Merge master into staging-next

lib/tests/modules.sh

@@ -717,6 +717,10 @@ checkConfigError 'In module .*/options-type-error-configuration.nix: expected an
 # Check that that merging of option collisions doesn't depend on type being set
 checkConfigError 'The option .group..*would be a parent of the following options, but its type .<no description>. does not support nested options.\n\s*- option.s. with prefix .group.enable..*' config.group.enable ./merge-typeless-option.nix
 
+# types.optionDeclaration
+checkConfigOutput '^10$' config.anOption ./option.nix
+checkConfigError 'A definition for option .aBadOptionDef. is not of type .option declaration.' config.aBadOptionDef ./option.nix
+
 # Test that types.optionType merges types correctly
 checkConfigOutput '^10$' config.theOption.int ./optionTypeMerging.nix
 checkConfigOutput '^"hello"$' config.theOption.str ./optionTypeMerging.nix

lib/tests/modules/option.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  options,
+  ...
+}:
+{
+  options = {
+    theOption = lib.mkOption {
+      type = lib.types.optionDeclaration;
+    };
+    anOption = config.theOption;
+    aBadOptionDef = lib.mkOption {
+      type = lib.types.optionDeclaration;
+      description = ''
+        This option is perfectly fine, but will have a bad definition.
+      '';
+    };
+  };
+  config = {
+    theOption = lib.mkOption {
+      type = lib.types.int;
+    };
+    anOption = 10;
+    aBadOptionDef = options.theOption; # Not a declaration
+  };
+}

lib/types.nix

@@ -1180,6 +1180,13 @@ rec {
       };
     };
 
+  optionDeclaration = mkOptionType {
+    name = "optionDeclaration";
+    description = "option declaration";
+    descriptionClass = "noun";
+    check = opt: isType "option" opt && !(opt ? value);
+  };
+
   # The type of a type!
   optionType = mkOptionType {
     name = "optionType";

maintainers/maintainer-list.nix

@@ -19104,6 +19104,12 @@
     githubId = 349360;
     name = "Brandon Bennett";
   };
+  neo = {
+    github = "chojs23";
+    githubId = 55792153;
+    name = "neo";
+    email = "chojs990222@gmail.com";
+  };
   neosimsim = {
     email = "me@abn.sh";
     github = "neosimsim";

nixos/doc/manual/development/option-types.section.md

@@ -137,6 +137,22 @@ Users must still be careful about how they reference these paths.
     multiple option definitions are correctly merged together. The main use
     case is as the type of the `_module.freeformType` option.
 
+`types.optionDeclaration`
+
+:   The type of a module system option declaration, as created by `lib.mkOption`.
+    This allows an option to hold another option declaration as its value, which
+    can then be spliced into a module's `options` attrset. Note that this only
+    accepts option declarations, not evaluated options (i.e. options that have
+    been processed by `evalModules` and have a `value` field).
+
+    ::: {.warning}
+    Use of this type is a form of metaprogramming that makes modules harder
+    to reason about, since options and their types become dynamic values
+    rather than statically declared structure. Prefer conventional module
+    patterns where possible, and only reach for `types.optionDeclaration` when the
+    added complexity is justified.
+    :::
+
 `types.attrs`
 
 :   A free-form attribute set.

nixos/modules/programs/nix-required-mounts.nix

@@ -43,6 +43,11 @@ let
           the `paths` contain symlinks. This may not work correctly with glob
           patterns.
         '';
+        options.safePrefixes = lib.mkOption {
+          default = [ builtins.storeDir ];
+          type = listOf path;
+          description = "A list of path prefixes that do not need and shall not be searched recursively for further symlink targets. Everything in the nix store does not need to be searched as the derivation already calculcated the full closure of all nix store paths for the drivers package.";
+        };
       }
     );
 

nixos/modules/services/misc/recyclarr.nix

@@ -10,7 +10,7 @@ let
   cfg = config.services.recyclarr;
   format = pkgs.formats.yaml { };
   stateDir = "/var/lib/recyclarr";
-  configPath = "${stateDir}/config.json";
+  configPath = "${stateDir}/config.yml";
   secretsReplacement = utils.genJqSecretsReplacement {
     loadCredential = true;
   } cfg.configuration configPath;
@@ -25,24 +25,24 @@ in
       type = format.type;
       default = { };
       example = {
-        sonarr = [
-          {
+        sonarr = {
+          sonarr-main = {
             instance_name = "main";
             base_url = "http://localhost:8989";
             api_key = {
               _secret = "/run/credentials/recyclarr.service/sonarr-api_key";
             };
-          }
-        ];
-        radarr = [
-          {
+          };
+        };
+        radarr = {
+          radarr-main = {
             instance_name = "main";
             base_url = "http://localhost:7878";
             api_key = {
               _secret = "/run/credentials/recyclarr.service/radarr-api_key";
             };
-          }
-        ];
+          };
+        };
       };
       description = ''
         Recyclarr YAML configuration as a Nix attribute set.
@@ -98,7 +98,6 @@ in
     systemd.services.recyclarr = {
       description = "Recyclarr Service";
 
-      # YAML is a JSON super-set
       preStart = secretsReplacement.script;
 
       serviceConfig = {
@@ -106,7 +105,11 @@ in
         User = cfg.user;
         Group = cfg.group;
         StateDirectory = "recyclarr";
-        ExecStart = "${lib.getExe cfg.package} ${cfg.command} --app-data ${stateDir} --config ${configPath}";
+        Environment = [
+          "RECYCLARR_CONFIG_DIR=${stateDir}"
+          "RECYCLARR_DATA_DIR=${stateDir}"
+        ];
+        ExecStart = "${lib.getExe cfg.package} ${cfg.command} --config ${configPath}";
         LoadCredential = secretsReplacement.credentials;
 
         ProtectSystem = "strict";
@@ -151,4 +154,6 @@ in
       };
     };
   };
+
+  meta.maintainers = [ lib.maintainers.josephst ];
 }

nixos/tests/all-tests.nix

@@ -1477,6 +1477,7 @@ in
   smokeping = runTest ./smokeping.nix;
   snapcast = runTest ./snapcast.nix;
   snapper = runTest ./snapper.nix;
+  snid = runTest ./snid.nix;
   snipe-it = runTest ./web-apps/snipe-it.nix;
   snips-sh = runTest ./snips-sh.nix;
   snmpd = runTest ./snmpd.nix;

nixos/tests/snid.nix

@@ -0,0 +1,31 @@
+{ lib, ... }:
+{
+  _class = "nixosTest";
+  name = "snid";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        system.services.snid = {
+          imports = [ pkgs.snid.services.default ];
+          snid = {
+            listen = [ "tcp:8443" ];
+            mode = "tcp";
+            backendCidrs = [ "127.0.0.0/8" ];
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8443 ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("snid.service")
+    machine.wait_for_open_port(8443)
+  '';
+
+  meta.maintainers = with lib.maintainers; [ tomfitzhenry ];
+}

pkgs/by-name/be/beans/package.nix

@@ -2,6 +2,8 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  installShellFiles,
+  stdenv,
   versionCheckHook,
 }:
 
@@ -18,6 +20,8 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-TprfPZ/clb7PLMAkxF0y78bCef4XarhgHlIhIPn1nQA=";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   ldflags = [
     "-s"
     "-X github.com/hmans/beans/cmd.version=${finalAttrs.version}"
@@ -25,6 +29,13 @@ buildGoModule (finalAttrs: {
     "-X github.com/hmans/beans/cmd.date=unknown"
   ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd beans \
+      --bash <($out/bin/beans completion bash) \
+      --fish <($out/bin/beans completion fish) \
+      --zsh <($out/bin/beans completion zsh)
+  '';
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "version";

pkgs/by-name/bt/btop/package.nix

@@ -41,8 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
   # fix build on darwin (see https://github.com/NixOS/nixpkgs/pull/422218#issuecomment-3039181870 and https://github.com/aristocratos/btop/pull/1173)
   cmakeFlags = [
     (lib.cmakeBool "BTOP_LTO" (!stdenv.hostPlatform.isDarwin))
+    (lib.cmakeBool "BTOP_STATIC" (stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BTOP_FORTIFY" (!stdenv.hostPlatform.isStatic))
   ];
 
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isStatic [ "fortify" ];
+
   postInstall = ''
     ${removeReferencesTo}/bin/remove-references-to -t ${stdenv.cc.cc} $(readlink -f $out/bin/btop)
   '';

pkgs/by-name/co/contact/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "contact";
-  version = "1.4.22";
+  version = "1.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdxlocations";
     repo = "contact";
     tag = finalAttrs.version;
-    hash = "sha256-Kf6q5CNS+kzs+5gkKAS40+5RnsQ4FAsh8OQaH5Ii17Y=";
+    hash = "sha256-nuhlxKE6o2kNMz5VRV0SIY4Hee5thBbV71Ex6mM1AXo=";
   };
 
   dependencies = [ python3Packages.meshtastic ];

pkgs/by-name/da/dapr-cli/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dapr-cli";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "dapr";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3nD6IVXUjLXpTz4OTNEEmsu7cDmMepLwguqI9nRQmxA=";
+    hash = "sha256-XsRMVuXkHRARQ2UhG317QH0Ub4SOG8mesa7PnesXpvc=";
   };
 
-  vendorHash = "sha256-o8lEcTTIASvhpRJveo0UciGhwSu+5z9+jQcII9+D5Z8=";
+  vendorHash = "sha256-WwYpoKyiNbeoXnOaRy94vSoG4Ya1a7DYNriZoZuBRF8=";
 
   proxyVendor = true;
 

pkgs/by-name/ec/ec/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ec";
-  version = "0.2.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "chojs23";
     repo = "ec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vpl9Gz/DVjdplx80oQsTbH2hTS/3Y7dKZw4x52V6wJU=";
+    hash = "sha256-tnOr0AVPwEm9gONa7gl3TzhPC5/1WEAbW7Ew5/mNn5U=";
   };
 
   vendorHash = "sha256-bV5y8zKculYULkFl9J95qebLOzdTT/LuYycqMmHKZ+g=";
@@ -53,9 +53,12 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Easy terminal-native 3-way git conflict resolver vim-like workflow";
     homepage = "https://github.com/chojs23/ec";
-    changelog = "https://github.com/chojs23/ec/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/chojs23/ec/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kpbaks ];
+    maintainers = with lib.maintainers; [
+      kpbaks
+      neo
+    ];
     mainProgram = "ec";
   };
 })

pkgs/by-name/gi/gitaly/git-data.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.52-aea8cc3a",
-  "rev": "aea8cc3a10c325a22a75e2d4f582db959d3854ae",
-  "hash": "sha256-YT5yPnuP4Rv7Q88lzFiPN29K5iGRys1FfHzw4jVmWVg="
+  "version": "2.53-c61120cf",
+  "rev": "c61120cf654250ac63bdcb5d5ee0bbb9caeae9cd",
+  "hash": "sha256-kTdpPQOuHNTXscgqbd/GOLPe8bEPiOeBlm5RppgMpUA="
 }

pkgs/by-name/gi/gitaly/package.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.9.3";
+  version = "18.10.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,10 +21,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-k8byGIGG1sDGTX27QV1N/q9tnae3DY9v47XTv0+Mf9Y=";
+      hash = "sha256-s9nDqhtNmLpUHRJ+jJvu9WikPbQLUwEum6TGV3PvG8Y=";
     };
 
