Merge master into haskell-updates

2023-12-30 00:12:20 +00:00
parent 03557b4cbb 95e6499333
commit c4fe98a2f5
163 changed files with 1629 additions and 910 deletions
@@ -17160,6 +17160,12 @@
      fingerprint = "897E 6BE3 0345 B43D CADD  05B7 290F CF08 1AED B3EC";
    }];
  };
+  smrehman = {
+    name = "Syed Moiz Ur Rehman";
+    email = "smrehman@proton.me";
+    github = "syedmoizurrehman";
+    githubId = 17818950;
+  };
  sna = {
    email = "abouzahra.9@wright.edu";
    github = "S-NA";
@@ -18988,6 +18994,13 @@
    matrix = "@ty:tjll.net";
    name = "Tyler Langlois";
  };
+  tylervick = {
+    email = "nix@tylervick.com";
+    github = "tylervick";
+    githubId = 1395852;
+    name = "Tyler Vick";
+    matrix = "@tylervick:matrix.org";
+  };
  tymscar = {
    email = "oscar@tymscar.com";
    github = "tymscar";
@@ -28,6 +28,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.

+- [ollama](https://ollama.ai), server for running large language models locally.
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

@@ -74,6 +76,17 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

  `CONFIG_FILE_NAME` includes `bpf_pinning`, `ematch_map`, `group`, `nl_protos`, `rt_dsfield`, `rt_protos`, `rt_realms`, `rt_scopes`, and `rt_tables`.

+- The `systemd.oomd` module behavior is changed as:
+
+  - Raise ManagedOOMMemoryPressureLimit from 50% to 80%. This should make systemd-oomd kill things less often, and fix issues like [this](https://pagure.io/fedora-workstation/issue/358).
+    Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/806c95e1c70af18f81d499b24cd7acfa4c36ffd6?branch=806c95e1c70af18f81d499b24cd7acfa4c36ffd6)
+
+  - Remove swap policy. This helps prevent killing processes when user's swap is small.
+
+  - Expand the memory pressure policy to system.slice, user-.slice, and all user owned slices. Reference: [commit](https://src.fedoraproject.org/rpms/systemd/c/7665e1796f915dedbf8e014f0a78f4f576d609bb)
+
+  - `systemd.oomd.enableUserServices` is renamed to `systemd.oomd.enableUserSlices`.
+
 ## Other Notable Changes {#sec-release-24.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -89,8 +102,23 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  The `nimPackages` and `nim2Packages` sets have been removed.
  See https://nixos.org/manual/nixpkgs/unstable#nim for more information.

+- [Portunus](https://github.com/majewsky/portunus) has been updated to 2.0.
+  This version of Portunus supports strong password hashes, but the legacy hash SHA-256 is also still supported to ensure a smooth migration of existing user accounts.
+  After upgrading, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all user accounts to strong password hashes.
+  Support for weak password hashes will be removed in NixOS 24.11.
+
 - `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.

+- The following options of the Nextcloud module were moved into [`services.nextcloud.extraOptions`](#opt-services.nextcloud.extraOptions) and renamed to match the name from Nextcloud's `config.php`:
+  - `logLevel` -> [`loglevel`](#opt-services.nextcloud.extraOptions.loglevel),
+  - `logType` -> [`log_type`](#opt-services.nextcloud.extraOptions.log_type),
+  - `defaultPhoneRegion` -> [`default_phone_region`](#opt-services.nextcloud.extraOptions.default_phone_region),
+  - `overwriteProtocol` -> [`overwriteprotocol`](#opt-services.nextcloud.extraOptions.overwriteprotocol),
+  - `skeletonDirectory` -> [`skeletondirectory`](#opt-services.nextcloud.extraOptions.skeletondirectory),
+  - `globalProfiles` -> [`profile.enabled`](#opt-services.nextcloud.extraOptions._profile.enabled_),
+  - `extraTrustedDomains` -> [`trusted_domains`](#opt-services.nextcloud.extraOptions.trusted_domains) and
+  - `trustedProxies` -> [`trusted_proxies`](#opt-services.nextcloud.extraOptions.trusted_proxies).
+
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
  non-child processes. This means you will not be able to attach gdb to an
  existing process, but will need to start that process from gdb (so it is a
@@ -226,18 +226,6 @@ in
      "ldap.conf" = ldapConfig;
    };

-    system.activationScripts = mkIf (!cfg.daemon.enable) {
-      ldap = stringAfter [ "etc" "groups" "users" ] ''
-        if test -f "${cfg.bind.passwordFile}" ; then
-          umask 0077
-          conf="$(mktemp)"
-          printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
-          cat ${ldapConfig.source} - >"$conf"
-          mv -fT "$conf" /etc/ldap.conf
-        fi
-      '';
-    };
-
    system.nssModules = mkIf cfg.nsswitch (singleton (
      if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
    ));
@@ -258,42 +246,63 @@ in
      };
    };

-    systemd.services = mkIf cfg.daemon.enable {
-      nslcd = {
-        wantedBy = [ "multi-user.target" ];
-
-        preStart = ''
-          umask 0077
-          conf="$(mktemp)"
-          {
-            cat ${nslcdConfig}
-            test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
-            printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
-            test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
-            printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
-          } >"$conf"
-          mv -fT "$conf" /run/nslcd/nslcd.conf
-        '';
-
-        restartTriggers = [
-          nslcdConfig
-          cfg.bind.passwordFile
-          cfg.daemon.rootpwmodpwFile
-        ];
-
-        serviceConfig = {
-          ExecStart = "${nslcdWrapped}/bin/nslcd";
-          Type = "forking";
-          Restart = "always";
-          User = "nslcd";
-          Group = "nslcd";
-          RuntimeDirectory = [ "nslcd" ];
-          PIDFile = "/run/nslcd/nslcd.pid";
-          AmbientCapabilities = "CAP_SYS_RESOURCE";
+    systemd.services = mkMerge [
+      (mkIf (!cfg.daemon.enable) {
+        ldap-password = {
+          wantedBy = [ "sysinit.target" ];
+          before = [ "sysinit.target" "shutdown.target" ];
+          conflicts = [ "shutdown.target" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          serviceConfig.RemainAfterExit = true;
+          script = ''
+            if test -f "${cfg.bind.passwordFile}" ; then
+              umask 0077
+              conf="$(mktemp)"
+              printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
+              cat ${ldapConfig.source} - >"$conf"
+              mv -fT "$conf" /etc/ldap.conf
+            fi
+          '';
        };
-      };
+      })

-    };
+      (mkIf cfg.daemon.enable {
+        nslcd = {
+          wantedBy = [ "multi-user.target" ];
+
+          preStart = ''
+            umask 0077
+            conf="$(mktemp)"
+            {
+              cat ${nslcdConfig}
+              test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
+              printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
+              test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
+              printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
+            } >"$conf"
+            mv -fT "$conf" /run/nslcd/nslcd.conf
+          '';
+
+          restartTriggers = [
+            nslcdConfig
+            cfg.bind.passwordFile
+            cfg.daemon.rootpwmodpwFile
+          ];
+
+          serviceConfig = {
+            ExecStart = "${nslcdWrapped}/bin/nslcd";
+            Type = "forking";
+            Restart = "always";
+            User = "nslcd";
+            Group = "nslcd";
+            RuntimeDirectory = [ "nslcd" ];
+            PIDFile = "/run/nslcd/nslcd.pid";
+            AmbientCapabilities = "CAP_SYS_RESOURCE";
+          };
+        };
+      })
+    ];

  };

@@ -12,7 +12,6 @@ let
    mkDefault
    mkIf
    mkOption
-    stringAfter
    types
    ;

@@ -39,9 +39,10 @@ in

    hardware.firmware = [ package.fw ];

-    system.activationScripts.setup-amdgpu-pro = ''
-      ln -sfn ${package}/opt/amdgpu{,-pro} /run
-    '';
+    systemd.tmpfiles.settings.amdgpu-pro = {
+      "/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
+      "/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
+    };

    system.requiredKernelConfig = with config.lib.kernelConfig; [
      (isYes "DEVICE_PRIVATE")
@@ -231,7 +231,8 @@ in
        # even if you've upgraded your system to a new NixOS release.
        #
        # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-        # so changing it will NOT upgrade your system.
+        # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+        # to actually do that.
        #
        # This value being lower than the current NixOS release does NOT mean your system is
        # out of date, out of support, or vulnerable.
@@ -723,6 +723,7 @@
  ./services/misc/nzbget.nix
  ./services/misc/nzbhydra2.nix
  ./services/misc/octoprint.nix
+  ./services/misc/ollama.nix
  ./services/misc/ombi.nix
  ./services/misc/osrm.nix
  ./services/misc/owncast.nix
@@ -18,7 +18,7 @@ in

      settings = mkOption {
        type = settingsFormat.type;
-        default = {};
+        default = { };
        description = lib.mdDoc ''
          System-wide configuration for GameMode (/etc/gamemode.ini).
          See gamemoded(8) man page for available settings.
@@ -181,25 +181,33 @@ in {
      '';
    };

-    system.activationScripts.ipa = stringAfter ["etc"] ''
-      # libcurl requires a hard copy of the certificate
-      if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
-        rm -f /etc/ipa/ca.crt
-        cp ${cfg.certificate} /etc/ipa/ca.crt
-      fi
+    systemd.services."ipa-activation" = {
+      wantedBy = [ "sysinit.target" ];
+      before = [ "sysinit.target" "shutdown.target" ];
+      conflicts = [ "shutdown.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
+        # libcurl requires a hard copy of the certificate
+        if ! ${pkgs.diffutils}/bin/diff ${cfg.certificate} /etc/ipa/ca.crt > /dev/null 2>&1; then
+          rm -f /etc/ipa/ca.crt
+          cp ${cfg.certificate} /etc/ipa/ca.crt
+        fi

-      if [ ! -f /etc/krb5.keytab ]; then
-        cat <<EOF
+        if [ ! -f /etc/krb5.keytab ]; then
+          cat <<EOF

-          In order to complete FreeIPA integration, please join the domain by completing the following steps:
-          1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
-          2. Join the domain and obtain the keytab file: ipa-join
-          3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
-          4. Restart sssd systemd service: sudo systemctl restart sssd
+            In order to complete FreeIPA integration, please join the domain by completing the following steps:
+            1. Authenticate as an IPA user authorized to join new hosts, e.g. kinit admin@${cfg.realm}
+            2. Join the domain and obtain the keytab file: ipa-join
+            3. Install the keytab file: sudo install -m 600 krb5.keytab /etc/
+            4. Restart sssd systemd service: sudo systemctl restart sssd

