      generateScript = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to generate the system-wide xinitrc script (/etc/X11/xinit/xinitrc).
+          This script will take care of setting up the session for systemd user
+          services, running the window manager and cleaning up on exit.
+
+          ::: {.note}
+          This script will only be used by `startx` when both `.xinitrc` does not
+          exists and the `XINITRC` environment variable is unset.
+          :::
+        '';
+      };
+
+      extraCommands = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = ''
+          Shell commands to be added to the system-wide xinitrc script.
+        '';
+      };
+
     };
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
-    services.xserver = {
-      exportConfiguration = true;
-    };
+  config = lib.mkIf cfg.enable {
+    services.xserver.exportConfiguration = true;
 
     # Other displayManagers log to /dev/null because they're services and put
     # Xorg's stdout in the journal
     #
     # To send log to Xorg's default log location ($XDG_DATA_HOME/xorg/), we do
     # not specify a log file when running X
-    services.xserver.logFile = mkDefault null;
+    services.xserver.logFile = lib.mkDefault null;
 
     # Implement xserverArgs via xinit's system-wide xserverrc
     environment.etc."X11/xinit/xserverrc".source = pkgs.writeShellScript "xserverrc" ''
-      exec ${pkgs.xorg.xorgserver}/bin/X ${toString config.services.xserver.displayManager.xserverArgs} "$@"
+      exec ${pkgs.xorg.xorgserver}/bin/X \
+        ${toString config.services.xserver.displayManager.xserverArgs} "$@"
     '';
+
+    # Add a sane system-wide xinitrc script
+    environment.etc."X11/xinit/xinitrc".source = lib.mkIf cfg.generateScript (
+      pkgs.writeShellScript "xinitrc" ''
+        ${cfg.extraCommands}
+
+        # start user services
+        systemctl --user import-environment DISPLAY XDG_SESSION_ID
+        systemctl --user start nixos-fake-graphical-session.target
+
+        # run the window manager script
+        ${sessionScript}
+        wait $waitPID
+
+        # stop services and all subprocesses
+        systemctl --user stop nixos-fake-graphical-session.target
+        kill 0
+      ''
+    );
+
     environment.systemPackages = with pkgs; [ xorg.xinit ];
+
+    # Make graphical-session fail if the user environment has not been imported
+    systemd.user.targets.graphical-session = {
+      unitConfig.AssertEnvironment = [
+        "DISPLAY"
+        "XDG_SESSION_ID"
+      ];
+    };
+
   };
 
 }

nixos/tests/all-tests.nix

@@ -1152,6 +1152,7 @@ in {
   systemd-userdbd = handleTest ./systemd-userdbd.nix {};
   systemd-homed = handleTest ./systemd-homed.nix {};
   systemtap = handleTest ./systemtap.nix {};
+  startx = runTest ./startx.nix;
   taler = handleTest ./taler {};
   tandoor-recipes = handleTest ./tandoor-recipes.nix {};
   tandoor-recipes-script-name = handleTest ./tandoor-recipes-script-name.nix {};

nixos/tests/startx.nix

@@ -0,0 +1,108 @@
+{ lib, ... }:
+
+{
+  name = "startx";
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.getty.autologinUser = "root";
+
+      environment.systemPackages = with pkgs; [
+        xdotool
+        catclock
+      ];
+
+      programs.bash.promptInit = "PS1='# '";
+
+      # startx+bspwm setup
+      services.xserver = {
+        enable = true;
+        windowManager.bspwm = {
+          enable = true;
+          configFile = pkgs.writeShellScript "bspwrc" ''
+            bspc config border_width 2
+            bspc config window_gap 12
+            bspc rule -a xclock state=floating sticky=on
+          '';
+          sxhkd.configFile = pkgs.writeText "sxhkdrc" ''
+            # open a terminal
+            super + Return
+              urxvtc
+            # quit bspwm
+            super + alt + Escape
+              bspc quit
+          '';
+        };
+        displayManager.startx = {
+          enable = true;
+          generateScript = true;
+          extraCommands = ''
+            xrdb -load ~/.Xresources
+            xsetroot -solid '#343d46'
+            xsetroot -cursor_name trek
+            xclock &
+          '';
+        };
+      };
+
+      # enable some user services
+      security.polkit.enable = true;
+      services.urxvtd.enable = true;
+      programs.xss-lock.enable = true;
+    };
+
+  testScript = ''
+    import textwrap
+
+    sysu = "env XDG_RUNTIME_DIR=/run/user/0 systemctl --user";
+    prompt = "# "
+
+    with subtest("Wait for the autologin"):
+        machine.wait_until_tty_matches("1", prompt)
+
+    with subtest("Setup dotfiles"):
+        machine.execute(textwrap.dedent("""
+          cat <<EOF > ~/.Xresources
+            urxvt*foreground: #9b9081
+            urxvt*background: #181b20
+            urxvt*scrollBar:  false
+            urxvt*title:      myterm
+            urxvt*geometry:   80x240+0+0
+            xclock*geometry:  164x164+24+440
+          EOF
+        """))
+
+    with subtest("Can start the X server"):
+        machine.send_chars("startx\n")
+        machine.wait_for_x()
+        machine.wait_for_window("xclock")
+
+    with subtest("Graphical services are running"):
+        machine.succeed(f"{sysu} is-active graphical-session.target")
+        machine.succeed(f"{sysu} is-active urxvtd")
+        machine.succeed(f"{sysu} is-active xss-lock")
+
+    with subtest("Can interact with the WM"):
+        machine.wait_until_succeeds("pgrep sxhkd")
+        machine.wait_until_succeeds("pgrep bspwm")
+        # spawn some terminals
+        machine.send_key("meta_l-ret", delay=0.5)
+        machine.send_key("meta_l-ret", delay=0.5)
+        machine.send_key("meta_l-ret", delay=0.5)
+        # Note: this tests that resources have beeen loaded
+        machine.wait_for_window("myterm")
+        machine.screenshot("screenshot.png")
+
+    with subtest("Can stop the X server"):
+        # kill the WM
+        machine.send_key("meta_l-alt-esc")
+        machine.wait_until_tty_matches("1", prompt)
+
+    with subtest("Graphical session has stopped"):
+        machine.fail(f"{sysu} is-active graphical-session.target")
+        machine.fail(f"{sysu} is-active urxvtd")
+        machine.fail(f"{sysu} is-active xss-lock")
+  '';
+}

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -61,7 +61,6 @@ lib.extendMkDerivation {
       propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;
 
       strictDeps = args.strictDeps or true;
-      __structuredAttrs = args.__structuredAttrs or true;
 
       inherit turnCompilationWarningToError ignoreCompilationError;
 

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.22";
+  version = "0.0.23";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
     tag = "v${version}";
-    hash = "sha256-m33yNoGnSYKfjTuabxx/QsMptiUxAcP8NVe/su+JfkE=";
+    hash = "sha256-Ud4NkJH7hze5796KjVe5Nj9DzxwQkDQErCJDDiBzAIY=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-pyright";
     name = "pyright";
-    version = "1.1.394";
-    hash = "sha256-LQYC4dZ0lJ+NkQjRGW0HQ16TK2NI0ZK2IYytkxoBhR0=";
+    version = "1.1.396";
+    hash = "sha256-QKfFJvzyPlF9tPDeg271/oZ506hIlr3OX7JuF0f6kEE=";
   };
 
   meta = {

pkgs/applications/gis/qgis/default.nix

@@ -21,7 +21,7 @@ let
 in
 symlinkJoin rec {
 
-  inherit (qgis-unwrapped) version;
+  inherit (qgis-unwrapped) version src;
   name = "qgis-${version}";
 
   paths = [ qgis-unwrapped ];
@@ -47,6 +47,10 @@ symlinkJoin rec {
   passthru = {
     unwrapped = qgis-unwrapped;
     tests.qgis = nixosTests.qgis;
+    updateScript = [
+      ./update.sh
+      "qgis"
+    ];
   };
 
   meta = qgis-unwrapped.meta;

pkgs/applications/gis/qgis/ltr.nix

@@ -21,7 +21,7 @@ let
 in
 symlinkJoin rec {
 
-  inherit (qgis-ltr-unwrapped) version;
+  inherit (qgis-ltr-unwrapped) version src;
   name = "qgis-${version}";
 
   paths = [ qgis-ltr-unwrapped ];
@@ -48,6 +48,10 @@ symlinkJoin rec {
   passthru = {
     unwrapped = qgis-ltr-unwrapped;
     tests.qgis-ltr = nixosTests.qgis-ltr;
+    updateScript = [
+      ./update.sh
+      "qgis-ltr"
+    ];
   };
 