-    vendorHash = "sha256-1lMOJLtwnu0drrGHuhCiZSNdpyBjLed4uV4B2NSJPJQ=";
+    vendorHash = "sha256-W7ZI8IOaW/88zWrVymDkRQqzk+aLgvdO+rPycK70Bb0=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"

pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix

@@ -11,17 +11,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.13.3";
+  version = "5.14.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0FLAqjbafYsmr21OwNJceikC5Qdr5BIAuHnl1x8oiXs=";
+    hash = "sha256-yYl2cSPY5hn1GSda5ioMD3rEectNMtYGstVpz73pi3Y=";
   };
 
-  vendorHash = "sha256-2RlRCkqxupOvmyBe/zQC3Lyp9x0KHnTa6UnxldK1YZQ=";
+  vendorHash = "sha256-yeVEQEXHGAkdkfcnjok8iOvVRxucObVAxhuACmyFDJw=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/gi/gitlab-pages/package.nix

@@ -6,17 +6,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.9.3";
+  version = "18.10.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UHQ0M/WTmjmfwFHJM8BJ5XPZs+x4A8uh4FNBp+3x0ew=";
+    hash = "sha256-B/6BJaH2xge9/3HrI0yMIMtw4TeC+/bNqLFmKbZ2Ubw=";
   };
 
-  vendorHash = "sha256-AZIv/CU01OAbn5faE4EkSuDCakYzDjRprB5ox5tIlck=";
+  vendorHash = "sha256-EaTYw8ydHMA3Rmr8YJvUxWBIkPhyKLc8zNUsJRTlMmE=";
   subPackages = [ "." ];
 
   ldflags = [

pkgs/by-name/gi/gitlab-shell/package.nix

@@ -8,14 +8,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-shell";
-  version = "14.45.6";
+  version = "14.47.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Z7Vw7d70+RAG60aXuYRFMFZHpX/eU0+2FUPoAsWe8dI=";
+    hash = "sha256-1FQH7Epa9mKxJMyN+NFDIir4shosmEbh6BHcXinuTyk=";
   };
 
   buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-pfKRPZl6xw93rNBDUNJihQQ+3ZnoOOUVJpHZw68pztQ=";
+  vendorHash = "sha256-KkIDo/jhBBMwa/T6VzCgeuy9kXIncJglMjab70wqYug=";
 
   subPackages = [
     "cmd/gitlab-shell"

pkgs/by-name/gi/gitlab/data.json

@@ -1,17 +1,17 @@
 {
-  "version": "18.9.3",
-  "repo_hash": "sha256-xApcwmDca3cK/nlDeS+DDh4MklmXxGnO/3+79WIC9Uk=",
-  "yarn_hash": "sha256-uXyUJS4+YIRB3pPezVbj5u1fytOo+/bNR18Kq6FAKSQ=",
+  "version": "18.10.1",
+  "repo_hash": "sha256-z4MRfgqGOBxAE4EzqhIKosMLOZXDuiH88wSxkwUpV5E=",
+  "yarn_hash": "sha256-tWpPN//SdgnRONVa1ykagVHCNs7TCboTnQLQ5Sx0DQs=",
   "frontend_islands_yarn_hash": "sha256-OkCoiyL9FFJcWcNUbeRSBGGSauYIm7l+yxNfA0CsNEQ=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.9.3-ee",
+  "rev": "v18.10.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.9.3",
-    "GITLAB_KAS_VERSION": "18.9.3",
-    "GITLAB_PAGES_VERSION": "18.9.3",
-    "GITLAB_SHELL_VERSION": "14.45.6",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.13.3",
-    "GITLAB_WORKHORSE_VERSION": "18.9.3"
+    "GITALY_SERVER_VERSION": "18.10.1",
+    "GITLAB_KAS_VERSION": "18.10.1",
+    "GITLAB_PAGES_VERSION": "18.10.1",
+    "GITLAB_SHELL_VERSION": "14.47.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.1",
+    "GITLAB_WORKHORSE_VERSION": "18.10.1"
   }
 }

pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix

@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.9.3";
+  version = "18.10.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/workhorse";
 
-  vendorHash = "sha256-F2iK+DcCYz2KDsFSGQzfHqOYKA8W/SMwlKQR+MS3Ahs=";
+  vendorHash = "sha256-dLM+xmpPK4RA0DnZkj8dXN9FdKiRLXXQCeVLI8SqZ3Y=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${finalAttrs.version}" ];
   doCheck = false;

pkgs/by-name/gi/gitlab/package.nix

@@ -108,7 +108,7 @@ let
         '';
       };
 
-      gitlab_query_language = attrs: {
+      gitlab_query_language = attrs: rec {
         cargoDeps = rustPlatform.fetchCargoVendor {
           src = stdenv.mkDerivation {
             inherit (buildRubyGem { inherit (attrs) gemName version source; })
@@ -119,13 +119,30 @@ let
               ;
             installPhase = ''
               mkdir -p $out
-              cp -R ext $out
-              cp Cargo.* $out
+              cp Cargo.lock $out
+              cp -R ext/gitlab_query_language/* $out
             '';
           };
-          hash = "sha256-XnNIcEoAs/cSIsd3BdEtTAPNbiyfdVmlO7tSIL/9d3w=";
+
+          # GitLab publishes a Cargo.lock for gitlab_query_lanaguage that does not contain the `source` attribute
+          # for the `glql` dependency. This is an intentional choice by them that is documented in the README.
+          # This code refetches this hash and exposes the lockfile, so that it can be used in later stages.
+          nativeBuildInputs = [ cargo ];
+          postPatch = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+            cargo fetch
+          '';
+          postBuild = ''
+            cp Cargo.lock $out
+          '';
+
+          hash = "sha256-YQEldpT1pCJe5hBJmLTVyvOjnilH10mGhgYfKDSOY3k=";
         };
 
+        postPatch = ''
+          cp ${cargoDeps}/Cargo.lock .
+        '';
+
         dontBuild = false;
 
         nativeBuildInputs = [

pkgs/by-name/gi/gitlab/rubyEnv/Gemfile

@@ -73,7 +73,7 @@ gem 'view_component', '~> 3.23.2', feature_category: :shared # rubocop:todo Gemf
 # Supported DBs
 gem 'pg', '~> 1.6.1', feature_category: :database
 
-gem 'rugged', '~> 1.6', feature_category: :gitaly
+gem 'rugged', '~> 1.9', feature_category: :gitaly
 
 gem 'faraday', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'faraday-retry', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -83,7 +83,7 @@ gem 'logger', '~> 1.7.0', feature_category: :shared # rubocop:todo Gemfile/Missi
 gem 'marginalia', '~> 1.11.1', feature_category: :database
 
 # Authorization
-gem 'declarative_policy', '~> 2.0.1', feature_category: :permissions
+gem 'declarative_policy', '~> 2.1.0', feature_category: :permissions
 
 # For source code paths mapping
 gem 'coverband', '6.1.7', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -246,9 +246,9 @@ gem 'seed-fu', '~> 2.3.7', feature_category: :shared # rubocop:todo Gemfile/Miss
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.226.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.242.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.193.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.213.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
@@ -290,7 +290,7 @@ gem 'rack', '~> 2.2.9', feature_category: :shared # rubocop:todo Gemfile/Missing
 gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 group :puma do
-  gem 'puma', '~> 7.1', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+  gem 'puma', '~> 7.2', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
   gem 'sd_notify', '~> 0.1.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 end
 
@@ -383,7 +383,7 @@ gem 'rack-proxy', '~> 0.7.7', feature_category: :shared # rubocop:todo Gemfile/M
 gem 'cssbundling-rails', '1.4.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'terser', '1.0.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
-gem 'click_house-client', '0.8.7', feature_category: :database
+gem 'click_house-client', '0.8.8', feature_category: :database
 gem 'addressable', '~> 2.8', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'gon', '~> 6.5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'request_store', '~> 1.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -406,7 +406,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c
 gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
-gem 'gitlab-labkit', '~> 1.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'gitlab-labkit', '~> 1.5.0', feature_category: :error_budgets
 gem 'thrift', '~> 0.22.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 # I18n
@@ -532,7 +532,7 @@ group :development, :test do
   gem 'benchmark-memory', '~> 0.1', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
   gem 'knapsack', '~> 4.0.0', feature_category: :tooling
-  gem 'gitlab-crystalball', '~> 1.1.0', require: false, feature_category: :tooling
+  gem 'gitlab-crystalball', '~> 1.1.3', require: false, feature_category: :tooling
   gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling
 
   gem 'simple_po_parser', '~> 1.1.6', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -573,7 +573,6 @@ group :development, :test, :monorepo do
 end
 
 group :test do
-  gem 'rspec-retry', '~> 0.6.2', feature_category: :tooling
   gem 'rspec_profiling', '~> 0.0.9', feature_category: :tooling
   gem 'rspec-benchmark', '~> 0.6.0', feature_category: :tooling
   gem 'rspec-parameterized', '~> 1.0', '>= 1.0.2', require: false, feature_category: :tooling
@@ -604,14 +603,14 @@ group :test do
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
-  gem 'gitlab_quality-test_tooling', '~> 3.7.1', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 3.9.0', require: false, feature_category: :tooling
 end
 
 gem 'octokit', '~> 9.0', feature_category: :importers
 # Needed by octokit: https://github.com/octokit/octokit.rb/pull/1688
 gem 'faraday-multipart', '~> 1.0', feature_category: :importers
 
-gem 'gitlab-mail_room', '~> 0.1.0', require: 'mail_room', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'gitlab-mail_room', '~> 1.0.0', require: 'mail_room', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 gem 'email_reply_trimmer', '~> 0.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'html2text', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -645,7 +644,10 @@ gem 'gitaly', '~> 18.8.0', feature_category: :gitaly
 # KAS GRPC protocol definitions
 gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
 
-gem 'grpc', '~> 1.76.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+# Knowledge Graph GRPC protocol definitions
+gem 'gitlab-gkg-proto', '~> 0.7.0', feature_category: :knowledge_graph
+
+gem 'grpc', '~> 1.78.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 gem 'google-protobuf', '>= 3.25', '< 5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
@@ -656,7 +658,7 @@ gem 'flipper', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/Miss
 gem 'flipper-active_record', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'flipper-active_support_cache_store', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'unleash', '~> 3.2.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'gitlab-experiment', '~> 1.2.0', feature_category: :acquisition
+gem 'gitlab-experiment', '~> 1.3.0', feature_category: :acquisition
 
 # Structured logging
 gem 'lograge', '~> 0.5', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -714,7 +716,7 @@ gem 'ed25519', '~> 1.4.0', feature_category: :shared # rubocop:todo Gemfile/Miss
 gem 'error_tracking_open_api', path: 'gems/error_tracking_open_api', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 # Vulnerability advisories
-gem 'cvss-suite', '~> 3.3.0', require: 'cvss_suite', feature_category: :software_composition_analysis
+gem 'cvss-suite', '~> 4.1.1', require: 'cvss_suite', feature_category: :software_composition_analysis
 
 # Work with RPM packages
 gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry
@@ -753,8 +755,8 @@ gem 'paper_trail', '~> 16.0', feature_category: :workspaces
 
 gem "i18n_data", "~> 0.13.1", feature_category: :system_access
 
-gem "gitlab-cloud-connector", "~> 1.44", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
+gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
 
 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
-gem 'gitlab_query_language', '~> 0.20.12', feature_category: :integrations
+gem 'gitlab_query_language', '~> 0.23.0', feature_category: :integrations

pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock

@@ -107,7 +107,7 @@ PATH
     gitlab-rspec (0.1.0)
       activerecord (>= 6.1, < 8)
       activesupport (>= 6.1, < 8)
-      gitlab_quality-test_tooling (>= 3.1, < 4)
+      gitlab_quality-test_tooling (>= 3.8, < 4)
       rspec (~> 3.0)
 