-      EOF
-      fi
-    '';
+        EOF
+        fi
+      '';
+    };

    services.sssd.config = ''
      [domain/${cfg.domain}]
@@ -280,6 +280,7 @@ in
      wantedBy = [ "sysinit.target" ];
      before = [ "sysinit.target" "shutdown.target" ];
      conflicts = [ "shutdown.target" ];
+      after = [ "systemd-sysusers.service" ];
      unitConfig.DefaultDependencies = false;
      unitConfig.RequiresMountsFor = [ "/nix/store" "/run/wrappers" ];
      serviceConfig.Type = "oneshot";
@@ -143,20 +143,15 @@ let
  };

  # Paths listed in ReadWritePaths must exist before service is started
-  mkActivationScript = name: cfg:
+  mkTmpfiles = name: cfg:
    let
-      install = "install -o ${cfg.user} -g ${cfg.group}";
-    in
-      nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
-        # Ensure that the home directory already exists
-        # We can't assert createHome == true because that's not the case for root
-        cd "${config.users.users.${cfg.user}.home}"
-        # Create each directory separately to prevent root owned parent dirs
-        ${install} -d .config .config/borg
-        ${install} -d .cache .cache/borg
-      '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
-        ${install} -d ${escapeShellArg cfg.repo}
-      ''));
+      settings = { inherit (cfg) user group; };
+    in lib.nameValuePair "borgbackup-job-${name}" ({
+      "${config.users.users."${cfg.user}".home}/.config/borg".d = settings;
+      "${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;
+    } // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {
+      "${cfg.repo}".d = settings;
+    });

  mkPassAssertion = name: cfg: {
    assertion = with cfg.encryption;
@@ -760,7 +755,7 @@ in {
        ++ mapAttrsToList mkSourceAssertions jobs
        ++ mapAttrsToList mkRemovableDeviceAssertions jobs;

-      system.activationScripts = mapAttrs' mkActivationScript jobs;
+      systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;

      systemd.services =
        # A job named "foo" is mapped to systemd.services.borgbackup-job-foo
@@ -220,10 +220,16 @@ in
      logcheck = {};
    };

-    system.activationScripts.logcheck = ''
-      mkdir -m 700 -p /var/{lib,lock}/logcheck
-      chown ${cfg.user} /var/{lib,lock}/logcheck
-    '';
+    systemd.tmpfiles.settings.logcheck = {
+      "/var/lib/logcheck".d = {
+        mode = "700";
+        inherit (cfg) user;
+      };
+      "/var/lock/logcheck".d = {
+        mode = "700";
+        inherit (cfg) user;
+      };
+    };

    services.cron.systemCronJobs =
        let withTime = name: {timeArgs, ...}: timeArgs != null;
@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }: let
+
+  cfg = config.services.ollama;
+
+in {
+
+  options = {
+    services.ollama = {
+      enable = lib.mkEnableOption (
+        lib.mdDoc "Server for local large language models"
+      );
+      package = lib.mkPackageOption pkgs "ollama" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd = {
+      services.ollama = {
+        wantedBy = [ "multi-user.target" ];
+        description = "Server for local large language models";
+        after = [ "network.target" ];
+        environment = {
+          HOME = "%S/ollama";
+          OLLAMA_MODELS = "%S/ollama/models";
+        };
+        serviceConfig = {
+          ExecStart = "${lib.getExe cfg.package} serve";
+          WorkingDirectory = "/var/lib/ollama";
+          StateDirectory = [ "ollama" ];
+          DynamicUser = true;
+        };
+      };
+    };
+
+    environment.systemPackages = [ cfg.package ];
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}
@@ -102,7 +102,9 @@ in
    ldap = {
      package = mkOption {
        type = types.package;
-        # needs openldap built with a libxcrypt that support crypt sha256 until https://github.com/majewsky/portunus/issues/2 is solved
+        # needs openldap built with a libxcrypt that support crypt sha256 until users have had time to migrate to newer hashes
+        # Ref: <https://github.com/majewsky/portunus/issues/2>
+        # TODO: remove in NixOS 24.11 (cf. same note on pkgs/servers/portunus/default.nix)
        default = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
        defaultText = lib.literalExpression "pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; }";
        description = lib.mdDoc "The OpenLDAP package to use.";
@@ -137,16 +137,24 @@ in
        message = "networking.enableIPv6 must be true for yggdrasil to work";
      }];

-      system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
-        if [ ! -e ${keysPath} ]
-        then
-          mkdir --mode=700 -p ${builtins.dirOf keysPath}
-          ${binYggdrasil} -genconf -json \
-            | ${pkgs.jq}/bin/jq \
-                'to_entries|map(select(.key|endswith("Key")))|from_entries' \
-            > ${keysPath}
-        fi
-      '';
+      # This needs to be a separate service. The yggdrasil service fails if
+      # this is put into its preStart.
+      systemd.services.yggdrasil-persistent-keys = lib.mkIf cfg.persistentKeys {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "yggdrasil.service" ];
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        script = ''
+          if [ ! -e ${keysPath} ]
+          then
+            mkdir --mode=700 -p ${builtins.dirOf keysPath}
+            ${binYggdrasil} -genconf -json \
+              | ${pkgs.jq}/bin/jq \
+                  'to_entries|map(select(.key|endswith("Key")))|from_entries' \
+              > ${keysPath}
+          fi
+        '';
+      };

      systemd.services.yggdrasil = {
        description = "Yggdrasil Network Service";
@@ -45,19 +45,25 @@ in

    systemd.services.munged = {
      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      wants = [
+        "network-online.target"
+        "time-sync.target"
+      ];
+      after = [
+        "network-online.target"
+        "time-sync.target"
+      ];

      path = [ pkgs.munge pkgs.coreutils ];

      serviceConfig = {
        ExecStartPre = "+${pkgs.coreutils}/bin/chmod 0400 ${cfg.password}";
-        ExecStart = "${pkgs.munge}/bin/munged --syslog --key-file ${cfg.password}";
-        PIDFile = "/run/munge/munged.pid";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecStart = "${pkgs.munge}/bin/munged --foreground --key-file ${cfg.password}";
        User = "munge";
        Group = "munge";
        StateDirectory = "munge";
        StateDirectoryMode = "0711";
+        Restart = "on-failure";
        RuntimeDirectory = "munge";
      };

@@ -51,7 +51,7 @@ to ensure that changes can be applied by changing the module's options.
 In case the application serves multiple domains (those are checked with
 [`$_SERVER['HTTP_HOST']`](https://www.php.net/manual/en/reserved.variables.server.php))
 it's needed to add them to
-[`services.nextcloud.config.extraTrustedDomains`](#opt-services.nextcloud.config.extraTrustedDomains).
+[`services.nextcloud.extraOptions.trusted_domains`](#opt-services.nextcloud.extraOptions.trusted_domains).

 Auto updates for Nextcloud apps can be enabled using
 [`services.nextcloud.autoUpdateApps`](#opt-services.nextcloud.autoUpdateApps.enable).
@@ -23,6 +23,43 @@ let
    catch_workers_output = "yes";
  };

+  appStores = {
+    # default apps bundled with pkgs.nextcloudXX, e.g. files, contacts
+    apps = {
+      enabled = true;
+      writable = false;
+    };
+    # apps installed via cfg.extraApps
+    nix-apps = {
+      enabled = cfg.extraApps != { };
+      linkTarget = pkgs.linkFarm "nix-apps"
+        (mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps);
+      writable = false;
+    };
+    # apps installed via the app store.
+    store-apps = {
+      enabled = cfg.appstoreEnable == null || cfg.appstoreEnable;
+      linkTarget = "${cfg.home}/store-apps";
+      writable = true;
+    };
+  };
+
+  webroot = pkgs.runCommand
+    "${cfg.package.name or "nextcloud"}-with-apps"
+    { }
+    ''
+      mkdir $out
+      ln -sfv "${cfg.package}"/* "$out"
+      ${concatStrings
+        (mapAttrsToList (name: store: optionalString (store.enabled && store?linkTarget) ''
+          if [ -e "$out"/${name} ]; then
+            echo "Didn't expect ${name} already in $out!"
+            exit 1
+          fi
+          ln -sfTv ${store.linkTarget} "$out"/${name}
+        '') appStores)}
+    '';
+
  inherit (cfg) datadir;

  phpPackage = cfg.phpPackage.buildEnv {
@@ -45,7 +82,7 @@ let

  occ = pkgs.writeScriptBin "nextcloud-occ" ''
    #! ${pkgs.runtimeShell}
-    cd ${cfg.package}
+    cd ${webroot}
    sudo=exec
    if [[ "$USER" != nextcloud ]]; then
      sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR --preserve-env=OC_PASS'
@@ -94,6 +131,22 @@ in {
    (mkRemovedOptionModule [ "services" "nextcloud" "disableImagemagick" ] ''
      Use services.nextcloud.enableImagemagick instead.
    '')
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "logLevel" ] [ "services" "nextcloud" "extraOptions" "loglevel" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "logType" ] [ "services" "nextcloud" "extraOptions" "log_type" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "defaultPhoneRegion" ] [ "services" "nextcloud" "extraOptions" "default_phone_region" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "overwriteProtocol" ] [ "services" "nextcloud" "extraOptions" "overwriteprotocol" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "skeletonDirectory" ] [ "services" "nextcloud" "extraOptions" "skeletondirectory" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "globalProfiles" ] [ "services" "nextcloud" "extraOptions" "profile.enabled" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "extraTrustedDomains" ] [ "services" "nextcloud" "extraOptions" "trusted_domains" ])
+    (mkRenamedOptionModule
+      [ "services" "nextcloud" "config" "trustedProxies" ] [ "services" "nextcloud" "extraOptions" "trusted_proxies" ])
  ];

  options.services.nextcloud = {
@@ -157,32 +210,6 @@ in {
        Set this to false to disable the installation of apps from the global appstore. App management is always enabled regardless of this setting.
      '';
    };
-    logLevel = mkOption {
-      type = types.ints.between 0 4;
-      default = 2;
-      description = lib.mdDoc ''
-        Log level value between 0 (DEBUG) and 4 (FATAL).
-
-        - 0 (debug): Log all activity.
-
-        - 1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
-
-        - 2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
-
-        - 3 (error): Log failed operations and fatal errors.
-
-        - 4 (fatal): Log only fatal errors that cause the server to stop.
-      '';
-    };
-    logType = mkOption {
-      type = types.enum [ "errorlog" "file" "syslog" "systemd" ];
-      default = "syslog";
-      description = lib.mdDoc ''
-        Logging backend to use.
-        systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
-        See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
-      '';
-    };
    https = mkOption {
      type = types.bool;
      default = false;
@@ -206,16 +233,6 @@ in {
      '';
    };

-    skeletonDirectory = mkOption {
-      default = "";
-      type = types.str;
-      description = lib.mdDoc ''
-        The directory where the skeleton files are located. These files will be
-        copied to the data directory of new users. Leave empty to not copy any
-        skeleton files.
-      '';
-    };
-
    webfinger = mkOption {
      type = types.bool;
      default = false;
@@ -315,7 +332,6 @@ in {