   inherit (qgis-ltr-unwrapped) meta;

pkgs/applications/gis/qgis/set-pyqt-package-dirs-ltr.patch

@@ -11,16 +11,6 @@ index b51fd0075e..87ee317e05 100644
      IF(_pyqt5_metadata)
        FILE(READ ${_pyqt5_metadata} _pyqt5_metadata_contents)
        STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" PYQT5_VERSION_STR ${_pyqt5_metadata_contents})
-@@ -34,8 +34,8 @@ ELSE(EXISTS PYQT5_VERSION_STR)
-     ENDIF(_pyqt5_metadata)
- 
-     IF(PYQT5_VERSION_STR)
--      SET(PYQT5_MOD_DIR "${Python_SITEARCH}/PyQt5")
--      SET(PYQT5_SIP_DIR "${Python_SITEARCH}/PyQt5/bindings")
-+      SET(PYQT5_MOD_DIR "@pyQt5PackageDir@/PyQt5")
-+      SET(PYQT5_SIP_DIR "@pyQt5PackageDir@/PyQt5/bindings")
-       FIND_PROGRAM(__pyuic5 "pyuic5")
-       GET_FILENAME_COMPONENT(PYQT5_BIN_DIR ${__pyuic5} DIRECTORY)
  
 diff --git a/cmake/FindQsci.cmake b/cmake/FindQsci.cmake
 index 69e41c1fe9..5456c3d59b 100644

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.34.15";
+  version = "3.40.4";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-TFnlQIizI+8CZgNpwkuipSCNT3OYIaOeoz6kIGcSYL4=";
+    hash = "sha256-R2/ycRPQVKqleSt+9D/YCpBlqKgJdhLc0BvYT7qFJo8=";
   };
 
   passthru = {
@@ -160,6 +160,11 @@ mkDerivation rec {
       "-DWITH_3D=True"
       "-DWITH_PDAL=True"
       "-DENABLE_TESTS=False"
+      "-DQT_PLUGINS_DIR=${qtbase}/${qtbase.qtPluginPrefix}"
+
+      # Remove for QGIS 3.42
+      "-DCMAKE_POLICY_DEFAULT_CMP0175=OLD"
+      "-DCMAKE_POLICY_DEFAULT_CMP0177=OLD"
     ]
     ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
     ++ lib.optional withServer [

pkgs/applications/gis/qgis/unwrapped.nix

@@ -80,14 +80,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.40.3";
+  version = "3.42.0";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-AUDohf71NIuEjFrzRQ8QsdvmEjYsZK9aI4j0msVJgcQ=";
+    hash = "sha256-vqT6ffqY1M6/2eW08VghysC+v7ZI9Yz0Zhk9UY/izZc=";
   };
 
   passthru = {

pkgs/applications/gis/qgis/update.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jq
+
+set -eu -o pipefail
+
+url="https://version.qgis.org/version.json"
+
+package="$1"
+
+function make_version {
+    jq --raw-output '[.major, .minor, .patch] | join(".")'
+}
+
+if [ "$package" == "qgis" ]; then
+    version="$(curl --silent $url | jq '.latest' | make_version)"
+elif [ "$package" == "qgis-ltr" ]; then
+    version="$(curl --silent $url | jq '.ltr' | make_version)"
+fi
+
+update-source-version "$package" "$version"

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "136.0";
+  version = "136.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a2b7e74e8404138b294f7b3c5f1eaeaeb8ce84c9aad25379e8ec785a9686f42def9f8c119d4bc276dd371d13d7bebbe4b1b092af41500aa8c2b2c827971445b4";
+    sha512 = "e5833ccf97796c15b5156357427621d1f2d1d7ee55b53262f3935eadb98229c74a355bbe2f72a4168ec4e29dd3f83f4eaca99c5215d61bd087475331d3522abd";
   };
 
   meta = {

pkgs/applications/video/tartube/default.nix

@@ -15,13 +15,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "tartube";
-  version = "2.5.062";
+  version = "2.5.100";
 
   src = fetchFromGitHub {
     owner = "axcore";
     repo = "tartube";
     tag = "v${version}";
-    sha256 = "sha256-AtyqSapX8M8PUGeOiC2WFgs0nPgosT7UcbTHejIfwhc=";
+    sha256 = "sha256-zocFQRpYbWxG/EoZW419v6li8HBo/9woTBYDbzHR4qQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/balena-cli/package.nix

@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "20.2.7";
+  version = "20.2.10";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-D6GZRkA+O6vuz1ntUT8Hz0fCEv6xlHx7sG6BrLzJm/k=";
+    hash = "sha256-kY8hXNDxbQwM2QleQ8MafDuANQzBRL3+Tei10P976bU=";
   };
 
-  npmDepsHash = "sha256-x9/qwDJH0AlWehUlsFQdNHI53YWh2DHX/19VDA7vJc4=";
+  npmDepsHash = "sha256-AD/5QMgko1l8xH8dwua6YkrYuXe1Af7eo17p2L2PkyY=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/by-name/co/containerlab/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "containerlab";
-  version = "0.65.1";
+  version = "0.66.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     rev = "v${version}";
-    hash = "sha256-ivygQomXIgRpCBa3YZYKfk6Twml+TJOae7YGsTDqf+8=";
+    hash = "sha256-y3zmKS5jeVxJAe+TBu7eg7OeM27d0xbKuxR03WnibkE=";
   };
 
-  vendorHash = "sha256-Y7ckQeC94zqNmSu9Y5Cd/kM3aoRdjsmBK2uMZzoJNh4=";
+  vendorHash = "sha256-zRq9o+xOmb3C3BARS2Y2Cu5ioQKey/5MGu9HxYBxcsw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/cy/cyme/package.nix

@@ -3,6 +3,7 @@
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
+  installShellFiles,
   stdenv,
   darwin,
   versionCheckHook,
@@ -26,6 +27,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs =
     [
       pkg-config
+      installShellFiles
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       darwin.DarwinTools
@@ -39,6 +41,14 @@ rustPlatform.buildRustPackage rec {
     "--skip=test_run"
   ];
 
+  postInstall = ''
+    installManPage doc/cyme.1
+    installShellCompletion --cmd cyme \
+      --bash doc/cyme.bash \
+      --fish doc/cyme.fish \
+      --zsh doc/_cyme
+  '';
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/da/dayon/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dayon";
-  version = "16.0.1";
+  version = "16.0.2";
 
   src = fetchFromGitHub {
     owner = "RetGal";
     repo = "dayon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w5k5AiJ956+VO16e3hSjZWCTlR9l/oeNg6kWQLpFvOs=";
+    hash = "sha256-EOQVDzza1tqAzGtEV0npT2k1thTNJOhzMXXX1Tuti6Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dovecot-fts-flatcurve/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-dovecot=${dovecot}/lib/dovecot"
-    "--with-moduledir=$(out)/lib/dovecot"
+    "--with-moduledir=${placeholder "out"}/lib/dovecot/modules"
   ];
 
   meta = with lib; {

pkgs/by-name/do/dovecot_fts_xapian/package.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-dovecot=${dovecot}/lib/dovecot"
-    "--with-moduledir=$(out)/lib/dovecot"
+    "--with-moduledir=${placeholder "out"}/lib/dovecot/modules"
   ];
 
   meta = with lib; {

pkgs/by-name/do/dovecot_pigeonhole/package.nix

@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-dovecot=${dovecot}/lib/dovecot"
+    "--with-moduledir=${placeholder "out"}/lib/dovecot/modules"
     "--without-dovecot-install-dirs"
-    "--with-moduledir=$(out)/lib/dovecot"
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/do/dovi-tool/package.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  fontconfig,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "dovi-tool";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "quietvoid";
+    repo = "dovi_tool";
+    tag = finalAttrs.version;
+    hash = "sha256-z783L6gBr9o44moKYZGwymWEMp5ZW7yOhZcpvbznXK4=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-pwB6QBLeHALbYZHzTBm/ODLPHhxM3B5n+B/0iXYNuVc=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    fontconfig
+  ];
+
+  checkFlags = [
+    # fails because nix-store is read only
+    "--skip=rpu::plot::plot_p7"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/dovi_tool";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI tool combining multiple utilities for working with Dolby Vision";
+    homepage = "https://github.com/quietvoid/dovi_tool";
+    changelog = "https://github.com/quietvoid/dovi_tool/releases";
+    mainProgram = "dovi_tool";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ plamper ];
+  };
+})

pkgs/by-name/em/emmet-language-server/package.nix

@@ -1,33 +1,73 @@
 {
   lib,
-  buildNpmPackage,
+  stdenvNoCC,
+  nodejs,
+  pnpm_9,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
-buildNpmPackage rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "emmet-language-server";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "olrtg";
     repo = "emmet-language-server";
-    rev = "v${version}";
-    hash = "sha256-R20twrmfLz9FP87qkjgz1R/n+Nhzwn22l9t/2fyuVeM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2ptIdZPGLjKsdFJKjt5LZ8JQNNBU5KR62Yw78qzfRxg=";
   };
 