 PATH
@@ -315,7 +315,7 @@ GEM
       tins (~> 1.0)
     amazing_print (1.8.1)
     android_key_attestation (0.3.0)
-    apollo_upload_server (2.1.7)
+    apollo_upload_server (2.1.8)
       actionpack (>= 6.1.6)
       graphql (>= 1.8)
     app_store_connect (0.38.0)
@@ -349,18 +349,19 @@ GEM
     aws-sdk-cloudformation (1.134.0)
       aws-sdk-core (~> 3, >= 3.225.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-core (3.226.3)
+    aws-sdk-core (3.242.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
     aws-sdk-kms (1.76.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.193.0)
-      aws-sdk-core (~> 3, >= 3.225.0)
+    aws-sdk-s3 (1.213.0)
+      aws-sdk-core (~> 3, >= 3.241.4)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.9.1)
@@ -441,7 +442,7 @@ GEM
       cork
       nap
       open4 (~> 1.3)
-    click_house-client (0.8.7)
+    click_house-client (0.8.8)
       activerecord (>= 7.0, < 9.0)
       activesupport (>= 7.0, < 9.0)
       addressable (~> 2.8)
@@ -451,8 +452,8 @@ GEM
       descendants_tracker (~> 0.0.1)
     colored2 (3.1.2)
     commonmarker (0.23.12)
-    concurrent-ruby (1.3.5)
-    connection_pool (2.5.4)
+    concurrent-ruby (1.3.6)
+    connection_pool (2.5.5)
     console (1.29.2)
       fiber-annotation
       fiber-local (~> 1.1)
@@ -480,7 +481,8 @@ GEM
     cssbundling-rails (1.4.3)
       railties (>= 6.0.0)
     csv (3.3.0)
-    cvss-suite (3.3.0)
+    cvss-suite (4.1.2)
+      bigdecimal (~> 3.1)
     danger (9.4.2)
       claide (~> 1.0)
       claide-plugins (>= 0.9.2)
@@ -508,7 +510,7 @@ GEM
       reline (>= 0.3.8)
     debug_inspector (1.1.0)
     declarative (0.0.20)
-    declarative_policy (2.0.1)
+    declarative_policy (2.1.0)
     deprecation_toolkit (2.2.4)
       activesupport (>= 6.1)
     derailed_benchmarks (2.2.1)
@@ -687,7 +689,7 @@ GEM
       excon (~> 1.0)
       formatador (>= 0.2, < 2.0)
       mime-types
-    fog-google (1.29.3)
+    fog-google (1.29.4)
       addressable (>= 2.7.0)
       fog-core (~> 2.5)
       fog-json (~> 1.2)
@@ -741,24 +743,24 @@ GEM
     git (1.19.1)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (18.8.1)
+    gitaly (18.8.3)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.6)
       numerizer (~> 0.2)
-    gitlab-cloud-connector (1.44.0)
+    gitlab-cloud-connector (1.46.0)
       activesupport (>= 7.0)
       jwt (~> 2.9)
-    gitlab-crystalball (1.1.1)
+    gitlab-crystalball (1.1.3)
       git (< 4)
       ostruct (< 1)
     gitlab-dangerfiles (4.10.0)
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
       rake (~> 13.0)
-    gitlab-experiment (1.2.0)
+    gitlab-experiment (1.3.0)
       activesupport (>= 3.0)
       request_store (>= 1.0)
     gitlab-fog-azure-rm (2.4.0)
@@ -770,11 +772,13 @@ GEM
       mime-types
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
+    gitlab-gkg-proto (0.7.0)
+      grpc (~> 1.0)
     gitlab-glfm-markdown (0.0.41)
       rb_sys (~> 0.9.124)
     gitlab-kas-grpc (18.5.0.pre.rc4)
       grpc (~> 1.0)
-    gitlab-labkit (1.3.4)
+    gitlab-labkit (1.5.1)
       actionpack (>= 5.0.0, < 8.1.0)
       activesupport (>= 5.0.0, < 8.1.0)
       google-protobuf (>= 3.25, < 5.0)
@@ -782,12 +786,15 @@ GEM
       jaeger-client (~> 1.1.0)
       json_schemer (>= 2.3.0, < 3.0)
       openssl (~> 3.3.2)
+      opentelemetry-exporter-otlp (~> 0.31.1)
+      opentelemetry-instrumentation-all (~> 0.89.1)
+      opentelemetry-sdk (~> 1.10)
       opentracing (~> 0.4)
       pg_query (>= 6.1.0, < 7.0)
       prometheus-client-mmap (>= 1.2, < 2.0)
       redis (> 3.0.0, < 6.0.0)
     gitlab-license (2.6.0)
-    gitlab-mail_room (0.1.0)
+    gitlab-mail_room (1.0.0)
       jwt (>= 2.0)
       net-imap (>= 0.2.1)
       oauth2 (>= 1.4.4, < 3)
@@ -800,7 +807,7 @@ GEM
       activesupport (>= 5.2.0)
       rake (~> 13.0)
       snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.39.1)
+    gitlab-secret_detection (0.39.3)
       grpc (>= 1.63.0, < 2)
       grpc_reflection (~> 0.1)
       parallel (~> 1)
@@ -828,7 +835,7 @@ GEM
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (3.7.1)
+    gitlab_quality-test_tooling (3.9.0)
       activesupport (>= 7.0)
       amatch (~> 0.4.1)
       fog-google (~> 1.24, >= 1.24.1)
@@ -840,7 +847,7 @@ GEM
       rspec-parameterized (>= 1.0, < 3.0)
       table_print (= 1.5.7)
       zeitwerk (>= 2, < 3)
-    gitlab_query_language (0.20.12)
+    gitlab_query_language (0.23.0)
       rb_sys (~> 0.9.91)
     globalid (1.1.0)
       activesupport (>= 5.0)
@@ -949,7 +956,7 @@ GEM
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
       signet (>= 0.16, < 2.a)
-    gpgme (2.0.25)
+    gpgme (2.0.26)
       mini_portile2 (~> 2.7)
     grape (2.0.0)
       activesupport (>= 5)
@@ -990,7 +997,7 @@ GEM
       logger (~> 1.6)
       ostruct (~> 0.6)
       sass-embedded (~> 1.58)
-    grpc (1.76.0)
+    grpc (1.78.1)
       google-protobuf (>= 3.25, < 5.0)
       googleapis-common-protos-types (~> 1.0)
     grpc-google-iam-v1 (1.11.0)
@@ -1258,7 +1265,7 @@ GEM
     nio4r (2.7.0)
     nkf (0.2.0)
     no_proxy_fix (0.1.2)
-    nokogiri (1.19.0)
+    nokogiri (1.19.1)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
@@ -1326,7 +1333,7 @@ GEM
     omniauth-oauth2-generic (0.2.8)
       omniauth-oauth2 (~> 1.0)
       rake
-    omniauth-saml (2.2.4)
+    omniauth-saml (2.2.5)
       omniauth (~> 2.1)
       ruby-saml (~> 1.18)
     omniauth-shibboleth-redux (2.0.0)
@@ -1354,101 +1361,173 @@ GEM
     openssl (3.3.2)
     openssl-signature_algorithm (1.3.0)
       openssl (> 2.0)
-    opentelemetry-api (1.2.5)
+    opentelemetry-api (1.7.0)
     opentelemetry-common (0.21.0)
       opentelemetry-api (~> 1.0)
-    opentelemetry-exporter-otlp (0.29.1)
+    opentelemetry-exporter-otlp (0.31.1)
       google-protobuf (>= 3.18)
       googleapis-common-protos-types (~> 1.3)
       opentelemetry-api (~> 1.1)
       opentelemetry-common (~> 0.20)
-      opentelemetry-sdk (~> 1.2)
+      opentelemetry-sdk (~> 1.10)
       opentelemetry-semantic_conventions
-    opentelemetry-helpers-sql-obfuscation (0.1.0)
-      opentelemetry-common (~> 0.20)
-    opentelemetry-instrumentation-action_mailer (0.2.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-active_support (~> 0.1)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-action_pack (0.10.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-      opentelemetry-instrumentation-rack (~> 0.21)
-    opentelemetry-instrumentation-action_view (0.7.3)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-active_support (~> 0.6)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_job (0.7.8)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_record (0.8.1)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-active_support (0.6.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-aws_sdk (0.7.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-base (0.22.3)
+    opentelemetry-helpers-mysql (0.4.0)
+      opentelemetry-api (~> 1.7)
+      opentelemetry-common (~> 0.21)
+    opentelemetry-helpers-sql (0.3.0)
+      opentelemetry-api (~> 1.7)
+    opentelemetry-helpers-sql-processor (0.4.0)
       opentelemetry-api (~> 1.0)
+      opentelemetry-common (~> 0.21)
+    opentelemetry-instrumentation-action_mailer (0.6.1)
+      opentelemetry-instrumentation-active_support (~> 0.10)
+    opentelemetry-instrumentation-action_pack (0.15.1)
+      opentelemetry-instrumentation-rack (~> 0.29)
+    opentelemetry-instrumentation-action_view (0.11.2)
+      opentelemetry-instrumentation-active_support (~> 0.10)
+    opentelemetry-instrumentation-active_job (0.10.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-active_model_serializers (0.24.0)
+      opentelemetry-instrumentation-active_support (>= 0.7.0)
+    opentelemetry-instrumentation-active_record (0.11.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-active_storage (0.3.1)
+      opentelemetry-instrumentation-active_support (~> 0.10)
+    opentelemetry-instrumentation-active_support (0.10.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-all (0.89.1)
+      opentelemetry-instrumentation-active_model_serializers (~> 0.24.0)
+      opentelemetry-instrumentation-anthropic (~> 0.3.0)
+      opentelemetry-instrumentation-aws_lambda (~> 0.6.0)
+      opentelemetry-instrumentation-aws_sdk (~> 0.11.0)
+      opentelemetry-instrumentation-bunny (~> 0.24.0)
+      opentelemetry-instrumentation-concurrent_ruby (~> 0.24.0)
+      opentelemetry-instrumentation-dalli (~> 0.29.0)
+      opentelemetry-instrumentation-delayed_job (~> 0.25.1)
+      opentelemetry-instrumentation-ethon (~> 0.26.0)
+      opentelemetry-instrumentation-excon (~> 0.26.0)
+      opentelemetry-instrumentation-faraday (~> 0.30.0)
+      opentelemetry-instrumentation-grape (~> 0.5.0)
+      opentelemetry-instrumentation-graphql (~> 0.31.1)
+      opentelemetry-instrumentation-grpc (~> 0.4.1)
+      opentelemetry-instrumentation-gruf (~> 0.5.0)
+      opentelemetry-instrumentation-http (~> 0.27.0)
+      opentelemetry-instrumentation-http_client (~> 0.26.0)
+      opentelemetry-instrumentation-httpx (~> 0.5.0)
+      opentelemetry-instrumentation-koala (~> 0.23.0)
+      opentelemetry-instrumentation-lmdb (~> 0.25.0)
+      opentelemetry-instrumentation-mongo (~> 0.25.0)
+      opentelemetry-instrumentation-mysql2 (~> 0.32.1)
+      opentelemetry-instrumentation-net_http (~> 0.26.0)
+      opentelemetry-instrumentation-pg (~> 0.34.1)
+      opentelemetry-instrumentation-que (~> 0.12.0)
+      opentelemetry-instrumentation-racecar (~> 0.6.0)
+      opentelemetry-instrumentation-rack (~> 0.29.0)
+      opentelemetry-instrumentation-rails (~> 0.39.1)
+      opentelemetry-instrumentation-rake (~> 0.5.0)
+      opentelemetry-instrumentation-rdkafka (~> 0.9.0)