    };

-
    config = {
      dbtype = mkOption {
        type = types.enum [ "sqlite" "pgsql" "mysql" ];
@@ -380,53 +396,6 @@ in {
          setup of Nextcloud by the systemd service `nextcloud-setup.service`.
        '';
      };
-
-      extraTrustedDomains = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = lib.mdDoc ''
-          Trusted domains from which the Nextcloud installation will be
-          accessible.  You don't need to add
-          `services.nextcloud.hostname` here.
-        '';
-      };
-
-      trustedProxies = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = lib.mdDoc ''
-          Trusted proxies to provide if the Nextcloud installation is being
-          proxied to secure against, e.g. spoofing.
-        '';
-      };
-
-      overwriteProtocol = mkOption {
-        type = types.nullOr (types.enum [ "http" "https" ]);
-        default = null;
-        example = "https";
-
-        description = lib.mdDoc ''
-          Force Nextcloud to always use HTTP or HTTPS i.e. for link generation.
-          Nextcloud uses the currently used protocol by default, but when
-          behind a reverse-proxy, it may use `http` for everything although
-          Nextcloud may be served via HTTPS.
-        '';
-      };
-
-      defaultPhoneRegion = mkOption {
-        default = null;
-        type = types.nullOr types.str;
-        example = "DE";
-        description = lib.mdDoc ''
-          An [ISO 3166-1](https://www.iso.org/iso-3166-country-codes.html)
-          country code which replaces automatic phone-number detection
-          without a country code.
-
-          As an example, with `DE` set as the default phone region,
-          the `+49` prefix can be omitted for phone numbers.
-        '';
-      };
-
      objectstore = {
        s3 = {
          enable = mkEnableOption (lib.mdDoc ''
@@ -609,30 +578,109 @@ in {
        The nextcloud-occ program preconfigured to target this Nextcloud instance.
      '';
    };
-    globalProfiles = mkEnableOption (lib.mdDoc "global profiles") // {
-      description = lib.mdDoc ''
-        Makes user-profiles globally available under `nextcloud.tld/u/user.name`.
-        Even though it's enabled by default in Nextcloud, it must be explicitly enabled
-        here because it has the side-effect that personal information is even accessible to
-        unauthenticated users by default.
-
-        By default, the following properties are set to “Show to everyone”
-        if this flag is enabled:
-        - About
-        - Full name
-        - Headline
-        - Organisation
-        - Profile picture
-        - Role
-        - Twitter
-        - Website
-
-        Only has an effect in Nextcloud 23 and later.
-      '';
-    };

    extraOptions = mkOption {
-      type = jsonFormat.type;
+      type = types.submodule {
+        freeformType = jsonFormat.type;
+        options = {
+
+          loglevel = mkOption {
+            type = types.ints.between 0 4;
+            default = 2;
+            description = lib.mdDoc ''
+              Log level value between 0 (DEBUG) and 4 (FATAL).
+
+              - 0 (debug): Log all activity.
+
+              - 1 (info): Log activity such as user logins and file activities, plus warnings, errors, and fatal errors.
+
+              - 2 (warn): Log successful operations, as well as warnings of potential problems, errors and fatal errors.
+
+              - 3 (error): Log failed operations and fatal errors.
+
+              - 4 (fatal): Log only fatal errors that cause the server to stop.
+            '';
+          };
+          log_type = mkOption {
+            type = types.enum [ "errorlog" "file" "syslog" "systemd" ];
+            default = "syslog";
+            description = lib.mdDoc ''
+              Logging backend to use.
+              systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
+              See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
+            '';
+          };
+          skeletondirectory = mkOption {
+            default = "";
+            type = types.str;
+            description = lib.mdDoc ''
+              The directory where the skeleton files are located. These files will be
+              copied to the data directory of new users. Leave empty to not copy any
+              skeleton files.
+            '';
+          };
+          trusted_domains = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = lib.mdDoc ''
+              Trusted domains, from which the nextcloud installation will be
+              accessible. You don't need to add
+              `services.nextcloud.hostname` here.
+            '';
+          };
+          trusted_proxies = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = lib.mdDoc ''
+              Trusted proxies, to provide if the nextcloud installation is being
+              proxied to secure against e.g. spoofing.
+            '';
+          };
+          overwriteprotocol = mkOption {
+            type = types.enum [ "" "http" "https" ];
+            default = "";
+            example = "https";
+            description = lib.mdDoc ''
+              Force Nextcloud to always use HTTP or HTTPS i.e. for link generation.
+              Nextcloud uses the currently used protocol by default, but when
+              behind a reverse-proxy, it may use `http` for everything although
+              Nextcloud may be served via HTTPS.
+            '';
+          };
+          default_phone_region = mkOption {
+            default = "";
+            type = types.str;
+            example = "DE";
+            description = lib.mdDoc ''
+              An [ISO 3166-1](https://www.iso.org/iso-3166-country-codes.html)
+              country code which replaces automatic phone-number detection
+              without a country code.
+
+              As an example, with `DE` set as the default phone region,
+              the `+49` prefix can be omitted for phone numbers.
+            '';
+          };
+          "profile.enabled" = mkEnableOption (lib.mdDoc "global profiles") // {
+            description = lib.mdDoc ''
+              Makes user-profiles globally available under `nextcloud.tld/u/user.name`.
+              Even though it's enabled by default in Nextcloud, it must be explicitly enabled
+              here because it has the side-effect that personal information is even accessible to
+              unauthenticated users by default.
+              By default, the following properties are set to “Show to everyone”
+              if this flag is enabled:
+              - About
+              - Full name
+              - Headline
+              - Organisation
+              - Profile picture
+              - Role
+              - Twitter
+              - Website
+              Only has an effect in Nextcloud 23 and later.
+            '';
+          };
+        };
+      };
      default = {};
      description = lib.mdDoc ''
        Extra options which should be appended to Nextcloud's config.php file.
@@ -766,11 +814,10 @@ in {
        # When upgrading the Nextcloud package, Nextcloud can report errors such as
        # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
        # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
-        phpfpm-nextcloud.restartTriggers = [ cfg.package ];
+        phpfpm-nextcloud.restartTriggers = [ webroot ];

        nextcloud-setup = let
          c = cfg.config;
-          writePhpArray = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
          requiresReadSecretFunction = c.dbpassFile != null || c.objectstore.s3.enable;
          objectstoreConfig = let s3 = c.objectstore.s3; in optionalString s3.enable ''
            'objectstore' => [
@@ -800,6 +847,10 @@ in {

          nextcloudGreaterOrEqualThan = req: versionAtLeast cfg.package.version req;

+          mkAppStoreConfig = name: { enabled, writable, ... }: optionalString enabled ''
+            [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${boolToString writable} ],
+          '';
+
          overrideConfig = pkgs.writeText "nextcloud-config.php" ''
            <?php
            ${optionalString requiresReadSecretFunction ''
@@ -828,17 +879,10 @@ in {
            }
            $CONFIG = [
              'apps_paths' => [
-                ${optionalString (cfg.extraApps != { }) "[ 'path' => '${cfg.home}/nix-apps', 'url' => '/nix-apps', 'writable' => false ],"}
-                [ 'path' => '${cfg.home}/apps', 'url' => '/apps', 'writable' => false ],
-                [ 'path' => '${cfg.home}/store-apps', 'url' => '/store-apps', 'writable' => true ],
+                ${concatStrings (mapAttrsToList mkAppStoreConfig appStores)}
              ],
              ${optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
-              'datadirectory' => '${datadir}/data',
-              'skeletondirectory' => '${cfg.skeletonDirectory}',
              ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
-              'log_type' => '${cfg.logType}',
-              'loglevel' => '${builtins.toString cfg.logLevel}',
-              ${optionalString (c.overwriteProtocol != null) "'overwriteprotocol' => '${c.overwriteProtocol}',"}
              ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
              ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
              ${optionalString (c.dbport != null) "'dbport' => '${toString c.dbport}',"}
@@ -851,10 +895,6 @@ in {
                ''
              }
              'dbtype' => '${c.dbtype}',
-              'trusted_domains' => ${writePhpArray ([ cfg.hostName ] ++ c.extraTrustedDomains)},
-              'trusted_proxies' => ${writePhpArray (c.trustedProxies)},
-              ${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"}
-              ${optionalString (nextcloudGreaterOrEqualThan "23") "'profile.enabled' => ${boolToString cfg.globalProfiles},"}
              ${objectstoreConfig}
            ];

@@ -907,7 +947,7 @@ in {
            (i: v: ''
              ${occ}/bin/nextcloud-occ config:system:set trusted_domains \
                ${toString i} --value="${toString v}"
-            '') ([ cfg.hostName ] ++ cfg.config.extraTrustedDomains));
+            '') ([ cfg.hostName ] ++ cfg.extraOptions.trusted_domains));

        in {
          wantedBy = [ "multi-user.target" ];
@@ -935,17 +975,16 @@ in {
              exit 1
            fi

-            ln -sf ${cfg.package}/apps ${cfg.home}/
-
-            # Install extra apps
-            ln -sfT \
-              ${pkgs.linkFarm "nix-apps"
-                (mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps)} \
-              ${cfg.home}/nix-apps
+            ${concatMapStrings (name: ''
+              if [ -d "${cfg.home}"/${name} ]; then
+                echo "Cleaning up ${name}; these are now bundled in the webroot store-path!"
+                rm -r "${cfg.home}"/${name}
+              fi
+            '') [ "nix-apps" "apps" ]}

            # create nextcloud directories.
            # if the directories exist already with wrong permissions, we fix that
-            for dir in ${datadir}/config ${datadir}/data ${cfg.home}/store-apps ${cfg.home}/nix-apps; do
+            for dir in ${datadir}/config ${datadir}/data ${cfg.home}/store-apps; do
              if [ ! -e $dir ]; then
                install -o nextcloud -g nextcloud -d $dir
              elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
@@ -982,7 +1021,7 @@ in {
          environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
          serviceConfig.Type = "oneshot";
          serviceConfig.User = "nextcloud";
-          serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${cfg.package}/cron.php";
+          serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${webroot}/cron.php";
        };
        nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
          after = [ "nextcloud-setup.service" ];
@@ -1043,22 +1082,25 @@ in {
        user = "nextcloud";
      };