-  npmDepsHash = "sha256-yv+5/wBif75AaAsbJrwLNtlui9SHws2mu3jYOR1Z55M=";
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
+  };
 
-  # Upstream doesn't have a lockfile
-  postPatch = ''
-    cp ${./package-lock.json} ./package-lock.json
+  nativeBuildInputs = [
+    nodejs
+    pnpm_9.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    # TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
+    pnpm build
+
+    runHook postBuild
   '';
 
+  # remove unnecessary and non-deterministic files
+  preInstall = ''
+    pnpm --ignore-scripts --prod prune
+    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
+    # https://github.com/pnpm/pnpm/issues/3645
+    find node_modules -xtype l -delete
+
+    rm node_modules/.modules.yaml
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib/emmet-language-server}
+    mv {node_modules,dist} $out/lib/emmet-language-server
+    ln -s $out/lib/emmet-language-server/dist/index.js $out/bin/emmet-language-server
+    chmod +x $out/bin/emmet-language-server
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Language server for emmet.io";
     homepage = "https://github.com/olrtg/emmet-language-server";
-    changelog = "https://github.com/olrtg/emmet-language-server/releases/tag/v${version}";
+    changelog = "https://github.com/olrtg/emmet-language-server/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
     mainProgram = "emmet-language-server";
   };
-}
+})

pkgs/by-name/gr/grimblast/package.nix

@@ -18,13 +18,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "grimblast";
-  version = "0.1-unstable-2025-03-06";
+  version = "0.1-unstable-2025-03-11";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "0e40ccfc2d6772f9b7d5e1b50c56fb5e468a18fb";
-    hash = "sha256-inSG4OUSdCHXSJZhLNcCUA1s0Ebomr5+v4x3FE/XQ3M=";
+    rev = "e14d9c5e9aea4a84c3677e0a7c73268153b15327";
+    hash = "sha256-SJrLVyoaQUg29fq3nNdRmYrLgiu9dtgcIVqpl8j/Teo=";
   };
 
   strictDeps = true;

pkgs/by-name/im/immich-public-proxy/package.nix

@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.7.3";
+  version = "1.8.0";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-8cy06fNPqzg39Cg/hP6LT1cGNotr08McDVsHxBKs9kA=";
+    hash = "sha256-khOmZj/9/28bADeffAqnbpw9yTvyz+wgBkxZlY9sXPw=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-YH3Li+JMQk8CtddrITIcTYtASh8+bmm/LgZSCnYdlKc=";
+  npmDepsHash = "sha256-jLXO8in7gWBg24210lEVNpfKq0HFs4b+zXPAZGzXsIg=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''

pkgs/by-name/is/is-fast/package.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  pkg-config,
+  openssl,
+  oniguruma,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "is-fast";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "Magic-JD";
+    repo = "is-fast";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-exC9xD0scCa1jYomBCewaLv2kzoxSjHhc75EhEERPR8=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-r1neLuUkWVKl7Qc4FNqW1jzX/HHyVJPEqgZV/GYkGRU=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    oniguruma
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  };
+
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Error creating config directory: Operation not permitted (os error 1)
+    # Using writableTmpDirAsHomeHomeHook is not working
+    "--skip=generate_config::tests::test_run_creates_config_file"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Check the internet as fast as possible";
+    homepage = "https://github.com/Magic-JD/is-fast";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pwnwriter ];
+    mainProgram = "is-fast";
+  };
+})

pkgs/by-name/li/libnvidia-container/package.nix

@@ -12,11 +12,14 @@
   makeWrapper,
   removeReferencesTo,
   replaceVars,
-  go,
+  go_1_23,
   applyPatches,
   nvidia-modprobe,
 }:
 let
+  # https://github.com/NVIDIA/libnvidia-container/pull/297
+  go = go_1_23;
+
   modprobeVersion = "550.54.14";
   patchedModprobe = applyPatches {
     src = nvidia-modprobe.src.override {

pkgs/by-name/ma/mailsend/package.nix

@@ -1,18 +1,21 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   fetchpatch,
   openssl,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mailsend";
   version = "1.19";
 
-  src = fetchurl {
-    url = "https://github.com/muquit/mailsend/archive/${version}.tar.gz";
-    sha256 = "sha256-Vl72vibFjvdQZcVRnq6N1VuuMUKShhlpayjSQrc0k/c=";
+  src = fetchFromGitHub {
+    owner = "muquit";
+    repo = "mailsend";
+    tag = finalAttrs.version;
+    hash = "sha256-g1V4NrFlIz8oh7IS+cGWG6eje6kBGvPZS7Q131ESrXI=";
   };
 
   buildInputs = [
@@ -23,9 +26,11 @@ stdenv.mkDerivation rec {
   ];
 
   patches = [
-    (fetchurl {
+    # OpenSSL 1.1 support for HMAC api
+    (fetchpatch {
+      name = "openssl-1-1-hmac.patch";
       url = "https://github.com/muquit/mailsend/commit/960df6d7a11eef90128dc2ae660866b27f0e4336.patch";
-      sha256 = "0vz373zcfl19inflybfjwshcq06rvhx0i5g0f4b021cxfhyb1sm0";
+      hash = "sha256-Gy4pZMYoUXcjMatw5BSk+IUKXjgpLCwPXtfC++WPKAM=";
     })
     # Pull fix pending upstream inclusion for parallel build failures:
     #   https://github.com/muquit/mailsend/pull/165
@@ -36,15 +41,23 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "-V";
+
+  meta = {
     description = "CLI email sending tool";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
     homepage = "https://github.com/muquit/mailsend";
     downloadPage = "https://github.com/muquit/mailsend/releases";
     mainProgram = "mailsend";
   };
-}
+})

pkgs/by-name/mo/mochi/package.nix

@@ -0,0 +1,65 @@
+{
+  _7zz,
+  appimageTools,
+  fetchurl,
+  fetchzip,
+  lib,
+  stdenvNoCC,
+  xorg,
+}:
+
+let
+  pname = "mochi";
+  version = "1.18.7";
+
+  linux = appimageTools.wrapType2 rec {
+    inherit pname version meta;
+
+    src = fetchurl {
+      url = "https://mochi.cards/releases/Mochi-${version}.AppImage";
+      hash = "sha256-FCh8KLnvs26GKTVJY4Tqp+iA8sNlK7e0rv+oywBIF+U=";
+    };
+
+    appimageContents = appimageTools.extractType2 { inherit pname version src; };
+
+    extraPkgs = pkgs: [ xorg.libxshmfence ];
+
+    extraInstallCommands = ''
+      install -Dm444 ${appimageContents}/${pname}.desktop -t $out/share/applications/
+      install -Dm444 ${appimageContents}/${pname}.png -t $out/share/pixmaps/
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace-fail 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
+    '';
+  };
+
+  darwin = stdenvNoCC.mkDerivation {
+    inherit pname version meta;
+
+    src = fetchzip {
+      url = "https://mochi.cards/releases/Mochi-${version}.dmg";
+      hash = "sha256-W3JqEPF8iCiXlKqjPoFcm7lP+n3lN4XBeAQdBEWvy8s=";
+      stripRoot = false;
+      nativeBuildInputs = [ _7zz ];
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -r *.app $out/Applications
+
+      runHook postInstall
+    '';
+  };
+
+  meta = {
+    description = "Simple markdown-powered SRS app";
+    homepage = "https://mochi.cards/";
+    changelog = "https://mochi.cards/changelog.html";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ poopsicles ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+in
+if stdenvNoCC.hostPlatform.isDarwin then darwin else linux

pkgs/by-name/my/mysql_jdbc/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mysql-connector-java";
-  version = "9.1.0";
+  version = "9.2.0";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-${version}.zip";
-    hash = "sha256-cs3VP+Rd99JrITkxqlVLn9x5FPyrppZcImhdE10VT0U=";
+    hash = "sha256-4+5QyBvRVSCYbc6a0vYuk9S/dgLkGwb22yttJHx/pkk=";
   };
 
   installPhase = ''

pkgs/by-name/ns/nss_pam_ldapd/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nss-pam-ldapd";
-  version = "0.9.12";
+  version = "0.9.13";
 
   src = fetchurl {
     url = "https://arthurdejong.org/nss-pam-ldapd/${pname}-${version}.tar.gz";
-    sha256 = "sha256-xtZh50aTy/Uxp5BjHKk7c/KR+yPMOUZbCd642iv7DhQ=";
+    sha256 = "sha256-4BeE4Xy1M7tmvQYB4gXnhSY0RcPC33pvkCMqtBMccW0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/openbao/package.nix