+      opentelemetry-instrumentation-redis (~> 0.28.0)
+      opentelemetry-instrumentation-resque (~> 0.8.0)
+      opentelemetry-instrumentation-restclient (~> 0.26.0)
+      opentelemetry-instrumentation-ruby_kafka (~> 0.24.0)
+      opentelemetry-instrumentation-sidekiq (~> 0.28.1)
+      opentelemetry-instrumentation-sinatra (~> 0.28.0)
+      opentelemetry-instrumentation-trilogy (~> 0.65.1)
+    opentelemetry-instrumentation-anthropic (0.3.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-aws_lambda (0.6.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-aws_sdk (0.11.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-base (0.25.0)
+      opentelemetry-api (~> 1.7)
+      opentelemetry-common (~> 0.21)
       opentelemetry-registry (~> 0.1)
-    opentelemetry-instrumentation-concurrent_ruby (0.21.4)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-ethon (0.21.9)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-excon (0.22.5)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-faraday (0.24.7)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-grape (0.2.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-      opentelemetry-instrumentation-rack (~> 0.21)
-    opentelemetry-instrumentation-graphql (0.28.4)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-http (0.23.5)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-http_client (0.22.8)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-net_http (0.22.8)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-pg (0.29.1)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-helpers-sql-obfuscation
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rack (0.25.0)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rails (0.33.1)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-action_mailer (~> 0.2.0)
-      opentelemetry-instrumentation-action_pack (~> 0.10.0)
-      opentelemetry-instrumentation-action_view (~> 0.7.0)
-      opentelemetry-instrumentation-active_job (~> 0.7.0)
-      opentelemetry-instrumentation-active_record (~> 0.8.0)
-      opentelemetry-instrumentation-active_support (~> 0.6.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rake (0.2.2)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-redis (0.25.7)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-sidekiq (0.25.7)
-      opentelemetry-api (~> 1.0)
-      opentelemetry-instrumentation-base (~> 0.22.1)
+    opentelemetry-instrumentation-bunny (0.24.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-concurrent_ruby (0.24.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-dalli (0.29.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-delayed_job (0.25.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-ethon (0.26.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-excon (0.26.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-faraday (0.30.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-grape (0.5.0)
+      opentelemetry-instrumentation-rack (~> 0.29)
+    opentelemetry-instrumentation-graphql (0.31.2)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-grpc (0.4.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-gruf (0.5.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-http (0.27.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-http_client (0.26.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-httpx (0.5.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-koala (0.23.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-lmdb (0.25.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-mongo (0.25.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-mysql2 (0.32.1)
+      opentelemetry-helpers-mysql
+      opentelemetry-helpers-sql
+      opentelemetry-helpers-sql-processor
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-net_http (0.26.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-pg (0.34.1)
+      opentelemetry-helpers-sql
+      opentelemetry-helpers-sql-processor
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-que (0.12.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-racecar (0.6.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-rack (0.29.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-rails (0.39.1)
+      opentelemetry-instrumentation-action_mailer (~> 0.6)
+      opentelemetry-instrumentation-action_pack (~> 0.15)
+      opentelemetry-instrumentation-action_view (~> 0.11)
+      opentelemetry-instrumentation-active_job (~> 0.10)
+      opentelemetry-instrumentation-active_record (~> 0.11)
+      opentelemetry-instrumentation-active_storage (~> 0.3)
+      opentelemetry-instrumentation-active_support (~> 0.10)
+      opentelemetry-instrumentation-concurrent_ruby (~> 0.23)
+    opentelemetry-instrumentation-rake (0.5.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-rdkafka (0.9.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-redis (0.28.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-resque (0.8.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-restclient (0.26.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-ruby_kafka (0.24.0)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-sidekiq (0.28.1)
+      opentelemetry-instrumentation-base (~> 0.25)
+    opentelemetry-instrumentation-sinatra (0.28.0)
+      opentelemetry-instrumentation-rack (~> 0.29)
+    opentelemetry-instrumentation-trilogy (0.65.1)
+      opentelemetry-helpers-mysql
+      opentelemetry-helpers-sql
+      opentelemetry-helpers-sql-processor
+      opentelemetry-instrumentation-base (~> 0.25)
+      opentelemetry-semantic_conventions (>= 1.8.0)
     opentelemetry-registry (0.3.0)
       opentelemetry-api (~> 1.1)
-    opentelemetry-sdk (1.6.0)
+    opentelemetry-sdk (1.10.0)
       opentelemetry-api (~> 1.1)
       opentelemetry-common (~> 0.20)
       opentelemetry-registry (~> 0.2)
@@ -1550,7 +1629,7 @@ GEM
       date
       stringio
     public_suffix (6.0.1)
-    puma (7.1.0)
+    puma (7.2.0)
       nio4r (~> 2.0)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
@@ -1727,8 +1806,6 @@ GEM
       rspec-expectations (~> 3.13)
       rspec-mocks (~> 3.13)
       rspec-support (~> 3.13)
-    rspec-retry (0.6.2)
-      rspec-core (> 3.3)
     rspec-support (3.13.1)
     rspec_junit_formatter (0.6.0)
       rspec-core (>= 2, < 4, != 2.12.0)
@@ -1786,7 +1863,7 @@ GEM
     rubyntlm (0.6.3)
     rubypants (0.2.0)
     rubyzip (2.4.1)
-    rugged (1.6.3)
+    rugged (1.9.0)
     safe_yaml (1.0.4)
     safety_net_attestation (0.4.0)
       jwt (~> 2.0)
@@ -1896,7 +1973,7 @@ GEM
     ssh_data (2.0.0)
       base64 (~> 0.1)
     ssrf_filter (1.0.8)
-    stackprof (0.2.27)
+    stackprof (0.2.28)
     state_machines (0.100.4)
     state_machines-activemodel (0.101.0)
       activemodel (>= 7.2)
@@ -2113,8 +2190,8 @@ DEPENDENCIES
   atlassian-jwt (~> 0.2.1)
   attr_encrypted (~> 4.2)
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.226.0)
-  aws-sdk-s3 (~> 1.193.0)
+  aws-sdk-core (~> 3.242.0)
+  aws-sdk-s3 (~> 1.213.0)
   axe-core-rspec (~> 4.10.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
@@ -2132,7 +2209,7 @@ DEPENDENCIES
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.9)
   circuitbox (= 2.0.0)
-  click_house-client (= 0.8.7)
+  click_house-client (= 0.8.8)
   commonmarker (~> 0.23.10)
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.5.3)
@@ -2141,10 +2218,10 @@ DEPENDENCIES
   creole (~> 0.5.0)
   cssbundling-rails (= 1.4.3)
   csv_builder!
-  cvss-suite (~> 3.3.0)
+  cvss-suite (~> 4.1.1)
   database_cleaner-active_record (~> 2.2.0)
   debug (~> 1.11.0)
-  declarative_policy (~> 2.0.1)
+  declarative_policy (~> 2.1.0)
   deprecation_toolkit (~> 2.2.3)
   derailed_benchmarks
   devfile (~> 0.5.0)
@@ -2192,20 +2269,21 @@ DEPENDENCIES
   gitlab-active-context!
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
-  gitlab-cloud-connector (~> 1.44)
-  gitlab-crystalball (~> 1.1.0)
+  gitlab-cloud-connector (~> 1.45)
+  gitlab-crystalball (~> 1.1.3)
   gitlab-dangerfiles (~> 4.10.0)
   gitlab-duo-workflow-service-client (~> 0.6)!
-  gitlab-experiment (~> 1.2.0)
+  gitlab-experiment (~> 1.3.0)
   gitlab-fog-azure-rm (~> 2.4.0)
+  gitlab-gkg-proto (~> 0.7.0)
   gitlab-glfm-markdown (~> 0.0.41)
   gitlab-grape-openapi!
   gitlab-housekeeper!
   gitlab-http!
   gitlab-kas-grpc (~> 18.5.0.pre.rc4)
-  gitlab-labkit (~> 1.3.0)
+  gitlab-labkit (~> 1.5.0)
   gitlab-license (~> 2.6)
-  gitlab-mail_room (~> 0.1.0)
+  gitlab-mail_room (~> 1.0.0)
   gitlab-markup (~> 2.0.0)
   gitlab-net-dns (~> 0.15.0)
   gitlab-rspec!
@@ -2221,8 +2299,8 @@ DEPENDENCIES
   gitlab-utils!
   gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.3.0)
-  gitlab_quality-test_tooling (~> 3.7.1)
-  gitlab_query_language (~> 0.20.12)
+  gitlab_quality-test_tooling (~> 3.9.0)
+  gitlab_query_language (~> 0.23.0)
   gon (~> 6.5.0)
   google-apis-androidpublisher_v3 (~> 0.92.0)
   google-apis-cloudbilling_v1 (~> 0.22.0)
@@ -2251,7 +2329,7 @@ DEPENDENCIES
   graphlyte (~> 1.0.0)
   graphql (= 2.5.11)
   graphql-docs (~> 5.2.0)
-  grpc (~> 1.76.0)
+  grpc (~> 1.78.0)
   gssapi (~> 1.3.1)
   guard-rspec
   gvltools (~> 0.4.0)
@@ -2367,7 +2445,7 @@ DEPENDENCIES
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.4)
-  puma (~> 7.1)
+  puma (~> 7.2)
   rack (~> 2.2.9)
   rack-attack (~> 6.8.0)
   rack-cors (~> 2.0.1)
@@ -2395,7 +2473,6 @@ DEPENDENCIES
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0, >= 1.0.2)
   rspec-rails (~> 7.1.0)
-  rspec-retry (~> 0.6.2)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.9)
   rubocop
@@ -2406,7 +2483,7 @@ DEPENDENCIES
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.18)
   rubyzip (~> 2.4.0)
-  rugged (~> 1.6)
+  rugged (~> 1.9)
   sanitize (~> 6.0.2)
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)