-      services.nextcloud = lib.mkIf cfg.configureRedis {
-        caching.redis = true;
-        extraOptions = {
+      services.nextcloud = {
+        caching.redis = lib.mkIf cfg.configureRedis true;
+        extraOptions = mkMerge [({
+          datadirectory = lib.mkDefault "${datadir}/data";
+          trusted_domains = [ cfg.hostName ];
+        }) (lib.mkIf cfg.configureRedis {
          "memcache.distributed" = ''\OC\Memcache\Redis'';
          "memcache.locking" = ''\OC\Memcache\Redis'';
          redis = {
            host = config.services.redis.servers.nextcloud.unixSocket;
            port = 0;
          };
-        };
+        })];
      };

      services.nginx.enable = mkDefault true;

      services.nginx.virtualHosts.${cfg.hostName} = {
-        root = cfg.package;
+        root = webroot;
        locations = {
          "= /robots.txt" = {
            priority = 100;
@@ -1075,14 +1117,6 @@ in {
              }
            '';
          };
-          "~ ^/store-apps" = {
-            priority = 201;
-            extraConfig = "root ${cfg.home};";
-          };
-          "~ ^/nix-apps" = {
-            priority = 201;
-            extraConfig = "root ${cfg.home};";
-          };
          "^~ /.well-known" = {
            priority = 210;
            extraConfig = ''
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  inherit (lib) mkOption mkDefault types optionalString stringAfter;
+  inherit (lib) mkOption mkDefault types optionalString;

  cfg = config.boot.binfmt;

@@ -3,14 +3,18 @@
  cfg = config.systemd.oomd;

 in {
+  imports = [
+    (lib.mkRemovedOptionModule [ "systemd" "oomd" "enableUserServices" ] "Use systemd.oomd.enableUserSlices instead.")
+  ];
+
  options.systemd.oomd = {
    enable = lib.mkEnableOption (lib.mdDoc "the `systemd-oomd` OOM killer") // { default = true; };

    # Fedora enables the first and third option by default. See the 10-oomd-* files here:
-    # https://src.fedoraproject.org/rpms/systemd/tree/acb90c49c42276b06375a66c73673ac351025597
+    # https://src.fedoraproject.org/rpms/systemd/tree/806c95e1c70af18f81d499b24cd7acfa4c36ffd6
    enableRootSlice = lib.mkEnableOption (lib.mdDoc "oomd on the root slice (`-.slice`)");
    enableSystemSlice = lib.mkEnableOption (lib.mdDoc "oomd on the system slice (`system.slice`)");
-    enableUserServices = lib.mkEnableOption (lib.mdDoc "oomd on all user services (`user@.service`)");
+    enableUserSlices = lib.mkEnableOption (lib.mdDoc "oomd on all user slices (`user@.slice`) and all user owned slices");

    extraConfig = lib.mkOption {
      type = with lib.types; attrsOf (oneOf [ str int bool ]);
@@ -44,14 +48,23 @@ in {
    users.groups.systemd-oom = { };

    systemd.slices."-".sliceConfig = lib.mkIf cfg.enableRootSlice {
-      ManagedOOMSwap = "kill";
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "80%";
    };
    systemd.slices."system".sliceConfig = lib.mkIf cfg.enableSystemSlice {
-      ManagedOOMSwap = "kill";
-    };
-    systemd.services."user@".serviceConfig = lib.mkIf cfg.enableUserServices {
      ManagedOOMMemoryPressure = "kill";
-      ManagedOOMMemoryPressureLimit = "50%";
+      ManagedOOMMemoryPressureLimit = "80%";
+    };
+    systemd.slices."user-".sliceConfig = lib.mkIf cfg.enableUserSlices {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "80%";
+    };
+    systemd.user.units."slice" = lib.mkIf cfg.enableUserSlices {
+      text = ''
+        ManagedOOMMemoryPressure=kill
+        ManagedOOMMemoryPressureLimit=80%
+      '';
+      overrideStrategy = "asDropin";
    };
  };
 }
@@ -80,10 +80,17 @@ with lib;
        ACTION=="add|change", SUBSYSTEM=="input", ATTR{name}=="${cfg.device}", ATTR{device/speed}="${toString cfg.speed}", ATTR{device/sensitivity}="${toString cfg.sensitivity}"
      '';

-      system.activationScripts.trackpoint =
-        ''
-          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}"
+      systemd.services.trackpoint = {
+        wantedBy = [ "sysinit.target" ] ;
+        before = [ "sysinit.target" "shutdown.target" ];
+        conflicts = [ "shutdown.target" ];
+        unitConfig.DefaultDependencies = false;
+        serviceConfig.Type = "oneshot";
+        serviceConfig.RemainAfterExit = true;
+        serviceConfig.ExecStart = ''
+          ${config.systemd.package}/bin/udevadm trigger --attr-match=name="${cfg.device}
        '';
+      };
    })

    (mkIf (cfg.emulateWheel) {
@@ -85,35 +85,44 @@ in
      };
    };

-    ###### wrappers activation script
-
-    system.activationScripts.vmwareWrappers =
-      lib.stringAfter [ "specialfs" "users" ]
-        ''
-          mkdir -p "${parentWrapperDir}"
-          chmod 755 "${parentWrapperDir}"
-          # We want to place the tmpdirs for the wrappers to the parent dir.
-          wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
-          chmod a+rx "$wrapperDir"
-          ${lib.concatStringsSep "\n" (vmwareWrappers)}
-          if [ -L ${wrapperDir} ]; then
-            # Atomically replace the symlink
-            # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
-            old=$(readlink -f ${wrapperDir})
-            if [ -e "${wrapperDir}-tmp" ]; then
-              rm --force --recursive "${wrapperDir}-tmp"
-            fi
-            ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
-            mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
-            rm --force --recursive "$old"
-          else
-            # For initial setup
-            ln --symbolic "$wrapperDir" "${wrapperDir}"
-          fi
-        '';
-
    # Services

+    systemd.services."vmware-wrappers" = {
+      description = "Create VMVare Wrappers";
+      wantedBy = [ "multi-user.target" ];
+      before = [
+        "vmware-authdlauncher.service"
+        "vmware-networks-configuration.service"
+        "vmware-networks.service"
+        "vmware-usbarbitrator.service"
+      ];
+      after = [ "systemd-sysusers.service" ];
+      serviceConfig.Type = "oneshot";
+      serviceConfig.RemainAfterExit = true;
+      script = ''
+        mkdir -p "${parentWrapperDir}"
+        chmod 755 "${parentWrapperDir}"
+        # We want to place the tmpdirs for the wrappers to the parent dir.
+        wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
+        chmod a+rx "$wrapperDir"
+        ${lib.concatStringsSep "\n" (vmwareWrappers)}
+        if [ -L ${wrapperDir} ]; then
+          # Atomically replace the symlink
+          # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
+          old=$(readlink -f ${wrapperDir})
+          if [ -e "${wrapperDir}-tmp" ]; then
+            rm --force --recursive "${wrapperDir}-tmp"
+          fi
+          ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
+          mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
+          rm --force --recursive "$old"
+        else
+          # For initial setup
+          ln --symbolic "$wrapperDir" "${wrapperDir}"
+        fi
+      '';
+    };
+
    systemd.services."vmware-authdlauncher" = {
      description = "VMware Authentication Daemon";
      serviceConfig = {
@@ -15,7 +15,7 @@
    test-support.displayManager.auto.user = "alice";

    virtualisation.anbox.enable = true;
-    boot.kernelPackages = pkgs.linuxPackages_5_15;
+    boot.kernelPackages = pkgs.linuxKernel.packages.linux_5_15;
    virtualisation.memorySize = 2500;
  };

@@ -13,9 +13,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      '';

      # ensure the directory to be monitored exists before incron is started
-      system.activationScripts.incronTest = ''
-        mkdir /test
-      '';
+      systemd.tmpfiles.settings.incron-test = {
+        "/test".d = { };
+      };
    };

  testScript = ''
@@ -13,10 +13,12 @@ in {
    # The only thing the client needs to do is download a file.
    client = { ... }: {
      services.davfs2.enable = true;
-      system.activationScripts.davfs2-secrets = ''
-        echo "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}" > /tmp/davfs2-secrets
-        chmod 600 /tmp/davfs2-secrets
-      '';
+      systemd.tmpfiles.settings.nextcloud = {
+        "/tmp/davfs2-secrets"."f+" = {
+          mode = "0600";
+          argument = "http://nextcloud/remote.php/dav/files/${adminuser} ${adminuser} ${adminpass}";
+        };
+      };
      virtualisation.fileSystems = {
        "/mnt/dav" = {
          device = "http://nextcloud/remote.php/dav/files/${adminuser}";
@@ -32,7 +32,6 @@ in {
          adminpassFile = toString (pkgs.writeText "admin-pass-file" ''
            ${adminpass}
          '');
-          trustedProxies = [ "::1" ];
        };
        notify_push = {
          enable = true;
@@ -42,6 +41,7 @@ in {
        extraApps = {
          inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push;
        };
+        extraOptions.trusted_proxies = [ "::1" ];
      };

      services.redis.servers."nextcloud".enable = true;
@@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "g4music";
-  version = "3.3";
+  version = "3.4-1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "neithern";
    repo = "g4music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-sajA8+G1frQA0p+8RK84hvh2P36JaarmSZx/sxMoFqo=";
+    hash = "sha256-uklgxhyrnFQSUcttXvYQtm2BybRkdTK1IfaRpOp0sOE=";
  };

  nativeBuildInputs = [
@@ -2,38 +2,49 @@
 , lib
 , fetchFromGitHub
 , nix-update-script
-, autoreconfHook
-, perl
-, pkg-config
-, libsidplayfp
 , alsaSupport ? stdenv.hostPlatform.isLinux
 , alsa-lib
+, autoreconfHook
 , pulseSupport ? stdenv.hostPlatform.isLinux
 , libpulseaudio
+, libsidplayfp
 , out123Support ? stdenv.hostPlatform.isDarwin
 , mpg123
+, perl
+, pkg-config
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sidplayfp";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
-    rev = "v${version}";
-    sha256 = "sha256-ECHtHJrkJ5Y0YvDNdMM3VB+s7I/8JCPZiwsPYLM/oig=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-oV7ZPWgMEsNlsF2OoOvf7Ah5ZLcVkIDyC+PrPIJGyzQ=";
  };

-  nativeBuildInputs = [ autoreconfHook perl pkg-config ];
+  strictDeps = true;

-  buildInputs = [ libsidplayfp ]
-    ++ lib.optional alsaSupport alsa-lib
-    ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optional out123Support mpg123;
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+  ];