@@ -2,21 +2,25 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
+  go_1_24,
   testers,
   openbao,
+  versionCheckHook,
+  nix-update-script,
 }:
-buildGoModule rec {
+
+buildGoModule.override { go = go_1_24; } rec {
   pname = "openbao";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
-    rev = "v${version}";
-    hash = "sha256-viN1Yuqnyg/nrRzV2HkjVGZSWD9QIXLN6nG5N0QtwbU=";
+    tag = "v${version}";
+    hash = "sha256-dDMOeAceMaSrF7P4JZ2MKy6zDa10LxCQKkKwu/Q3kOU=";
   };
 
-  vendorHash = "sha256-dSEFoD2UbY6OejSxPBDxCNKHBoHI8YNnixayIS7z3e8=";
+  vendorHash = "sha256-zcMc63B/jTUykPfRKvea27xRxjOV+zytaxKOEQAUz1Q=";
 
   proxyVendor = true;
 
@@ -49,12 +53,23 @@ buildGoModule rec {
     version = "v${version}";
   };
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/bao";
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     homepage = "https://www.openbao.org/";
     description = "Open source, community-driven fork of Vault managed by the Linux Foundation";
     changelog = "https://github.com/openbao/openbao/blob/v${version}/CHANGELOG.md";
-    license = licenses.mpl20;
+    license = lib.licenses.mpl20;
     mainProgram = "bao";
-    maintainers = with maintainers; [ brianmay ];
+    maintainers = with lib.maintainers; [ brianmay ];
   };
 }

pkgs/by-name/re/remind/package.nix

@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "05.03.02";
+  version = "05.03.04";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-lVFa7STvkNVX9D+f5E7H7ArVxThzdWAh7h3Q4b8bIC4=";
+    hash = "sha256-6pUQONmafwfUZ3DAsYS6dju8mLE9piu7btPmP6QX4pM=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [

pkgs/by-name/sk/skyscraper/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  qt5,
+  p7zip,
+  python3,
+  installShellFiles,
+
+  # Whether to compile with XDG support
+  # (See: https://gemba.github.io/skyscraper/XDG/)
+  enableXdg ? false,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "skyscraper";
+  version = "3.14.0";
+
+  src = fetchFromGitHub {
+    owner = "Gemba";
+    repo = "skyscraper";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-UgPo9qEsYYYl2RgdPtPmToAruPKuvJ3FSgVrXa94kdA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    qt5.wrapQtAppsHook
+    qt5.qmake
+    installShellFiles
+  ];
+
+  buildInputs = [ python3 ];
+
+  postPatch = lib.optionalString enableXdg ''
+    substituteInPlace skyscraper.pro --replace-fail "#DEFINES+=XDG" "DEFINES+=XDG"
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd Skyscraper \
+      --bash supplementary/bash-completion/Skyscraper.bash
+  '';
+
+  preFixup = ''
+    qtWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ p7zip ]})
+    chmod +x $out/bin/*.py
+  '';
+
+  env.PREFIX = placeholder "out";
+
+  meta = {
+    description = "Powerful and versatile game data scraper written in Qt and C++";
+    homepage = "https://gemba.github.io/skyscraper/";
+    downloadPage = "https://github.com/Gemba/skyscraper/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ashgoldofficial ];
+    mainProgram = "Skyscraper";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/to/topicctl/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "topicctl";
-  version = "1.19.1";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "topicctl";
     rev = "v${version}";
-    sha256 = "sha256-3sYi2/c5twM10Q70/73Pd58qkAl5m8KqghG7oV+p2t8=";
+    sha256 = "sha256-sYt/t16OVJiWFVqSdLNog/mj1gj/TeY0r7z/gMZspls=";
   };
 
   vendorHash = "sha256-vPeqStOjoJPYKpdkHQNTBJFKc8NBjTH4A/W9B+HAy1I=";

pkgs/by-name/to/torzu/package.nix

@@ -83,12 +83,12 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "torzu";
-  version = "unstable-2024-12-15";
+  version = "unstable-2025-02-22";
 
   src = fetchgit {
-    url = "https://notabug.org/litucks/torzu";
-    rev = "02cfee3f184e6fdcc3b483ef399fb5d2bb1e8ec7";
-    hash = "sha256-hAWMFzTNJGFcrXov5LKMdW9YWhsu7wueATmiuS7EVkI=";
+    url = "https://git.ynh.ovh/liberodark/torzu.git";
+    rev = "eaa9c9e3a46eb5099193b11d620ddfe96b6aec83";
+    hash = "sha256-KxLRXM8Y+sIW5L9oYMSeK95HRb30zGRRSfil9DO+utU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/tp/tparted/package.nix

@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  makeWrapper,
+  parted,
+  util-linux,
+  dosfstools,
+  exfatprogs,
+  e2fsprogs,
+  ntfs3g,
+  btrfs-progs,
+  xfsprogs,
+  jfsutils,
+  f2fs-tools,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tparted";
+  version = "2025-01-24";
+
+  src = fetchurl {
+    url = "https://github.com/Kagamma/tparted/releases/download/${finalAttrs.version}/linux_x86-64_tparted_${finalAttrs.version}.tar.gz";
+    hash = "sha256-7V3bdsP4uqZ5zyw3j/s8fhMYFCyQ1Rz5Z1JiPFc1oFY=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/tparted \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          parted
+          util-linux
+          dosfstools
+          exfatprogs
+          e2fsprogs
+          ntfs3g
+          btrfs-progs
+          xfsprogs
+          jfsutils
+          f2fs-tools
+        ]
+      }
+  '';
+
+  runtimeDependencies = [
+    parted
+    util-linux
+    dosfstools
+    exfatprogs
+    e2fsprogs
+    ntfs3g
+    btrfs-progs
+    xfsprogs
+    jfsutils
+    f2fs-tools
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    tar xf $src
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp tparted $out/bin/
+    mkdir -p $out/opt/tparted
+    cp -r locale $out/opt/tparted/
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Text-based user interface (TUI) frontend for parted";
+    homepage = "https://github.com/Kagamma/tparted";
+    changelog = "https://github.com/Kagamma/tparted/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ liberodark ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    mainProgram = "tparted";
+  };
+})

pkgs/by-name/ve/versitygw/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-IG+Jg9+SVaj4Nlv7mfwjpAf1tsXMMEaVgq7w7fpIMcc=";
+    hash = "sha256-K0w9BoKqwVsEoxCuRvmKtuHYyCzZhVt/OZQ3vElHPdE=";
   };
 
-  vendorHash = "sha256-ZRu5519FRgdDFcKm+Ada0/KFNvPrZ+5hODPp7lUeyuI=";
+  vendorHash = "sha256-xFj4IGCCDhgIbBA1qIm9J06BUNYJiQQZYPSe6Uthm6w=";
 
   doCheck = false; # Require access to online S3 services
 

pkgs/common-updater/combinators.nix

@@ -169,18 +169,21 @@ rec {
 
     assert lib.assertMsg (lib.all validateFeatures scripts)
       "Combining update scripts with features enabled (other than “silent” scripts and an optional single script with “commit”) is currently unsupported.";
+
     assert lib.assertMsg (
       builtins.length (
         lib.unique (
-          builtins.map (
-            {
-              attrPath ? null,
-              ...
-            }:
-            attrPath
-          ) scripts
+          builtins.filter (attrPath: attrPath != null) (
+            builtins.map (
+              {
+                attrPath ? null,
+                ...
+              }:
+              attrPath
+            ) scripts
+          )
         )
-      ) == 1
+      ) <= 1
     ) "Combining update scripts with different attr paths is currently unsupported.";
 