pkgs/by-name/go/golden-cheetah/package.nix

@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "golden-cheetah";
-  version = "3.7-SP1";
+  version = "3.8-DEV2603";
 
   src = fetchFromGitHub {
     owner = "GoldenCheetah";
     repo = "GoldenCheetah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NsXTe4Ht4TFDu7/nK3/hdCk/K2mPm59I9GHkVOTDc74=";
+    hash = "sha256-FxQ18KJfR+fegQ5Qu4vI3vqckj4mB8s9VtSdRtIQISg=";
   };
 
   buildInputs =

pkgs/by-name/go/goshs/package.nix

@@ -2,30 +2,31 @@
   buildGoModule,
   fetchFromGitHub,
   stdenv,
-  versionCheckHook,
   lib,
+  testers,
+
+  # passthru
+  goshs,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "1.1.4";
+  version = "2.0.0-beta.3";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7z/7dUTDHteAwK78hbrvsHk3Gnv7ZSvaW25sC3vkwW4=";
+    hash = "sha256-ELYeabx0hb4oy2RH0yUIt6xTb2rm1eqxZIH+VhEZlvU=";
   };
 
-  vendorHash = "sha256-43Bu4BAmMmd6WrDNztQNCi2OdlzIfbrQC100DkcD4uE=";
+  vendorHash = "sha256-EXu1VQWxbKa0EkfqgOL8MDnOCGd8yynP1Bko5wqRCBg=";
 
   ldflags = [
     "-s"
     "-w"
   ];
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
-
   doInstallCheck = true;
 
   preCheck = ''
@@ -41,6 +42,13 @@ buildGoModule (finalAttrs: {
     "-skip=^TestGetIPv4Addr$"
   ];
 
+  # Disabled until https://github.com/patrickhener/goshs/issues/137 is resolved
+  # passthru.tests.version = testers.testVersion {
+  #   package = goshs;
+  #   command = "goshs -v";
+  #   version = "goshs ${finalAttrs.version}";
+  # };
+
   meta = {
     description = "Simple, yet feature-rich web server written in Go";
     homepage = "https://goshs.de";

pkgs/by-name/go/govee2mqtt/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "govee2mqtt";
-  version = "2025.11.25-60a39bcc";
+  version = "2026.03.25-ab9deb66";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = "govee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-8N/qQHJvVKWdlPQDbLskGw9le0L7yzTwxwz1w4cFu5g=";
+    hash = "sha256-APGvE5BIYgZtAWbM9DGJFuGyI3715g8Gyxou8uhspdM=";
   };
 
   cargoPatches = [
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace '"assets"' '"${placeholder "out"}/share/govee2mqtt/assets"'
   '';
 
-  cargoHash = "sha256-rs3wfvotR2p7jC6dn+JkTLJxVBtQR/IWgM9KmoYSelA=";
+  cargoHash = "sha256-XIdWxhyARhAHV0IZXOHOl4mHFS5/4Is74B4615jYeDs=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -42,7 +42,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/wez/govee2mqtt";
     changelog = "https://github.com/wez/govee2mqtt/blob/${finalAttrs.version}/addon/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    maintainers = with lib.maintainers; [
+      SuperSandro2000
+      niklaskorz
+    ];
     mainProgram = "govee";
   };
 })

pkgs/by-name/hy/hydrus/package.nix

@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "hydrus";
-  version = "665";
+  version = "666";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NMSZ+5slYyfrZlDig/A2QkfZBphtccmlbrsldoL/Tvk=";
+    hash = "sha256-Ikj1COV9eIp6UBk5zmxF1hwTY12K7Ut8hLM2Nvw7jis=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ib/ibtool/package.nix

@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ibtool";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "viraptor";
     repo = "ibtool";
     tag = finalAttrs.version;
-    hash = "sha256-O2CCuM34U5EbqgkFXs/vokM2Q1bv5mqBgFqfhDP463Y=";
+    hash = "sha256-D0AzcLBmcqdEZy1Td96CnJGgRID7FnbNeqKJ7xQUvlE=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/je/jello-lang/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  fetchpatch2,
+  jellyfish,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "jello-lang";
+  version = "0-unstable-2025-01-07";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "codereport";
+    repo = "jello";
+    rev = "462c48d0613d3ef5e2c2c9771b3db64f0747ac89";
+    hash = "sha256-5pyJYV6UITtsjHUsyqdiyTXw3dK1ibZQpi8Z3E/L+xo=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/codereport/jello/pull/43
+      url = "https://github.com/codereport/jello/commit/16ea477b302a810d161303539c4145130b90544c.patch";
+      hash = "sha256-6ZbytV6jUPAoPbV4IAbP5YsgPcjZZ+chGo3Z1h3hg1E=";
+    })
+  ];
+
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = [
+    python3Packages.colorama
+    python3Packages.prompt-toolkit
+  ];
+
+  # there are no tests
+  doCheck = false;
+
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ jellyfish ]}" ];
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Wrapper for Jellyfish (a fork of the Jelly programming language)";
+    homepage = "https://github.com/codereport/jello";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "jello";
+  };
+}

pkgs/by-name/je/jellyfish/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "jellyfish";
+  version = "0-unstable-2024-05-27";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "codereport";
+    repo = "jellyfish";
+    rev = "611fdf45c8950dfc06d22c2638aa73f9560203b4";
+    hash = "sha256-IwqXR7oeQjFV4MGadqg1Y6a5tUYb3MdT2L6kDs5JvTo=";
+  };
+
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = [ python3Packages.sympy ];
+
+  # there are no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Extension of the Jelly programming language created by Dennis Mitchell";
+    homepage = "https://github.com/codereport/jellyfish";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "jelly";
+  };
+}

pkgs/by-name/js/json-fortran/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "json-fortran";
-  version = "9.2.1";
+  version = "9.3.0";
 
   src = fetchFromGitHub {
     owner = "jacobwilliams";
     repo = "json-fortran";
     rev = finalAttrs.version;
-    hash = "sha256-ykvGdCWGXrMn3w1T2xJQQABHNiK1dojW25urKY6yqz4=";
+    hash = "sha256-shSMIiA2laNxqRmnsBBOgJDhWdXr/ULEWVkugHCEs+0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/mise/package.nix

@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.3.17";
+  version = "2026.4.6";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RVRKvhzjIHFGanBO8Ukat310IQT0HZA73WMFUCvVY84=";
+    hash = "sha256-tdHjJjLwnf0/0ZxVb9+tgCD8cD8/3TEE3hw6dM3fKtY=";
   };
 
-  cargoHash = "sha256-YoEVPfKeABvL5zAbLvQdcuf5Exnm8wwgylSoMd8Q7rs=";
+  cargoHash = "sha256-8JLwlEqxt8Ixg/b67ZICBBoOjGw8PFIYzNIBRiBJ8OA=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ng/nginx-sso/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nginx-sso";
-  version = "0.27.6";
+  version = "0.27.7";
 
   src = fetchFromGitHub {
     owner = "Luzifer";
     repo = "nginx-sso";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nYqk1VK6R9HH67NLQDUifW3AjIW5pjD1Jmf+cYH3SQo=";
+    hash = "sha256-vGap7FjBISlvJeu+n70Rhqugi07uAnqHFKCV9cprpBA=";
   };
 
-  vendorHash = "sha256-KflzlrjOOTDZQq2yP0zQsDgULrbnoeRRxOVHxKINsYw=";
+  vendorHash = "sha256-1gP5arImDp9pjPMc5kdW/Fba4IjbHJBLi3FZlHcHe2s=";
 
   postInstall = ''
     mkdir -p $out/share

pkgs/by-name/ni/nix-required-mounts/nix_required_mounts.py

@@ -1,14 +1,17 @@
-#!/usr/bin/env python3
-
 import glob
 import json
+import os
 import subprocess
 import textwrap
 from argparse import ArgumentParser
 from collections import deque
 from itertools import chain
-from pathlib import Path
-from typing import Deque, Dict, List, Set, Tuple, TypeAlias, TypedDict
+from pathlib import Path, PurePath
+from typing import (
+    TypeAlias,
+    TypedDict,
+    Iterable,
+)
 import logging
 
 Glob: TypeAlias = str
@@ -21,19 +24,20 @@ class Mount(TypedDict):
 
 
 class Pattern(TypedDict):
-    onFeatures: List[str]
-    paths: List[Glob | Mount]
+    onFeatures: list[str]
+    paths: list[Glob | Mount]
     unsafeFollowSymlinks: bool
+    safePrefixes: list[str]
 
 
-AllowedPatterns: TypeAlias = Dict[str, Pattern]
+AllowedPatterns: TypeAlias = dict[str, Pattern]
 
 
 parser = ArgumentParser("pre-build-hook")
 parser.add_argument("derivation_path")
 parser.add_argument("sandbox_path", nargs="?")
 parser.add_argument("--patterns", type=Path, required=True)
-parser.add_argument("--nix-exe", type=Path, required=True)
+parser.add_argument("--nix-exe", type=Path)
 parser.add_argument(
     "--issue-command",
     choices=("always", "conditional", "never"),
@@ -49,58 +53,234 @@ parser.add_argument(
 parser.add_argument("-v", "--verbose", action="count", default=0)
 
 
-def symlink_parents(p: Path) -> List[Path]:
-    out = []
-    while p.is_symlink() and p not in out:
-        parent = p.readlink()
-        if parent.is_relative_to("."):
-            p = p / parent
-        else:
-            p = parent
-        out.append(p)
-    return out
+def parse_derivation(
+    derivation_path: PathString, nix_exe: PathString | None
+) -> dict:
+    """Extract the content of a .drv file into a JSON dict"""
+    if not Path(derivation_path).exists():
+        logging.error(
+            f"{derivation_path} doesn't exist."
+            " Cf. https://github.com/NixOS/nix/issues/9272"
+            " Exiting the hook",
+        )
+
+    proc = subprocess.run(
+        [
+            nix_exe if nix_exe else "nix",
+            "show-derivation",
+            derivation_path,
+        ],
+        capture_output=True,
+    )
+    try:
+        parsed_drv = json.loads(proc.stdout)
+
+        # compabitility: https://github.com/NixOS/nix/pull/14770
+        if "derivations" in parsed_drv:
+            parsed_drv = parsed_drv["derivations"]
+    except json.JSONDecodeError:
+        output_str: str = proc.stdout.decode("utf-8")
+        logging.error(
+            "Couldn't parse the output of"
+            "`nix show-derivation`"
+            f". Expected JSON, observed: {output_str}",
+        )
+        logging.error(textwrap.indent(output_str, prefix=" " * 4))
+        logging.info("Exiting the nix-required-binds hook")
+
+    [canon_drv_path] = parsed_drv.keys()
+
+    return parsed_drv[canon_drv_path]
 
 
-def get_required_system_features(parsed_drv: dict) -> List[str]:
-    # Newer versions of Nix (since https://github.com/NixOS/nix/pull/13263) store structuredAttrs
-    # in the derivation JSON output.
+def get_required_system_features(parsed_drv: dict) -> set[str]:
+    # Newer versions of Nix (since https://github.com/NixOS/nix/pull/13263)
+    # store structuredAttrs in the derivation JSON output.
     if "structuredAttrs" in parsed_drv:
-        return parsed_drv["structuredAttrs"].get("requiredSystemFeatures", [])
+        return set(
+            parsed_drv["structuredAttrs"].get("requiredSystemFeatures", [])
+        )
 
     # Older versions of Nix store structuredAttrs in the env as a JSON string.
     drv_env = parsed_drv.get("env", {})
     if "__json" in drv_env:
-        return list(json.loads(drv_env["__json"]).get("requiredSystemFeatures", []))
+        return set(
+            json.loads(drv_env["__json"]).get("requiredSystemFeatures", [])
+        )
 
     # Without structuredAttrs, requiredSystemFeatures is a space-separated string in env.
-    return drv_env.get("requiredSystemFeatures", "").split()
+    return set(drv_env.get("requiredSystemFeatures", "").split())
 
 
-def validate_mounts(pattern: Pattern) -> List[Tuple[PathString, PathString, bool]]:
-    roots = []
-    for mount in pattern["paths"]:
-        if isinstance(mount, PathString):
-            matches = glob.glob(mount)
-            assert matches, f"Specified host paths do not exist: {mount}"
+def expand_globs(paths: list[PathString]) -> list[PathString]:
+    """Expand all existing paths from globbed paths like bash would"""
+    return sum(map(glob.glob, paths), [])
 