-  configureFlags = lib.optionals out123Support [
-    "--with-out123"
+  buildInputs = [
+    libsidplayfp
+  ] ++ lib.optionals alsaSupport [
+    alsa-lib
+  ] ++ lib.optionals pulseSupport [
+    libpulseaudio
+  ] ++ lib.optionals out123Support [
+    mpg123
+  ];
+
+  configureFlags = [
+    (lib.strings.withFeature out123Support "out123")
  ];

  enableParallelBuilding = true;
@@ -46,7 +57,8 @@ stdenv.mkDerivation rec {
    description = "A SID player using libsidplayfp";
    homepage = "https://github.com/libsidplayfp/sidplayfp";
    license = with licenses; [ gpl2Plus ];
+    mainProgram = "sidplayfp";
    maintainers = with maintainers; [ dezgeg OPNA2608 ];
    platforms = platforms.all;
  };
-}
+})
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "timeshift";
-  version = "23.12.1";
+  version = "23.12.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "timeshift";
    rev = version;
-    sha256 = "uesedEXPfvI/mRs8BiNkv8B2vVxmtTSaIvlQIsajkVg=";
+    sha256 = "xeO1/YQGRTCCGMRPr6Dqb9+89lP24fPBDBJpvtcr2X0=";
  };

  patches = [
@@ -68,10 +68,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  passthru.tests = {
-    smoke-test = nixosTests.bitcoind-knots;
-  };
-
  meta = with lib; {
    description = "A derivative of Bitcoin Core with a collection of improvements";
    homepage = "https://bitcoinknots.org/";
@@ -710,8 +710,8 @@ let
        mktplcRef = {
          name = "ruff";
          publisher = "charliermarsh";
-          version = "2023.40.0";
-          sha256 = "sha256-Ym76WtKvz18NgxH9o8O/Ozn+/AtqLvjJs8ffLhPOWkQ=";
+          version = "2023.60.0";
+          sha256 = "sha256-zxE4QcWt8M6djTbdIf0YNSpeF1w7vMK4/BW5ArCOYbE=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.32.0";
+  version = "1.33.0";

  format = "other";

@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-aF7EByUQ6CO+rXfGz4ivU18N5sh0X8nGgJT94dCuN8c=";
+    hash = "sha256-59RkynW02gxVPz48diC1Th+vtru+oHMeuArfdA2a1IU=";
  };

  nativeBuildInputs = [
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, python3, installShellFiles }:

 stdenv.mkDerivation rec {
-  version = "2.1";
+  version = "2.2";
  pname = "ddgr";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = "ddgr";
    rev = "v${version}";
-    sha256 = "sha256-D5FUhv1moQKzcLj/3VWJNs24jTXJir1dMpv59orPTtc=";
+    sha256 = "sha256-88cCQm3eViy0OwSyCTlnW7uuiFwz2/6Wz45QzxCgXxg=";
  };

  nativeBuildInputs = [ installShellFiles ];
@@ -29,13 +29,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "organicmaps";
-  version = "2023.11.17-17";
+  version = "2023.12.20-4";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    rev = "${version}-android";
-    hash = "sha256-3oGcupO49+ZXyW+ii4T+wov4qweDnLO+VkXSAIh7qJ4=";
+    hash = "sha256-9yQMBP5Jta6P/FmYL6Ek3MzU1DKtVEwlwYAkNxC5pn4=";
    fetchSubmodules = true;
  };

@@ -21,5 +21,6 @@ buildGoModule rec {
    changelog = "https://github.com/juruen/rmapi/blob/v${version}/CHANGELOG.md";
    license = licenses.agpl3Only;
    maintainers = [ maintainers.nickhu ];
+    mainProgram = "rmapi";
  };
 }
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "popeye";
-  version = "0.11.1";
+  version = "0.11.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "derailed";
    repo = "popeye";
-    sha256 = "sha256-A1jUlEgjBoiN+NYwpyW/1eYzkCK3UuPID++fu+zGvzk=";
+    sha256 = "sha256-2mLbBvdUWGspTNeU3QJzR5NDI24njvRO2nss/Bo93W8=";
  };

  ldflags = [
@@ -17,7 +17,7 @@ buildGoModule rec {
    "-X github.com/derailed/popeye/cmd.commit=${version}"
  ];

-  vendorHash = "sha256-MEsChBBn0mixgJ7pzRoqAqup75b/mVv6k3OMmzgyLC4=";
+  vendorHash = "sha256-Vt5QwggdasVk4j2huSIneBMemi3Q0R4MgZn2yNlOH5E=";

  doInstallCheck = true;
  installCheckPhase = ''
@@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution-ews";
-  version = "3.50.1";
+  version = "3.50.2";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "577S3Z/AhFf3W6ufiWJV8w/TTHu8nIqV74fi4pEqCa0=";
+    sha256 = "gYgjez2TGnOrire1c5/0Pqoky8mtjnK4I5KZ9pizHmY=";
  };

  patches = [
@@ -1,8 +1,8 @@
 diff --git a/src/EWS/calendar/e-cal-backend-ews-utils.c b/src/EWS/calendar/e-cal-backend-ews-utils.c
-index 653a8fb..ad80283 100644
+index b7c65ae..b334198 100644
 --- a/src/EWS/calendar/e-cal-backend-ews-utils.c
 +++ b/src/EWS/calendar/e-cal-backend-ews-utils.c
-@@ -2406,7 +2406,19 @@ e_cal_backend_ews_get_configured_evolution_icaltimezone (void)
+@@ -2425,7 +2425,19 @@ e_cal_backend_ews_get_configured_evolution_icaltimezone (void)
 		if (schema) {
 			GSettings *settings;
 
@@ -17,14 +17,14 @@

 stdenv.mkDerivation rec {
  pname = "planner";
-  version = "0.14.91";
+  version = "0.14.92";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "planner";
    rev = version;
-    hash = "sha256-LxctZv/CKolJ1I4Hql20E+/+p+ZoJLR1eZe34HPMqvY=";
+    hash = "sha256-2LmNeyZURVtA52Vosyn44wT8zSaJn8tR+8sPM9atAwM=";
  };

  postPatch = ''
@@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "23.12.3";
+  version = "23.12.5";
 in
 stdenv.mkDerivation {
  inherit pname appname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-cQjO5LgGDU9ZHnvKniFMBzcxgWRFfS+PQ0OSe+NFv+c=";
+    hash = "sha256-nPlaKbtG6ncHI9I/qHUFRtc98lWkz7C/VXFX/JkXhDo=";
  };

  nativeBuildInputs = [
@@ -18,17 +18,19 @@
 , indilib
 , libnova
 , qttools
+, exiv2
+, nlopt
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "stellarium";
-  version = "23.3";
+  version = "23.4";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
-    rev = "v${version}";
-    hash = "sha256-bYvGmYu9jMHk2IUICz2kCVh56Ymz8JHqurdWV+xEdJY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-rDqDs6sFaZQbqJcCRhY5w8sFM2mYHHvw0Ud2Niimg4Y=";
  };

  patches = [
@@ -66,12 +68,14 @@ stdenv.mkDerivation rec {
    qxlsx
    indilib
    libnova
+    exiv2
+    nlopt
  ] ++ lib.optionals stdenv.isLinux [
    qtwayland
  ];

  preConfigure = ''
-    export SOURCE_DATE_EPOCH=$(date -d 20${lib.versions.major version}0101 +%s)
+    export SOURCE_DATE_EPOCH=$(date -d 20${lib.versions.major finalAttrs.version}0101 +%s)
  '' + lib.optionalString stdenv.isDarwin ''
    export LC_ALL=en_US.UTF-8
  '';
@@ -89,11 +93,11 @@ stdenv.mkDerivation rec {
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  meta = with lib; {
+  meta =  {
    description = "Free open-source planetarium";
    homepage = "https://stellarium.org/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ kilianar ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kilianar ];
  };
-}
+})
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, dpkg, makeWrapper , mono, gtk-sharp-3_0
-, glib, libusb1 , zlib, gtk3-x11, callPackage
+, glib, libusb1 , zlib, gtk3-x11, callPackage, writeTextDir
 , scopes ? [
  "picocv"
  "ps2000"
@@ -114,7 +114,7 @@ in stdenv.mkDerivation rec {
  # services.udev.packages = [ pkgs.picoscope.rules ];
  # users.groups.pico = {};
  # users.users.you.extraGroups = [ "pico" ];
-  passthru.rules = lib.writeTextDir "lib/udev/rules.d/95-pico.rules" ''
+  passthru.rules = writeTextDir "lib/udev/rules.d/95-pico.rules" ''
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0ce9", MODE="664",GROUP="pico"
  '';

@@ -1,84 +1,98 @@
 { lib
-, callPackage
 , config
+, newScope
 , runCommand
 }:

 let
-  buildLua = callPackage ./buildLua.nix { };
-
  unionOfDisjoints = lib.fold lib.attrsets.unionOfDisjoint {};

-  addTests = name: drv: let
-    inherit (drv) scriptName;
-    scriptPath = "share/mpv/scripts/${scriptName}";
-    fullScriptPath = "${drv}/${scriptPath}";
+  addTests = name: drv:
+    if ! lib.isDerivation drv then
+      drv
+    else let
+      inherit (drv) scriptName;
+      scriptPath = "share/mpv/scripts/${scriptName}";
+      fullScriptPath = "${drv}/${scriptPath}";
+    in drv.overrideAttrs (old: { passthru = (old.passthru or {}) // { tests = unionOfDisjoints [
+      (old.passthru.tests or {})

-  in drv.overrideAttrs (old: { passthru = (old.passthru or {}) // { tests = unionOfDisjoints [
-    (old.passthru.tests or {})
+      {
+        scriptName-is-valid = runCommand "mpvScripts.${name}.passthru.tests.scriptName-is-valid" {
+          meta.maintainers = with lib.maintainers; [ nicoo ];
+          preferLocalBuild = true;
+        } ''
+          if [ -e "${fullScriptPath}" ]; then
+            touch $out
+          else
+            echo "mpvScripts.\"${name}\" does not contain a script named \"${scriptName}\"" >&2
+            exit 1
+          fi
+        '';
+      }

-    {
-      scriptName-is-valid = runCommand "mpvScripts.${name}.passthru.tests.scriptName-is-valid" {
-        meta.maintainers = with lib.maintainers; [ nicoo ];
-        preferLocalBuild = true;
-      } ''
-        if [ -e "${fullScriptPath}" ]; then
-          touch $out
-        else
-          echo "mpvScripts.\"${name}\" does not contain a script named \"${scriptName}\"" >&2
-          exit 1
-        fi
-      '';
-    }
+      # can't check whether `fullScriptPath` is a directory, in pure-evaluation mode
+      (with lib; optionalAttrs (! any (s: hasSuffix s drv.passthru.scriptName) [ ".js" ".lua" ".so" ]) {
+        single-main-in-script-dir = runCommand "mpvScripts.${name}.passthru.tests.single-main-in-script-dir" {
+          meta.maintainers = with lib.maintainers; [ nicoo ];
+          preferLocalBuild = true;
+        } ''
+          die() {
+            echo "$@" >&2
+            exit 1
+          }