     {

pkgs/desktops/gnome/update.nix

@@ -108,4 +108,5 @@ in
   supportedFeatures = [
     "commit"
   ];
+  inherit attrPath;
 }

pkgs/development/compilers/kotlin/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kotlin";
-  version = "2.1.0";
+  version = "2.1.10";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${finalAttrs.version}/kotlin-compiler-${finalAttrs.version}.zip";
-    sha256 = "sha256-tmmNVyitj57c3QFhfWOAcxkdigMTnMU4o5G043Wa0pc=";
+    sha256 = "sha256-xuniY2iJgo4ZyIEdWriQhiU4yJ3CoxAZVt/uPCqLprE=";
   };
 
   propagatedBuildInputs = [ jre ] ;

pkgs/development/compilers/llvm/default.nix

@@ -32,9 +32,9 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.0-rc3".officialRelease.sha256 = "sha256-mLSBoyq24FD+khynC6sC5IkDFqizgAn07lR9+ZRXlV0=";
     "21.0.0-git".gitRelease = {
-      rev = "71f4c7dabec0f32b2d475e8e08f0da99628a067c";
-      rev-version = "21.0.0-unstable-2025-03-02";
-      sha256 = "sha256-RNqQMVs0syNEXPNW6qOlvXGXYhZnN4s91Wc5vGcSuZM=";
+      rev = "58fc4b13cb5ff7e877c52c11f71328ed12e6a89c";
+      rev-version = "21.0.0-unstable-2025-03-09";
+      sha256 = "sha256-ioZubgLW+GpnA3DPe01YDxELnIJhXDGskCUAKZlDvUo=";
     };
   } // llvmVersions;
 

pkgs/development/embedded/tytools/default.nix

@@ -5,58 +5,34 @@
   cmake,
   pkg-config,
   wrapQtAppsHook,
-  qt6,
+  qtbase,
 }:
 
 stdenv.mkDerivation rec {
   pname = "tytools";
-  version = "0.9.9";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "Koromix";
-    repo = "rygel";
-    tag = "tytools/${version}";
-    hash = "sha256-nQZaNYOTkx79UC0RHencKIQFSYUnQ9resdmmWTmgQxA=";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-MKhh0ooDZI1Ks8vVuPRiHhpOqStetGaAhE2ulvBstxA=";
   };
 
   nativeBuildInputs = [
+    cmake
     pkg-config
-    qt6.wrapQtAppsHook
+    wrapQtAppsHook
   ];
-
   buildInputs = [
-    qt6.qtbase
+    qtbase
   ];
 
-  buildPhase = ''
-    runHook preBuild
-
-    ./bootstrap.sh
-    ./felix -p Fast tyuploader
-    ./felix -p Fast tycmd
-    ./felix -p Fast tycommander
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/applications
-    cp bin/Fast/tyuploader $out/bin/
-    cp bin/Fast/tycmd $out/bin/
-    cp bin/Fast/tycommander $out/bin/
-    cp src/tytools/tycommander/tycommander_linux.desktop $out/share/applications/tycommander.desktop
-    cp src/tytools/tyuploader/tyuploader_linux.desktop $out/share/applications/tyuploader.desktop
-
-    runHook postInstall
-  '';
-
-  meta = {
+  meta = with lib; {
     description = "Collection of tools to manage Teensy boards";
     homepage = "https://koromix.dev/tytools";
-    license = lib.licenses.unlicense;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ahuzik ];
+    license = licenses.unlicense;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ahuzik ];
   };
 }

pkgs/development/interpreters/racket/manifest.json

@@ -1,11 +1,11 @@
 {
-  "version": "8.15",
+  "version": "8.16",
   "full": {
-    "filename": "racket-8.15-src.tgz",
-    "sha256": "602b848459daf1b2222a46a9094e85ae2d28e480067219957fa46af8400e1233"
+    "filename": "racket-8.16-src.tgz",
+    "sha256": "b233a968f4a561f7b005ce06f2c4c29428562f308c1a04d28e2e2286f6b945c3"
   },
   "minimal": {
-    "filename": "racket-minimal-8.15-src.tgz",
-    "sha256": "1ac132c56bc52312049fa4f0849237f66713e8e0a7ab6c4780504633ee8f1dc3"
+    "filename": "racket-minimal-8.16-src.tgz",
+    "sha256": "4e727db75574ab11d6bec7af5e5d72a084fa7f662e200c35d5bc200772f5ce96"
   }
 }

pkgs/development/interpreters/racket/minimal.nix

@@ -19,7 +19,7 @@
 let
   manifest = lib.importJSON ./manifest.json;
 
-  inherit (stdenv.hostPlatform) isDarwin isStatic;
+  inherit (stdenv.hostPlatform) isDarwin;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -69,13 +69,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags =
     [
-      "--enable-check"
+      # > docs failure: ftype-ref: ftype mismatch for #<ftype-pointer>
+      # "--enable-check"
       "--enable-csonly"
       "--enable-liblz4"
       "--enable-libz"
     ]
     ++ lib.optional disableDocs "--disable-docs"
-    ++ lib.optionals (!isStatic) [
+    ++ lib.optionals (!(finalAttrs.dontDisableStatic or false)) [
       # instead of `--disable-static` that `stdenv` assumes
       "--disable-libs"
       # "not currently supported" in `configure --help-cs` but still emphasized in README
@@ -87,6 +88,9 @@ stdenv.mkDerivation (finalAttrs: {
       "--enable-xonx"
     ];
 
+  # The upstream script builds static libraries by default.
+  dontAddStaticConfigureFlags = true;
+
   dontStrip = isDarwin;
 
   postFixup =

pkgs/development/python-modules/cliff/default.nix

@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "cliff";
-  version = "4.8.0";
+  version = "4.9.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-I+/1AuYDzwqoQerqZmKkLNMGQWkWKz5ZayAiZADjTf0=";
+    hash = "sha256-WzkhmCk8C5Il1Fm+i6cQz4JI8e4zAGves9kvsAElkrQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/cliff/tests.nix

@@ -1,7 +1,7 @@
 {
   buildPythonPackage,
   cliff,
-  docutils,
+  sphinx,
   stestr,
   testscenarios,
 }:
@@ -22,7 +22,7 @@ buildPythonPackage {
 
   nativeCheckInputs = [
     cliff
-    docutils
+    sphinx
     stestr
     testscenarios
   ];

pkgs/development/python-modules/django/5.nix

@@ -72,6 +72,12 @@ buildPythonPackage rec {
         url = "https://github.com/django/django/commit/12f4f95405c7857cbf2f4bf4d0261154aac31676.patch";
         hash = "sha256-+K20/V8sh036Ox9U7CSPgfxue7f28Sdhr3MsB7erVOk=";
       })
+
+      # fix regression which breaks django-import-export
+      # https://github.com/django-import-export/django-import-export/pull/2045
+      # https://github.com/django/django/pull/19233
+      # manual backport because commit doesn't apply on stable cleanly
+      ./Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff
     ]
     ++ lib.optionals withGdal [
       (replaceVars ./django_5_set_geos_gdal_lib.patch {

pkgs/development/python-modules/django/Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff

@@ -0,0 +1,15 @@
+diff --git a/django/contrib/admin/models.py b/django/contrib/admin/models.py
+index 345b8cf341..2ed78d775b 100644
+--- a/django/contrib/admin/models.py
++++ b/django/contrib/admin/models.py
+@@ -51,7 +51,9 @@ def log_action(
+             change_message=change_message,
+         )
+ 
+-    def log_actions(self, user_id, queryset, action_flag, change_message=""):
++    def log_actions(
++        self, user_id, queryset, action_flag, change_message="", *, single_object=False
++    ):
+         # RemovedInDjango60Warning.
+         if type(self).log_action != LogEntryManager.log_action:
+             warnings.warn(

pkgs/development/python-modules/enlighten/default.nix

@@ -1,53 +1,48 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchPypi,
+  pythonOlder,
+
+  # dependencies
   blessed,
   prefixed,
+
+  # tests
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "enlighten";
-  version = "1.13.0";
+  version = "1.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7nGNqsaHPIP9Nwa8532kcsd2pR4Nb1+G9+YeJ/mtFmo=";
+    hash = "sha256-hcNUEqmk84hrMzfUH4E0Qfq5ow2fW18MAVvQeKRBFHM=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = [
     blessed
     prefixed
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "enlighten" ];
 