-            roots.extend((m, m, pattern["unsafeFollowSymlinks"]) for m in matches)
+
+def symlink_targets(p: Path) -> list[Path]:
+    """Traverse a chain of symlinks to collect every intermediate path up to the final destination."""
+
+    out = []
+    while p.is_symlink():
+        target = p.readlink()
+        if target.is_absolute():
+            p = target
         else:
-            assert isinstance(mount, dict) and "host" in mount, mount
-            assert Path(
-                mount["host"]
-            ).exists(), f"Specified host paths do not exist: {mount['host']}"
-            roots.append(
-                (
-                    mount["guest"],
-                    mount["host"],
-                    pattern["unsafeFollowSymlinks"],
-                )
-            )
+            # we need to resolve paths before concatenation because of things like
+            # $ ls -l /sys/dev/char/226:128/subsystem
+            # ... /sys/dev/char/226:128/subsystem
+            # -> ../../../../../../class/drm
+            #
+            # Path(normpath(...)) needed to normalize `foo/../bar` to `bar`
+            p = Path(os.path.normpath(p.parent.resolve() / target))
 
-    return roots
+        if p in out:
+            break
+        out.append(p)
+
+    return out
 
 
-def entrypoint():
+def symlink_targets_deep(
+    inputs: Iterable[PathString], follow_symlinks: bool
+) -> list[PathString]:
+    """Walk the file system tree and discover all possible symlink targets"""
+    queue: deque[PathString] = deque(inputs)
+    unique_paths: set[PathString] = set()
+    reachable_paths: list[PathString] = []
+
+    while queue:
+        path_str = str(queue.popleft())
+        if path_str not in unique_paths:
+            reachable_paths.append(path_str)
+            unique_paths.add(path_str)
+
+        if not follow_symlinks:
+            continue
+
+        path = Path(path_str)
+        if not (path.is_dir() or path.is_symlink()):
+            continue
+
+        paths: Iterable[Path] = [path]
+        if path.is_dir():
+            paths = chain(paths, path.iterdir())
+
+        for child in paths:
+            for parent in symlink_targets(child):
+                path = parent.absolute()
+                if all(
+                    not path.is_relative_to(existing_path)
+                    for existing_path in unique_paths
+                ):
+                    queue.append(path.as_posix())
+    return reachable_paths
+
+
+def prune_paths(inputs: Iterable[PathString]) -> list[PathString]:
+    """
+    From a list of paths prune all paths that are subdirectories of others
+
+    >>> prune_paths(["/a/b", "/a"])
+    ['/a']
+    >>> prune_paths(["/a/b/c", "/a/b"])
+    ['/a/b']
+    """
+    sorted_inputs = sorted(inputs)
+    pruned = [sorted_inputs[0]]
+
+    last_kept: PathString = pruned[0]
+    for current in sorted_inputs[1:]:
+        if not Path(current).is_relative_to(last_kept):
+            pruned.append(current)
+            last_kept = current
+
+    return pruned
+
+
+def mount_closure(pattern: Pattern) -> list[tuple[PathString, PathString]]:
+    """
+    This function extracts all paths from a pattern into the following:
+    - list of nix store paths
+    - host/hardware specific paths (anything outside the nix store)
+    - translations from host to guest (necessary for some non-NixOS hosts)
+
+    As the host paths are often multiple levels of symlinks, these can be
+    followed to be able to provide them all in the sandbox as they would
+    otherwise be broken (see `unsafeFollowSymlinks`).
+
+    The finally returned list contains tuples with guest-host mappings between
+    those paths. Most of them are 1:1.
+    """
+
+    def safe_prefix(p):
+        safe_prefixes = pattern.get("safePrefixes", [])
+        return any(p.startswith(safe_prefix) for safe_prefix in safe_prefixes)
+
+    # All nix store paths have been statically calculated before.
+    # There is no need to look into them or add anything
+    store_paths = [
+        p
+        for p in pattern["paths"]
+        if isinstance(p, PathString) and safe_prefix(p)
+    ]
+    # Paths that e.g. point to /dev/... or /run/... paths etc. might further
+    # point to other paths and these need to be added to the sandbox, too.
+    host_paths = [
+        p
+        for p in pattern["paths"]
+        if isinstance(p, PathString) and not safe_prefix(p)
+    ]
+    # Translations on the non-NixOS hosts like e.g. /usr/lib to /run/opengl-driver
+    # need to be applied on the final path list
+    translations: dict[PathString, PathString] = {
+        p["host"]: p["guest"]
+        for p in pattern["paths"]
+        if not isinstance(p, PathString)
+    }
+
+    host_paths.extend(translations.keys())
+
+    all_paths = prune_paths(
+        chain(
+            store_paths,
+            symlink_targets_deep(
+                expand_globs(host_paths), pattern["unsafeFollowSymlinks"]
+            ),
+        )
+    )
+
+    return [(translations.get(x, x), x) for x in all_paths]
+
+
+def patterns_for_features(
+    patterns: AllowedPatterns, features: set[str]
+) -> AllowedPatterns:
+    """
+    Return the list of patterns that are required for a given set of features.
+    >>> patterns = {
+    ...   "a": {
+    ...     "onFeatures": ["a"],
+    ...     "unsafeFollowSymlinks": True,
+    ...     "paths": []
+    ...   },
+    ...   "b": {
+    ...     "onFeatures": ["b"],
+    ...     "unsafeFollowSymlinks": True,
+    ...     "paths": []
+    ...   }
+    ... }
+    >>> list(patterns_for_features(patterns, {"a"}).keys())
+    ['a']
+    >>> list(patterns_for_features(patterns, {"a", "b"}).keys())
+    ['a', 'b']
+    """
+    return {
+        k: v for k, v in patterns.items() if set(v["onFeatures"]) & features
+    }
+
+
+def entrypoint() -> None:
     args = parser.parse_args()
 
     VERBOSITY_LEVELS = [logging.ERROR, logging.INFO, logging.DEBUG]
@@ -108,95 +288,28 @@ def entrypoint():
     level_index = min(args.verbose, len(VERBOSITY_LEVELS) - 1)
     logging.basicConfig(level=VERBOSITY_LEVELS[level_index])
 
-    drv_path = args.derivation_path
-
     with open(args.patterns, "r") as f:
-        allowed_patterns = json.load(f)
+        patterns = json.load(f)
 
-    if not Path(drv_path).exists():
-        logging.error(
-            f"{drv_path} doesn't exist."
-            " Cf. https://github.com/NixOS/nix/issues/9272"
-            " Exiting the hook",
-        )
-
-    proc = subprocess.run(
-        [
-            args.nix_exe,
-            "show-derivation",
-            drv_path,
-        ],
-        capture_output=True,
+    parsed_drv: dict = parse_derivation(args.derivation_path, args.nix_exe)
+    features: set[str] = get_required_system_features(parsed_drv)
+    required_patterns: AllowedPatterns = patterns_for_features(
+        patterns, features
     )
-    try:
-        parsed_drv = json.loads(proc.stdout)
-    except json.JSONDecodeError:
-        logging.error(
-            "Couldn't parse the output of"
-            "`nix show-derivation`"
-            f". Expected JSON, observed: {proc.stdout}",
-        )
-        logging.error(textwrap.indent(proc.stdout.decode("utf8"), prefix=" " * 4))
-        logging.info("Exiting the nix-required-binds hook")
-        return
-    [canon_drv_path] = parsed_drv.keys()
 
-    known_features = set(
+    mounts = list(
         chain.from_iterable(
-            pattern["onFeatures"] for pattern in allowed_patterns.values()
+            (mount_closure(pattern) for pattern in required_patterns.values())
         )
     )
 
-    parsed_drv = parsed_drv[canon_drv_path]
-    required_features = get_required_system_features(parsed_drv)
-    required_features = list(filter(known_features.__contains__, required_features))
-
-    patterns: List[Pattern] = list(
-        pattern
-        for pattern in allowed_patterns.values()
-        for path in pattern["paths"]
-        if any(feature in required_features for feature in pattern["onFeatures"])
-    )  # noqa: E501
-
-    queue: Deque[Tuple[PathString, PathString, bool]] = deque(
-        (mnt for pattern in patterns for mnt in validate_mounts(pattern))
-    )
-
-    unique_mounts: Set[Tuple[PathString, PathString]] = set()
-    mounts: List[Tuple[PathString, PathString]] = []
-
-    while queue:
-        guest_path_str, host_path_str, follow_symlinks = queue.popleft()
-        if (guest_path_str, host_path_str) not in unique_mounts:
-            mounts.append((guest_path_str, host_path_str))
-            unique_mounts.add((guest_path_str, host_path_str))
-
-        if not follow_symlinks:
-            continue
-
-        host_path = Path(host_path_str)
-        if not (host_path.is_dir() or host_path.is_symlink()):
-            continue
-
-        # assert host_path_str == guest_path_str, (host_path_str, guest_path_str)
-
-        for child in host_path.iterdir() if host_path.is_dir() else [host_path]:
-            for parent in symlink_parents(child):
-                parent_str = parent.absolute().as_posix()
-                queue.append((parent_str, parent_str, follow_symlinks))
-
     # the pre-build-hook command
     if args.issue_command == "always" or (
         args.issue_command == "conditional" and mounts
     ):
         print("extra-sandbox-paths")
-        print_paths = True
-    else:
-        print_paths = False
-
-    # arguments, one per line
-    for guest_path_str, host_path_str in mounts if print_paths else []:
-        print(f"{guest_path_str}={host_path_str}")
+        for guest_path_str, host_path_str in mounts:
+            print(f"{guest_path_str}={host_path_str}")
 
     # terminated by an empty line
     something_to_terminate = args.issue_stop == "conditional" and mounts

pkgs/by-name/ni/nix-required-mounts/package.nix

@@ -17,6 +17,7 @@
       "/dev/nvidia*"
     ];
     nvidia-gpu.unsafeFollowSymlinks = true;
+    nvidia-gpu.safePrefixes = [ builtins.storeDir ];
   },
   callPackage,
   extraWrapperArgs ? [ ],
@@ -37,13 +38,23 @@ python3Packages.buildPythonApplication {
   inherit pname version;
   pyproject = true;
 
-  src = lib.cleanSource ./.;
+  src = lib.sourceByRegex ./. [
+    "^pyproject.toml$"
+    "^.*nix_required_mounts.py$" # app and unit test file
+  ];
 
   nativeBuildInputs = [
     makeWrapper
     python3Packages.setuptools
   ];
 
+  checkInputs = [
+    python3Packages.pytestCheckHook
+  ];
+  pythonImportsCheck = [
+    "nix_required_mounts"
+  ];
+
   postFixup = ''
     wrapProgram $out/bin/${pname} \
       --add-flags "--patterns ${allowedPatternsPath}" \

pkgs/by-name/ni/nix-required-mounts/pyproject.toml

@@ -16,5 +16,11 @@ Homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nix-req
 [project.scripts]
 nix-required-mounts = "nix_required_mounts:entrypoint"
 