-    # can't check whether `fullScriptPath` is a directory, in pure-evaluation mode
-    (with lib; optionalAttrs (! any (s: hasSuffix s drv.passthru.scriptName) [ ".js" ".lua" ".so" ]) {
-      single-main-in-script-dir = runCommand "mpvScripts.${name}.passthru.tests.single-main-in-script-dir" {
-        meta.maintainers = with lib.maintainers; [ nicoo ];
-        preferLocalBuild = true;
-      } ''
-        die() {
-          echo "$@" >&2
-          exit 1
-        }
+          cd "${drv}/${scriptPath}"  # so the glob expands to filenames only
+          mains=( main.* )
+          if [ "''${#mains[*]}" -eq 1 ]; then
+            touch $out
+          elif [ "''${#mains[*]}" -eq 0 ]; then
+            die "'${scriptPath}' contains no 'main.*' file"
+          else
+            die "'${scriptPath}' contains multiple 'main.*' files:" "''${mains[*]}"
+          fi
+        '';
+      })
+    ]; }; });

-        cd "${drv}/${scriptPath}"  # so the glob expands to filenames only
-        mains=( main.* )
-        if [ "''${#mains[*]}" -eq 1 ]; then
-          touch $out
-        elif [ "''${#mains[*]}" -eq 0 ]; then
-          die "'${scriptPath}' contains no 'main.*' file"
-        else
-          die "'${scriptPath}' contains multiple 'main.*' files:" "''${mains[*]}"
-        fi
-      '';
-    })
-  ]; }; });
-in
+  scope = self: let
+    inherit (self) callPackage;
+  in lib.mapAttrs addTests {
+    inherit (callPackage ./mpv.nix { })
+      acompressor autocrop autodeint autoload;
+    inherit (callPackage ./occivink.nix { })
+      blacklistExtensions seekTo;

-lib.recurseIntoAttrs
-  (lib.mapAttrs addTests ({
-    chapterskip = callPackage ./chapterskip.nix { inherit buildLua; };
-    convert = callPackage ./convert.nix { inherit buildLua; };
-    cutter = callPackage ./cutter.nix { inherit buildLua; };
+    buildLua = callPackage ./buildLua.nix { };
+    chapterskip = callPackage ./chapterskip.nix { };
+    convert = callPackage ./convert.nix { };
+    cutter = callPackage ./cutter.nix { };
    inhibit-gnome = callPackage ./inhibit-gnome.nix { };
    mpris = callPackage ./mpris.nix { };
-    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { inherit buildLua; };
-    mpv-webm = callPackage ./mpv-webm.nix { inherit buildLua; };
-    mpvacious = callPackage ./mpvacious.nix { inherit buildLua; };
-    quality-menu = callPackage ./quality-menu.nix { inherit buildLua; };
-    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { inherit buildLua; };
+    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
+    mpv-webm = callPackage ./mpv-webm.nix { };
+    mpvacious = callPackage ./mpvacious.nix { };
+    quality-menu = callPackage ./quality-menu.nix { };
+    simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
    sponsorblock = callPackage ./sponsorblock.nix { };
-    sponsorblock-minimal = callPackage ./sponsorblock-minimal.nix { inherit buildLua; };
-    thumbfast = callPackage ./thumbfast.nix { inherit buildLua; };
-    thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
-    uosc = callPackage ./uosc.nix { inherit buildLua; };
-    visualizer = callPackage ./visualizer.nix { inherit buildLua; };
+    sponsorblock-minimal = callPackage ./sponsorblock-minimal.nix { };
+    thumbfast = callPackage ./thumbfast.nix { };
+    thumbnail = callPackage ./thumbnail.nix { };
+    uosc = callPackage ./uosc.nix { };
+    visualizer = callPackage ./visualizer.nix { };
    vr-reversal = callPackage ./vr-reversal.nix { };
    webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
-  }
-  // (callPackage ./mpv.nix      { inherit buildLua; })
-  // (callPackage ./occivink.nix { inherit buildLua; })))
-  // lib.optionalAttrs config.allowAliases {
-  youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
-}
+  };
+
+  aliases = {
+    youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
+  };
+in
+
+with lib; pipe scope [
+  (makeScope newScope)
+  (self:
+    assert builtins.intersectAttrs self aliases == {};
+    self // optionalAttrs config.allowAliases aliases)
+  recurseIntoAttrs
+]
@@ -40,8 +40,8 @@ import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; } ({
    src = fetchFromGitHub {
      owner = "melpa";
      repo = "package-build";
-      rev = "c48aa078c01b4f07b804270c4583a0a58ffea1c0";
-      sha256 = "sha256-MzPj375upIiYXdQR+wWXv3A1zMqbSrZlH0taLuxx/1M=";
+      rev = "c3c535e93d9dc92acd21ebc4b15016b5c3b90e7d";
+      sha256 = "17z0wbqdd6fspbj43yq8biff6wfggk74xgnaf1xx6ynsp1i74is5";
    };

    patches = [ ./package-build-dont-use-mtime.patch ];
@@ -11,22 +11,22 @@
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)

-(defun melpa2nix-build-package-1 (rcp)
-  (let* ((default-directory (package-recipe--working-tree rcp)))
+(defun melpa2nix-build-package-1 (rcp version commit)
+  (let ((source-dir (package-recipe--working-tree rcp)))
    (unwind-protect
        (let ((files (package-build-expand-files-spec rcp t)))
-          (unless files
-            (error "Unable to find files matching recipe patterns"))
-          (if (> (length files) 1)
-              (package-build--build-multi-file-package rcp files)
-            (package-build--build-single-file-package rcp files))))))
+          (cond
+           ((= (length files) 1)
+            (package-build--build-single-file-package
+             rcp version commit files source-dir))
+           ((> (length files) 1)
+            (package-build--build-multi-file-package
+             rcp version commit files source-dir))
+           (t (error "Unable to find files matching recipe patterns")))))))

 (defun melpa2nix-build-package ()
-  (unless noninteractive
-    (error "`melpa2nix-build-package' is to be used only with -batch"))
+  (if (not noninteractive)
+      (error "`melpa2nix-build-package' is to be used only with -batch"))
  (pcase command-line-args-left
    (`(,package ,version ,commit)
-     (let ((recipe (package-recipe-lookup package)))
-       (setf (oref recipe commit) commit)
-       (setf (oref recipe version) version)
-       (melpa2nix-build-package-1 recipe)))))
+     (melpa2nix-build-package-1 (package-recipe-lookup package) version commit))))
@@ -1,21 +1,40 @@
 diff --git a/package-build.el b/package-build.el
-index 29cdb61..c19be1b 100644
+index e572045..9eb0f82 100644
 --- a/package-build.el
 +++ b/package-build.el
-@@ -923,7 +923,6 @@ DIRECTORY is a temporary directory that contains the directory
- that is put in the tarball."
-   (let* ((name (oref rcp name))
-          (version (oref rcp version))
-         (time (oref rcp time))
-          (tar (expand-file-name (concat name "-" version ".tar")
-                                 package-build-archive-dir))
-          (dir (concat name "-" version)))
-@@ -939,7 +938,7 @@ that is put in the tarball."
-        ;; prevent a reproducible tarball as described at
+@@ -415,7 +415,7 @@ (defun package-build--write-pkg-file (desc dir)
+       (princ ";; Local Variables:\n;; no-byte-compile: t\n;; End:\n"
+              (current-buffer)))))
+ 
+-(defun package-build--create-tar (name version directory mtime)
+(defun package-build--create-tar (name version directory)
+   "Create a tar file containing the contents of VERSION of package NAME.
+ DIRECTORY is a temporary directory that contains the directory
+ that is put in the tarball.  MTIME is used as the modification
+@@ -434,7 +434,7 @@ (defun package-build--create-tar (name version directory mtime)
+        ;; prevent a reproducable tarball as described at
        ;; https://reproducible-builds.org/docs/archives.
        "--sort=name"
-       (format "--mtime=@%d" time)
+-       (format "--mtime=@%d" mtime)
 +       "--mtime=@0"
        "--owner=0" "--group=0" "--numeric-owner"
        "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
     (when (and package-build-verbose noninteractive)
+@@ -848,12 +848,11 @@ (defun package-build--build-multi-file-package (rcp version commit files source-
+                            (package-build--desc-from-library
+                             name version commit files 'tar)
+                            (error "%s[-pkg].el matching package name is missing"
+-                                  name))))
+-               (mtime (package-build--get-commit-time rcp commit)))
+                                  name)))))
+           (package-build--copy-package-files files source-dir target)
+           (package-build--write-pkg-file desc target)
+           (package-build--generate-info-files files source-dir target)
+-          (package-build--create-tar name version tmp-dir mtime)
+          (package-build--create-tar name version tmp-dir)
+           (package-build--write-pkg-readme name files source-dir)
+           (package-build--write-archive-entry desc))
+       (delete-directory tmp-dir t nil))))
+-- 
+2.37.2
+
@@ -0,0 +1,43 @@
+{ lib
+, fetchurl
+, appimageTools
+, makeWrapper
+}:
+
+let
+  pname = "caido";
+  version = "0.29.2";
+  src = fetchurl {
+    url = "https://storage.googleapis.com/caido-releases/v${version}/caido-desktop-linux-v${version}-e0f8102b.AppImage";
+    hash = "sha256-4PgQK52LAX1zacmoUK0muIhrvFDF7anQ6sx35I+ErVs=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit pname src version; };
+
+in appimageTools.wrapType2 {
+  inherit pname src version;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libthai ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/caido.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/caido.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    install -m 444 -D ${appimageContents}/caido.png \
+      $out/share/icons/hicolor/512x512/apps/caido.png
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/${pname} \
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+  '';
+
+  meta = with lib; {
+    description = "A lightweight web security auditing toolkit";
+    homepage = "https://caido.io/";
+    changelog = "https://github.com/caido/caido/releases/tag/v${version}";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ octodi ];
+    mainProgram = "caido";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "git-releaser";
-  version = "0.1.1";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "git-releaser";
    repo = "git-releaser";
    rev = "refs/tags/v${version}";
-    hash = "sha256-owIXiLLnCkda9O0C0wW0nEuwXC4hipNpR9fdFqgbWts=";
+    hash = "sha256-rgnOXon68QMfVbyYhERy5z2pUlLCBwum7a/U9kdp5M0=";
  };

-  vendorHash = "sha256-dTyHKSCEImySu6Tagqvh6jDvgDbOTL0fMUOjFBpp64k=";
+  vendorHash = "sha256-O6Rqdf6yZvW8aix51oIziip+WcVIiyDZZ2VOQfwP8Fs=";

  ldflags = [ "-X main.version=${version}" ];