-  disabledTests =
-    [
-      # AssertionError: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'> is not...
-      "test_init"
-      # AssertionError: Invalid format specifier (deprecated since prefixed 0.4.0)
-      "test_floats_prefixed"
-      "test_subcounter_prefixed"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # https://github.com/Rockhopper-Technologies/enlighten/issues/44
-      "test_autorefresh"
-    ];
-
-  meta = with lib; {
+  meta = {
     description = "Enlighten Progress Bar for Python Console Apps";
     homepage = "https://github.com/Rockhopper-Technologies/enlighten";
     changelog = "https://github.com/Rockhopper-Technologies/enlighten/releases/tag/${version}";
-    license = with licenses; [ mpl20 ];
-    maintainers = with maintainers; [ veprbl ];
+    license = with lib.licenses; [ mpl20 ];
+    maintainers = with lib.maintainers; [
+      veprbl
+      doronbehar
+    ];
   };
 }

pkgs/development/python-modules/jsonschema-rs/default.nix

@@ -0,0 +1,51 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  hypothesis,
+  lib,
+  pytestCheckHook,
+  pythonOlder,
+  rustPlatform,
+}:
+
+buildPythonPackage rec {
+  pname = "jsonschema-rs";
+  version = "0.29.1";
+
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  # Fetching from Pypi, because there is no Cargo.lock in the GitHub repo.
+  src = fetchPypi {
+    inherit version;
+    pname = "jsonschema_rs";
+    hash = "sha256-qfiWqeRRdjA3TxdTZHBYNsIvCdW9W7sG7AYRMytnAv0=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-kVi4EFig0ZGnOSVjzfJuGeR7BiEngP1Jhj6NvbhMVy4=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "jsonschema_rs" ];
+
+  meta = {
+    description = "High-performance JSON Schema validator for Python";
+    homepage = "https://github.com/Stranger6667/jsonschema/tree/master/crates/jsonschema-py";
+    changelog = "https://github.com/Stranger6667/jsonschema/blob/python-v${version}/crates/jsonschema-py/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = lib.teams.apm.members;
+  };
+}

pkgs/development/python-modules/minify-html/default.nix

@@ -0,0 +1,41 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  rustPlatform,
+}:
+
+buildPythonPackage rec {
+  pname = "minify-html";
+  version = "0.15.0";
+
+  pyproject = true;
+
+  # Fetching from Pypi, because there is no Cargo.lock in the GitHub repo.
+  src = fetchPypi {
+    inherit version;
+    pname = "minify_html";
+    hash = "sha256-z0w2tvmvOwkBvSoKKds7CcDN8MONPd4o5oNbzg9gXTc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-f93gKKQRkjxQJ49EK/0UI+BzFEa6iSfDX/0gNysSDmc=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "minify_html" ];
+
+  meta = {
+    description = "Extremely fast and smart HTML + JS + CSS minifier";
+    homepage = "https://github.com/wilsonzlin/minify-html/tree/master/minify-html-python";
+    changelog = "https://github.com/wilsonzlin/minify-html/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = lib.teams.apm.members;
+  };
+}

pkgs/development/python-modules/mwxml/default.nix

@@ -3,21 +3,27 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   jsonschema,
   mwcli,
   mwtypes,
+
+  # tests
   pytestCheckHook,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "mwxml";
-  version = "0.3.5";
+  version = "0.3.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K/5c6BfX2Jo/jcKhCa3hCQ8PtWzqSFZ8xFqe1R/CSEs=";
+    hash = "sha256-WlMYHTAhUq0D7FE/8Yaongx+H8xQx4MwRSoIcsqmOTU=";
   };
 
   build-system = [ setuptools ];
@@ -28,10 +34,10 @@ buildPythonPackage rec {
     mwtypes
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
   pythonImportsCheck = [ "mwxml" ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # AttributeError: Can't get local object 'map.<locals>.process_path'
     "test_complex_error_handler"

pkgs/development/python-modules/pykeepass/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pykeepass";
-  version = "4.1.0.post1";
+  version = "4.1.1.post1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "libkeepass";
     repo = "pykeepass";
     tag = "v${version}";
-    hash = "sha256-64is/XoRF/kojqd4jQIAQi1od8TRhiv9uR+WNIGvP2A=";
+    hash = "sha256-DeEz3zrUK3cXIvMK/32Zn3FPiNsenhpAb17Zgel826s=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pylance/default.nix

@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "pylance";
-  version = "0.24.0";
+  version = "0.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance";
     tag = "v${version}";
-    hash = "sha256-tzz+Zww6/owkcFhHBt8+2cvouCeqdspuv6Gy7HpZTP0=";
+    hash = "sha256-tfpHW36ESCXffoRI3QbeoKArycIMnddtk5fUXO5p9us=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -50,7 +50,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-7GN4iAQMvqZkK5kjBMrNa8Q6fETW0HDZklSQGye+Huc=";
+    hash = "sha256-5NoIuev3NoXfgifm7ALDRfNNQc6uTflBcBfAnRQ481E=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/shapely/default.nix

@@ -2,8 +2,7 @@
   lib,
   stdenv,
   buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   pytestCheckHook,
   pythonOlder,
 
@@ -17,24 +16,17 @@
 
 buildPythonPackage rec {
   pname = "shapely";
-  version = "2.0.6";
+  version = "2.0.7";
   pyproject = true;
-
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-mX9hWbFIQFnsI5ysqlNGf9i1Vk2r4YbNhKwpRGY7C/Y=";
+  src = fetchFromGitHub {
+    owner = "shapely";
+    repo = "shapely";
+    tag = version;
+    hash = "sha256-oq08nDeCdS6ARISai/hKM74v+ezSxO2PpSzas/ZFVaw=";
   };
 
-  patches = [
-    # fixes build error with GCC 14
-    (fetchpatch {
-      url = "https://github.com/shapely/shapely/commit/05455886750680728dc751dc5888cd02086d908e.patch";
-      hash = "sha256-YnmiWFfjHHFZCxrmabBINM4phqfLQ+6xEc30EoV5d98=";
-    })
-  ];
-
   nativeBuildInputs = [
     cython
     geos # for geos-config
@@ -45,7 +37,7 @@ buildPythonPackage rec {
 
   buildInputs = [ geos ];
 
-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -68,11 +60,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "shapely" ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/shapely/shapely/blob/${version}/CHANGES.txt";
     description = "Manipulation and analysis of geometric objects";
     homepage = "https://github.com/shapely/shapely";
-    license = licenses.bsd3;
-    maintainers = teams.geospatial.members;
+    license = lib.licenses.bsd3;
+    maintainers = lib.teams.geospatial.members;
   };
 }

pkgs/development/python-modules/streamlit/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "streamlit";
-  version = "1.41.1";
+  version = "1.42.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZibTKwmLoUWLce691jTGKvLdh2OA5ZxLah6CijnWLWk=";
+    hash = "sha256-YgJtvctIJ5CTP2WLCW191Y+nDaicHwb7w2WLkdzU2rI=";
   };
 
   build-system = [

pkgs/development/python-modules/tiptapy/default.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  jinja2,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "tiptapy";
+  # github repository does not have version tags
+  version = "0.20.0-unstable-2024-06-14";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "stckme";
+    repo = "tiptapy";
+    rev = "f34ed358b1b3448721b791150f4f104347a416bf";
+    hash = "sha256-y43/901tznZ9N9A4wH3z8FW0mHzNrA8pC+0d1CxdqJM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [ jinja2 ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "tiptapy" ];
+
+  meta = {
+    description = "Library that generates HTML output from JSON export of tiptap editor";
+    homepage = "https://github.com/stckme/tiptapy";
+    changelog = "https://github.com/stckme/tiptapy/blob/master/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = lib.teams.apm.members;
+  };
+}

pkgs/development/python-modules/vallox-websocket-api/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "vallox-websocket-api";
-  version = "5.3.0";
+  version = "5.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "yozik04";
     repo = "vallox_websocket_api";
     tag = version;
-    hash = "sha256-jJ+FFDU4w1vdCqErz6ksJDvjFcalSAwaH+G77BNI5/E=";
+    hash = "sha256-L9duL8XfDUxHgJxVbG7PPPRJRzVEckxqbB+1vX0GalU=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "vallox_websocket_api" ];
 
   meta = {
-    changelog = "https://github.com/yozik04/vallox_websocket_api/releases/tag/${version}";
+    changelog = "https://github.com/yozik04/vallox_websocket_api/releases/tag/${src.tag}";
     description = "Async API for Vallox ventilation units";
     homepage = "https://github.com/yozik04/vallox_websocket_api";
     license = lib.licenses.lgpl3Only;

pkgs/development/python-modules/xml2rfc/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.25.0";
+  version = "3.28.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "ietf-tools";
     repo = "xml2rfc";
     tag = "v${version}";
-    hash = "sha256-hBQ90OtqRWVgr9EHf2EWm1KSy7di1PcrOJ7O+5bLK6I=";
+    hash = "sha256-pWJ2nzRMnukcsuhzwsp1uZ3kFakfqrPn8/qooxGeM74=";
   };
 