+[tool.setuptools]
+py-modules = [ "nix_required_mounts" ]
+
 [tool.black]
 line-length = 79
+
+[tool.pytest.ini_options]
+addopts = ["--doctest-modules"]

pkgs/by-name/ni/nix-required-mounts/test_nix_required_mounts.py

@@ -0,0 +1,205 @@
+import unittest
+import tempfile
+import shutil
+from pathlib import Path
+from nix_required_mounts import (
+    PathString,
+    Pattern,
+    expand_globs,
+    mount_closure,
+    prune_paths,
+    symlink_targets,
+    symlink_targets_deep,
+)
+import os
+import pytest
+from pathlib import Path
+
+
+class TreeBuilder:
+    """Helper to create files and symlinks from a simple dict."""
+
+    def __init__(self, root: Path):
+        self.root = root
+
+    def build(self, structure: dict):
+        for path_str, target in structure.items():
+            path = self.root / path_str
+            path.parent.mkdir(parents=True, exist_ok=True)
+
+            if target == "file":
+                path.touch()
+            elif target == "dir":
+                path.mkdir(parents=True, exist_ok=True)
+            elif target.startswith("->"):
+                link_to = target.replace("->", "").strip()
+                path.symlink_to(link_to)
+        return self.root
+
+
+@pytest.fixture
+def tree(tmp_path):
+    # https://docs.pytest.org/en/stable/how-to/tmp_path.html
+    # the paths are kept on error for inspection
+    return TreeBuilder(tmp_path)
+
+
+def test_symlink_chain(tree):
+    # fmt: off
+    root = tree.build({
+        "a": "file",
+        "b": "-> a",
+        "c": "-> b",
+    })
+    # fmt: on
+
+    assert symlink_targets(root / "a") == []
+    assert symlink_targets(root / "b") == [root / "a"]
+    assert symlink_targets(root / "c") == [root / "b", root / "a"]
+
+
+def test_far_up_relative_links(tree):
+    depth = 15
+    path = "x/" * depth
+    root = tree.build(
+        {
+            "o/p": "file",
+            "a/b": f"-> ../{path}",
+            f"{path}/n": f"-> ../{'../' * depth}o/p",
+        }
+    )
+
+    assert symlink_targets(root / "a/b") == [root / Path(path)]
+
+
+def test_jump_outside_folder(tree):
+    # fmt: off
+    root = tree.build({
+        "c/d": "file",
+        "a/b": "-> ../c/d",
+    })
+    # fmt: on
+    assert symlink_targets(root / "a/b") == [root / "c/d"]
+
+
+def test_path_discovery_resolve_relative_links(tree):
+    depth = 15
+    path = "x/" * depth
+    root = tree.build(
+        {
+            "o/p": "file",
+            "a/b": f"-> ../{path}",
+            f"{path}/n": f"-> {'../' * depth}o/p",
+        }
+    )
+
+    assert symlink_targets_deep([root / "a"], follow_symlinks=True) == [
+        str(x) for x in [root / "a", root / path, root / "o/p"]
+    ]
+
+
+def test_pattern_extraction(tree):
+    root = tree.build(
+        {
+            "a": "file",
+            "b": "-> a",
+            "c": "-> b",
+            "d/e": "file",
+            "f/g": "-> ../d/e",
+        }
+    )
+
+    def strs(paths: list[Path]) -> list[PathString]:
+        return [str(x) if isinstance(x, Path) else x for x in paths]
+
+    def pairs(paths: list[Path]) -> list[tuple[str, str]]:
+        return [(x, x) for x in strs(paths)]
+
+    a = {
+        "onFeatures": ["feature_a", "feature_a1"],
+        "paths": [str(root / "c")],
+        "unsafeFollowSymlinks": True,
+    }
+
+    assert mount_closure(a) == pairs([root / "a", root / "b", root / "c"])
+
+    assert mount_closure(a | {"unsafeFollowSymlinks": False}) == pairs(
+        [root / "c"]
+    )
+
+    b = {
+        "onFeatures": ["feature_b", "feature_b2"],
+        "paths": strs([root / "d", root / "f"]),
+        "unsafeFollowSymlinks": True,
+    }
+
+    assert mount_closure(b) == pairs(
+        [
+            root / "d",
+            root / "f",
+        ]
+    )
+
+    with_mounts = {
+        "onFeatures": ["feature_b", "feature_b2"],
+        "paths": strs(
+            [
+                root / "d",  # prevent formatter
+                root / "f",
+                {"host": str(root), "guest": "/foo/bar"},
+            ]
+        ),
+        "unsafeFollowSymlinks": True,
+    }
+
+    assert mount_closure(with_mounts) == [
+        ("/foo/bar", str(root)),
+    ]
+
+
+def test_glob_expansion(tree):
+    # fmt: off
+    root = tree.build({
+        "a": "file",
+        "b": "-> a",
+        "c": "-> b",
+    })
+    # fmt: on
+
+    assert sorted(expand_globs([str(root / "*")])) == [
+        str(x) for x in [root / "a", root / "b", root / "c"]
+    ]
+
+
+def test_path_discovery(tree):
+    root = tree.build(
+        {
+            "a": "file",
+            "b": "-> a",
+            "c": "-> b",
+            "d/e": "file",
+            "f/g": "-> ../d/e",
+        }
+    )
+
+    ss = lambda unsorted_paths: sorted(map(str, unsorted_paths))
+
+    assert ss(
+        symlink_targets_deep(
+            [root / "c", root / "f"], follow_symlinks=True
+        )
+    ) == ss(
+        # fmt: off
+        [
+            root / "a",
+            root / "b",
+            root / "c",
+            root / "d/e",
+            root / "f",
+        ]
+        # fmt: on
+    )
+
+
+if __name__ == "__main__":
+    unittest.main()

pkgs/by-name/nq/nqptp/package.nix

@@ -8,22 +8,16 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.2.4";
+  version = "1.2.6";
   pname = "nqptp";
 
   src = fetchFromGitHub {
     owner = "mikebrady";
     repo = "nqptp";
     tag = finalAttrs.version;
-    hash = "sha256-roTNcr3v2kzE6vQ5plAVtlw1+2yJplltOYsGGibtoZo=";
+    hash = "sha256-bU7eTNnPhBA+XTW0SCps/iUCGuxObnv72/Lm+yKEgao=";
   };
 
-  patches = [
-    # these patches should be removed when > 1.2.4
-    ./remove-setcap.patch
-    ./systemd-service-capability.patch
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

pkgs/by-name/nq/nqptp/remove-setcap.patch

@@ -1,13 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index 78f36d7..8dc4e4f 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -19,8 +19,6 @@ endif
- 
- install-exec-hook:
- if BUILD_FOR_LINUX
--# NQPTP runs as user/group nqptp/nqptp on Linux and uses setcap to access ports 319 and 320
--	setcap 'cap_net_bind_service=+ep' $(bindir)/nqptp
- # no installer for System V
- if INSTALL_SYSTEMD_STARTUP
- 	getent group nqptp &>/dev/null || groupadd -r nqptp &>/dev/null

pkgs/by-name/nq/nqptp/systemd-service-capability.patch

@@ -1,12 +0,0 @@
-diff --git a/nqptp.service.in b/nqptp.service.in
-index 6f1eb0c..53e6a2e 100644
---- a/nqptp.service.in
-+++ b/nqptp.service.in
-@@ -8,6 +8,7 @@ Before=shairport-sync.service
- ExecStart=@prefix@/bin/nqptp
- User=nqptp
- Group=nqptp
-+AmbientCapabilities=CAP_NET_BIND_SERVICE
- 
- [Install]
- WantedBy=multi-user.target

pkgs/by-name/op/opencode/package.nix

@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.3.13";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P6Md0WzHK2/oAZ6VbpYnabVJyVcqwuYizoOqbxaf+lU=";
+    hash = "sha256-u3OeU+3Y/O6KEeDiOl+pswBZ7++kMqwoK+ams03qWE4=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -72,7 +72,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-fWc9xVn6HbNxnJ9S8Q+hdlYQYkdGk+4RWWbYaB+L09Q=";
+    outputHash = "sha256-atufNVv1pxdcz9TGhlZsQSwZ8E8dxJ7syPA/FD/cZWI=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };

pkgs/by-name/pr/process-compose/package.nix

@@ -10,13 +10,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "process-compose";
-  version = "1.94.0";
+  version = "1.103.0";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = "process-compose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5Lcy8evsgnKKLNi3zbuYHiDUVWIaYgzzUnF2rLWhY8U=";
+    hash = "sha256-DLMMUMI/1ntsa5EydjOR+eTcscVsppX1jdRAhijTBLE=";
 
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
@@ -46,7 +46,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  vendorHash = "sha256-DWHzWksKBUTx5zOj+/zZ84hSWFLEDtacaKnLyOmmNbw=";
+  vendorHash = "sha256-+1dFQYVHSux4WIjUifaUzkFVDzeelY18UA+0bPrXE+E=";
 
   doCheck = false;
 

pkgs/by-name/re/recyclarr/001-Git-Version.patch

@@ -1,14 +0,0 @@
-diff --git a/Directory.Build.props b/Directory.Build.props
-index af8e3b12..07dd1898 100644
---- a/Directory.Build.props
-+++ b/Directory.Build.props
-@@ -9,7 +9,7 @@
-     <RepositoryRoot>$(MSBuildThisFileDirectory)</RepositoryRoot>
-     <TestDirectory>$(RepositoryRoot)tests\</TestDirectory>
-     <GitVersionBaseDirectory>$(RepositoryRoot)</GitVersionBaseDirectory>
--    <!--<DisableGitVersionTask>true</DisableGitVersionTask>-->
-+    <DisableGitVersionTask>true</DisableGitVersionTask>
-   </PropertyGroup>
- 
-   <!--
-   

pkgs/by-name/re/recyclarr/package.nix

@@ -9,39 +9,41 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "recyclarr";
-  version = "7.4.1";
+  version = "8.5.1";
 
   src = fetchFromGitHub {
     owner = "recyclarr";
     repo = "recyclarr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eutlnIHOcRnucgFDwJIheTPXA7avqvp4H0xUX2Cv2z8=";
+    hash = "sha256-q2WEa28TYmmg2KDTIsT7AHQC5o0YwpOw+zmepvhoLaI=";
   };
 
-  projectFile = "Recyclarr.sln";
+  projectFile = "Recyclarr.slnx";
   nugetDeps = ./deps.json;
 
-  prePatch = ''
-    substituteInPlace src/Recyclarr.Cli/Console/CliSetup.cs \
-      --replace-fail '$"v{GitVersionInformation.SemVer} ({GitVersionInformation.FullBuildMetaData})"' '"${finalAttrs.version}-nixpkgs"'
-
-    substituteInPlace src/Recyclarr.Cli/Console/Setup/ProgramInformationDisplayTask.cs \
-      --replace-fail 'GitVersionInformation.InformationalVersion' '"${finalAttrs.version}-nixpkgs"'
-
-    substituteInPlace Recyclarr.sln \
-      --replace-fail ".config\dotnet-tools.json = .config\dotnet-tools.json" ""
+  postPatch = ''
+    cat > src/Recyclarr.Core/GitVersionInformation.g.cs <<'EOF'
+    public static class GitVersionInformation
+    {
+        public static string SemVer => "${finalAttrs.version}";
+        public static string FullBuildMetaData => "nixpkgs";
+        public static string InformationalVersion => "${finalAttrs.version}+nixpkgs";
+        public static int Major => ${lib.versions.major finalAttrs.version};
+    }
+    EOF
 
     rm .config/dotnet-tools.json
   '';
-  patches = [ ./001-Git-Version.patch ];
-
-  enableParallelBuilding = false;
 
   doCheck = false;
 
-  dotnet-sdk = dotnetCorePackages.sdk_9_0;
-  dotnet-runtime = dotnetCorePackages.runtime_9_0;
-  dotnet-test-sdk = dotnetCorePackages.sdk_9_0;
+  dotnetBuildFlags = [
+    "-p:DisableGitVersionTask=true"
+    "/m:1"
+  ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.runtime_10_0;
 
   executables = [ "recyclarr" ];
   makeWrapperArgs = [

pkgs/by-name/sn/snid/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nixosTests,
 }:
 
 buildGoModule (finalAttrs: {
@@ -17,6 +18,14 @@ buildGoModule (finalAttrs: {
 
   vendorHash = "sha256-cVarG6Tx4yWpZE5BLZsMtLV9LF1lsiFfIXxhYiNjQlY=";
 