@@ -41,13 +41,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "icewm";
-  version = "3.4.4";
+  version = "3.4.5";

  src = fetchFromGitHub {
    owner = "ice-wm";
    repo = "icewm";
    rev = finalAttrs.version;
-    hash = "sha256-bnoNkBsNJ/6CVmm5I/nwy6LGxYhxPXssjZ3TT7FdEz8=";
+    hash = "sha256-Auuu+hRYVziAF3hXH7XSOyNlDehEKg6QmSJicY+XQLk=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, makeWrapper
+, go
+, buf
+}:
+
+buildGoModule rec {
+  pname = "ignite-cli";
+  version = "28.1.0";
+
+  src = fetchFromGitHub {
+    repo = "cli";
+    owner = "ignite";
+    rev = "v${version}";
+    hash = "sha256-/MsBVJ3aqlNfGtktjqDKGdibbZea/bdLuQbXnP3Ag0k=";
+  };
+
+  vendorHash = "sha256-VAXzwZ79TGvAoSRzjupL9XkXBn05tvaPCtRuxhls6XE=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # Many tests require access to either executables, state or networking
+  doCheck = false;
+
+  # Required for wrapProgram
+  allowGoReference = true;
+
+  # Required for commands like `ignite version`, `ignite network` and others
+  postFixup = ''
+    wrapProgram $out/bin/ignite --prefix PATH : ${lib.makeBinPath [ go buf ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://ignite.com/";
+    changelog = "https://github.com/ignite/cli/releases/tag/v${version}";
+    description = "All-in-one platform to build, launch, and maintain any crypto application on a sovereign and secured blockchain";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ kashw2 ];
+    mainProgram = "ignite";
+  };
+}
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, cmocka
+, darwin
+, fetchFromGitHub
+, gtk3
+, meson
+, ninja
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libui-ng";
+  version = "unstable-2023-12-19";
+
+  src = fetchFromGitHub {
+    owner = "libui-ng";
+    repo = "libui-ng";
+    rev = "8de4a5c8336f82310df1c6dad51cb732113ea114";
+    hash = "sha256-ZMt2pEHwxXxLWtK8Rm7hky9Kxq5ZIB0olBLf1d9wVfc=";
+  };
+
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    substituteInPlace meson.build --replace "'-arch', 'arm64'" ""
+  '';
+
+  nativeBuildInputs = [
+    cmocka
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs =
+    if stdenv.isDarwin then [
+      darwin.libobjc
+      darwin.apple_sdk_11_0.Libsystem
+      darwin.apple_sdk_11_0.frameworks.Cocoa
+      darwin.apple_sdk_11_0.frameworks.AppKit
+      darwin.apple_sdk_11_0.frameworks.CoreFoundation
+    ] else [
+      gtk3
+    ];
+
+  mesonFlags = [
+    (lib.mesonBool "examples" (!stdenv.isDarwin))
+  ];
+
+  meta = with lib; {
+    description = "A portable GUI library for C";
+    homepage = "https://github.com/libui-ng/libui-ng";
+    license = licenses.mit;
+    maintainers = with maintainers; [ marsam ];
+    platforms = platforms.all;
+  };
+}
@@ -17,7 +17,7 @@
 , openclSupport ? false
 , clblast

-, openblasSupport ? true
+, openblasSupport ? !rocmSupport
 , openblas
 , pkg-config
 }:
@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "1671";
+  version = "1710";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-OFRc3gHKQboVCsDlQVHwzEBurIsOMj/bVGYuCLilydE=";
+    hash = "sha256-fbzHjaL+qAE9HdtBVxboo8T2/KCdS5O1RkTQvDwD/xs=";
  };

  patches = [
@@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmoneta";
-  version = "0.7.2";
+  version = "0.7.3";

  src = fetchFromGitHub {
    owner = "pgmoneta";
    repo = "pgmoneta";
    rev = version;
-    hash = "sha256-4jysBL6fwX2ns+N+ldhTCXZ7L/IuXjbAwou18Ur5+JU=";
+    hash = "sha256-sErdlHXMn97acVIxKapsnLkyOAgO7lOB0UQC5GkL4sQ=";
  };

  nativeBuildInputs = [
@@ -15,16 +15,16 @@
 rustPlatform.buildRustPackage rec {

  pname = "satty";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "gabm";
    repo = "Satty";
    rev = "v${version}";
-    hash = "sha256-5FKEQUH43qx8w7s7lW8EDOWtWCUJTbWlXcMQazR8Thk=";
+    hash = "sha256-KCHKR6DP8scd9xdWi0bLw3wObrEi0tOsflXHa9f4Z5k=";
  };

-  cargoHash = "sha256-FpCmzU2C+5+5eSB5Mno+lOFd4trHXmfp6e5oV+CvU1c=";
+  cargoHash = "sha256-pUBtUC+WOuiypLUpXCPR1pu0fRrMVTxg7FE2JSaszNw=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -71,13 +71,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "6.0.2";
+  version = "6.0.3";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-/kjl/0Qdro6H3fMfs1dA0Zf/GT5Z4s6kK4vB+EBKw0g=";
+    hash = "sha256-8Y+WUnNQ4p/JeUR4q6Ti6HdoN5bghXs6XJsuWGY66S4=";
  };

  patches = [
@@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-screensaver";
-  version = "6.0.1";
+  version = "6.0.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-jWUPn5+ynuLdb2GaqKph1M62Ky00sRP/vUXedEvBT7A=";
+    hash = "sha256-6Js670Z3/5BwAHvEJrXJkBZvEvx1NeT+eXOKaqKqFqI=";
  };

  nativeBuildInputs = [
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-y-icons";
-  version = "1.7.1";
+  version = "1.7.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-Uzayo1hmNwOMszTV8/KqOLxjERBC/L16hRpCWbK10Uc=";
+    hash = "sha256-8dwJyvM5sQNtUzhreBCgSWeElGlp/z3Dk7/xCeUSGKU=";
  };

  propagatedBuildInputs = [
@@ -40,7 +40,7 @@

 stdenv.mkDerivation rec {
  pname = "muffin";
-  version = "6.0.0";
+  version = "6.0.1";

  outputs = [ "out" "dev" "man" ];

@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-17B2C3SW9smTgLBBGJc9LwFpXoP9WidZEGgI2hbJTH8=";
+    hash = "sha256-yd23naaPIa6xrdf7ipOvVZKqkr7/CMxNqDZ3CQ2QH+Y=";
  };

  patches = [
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "nemo";
-  version = "6.0.1";
+  version = "6.0.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-3iGwpHuZrRBd35nAa3x1Lu/KDS1L42y5u8A4vM41b0Q=";
+    sha256 = "sha256-vSLFp0sgqGsZtcXdv82PVH0HcBbmcxrMySLFCBrLJpA=";
  };

  patches = [
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "warpinator";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-dxbs2Qq1Ix04yIA587tntLJ3W/pnA0wTiQ4BB5GCTR0=";
+    hash = "sha256-wBln4YqjZ8aI3D4Arwa7UgDKxNPSlC5fRZtjanTHl4Q=";
  };

  nativeBuildInputs = [
@@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "xreader";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-TL8LlNQLGUevXlNcnS9HcdGh1TzC/0I/6reJpe6rahM=";
+    sha256 = "sha256-sADdslxDtI+zV8DLnczlzNtB9W+BhMP8vb5riSnPYaw=";
  };

  nativeBuildInputs = [
@@ -4,12 +4,12 @@

 let
  pname = "elixir-ls";
-  version = "0.17.10";
+  version = "0.18.1";
  src = fetchFromGitHub {
    owner = "elixir-lsp";
    repo = "elixir-ls";
    rev = "v${version}";
-    hash = "sha256-LUAYfR6MNNGLaqv8EBx0JQ8KYYD7jRvez3HJFnczV+Y=";
+    hash = "sha256-o5/H2FeDXzT/ZyWtLmRs+TWJQfmuDUnnR5Brvkifn6E=";
    fetchSubmodules = true;
  };
 in
@@ -21,7 +21,7 @@ mixRelease {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    hash = "sha256-MVGYENy6/xI/ph/X0DxquigCuLK1FAEIONzoQU7TXoM=";
+    hash = "sha256-q4VKtGxrRaAhtNIJFjNN7tF+HFgU/UX9sKq0BkOIiQI=";
  };

  # elixir-ls is an umbrella app
@@ -50,9 +50,9 @@ mixRelease {
      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
    chmod +x $out/bin/elixir-ls

-    substitute release/debugger.sh $out/bin/elixir-debugger \
+    substitute release/debug_adapter.sh $out/bin/elixir-debug-adapter \
      --replace 'exec "''${dir}/launch.sh"' "exec $out/lib/launch.sh"
-    chmod +x $out/bin/elixir-debugger
+    chmod +x $out/bin/elixir-debug-adapter
    # prepare the launcher
    substituteInPlace $out/lib/launch.sh \
      --replace "ERL_LIBS=\"\$SCRIPTPATH:\$ERL_LIBS\"" \
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "jasmin-compiler";
-  version = "2023.06.1";
+  version = "2023.06.2";

  src = fetchurl {
    url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    hash = "sha256-3+eIR8wkBlcUQVDsugHo/rHNHbE2vpE9gutp55kRY4Y=";
+    hash = "sha256-I3+MP2Q7ENOdQdvvCqcyD+I8ImF6c+9HQDpY6QUWuY8=";
  };

  sourceRoot = "jasmin-compiler-v${version}/compiler";
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage.override {

  passthru = {
    rustc = rustc;
-    inherit (rustc) tests;
+    inherit (rustc.unwrapped) tests;
  };

  # Upstream rustc still assumes that musl = static[1].  The fix for
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "joker";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-TaNuw84VCC1s2I7rmTdVKTrpT/nTrb+45haEFWf6S7k=";
+    sha256 = "sha256-sueFfR5KVj6HXR+5XWowL0Zjbuu7K+p/+skcTaXlOMc=";
  };

  vendorHash = "sha256-rxWYNGFbFUKjy232DOhVlh341GV2VKLngJKM+DEd27o=";
@@ -2,6 +2,7 @@ self: dontUse: with self;

 let
  inherit (python) pythonOnBuildForHost;
+  inherit (pkgs) runCommand;
  pythonInterpreter = pythonOnBuildForHost.interpreter;
  pythonSitePackages = python.sitePackages;
  pythonCheckInterpreter = python.interpreter;
@@ -67,7 +68,7 @@ in {
      # Such conflicts don't happen within the standard nixpkgs python package
      #   set, but in downstream projects that build packages depending on other
      #   versions of this hook's dependencies.
-      passthru.tests = import ./pypa-build-hook-tests.nix {
+      passthru.tests = import ./pypa-build-hook-test.nix {
        inherit pythonOnBuildForHost runCommand;
      };
    } ./pypa-build-hook.sh) {
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "level-zero";
-  version = "1.15.1";
+  version = "1.15.8";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "level-zero";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jf1sKFfUmeNbLtmawKISmLQK2/95XvSg40se9IEKMT0=";
+    hash = "sha256-n1dcsI2sLeB68HpI5oQ5p3zdAcSvnSY+qpHL9vp6FOk=";
  };

  nativeBuildInputs = [ cmake addOpenGLRunpath ];
@@ -4,38 +4,55 @@
 , fetchpatch
 , makeFontsConf
 , nix-update-script
+, testers
 , autoreconfHook
-, pkg-config
-, perl
-, unittest-cpp
-, xa
-, libgcrypt
-, libexsid
 , docSupport ? true
 , doxygen
 , graphviz
+, libexsid
+, libgcrypt
+, perl
+, pkg-config
+, unittest-cpp
+, xa
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libsidplayfp";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "libsidplayfp";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    sha256 = "sha256-KCp/8UjVl8e3+4s1FD4GvHP7AUAS+eIB7RWhmgm5GIA=";
+    hash = "sha256-1e1QDSJ8CjLU794saba2auCKko7p2ylrdI0JWhh8Kco=";
  };