   postPatch = ''
@@ -81,7 +81,7 @@ buildPythonPackage rec {
     description = "Tool generating IETF RFCs and drafts from XML sources";
     mainProgram = "xml2rfc";
     homepage = "https://github.com/ietf-tools/xml2rfc";
-    changelog = "https://github.com/ietf-tools/xml2rfc/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/ietf-tools/xml2rfc/blob/${src.tag}/CHANGELOG.md";
     # Well, parts might be considered unfree, if being strict; see:
     # http://metadata.ftp-master.debian.org/changelogs/non-free/x/xml2rfc/xml2rfc_2.9.6-1_copyright
     license = licenses.bsd3;

pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon/default.nix

@@ -5,13 +5,13 @@
 
 callPackage ../generic.nix rec {
   pname = "experienced-pixel-dungeon";
-  version = "2.18.2";
+  version = "2.19";
 
   src = fetchFromGitHub {
     owner = "TrashboxBobylev";
     repo = "Experienced-Pixel-Dungeon-Redone";
-    rev = "ExpPD-${version}";
-    hash = "sha256-REBltg7rKgrNSKHh3QuG8XVLPivS1fAtyqf/TRjH0W0=";
+    tag = "ExpPD-${version}";
+    hash = "sha256-O3FEHIOGe1sO8L4eDUF3NGXhB9LviLT8M6mGqpe42B4=";
   };
 
   desktopName = "Experienced Pixel Dungeon";

pkgs/servers/http/nginx/generic.nix

@@ -314,6 +314,7 @@ stdenv.mkDerivation {
         mainProgram = "nginx";
         homepage = "http://nginx.org";
         license = [ licenses.bsd2 ] ++ concatMap (m: m.meta.license) modules;
+        broken = lib.any (m: m.meta.broken or false) modules;
         platforms = platforms.all;
         maintainers =
           with maintainers;

pkgs/servers/http/nginx/modules.nix

@@ -4,6 +4,7 @@
 , fetchFromGitLab
 , fetchhg
 , runCommand
+, stdenv
 
 , arpa2common
 , brotli
@@ -1020,6 +1021,25 @@ let self = {
     };
   };
 
+  zip = {
+    name = "zip";
+    src = fetchFromGitHub {
+      name = "zip";
+      owner = "evanmiller";
+      repo = "mod_zip";
+      rev = "8e65b82c82c7890f67a6107271c127e9881b6313";
+      hash = "sha256-2bUyGsLSaomzaijnAcHQV9TNSuV7Z3G9EUbrZzLG+mk=";
+    };
+
+    meta = with lib; {
+      description = "Streaming ZIP archiver for nginx";
+      homepage = "https://github.com/evanmiller/mod_zip";
+      license = with licenses; [ bsd3 ];
+      broken = stdenv.hostPlatform.isDarwin;
+      maintainers = teams.apm.members;
+    };
+  };
+
   zstd = {
     name = "zstd";
     src = fetchFromGitHub {

pkgs/servers/mail/dovecot/2.3.x-module_dir.patch

@@ -1,165 +0,0 @@
-diff -ru dovecot-2.3.9.2.orig/src/auth/main.c dovecot-2.3.9.2/src/auth/main.c
---- dovecot-2.3.9.2.orig/src/auth/main.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/auth/main.c	2019-12-15 19:46:52.101597499 +0100
-@@ -191,7 +191,7 @@
- 	mod_set.debug = global_auth_settings->debug;
- 	mod_set.filter_callback = auth_module_filter;
- 
--	modules = module_dir_load(AUTH_MODULE_DIR, NULL, &mod_set);
-+	modules = module_dir_load("/etc/dovecot/modules/auth", NULL, &mod_set);
- 	module_dir_init(modules);
- 
- 	if (!worker)
-@@ -222,7 +222,7 @@
- 	mod_set.debug = global_auth_settings->debug;
- 	mod_set.ignore_missing = TRUE;
- 
--	modules = module_dir_load_missing(modules, AUTH_MODULE_DIR, names,
-+	modules = module_dir_load_missing(modules, "/etc/dovecot/modules/auth", names,
- 					  &mod_set);
- 	module_dir_init(modules);
- }
-diff -ru dovecot-2.3.9.2.orig/src/config/all-settings.c dovecot-2.3.9.2/src/config/all-settings.c
---- dovecot-2.3.9.2.orig/src/config/all-settings.c	2019-12-13 14:12:32.000000000 +0100
-+++ dovecot-2.3.9.2/src/config/all-settings.c	2019-12-15 19:49:42.764650074 +0100
-@@ -1080,7 +1080,7 @@
- 	.last_valid_gid = 0,
- 
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- 
- 	.mail_log_prefix = "%s(%u)<%{pid}><%{session}>: ",
- 
-@@ -3849,7 +3849,7 @@
- 	.login_log_format = "%$: %s",
- 	.login_access_sockets = "",
- 	.login_proxy_notify_path = "proxy-notify",
--	.login_plugin_dir = MODULEDIR"/login",
-+	.login_plugin_dir = "/etc/dovecot/modules""/login",
- 	.login_plugins = "",
- 	.login_proxy_max_disconnect_delay = 0,
- 	.director_username_hash = "%u",
-@@ -4058,7 +4058,7 @@
- 	.login_trusted_networks = "",
- 
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- };
- static const struct setting_parser_info *lmtp_setting_dependencies[] = {
- 	&lda_setting_parser_info,
-@@ -4823,7 +4823,7 @@
- 	.base_dir = PKG_RUNDIR,
- 	.libexec_dir = PKG_LIBEXECDIR,
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- 	.mail_temp_dir = "/tmp",
- 	.auth_debug = FALSE,
- 	.auth_socket_path = "auth-userdb",
-diff -ru dovecot-2.3.9.2.orig/src/config/config-parser.c dovecot-2.3.9.2/src/config/config-parser.c
---- dovecot-2.3.9.2.orig/src/config/config-parser.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/config/config-parser.c	2019-12-15 19:46:52.102597505 +0100
-@@ -1077,7 +1077,7 @@
- 
- 	i_zero(&mod_set);
- 	mod_set.abi_version = DOVECOT_ABI_VERSION;
--	modules = module_dir_load(CONFIG_MODULE_DIR, NULL, &mod_set);
-+	modules = module_dir_load("/etc/dovecot/modules/settings", NULL, &mod_set);
- 	module_dir_init(modules);
- 
- 	i_array_init(&new_roots, 64);
-diff -ru dovecot-2.3.9.2.orig/src/dict/main.c dovecot-2.3.9.2/src/dict/main.c
---- dovecot-2.3.9.2.orig/src/dict/main.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/dict/main.c	2019-12-15 19:46:52.102597505 +0100
-@@ -104,7 +104,7 @@
- 	mod_set.abi_version = DOVECOT_ABI_VERSION;
- 	mod_set.require_init_funcs = TRUE;
- 
--	modules = module_dir_load(DICT_MODULE_DIR, NULL, &mod_set);
-+	modules = module_dir_load("/etc/dovecot/modules/dict", NULL, &mod_set);
- 	module_dir_init(modules);
- 
- 	/* Register only after loading modules. They may contain SQL drivers,
-diff -ru dovecot-2.3.9.2.orig/src/doveadm/doveadm-settings.c dovecot-2.3.9.2/src/doveadm/doveadm-settings.c
---- dovecot-2.3.9.2.orig/src/doveadm/doveadm-settings.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/doveadm/doveadm-settings.c	2019-12-15 19:47:29.525812499 +0100
-@@ -89,7 +89,7 @@
- 	.base_dir = PKG_RUNDIR,
- 	.libexec_dir = PKG_LIBEXECDIR,
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- 	.mail_temp_dir = "/tmp",
- 	.auth_debug = FALSE,
- 	.auth_socket_path = "auth-userdb",
-diff -ru dovecot-2.3.9.2.orig/src/doveadm/doveadm-util.c dovecot-2.3.9.2/src/doveadm/doveadm-util.c
---- dovecot-2.3.9.2.orig/src/doveadm/doveadm-util.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/doveadm/doveadm-util.c	2019-12-15 19:52:32.003844670 +0100
-@@ -33,7 +33,7 @@
- 	mod_set.debug = doveadm_debug;
- 	mod_set.ignore_dlopen_errors = TRUE;
- 
--	modules = module_dir_load_missing(modules, DOVEADM_MODULEDIR,
-+	modules = module_dir_load_missing(modules, "/etc/dovecot/modules/doveadm",
- 					  NULL, &mod_set);
- 	module_dir_init(modules);
- }
-@@ -58,7 +58,7 @@
- 			return FALSE;
- 	}
- 
--	dir = opendir(DOVEADM_MODULEDIR);
-+	dir = opendir("/etc/dovecot/modules/doveadm");
- 	if (dir == NULL)
- 		return FALSE;
- 
-diff -ru dovecot-2.3.9.2.orig/src/lib-fs/fs-api.c dovecot-2.3.9.2/src/lib-fs/fs-api.c
---- dovecot-2.3.9.2.orig/src/lib-fs/fs-api.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/lib-fs/fs-api.c	2019-12-15 19:46:52.102597505 +0100
-@@ -114,7 +114,7 @@
- 	mod_set.abi_version = DOVECOT_ABI_VERSION;
- 	mod_set.ignore_missing = TRUE;
- 
--	fs_modules = module_dir_load_missing(fs_modules, MODULE_DIR,
-+	fs_modules = module_dir_load_missing(fs_modules, "/etc/dovecot/modules",
- 					     module_name, &mod_set);
- 	module_dir_init(fs_modules);
- 
-diff -ru dovecot-2.3.9.2.orig/src/lib-ssl-iostream/iostream-ssl.c dovecot-2.3.9.2/src/lib-ssl-iostream/iostream-ssl.c
---- dovecot-2.3.9.2.orig/src/lib-ssl-iostream/iostream-ssl.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/lib-ssl-iostream/iostream-ssl.c	2019-12-15 19:46:52.102597505 +0100
-@@ -54,7 +54,7 @@
- 	mod_set.abi_version = DOVECOT_ABI_VERSION;
- 	mod_set.setting_name = "<built-in lib-ssl-iostream lookup>";
- 	mod_set.require_init_funcs = TRUE;
--	ssl_module = module_dir_load(MODULE_DIR, plugin_name, &mod_set);
-+	ssl_module = module_dir_load("/etc/dovecot/modules", plugin_name, &mod_set);
- 	if (module_dir_try_load_missing(&ssl_module, MODULE_DIR, plugin_name,
- 					&mod_set, error_r) < 0)
- 		return -1;
-diff -ru dovecot-2.3.9.2.orig/src/lib-storage/mail-storage-settings.c dovecot-2.3.9.2/src/lib-storage/mail-storage-settings.c
---- dovecot-2.3.9.2.orig/src/lib-storage/mail-storage-settings.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/lib-storage/mail-storage-settings.c	2019-12-15 19:46:52.102597505 +0100
-@@ -337,7 +337,7 @@
- 	.last_valid_gid = 0,
- 
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- 
- 	.mail_log_prefix = "%s(%u)<%{pid}><%{session}>: ",
- 
-diff -ru dovecot-2.3.9.2.orig/src/lmtp/lmtp-settings.c dovecot-2.3.9.2/src/lmtp/lmtp-settings.c
---- dovecot-2.3.9.2.orig/src/lmtp/lmtp-settings.c	2019-12-13 14:12:00.000000000 +0100
-+++ dovecot-2.3.9.2/src/lmtp/lmtp-settings.c	2019-12-15 19:46:52.102597505 +0100
-@@ -95,7 +95,7 @@
- 	.login_trusted_networks = "",
- 
- 	.mail_plugins = "",
--	.mail_plugin_dir = MODULEDIR,
-+	.mail_plugin_dir = "/etc/dovecot/modules",
- };
- 
- static const struct setting_parser_info *lmtp_setting_dependencies[] = {