+  passthru = {
+    tests.nixos = nixosTests.snid;
+    services.default = {
+      imports = [ (lib.modules.importApply ./service.nix { }) ];
+      snid.package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "Zero config TLS proxy server that uses SNI";
     homepage = "https://github.com/AGWA/snid";

pkgs/by-name/sn/snid/service.nix

@@ -0,0 +1,173 @@
+# Non-module dependencies (`importApply`)
+{ }:
+
+# Service module
+{
+  lib,
+  config,
+  options,
+  ...
+}:
+let
+  inherit (lib)
+    concatMap
+    getExe
+    mkOption
+    optional
+    types
+    ;
+  cfg = config.snid;
+in
+{
+  # https://nixos.org/manual/nixos/unstable/#modular-services
+  _class = "service";
+
+  options = {
+    snid = {
+      package = mkOption {
+        description = "Package to use for snid.";
+        defaultText = "The snid package that provided this module.";
+        type = types.package;
+      };
+
+      listen = mkOption {
+        description = ''
+          Addresses to listen on, in go-listener syntax.
+
+          Examples: `"tcp:443"`, `"tcp:0.0.0.0:443"`, `"tcp:192.0.2.4:443"`.
+        '';
+        type = types.listOf types.str;
+        example = [ "tcp:0.0.0.0:443" ];
+      };
+
+      mode = mkOption {
+        description = ''
+          Proxy mode. One of `nat46`, `tcp`, or `unix`.
+        '';
+        type = types.enum [
+          "nat46"
+          "tcp"
+          "unix"
+        ];
+      };
+
+      defaultHostname = mkOption {
+        description = ''
+          Hostname to use if a client does not include the SNI extension.
+          If null, SNI-less connections will be terminated with a TLS alert.
+        '';
+        type = types.nullOr types.str;
+        default = null;
+      };
+
+      nat46Prefix = mkOption {
+        description = ''
+          IPv6 prefix for the source address when connecting to the backend
+          in NAT46 mode. The client's IPv4 address is placed in the lower 4
+          bytes.
+
+          Note: this prefix must be routed to the local host, e.g.
+          ```
+          ip route add local 64:ff9b:1::/96 dev lo
+          ```
+        '';
+        type = types.nullOr types.str;
+        default = null;
+        example = "64:ff9b:1::";
+      };
+
+      backendCidrs = mkOption {
+        description = ''
+          Subnets to which connections may be forwarded. Connections to
+          addresses outside these subnets are rejected. Used in `nat46` and
+          `tcp` modes.
+        '';
+        type = types.listOf types.str;
+        default = [ ];
+        example = [
+          "2001:db8::/64"
+          "192.0.2.0/24"
+        ];
+      };
+
+      backendPort = mkOption {
+        description = ''
+          Port number to connect to on the backend in TCP mode. If null,
+          snid uses the same port as the inbound connection.
+        '';
+        type = types.nullOr types.port;
+        default = null;
+      };
+
+      unixDirectory = mkOption {
+        description = ''
+          Path to the directory containing UNIX domain sockets, used in
+          `unix` mode.
+        '';
+        type = types.nullOr types.path;
+        default = null;
+      };
+
+      proxyProto = mkOption {
+        description = ''
+          Use PROXY protocol v2 to convey the client IP address to the
+          backend. Applicable in `tcp` and `unix` modes.
+        '';
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
+
+  config = {
+    assertions = [
+      {
+        assertion = cfg.mode == "nat46" -> cfg.nat46Prefix != null;
+        message = "snid: `nat46Prefix` must be set when `mode` is `nat46`.";
+      }
+      {
+        assertion = cfg.mode == "nat46" -> cfg.backendCidrs != [ ];
+        message = "snid: `backendCidrs` must be set when `mode` is `nat46`.";
+      }
+      {
+        assertion = cfg.mode == "tcp" -> cfg.backendCidrs != [ ];
+        message = "snid: `backendCidrs` must be set when `mode` is `tcp`.";
+      }
+      {
+        assertion = cfg.mode == "unix" -> cfg.unixDirectory != null;
+        message = "snid: `unixDirectory` must be set when `mode` is `unix`.";
+      }
+    ];
+
+    process.argv = [
+      (getExe cfg.package)
+      "-mode"
+      cfg.mode
+    ]
+    ++ concatMap (l: [
+      "-listen"
+      l
+    ]) cfg.listen
+    ++ concatMap (c: [
+      "-backend-cidr"
+      c
+    ]) cfg.backendCidrs
+    ++ optional (cfg.defaultHostname != null) "-default-hostname=${cfg.defaultHostname}"
+    ++ optional (cfg.nat46Prefix != null) "-nat46-prefix=${cfg.nat46Prefix}"
+    ++ optional (cfg.backendPort != null) "-backend-port=${toString cfg.backendPort}"
+    ++ optional (cfg.unixDirectory != null) "-unix-directory=${cfg.unixDirectory}"
+    ++ optional cfg.proxyProto "-proxy-proto";
+  }
+  // lib.optionalAttrs (options ? systemd) {
+    systemd.service = {
+      after = [ "network.target" ];
+      wants = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Restart = "on-failure";
+        DynamicUser = true;
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      };
+    };
+  };
+}

pkgs/development/mobile/androidenv/ndk-bundle/default.nix

@@ -24,7 +24,7 @@ let
         gawk
         gnugrep
         gnused
-        jdk
+        jdk_headless
         python3
         which
       ]

pkgs/development/python-modules/aiohomeconnect/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohomeconnect";
-  version = "0.33.0";
+  version = "0.34.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hpM1Fr1CPBKNJ/GJtNiL/ifR0UN/VrDL3GVanmBIb9U=";
+    hash = "sha256-fGK7Qc4dzW1BTbSNrNE7N4RZvyaXf2pQ49zTOkjNyBg=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/azure-kusto-data/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "azure-kusto-data";
-  version = "6.0.2";
+  version = "6.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-kusto-python";
     tag = "v${version}";
-    hash = "sha256-jg8VueMohp7z45va5Z+cF0Hz+RMW4Vd5AchJX/wngLc=";
+    hash = "sha256-n69KpWZpAVMjr7d1QRQ/J/SgeTLkadJUhCgD62F6O7w=";
   };
 
   sourceRoot = "${src.name}/${pname}";

pkgs/development/python-modules/hyponcloud/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyponcloud";
-  version = "0.9.1";
+  version = "0.9.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jcisio";
     repo = "hyponcloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EfAML6n/dhvpRVjghJUoAV3deP4YcMFon01UCwhT7Oc=";
+    hash = "sha256-qPELNzaVQtlQQ8u1IvJNkEzywuVHol79Tv3w9Sfaar0=";
   };
 
   build-system = [

pkgs/development/python-modules/incomfort-client/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "incomfort-client";
-  version = "0.6.12";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zxdavb";
     repo = "incomfort-client";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5IP0R7NI+TXBOPwDZ26inVC6YxhYozo4ZM/V7w73EvQ=";
+    hash = "sha256-myjT9mx3QfXFTVDPYusLGrpB61+qywu5r0K5InzMhYA=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/pylutron/default.nix

@@ -7,44 +7,38 @@
   telnetlib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pylutron";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thecynic";
     repo = "pylutron";
-    tag = version;
-    hash = "sha256-y5RDwlIxmwzKihTDFZKoOJL+TPJbY05MKPUMs2hBWiw=";
+    tag = finalAttrs.version;
+    hash = "sha256-bfr0Guu4rbb50arFB6fIWPSqh1hLZY0WO9mALsf8dj0=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail TEMPLATE_VERSION ${version}
+      --replace-fail TEMPLATE_VERSION ${finalAttrs.version}
   '';
 
   build-system = [ setuptools ];
 
-  dependencies = [
-    telnetlib3
-  ];
+  dependencies = [ telnetlib3 ];
 
   pythonImportsCheck = [ "pylutron" ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-  enabledTestPaths = [
-    "tests"
-  ];
+  enabledTestPaths = [ "tests" ];
 
   meta = {
     description = "Python library for controlling a Lutron RadioRA 2 system";
     homepage = "https://github.com/thecynic/pylutron";
-    changelog = "https://github.com/thecynic/pylutron/releases/tag/${version}";
+    changelog = "https://github.com/thecynic/pylutron/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/development/python-modules/rembg/default.nix

@@ -46,14 +46,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "rembg";
-  version = "2.0.74";
+  version = "2.0.75";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "danielgatis";
     repo = "rembg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bCwteS0OJThIAIXxWjzol33p+EH1Gy+CBjKNDwcH7p8=";
+    hash = "sha256-mHGdv47BXUIjE7O5m2Wkg+mkszlZUU1dmAbtpnttwjw=";
   };
 
   env.POETRY_DYNAMIC_VERSIONING_BYPASS = finalAttrs.version;

pkgs/development/python-modules/skein/default.nix

@@ -77,8 +77,8 @@ buildPythonPackage rec {
       alexbiehl
       illustris
     ];
-    # https://github.com/NixOS/nixpkgs/issues/48663#issuecomment-1083031627
-    # replace with https://github.com/NixOS/nixpkgs/pull/140325 once it is merged
-    broken = lib.traceIf isPy27 "${pname} not supported on ${python.executable}" isPy27;
+    problems = lib.optionalAttrs isPy27 {
+      broken.message = "${pname} not supported on ${python.executable}";
+    };
   };
 }

pkgs/development/python-modules/tessie-api/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "tessie-api";
-  version = "0.1.2";
+  version = "0.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andrewgierens";
     repo = "tessie_python_api";
     tag = version;
-    hash = "sha256-uY52SSG2u4lcX9X7Ql/pn31uOwpqIy3kkuLMvsFBA3s=";
+    hash = "sha256-Ia5J7dGbcfEa6rEKyJzEnzVnMC3HyI7l5g20v7d7Gjo=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/wiim/default.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  async-upnp-client,
+  pytestCheckHook,
+  pytest-asyncio,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "wiim";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Linkplay2020";
+    repo = "wiim";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cX8CLbzoNUs8u0+HLcg9C5aw48Dw/wI19T/q/5np6KE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    async-upnp-client
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "wiim" ];
+
+  meta = {
+    description = "Python-based API interface for controlling and communicating with WiiM audio devices";
+    homepage = "https://github.com/Linkplay2020/wiim";
+    changelog = "https://github.com/Linkplay2020/wiim/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jamiemagee ];
+  };
+})

pkgs/development/python-modules/xiaomi-ble/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "xiaomi-ble";
-  version = "1.10.0";
+  version = "1.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rn0GoDh91GBi2lDMS6iN7unxtZAJq1WDpb49jQ2GUjQ=";
+    hash = "sha256-60n47FZy5m7aBCRPgwNCPMZ1sMofYZET0S5o2OjGKbg=";
   };
 
   build-system = [ poetry-core ];

pkgs/servers/home-assistant/component-packages.nix

@@ -7051,7 +7051,8 @@
       ];
     "wiim" =
       ps: with ps; [
-      ]; # missing inputs: wiim
+        wiim
+      ];
     "wilight" =
       ps: with ps; [
         pywilight
@@ -8426,6 +8427,7 @@
     "whirlpool"
     "whois"
     "wiffi"
+    "wiim"
     "wilight"
     "window"
     "withings"

pkgs/top-level/python-packages.nix

@@ -21147,6 +21147,8 @@ self: super: with self; {
 
   wifi = callPackage ../development/python-modules/wifi { };
 
+  wiim = callPackage ../development/python-modules/wiim { };
+
   wikipedia = callPackage ../development/python-modules/wikipedia { };
 
   wikipedia-api = callPackage ../development/python-modules/wikipedia-api { };