pkgs/servers/mail/dovecot/default.nix

@@ -103,10 +103,8 @@ stdenv.mkDerivation rec {
 
   patches =
     [
-      # Make dovecot look for plugins in /etc/dovecot/modules
-      # so we can symlink plugins from several packages there.
-      # The symlinking needs to be done in NixOS.
-      ./2.3.x-module_dir.patch
+      # Fix loading extended modules.
+      ./load-extended-modules.patch
       # fix openssl 3.0 compatibility
       (fetchpatch {
         url = "https://salsa.debian.org/debian/dovecot/-/raw/debian/1%252.3.19.1+dfsg1-2/debian/patches/Support-openssl-3.0.patch";
@@ -125,6 +123,7 @@ stdenv.mkDerivation rec {
       "--localstatedir=/var"
       # We need this so utilities default to reading /etc/dovecot/dovecot.conf file.
       "--sysconfdir=/etc"
+      "--with-moduledir=${placeholder "out"}/lib/dovecot/modules"
       "--with-ldap"
       "--with-ssl=openssl"
       "--with-zlib"

pkgs/servers/mail/dovecot/load-extended-modules.patch

@@ -0,0 +1,12 @@
+diff --git a/src/config/config-parser.h b/src/config/config-parser.h
+index e0a0a5b..a7fd725 100644
+--- a/src/config/config-parser.h
++++ b/src/config/config-parser.h
+@@ -1,7 +1,7 @@
+ #ifndef CONFIG_PARSER_H
+ #define CONFIG_PARSER_H
+ 
+-#define CONFIG_MODULE_DIR MODULEDIR"/settings"
++#define CONFIG_MODULE_DIR "/run/current-system/sw/lib/dovecot/modules/settings"
+ 
+ #define IS_WHITE(c) ((c) == ' ' || (c) == '\t')

pkgs/servers/mir/default.nix

@@ -5,8 +5,8 @@ let
 in
 {
   mir = common {
-    version = "2.19.3";
-    hash = "sha256-WwT0cdLZJlVTTq8REuQrtYWdpRhqEDjYPHDy2oj8Edk=";
+    version = "2.20.0";
+    hash = "sha256-Dmo/aEATbbVoZd3fWIO0uHkwnAiATih33XS2MF/azoY=";
   };
 
   mir_2_15 = common {

pkgs/tools/misc/depotdownloader/default.nix

@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "depotdownloader";
-  version = "2.7.4";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "SteamRE";
     repo = "DepotDownloader";
     rev = "DepotDownloader_${version}";
-    hash = "sha256-XcUWNr3l1Bsl8SRYm8OS7t2JYppfKJVrVWyM5OILFDA=";
+    hash = "sha256-QfnSs8pmWq/+64XdJskYxmUDKbHCnhA6Xd8VrTUaeJE=";
   };
 
   projectFile = "DepotDownloader.sln";

pkgs/tools/misc/depotdownloader/deps.json

@@ -46,8 +46,8 @@
   },
   {
     "pname": "SteamKit2",
-    "version": "3.0.0",
-    "hash": "sha256-bRRdX8WFo9k+QCZWh0KHb3TULpJxpR4Hg9FDXKBW6d4="
+    "version": "3.0.1",
+    "hash": "sha256-OnfUEPSEE9J6oTO1NFsa1MJRWvEH5MDR1wsGedKGzgI="
   },
   {
     "pname": "System.Collections.Immutable",
@@ -56,8 +56,8 @@
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "8.0.0",
-    "hash": "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="
+    "version": "9.0.0",
+    "hash": "sha256-k6Pdndm5fTD6CB1QsQfP7G+2h4B30CWIsuvjHuBg3fc="
   },
   {
     "pname": "System.Security.AccessControl",

pkgs/top-level/all-packages.nix

@@ -7243,7 +7243,9 @@ with pkgs;
   wireplumber = callPackage ../development/libraries/pipewire/wireplumber.nix { };
 
   racket = callPackage ../development/interpreters/racket { };
-  racket-minimal = callPackage ../development/interpreters/racket/minimal.nix { };
+  racket-minimal = callPackage ../development/interpreters/racket/minimal.nix {
+    stdenv = stdenvAdapters.makeStaticLibraries stdenv;
+  };
 
   rakudo = callPackage ../development/interpreters/rakudo { };
   moarvm = darwin.apple_sdk_11_0.callPackage ../development/interpreters/rakudo/moarvm.nix {

pkgs/top-level/python-packages.nix

@@ -6917,6 +6917,8 @@ self: super: with self; {
 
   jsonschema-path = callPackage ../development/python-modules/jsonschema-path { };
 
+  jsonschema-rs = callPackage ../development/python-modules/jsonschema-rs { };
+
   jsonschema-spec = callPackage ../development/python-modules/jsonschema-spec { };
 
   jsonschema-specifications = callPackage ../development/python-modules/jsonschema-specifications { };
@@ -8413,6 +8415,8 @@ self: super: with self; {
 
   miniful = callPackage ../development/python-modules/miniful { };
 
+  minify-html = callPackage ../development/python-modules/minify-html { };
+
   minikanren = callPackage ../development/python-modules/minikanren { };
 
   minikerberos = callPackage ../development/python-modules/minikerberos { };
@@ -16656,6 +16660,8 @@ self: super: with self; {
 
   tinytuya = callPackage ../development/python-modules/tinytuya { };
 
+  tiptapy = callPackage ../development/python-modules/tiptapy { };
+
   titlecase = callPackage ../development/python-modules/titlecase { };
 
   tivars = callPackage ../development/python-modules/tivars { };