+  outputs = [
+    "out"
+  ] ++ lib.optionals docSupport [
+    "doc"
+  ];
+
  patches = [
    # Pull autoconf-2.72 compatibility fix:
    #   https://github.com/libsidplayfp/libsidplayfp/pull/103
+    # Remove when version > 2.5.1
    (fetchpatch {
-      name = "autoconf-2.72";
-      url = "https://github.com/libsidplayfp/libsidplayfp/commit/b8fff55f6aaa005a3899b59e70cd8730f962641b.patch";
+      name = "0001-libsidplayfp-autoconf-2.72-compat.patch";
+      url = "https://github.com/libsidplayfp/libsidplayfp/commit/2b1b41beb5099d5697e3f8416d78f27634732a9e.patch";
      hash = "sha256-5Hk202IuHUBow7HnnPr2/ieWFjKDuHLQjQ9mJUML9q8=";
    })
+
+    # Fix --disable-tests logic
+    # https://github.com/libsidplayfp/libsidplayfp/pull/108
+    # Remove when version > 2.5.1
+    (fetchpatch {
+      name = "0002-libsidplayfp-Fix-autoconf-logic-for-tests-option.patch";
+      url = "https://github.com/libsidplayfp/libsidplayfp/commit/39dd2893b6186c4932d17b529bb62627b742b742.patch";
+      hash = "sha256-ErdfPvu8R81XxdHu2TaV87OpLFlRhJai51QcYUIkUZ4=";
+    })
  ];

  postPatch = ''
@@ -44,30 +61,35 @@ stdenv.mkDerivation rec {

  strictDeps = true;

-  nativeBuildInputs = [ autoreconfHook pkg-config perl xa ]
-    ++ lib.optionals docSupport [ doxygen graphviz ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+    xa
+  ] ++ lib.optionals docSupport [
+    doxygen
+    graphviz
+  ];

-  buildInputs = [ libgcrypt libexsid ];
+  buildInputs = [
+    libexsid
+    libgcrypt
+  ];

-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
-  checkInputs = [ unittest-cpp ];
+  checkInputs = [
+    unittest-cpp
+  ];

  enableParallelBuilding = true;

-  installTargets = [ "install" ]
-    ++ lib.optionals docSupport [ "doc" ];
-
-  outputs = [ "out" ]
-    ++ lib.optionals docSupport [ "doc" ];
-
  configureFlags = [
-    "--enable-hardsid"
-    "--with-gcrypt"
-    "--with-exsid"
-  ]
-  ++ lib.optional doCheck "--enable-tests";
+    (lib.strings.enableFeature true "hardsid")
+    (lib.strings.withFeature true "gcrypt")
+    (lib.strings.withFeature true "exsid")
+    (lib.strings.enableFeature finalAttrs.finalPackage.doCheck "tests")
+  ];

+  # Make Doxygen happy with the setup, reduce log noise
  FONTCONFIG_FILE = lib.optionalString docSupport (makeFontsConf { fontDirectories = [ ]; });

  preBuild = ''
@@ -75,12 +97,21 @@ stdenv.mkDerivation rec {
    export XDG_CACHE_HOME=$TMPDIR
  '';

+  buildFlags = [
+    "all"
+  ] ++ lib.optionals docSupport [
+    "doc"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
  postInstall = lib.optionalString docSupport ''
    mkdir -p $doc/share/doc/libsidplayfp
    mv docs/html $doc/share/doc/libsidplayfp/
  '';

  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
    updateScript = nix-update-script { };
  };

@@ -96,5 +127,9 @@ stdenv.mkDerivation rec {
    license = with licenses; [ gpl2Plus ];
    maintainers = with maintainers; [ ramkromberg OPNA2608 ];
    platforms = platforms.all;
+    pkgConfigModules = [
+      "libsidplayfp"
+      "libstilview"
+    ];
  };
-}
+})
@@ -0,0 +1,13 @@
+diff --git a/include/internal/common.h b/include/internal/common.h
+index 15666f1..d91e25b 100644
+--- a/include/internal/common.h
+++ b/include/internal/common.h
+@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
+#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
@@ -0,0 +1,13 @@
+diff --git a/include/internal/common.h b/include/internal/common.h
+index 15666f1..d91e25b 100644
+--- a/include/internal/common.h
+++ b/include/internal/common.h
+@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr,
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
+#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
@@ -234,6 +234,13 @@ let
  });

 in {
+  # intended version "policy":
+  # - 1.1 as long as some package exists, which does not build without it
+  # - latest 3.x LTS
+  # - latest 3.x non-LTS as preview/for development
+  #
+  # - other versions in between only when reasonable need is stated for some package
+  # - backport every security critical fix release e.g. 3.0.y -> 3.0.y+1 but no new version, e.g. 3.1 -> 3.2

  # If you do upgrade here, please update in pkgs/top-level/release.nix
  # the permitted insecure version to ensure it gets cached for our users
@@ -279,9 +286,9 @@ in {
    };
  };

-  openssl_3_1 = common {
-    version = "3.1.4";
-    hash = "sha256-hAr1Nmq5tSK95SWCa+PvD7Cvgcap69hMqmAP6hcx7uM=";
+  openssl_3_2 = common {
+    version = "3.2.0";
+    hash = "sha256-FMgm8Hx+QzcG+1xp+p4l2rlWhIRLTJYqLPG/GD60aQ4=";

    patches = [
      ./3.0/nix-ssl-cert-file.patch
@@ -291,8 +298,8 @@ in {
      ./3.0/openssl-disable-kernel-detection.patch

      (if stdenv.hostPlatform.isDarwin
-       then ./use-etc-ssl-certs-darwin.patch
-       else ./use-etc-ssl-certs.patch)
+       then ./3.2/use-etc-ssl-certs-darwin.patch
+       else ./3.2/use-etc-ssl-certs.patch)
    ];

    withDocs = true;
@@ -3290,18 +3290,18 @@ buildLuarocksPackage {
 toml-edit = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luarocks-build-rust-mlua }:
 buildLuarocksPackage {
  pname = "toml-edit";
-  version = "0.1.4-1";
+  version = "0.1.5-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/toml-edit-0.1.4-1.rockspec";
-    sha256 = "05bcc1xafcspdf1rcka9bhg7b6z617b4jrcahs1r7grcp78w89vf";
+    url    = "mirror://luarocks/toml-edit-0.1.5-1.rockspec";
+    sha256 = "1xgjh8x44kn24vc29si811zq2a7pr24zqj4w07pys5k6ccnv26qz";
  }).outPath;
  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
  "url": "https://github.com/vhyrro/toml-edit.lua",
-  "rev": "f6efdab4ca6fab276f172060971781dc42a94f2d",
-  "date": "2023-10-02T16:54:10+02:00",
-  "path": "/nix/store/p1368agmqg4jwb1qvf2iff3fdrq9vkdj-toml-edit.lua",
-  "sha256": "1aa8znjnmm84392gnl7w0hm069xfv7niym3i8my7kyk0vdgxja06",
-  "hash": "sha256-BijZX9tg+nl8RXFUH+3ZricDKgT8UPtEGgTVaqX9SKk=",
+  "rev": "34f072d8ff054b3124d9d2efc0263028d7425525",
+  "date": "2023-12-29T15:53:36+01:00",
+  "path": "/nix/store/z1gn59hz9ypk3icn3gmafaa19nzx7a1v-toml-edit.lua",
+  "sha256": "0jzzp4sd48haq1kmh2k85gkygfq39i10kvgjyqffcrv3frdihxvx",
+  "hash": "sha256-fXcYW3ZjZ+Yc9vLtCUJMA7vn5ytoClhnwAoi0jS5/0s=",
  "fetchLFS": false,
  "fetchSubmodules": true,
  "deepClone": false,
@@ -618,7 +618,7 @@ with prev;

    cargoDeps = rustPlatform.fetchCargoTarball {
      src = oa.src;
-      hash = "sha256-pLAisfnSDoAToQO/kdKTdic6vEug7/WFNtgOfj0bRAE=";
+      hash = "sha256-gvUqkLOa0WvAK4GcTkufr0lC2BOs2FQ2bgFpB0qa47k=";
    };

    nativeBuildInputs = oa.nativeBuildInputs ++ [ cargo rustPlatform.cargoSetupHook ];
@@ -2,7 +2,7 @@
 , stdenv
 , cmake
 , fetchFromGitHub
-, static ? stdenv.hostPlatform.isStatic
+, withFilters ? false
 }:

 let
@@ -18,16 +18,19 @@ let
        inherit hash;
      };

+      outputs = [ "out" "dev" ];
+
      nativeBuildInputs = [ cmake ];

      cmakeFlags = [
-        "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+        "-DBUILD_SHARED_LIBS=ON"
        "-DBUILD_BENCHMARKS=OFF"
        "-DBUILD_FUZZERS=OFF"
        "-DBUILD_GENERATORS=OFF"
        "-DENABLE_COVERAGE=OFF"
        "-DENABLE_FORMAT=OFF"
        "-DENABLE_LINTING=OFF"
+        (lib.cmakeBool "BUILD_FILTERS" withFilters)
      ];

      meta = with lib; {
@@ -11,6 +11,7 @@
 , packaging
 , psutil
 , pyyaml
+, safetensors
 , torch
 , evaluate
 , parameterized
@@ -19,26 +20,18 @@

 buildPythonPackage rec {
  pname = "accelerate";
-  version = "0.24.1";
-  format = "pyproject";
+  version = "0.25.0";
+  pyproject = true;
+
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-DKyFb+4DUMhVUwr+sgF2IaJS9pEj2o2shGYwExfffWg=";
+    hash = "sha256-WIMOSfo9fGbevMkUHvFsA51SOiGkBO1cK388FudRDY0=";
  };

-  patches = [
-    # https://github.com/huggingface/accelerate/pull/2121
-    (fetchpatch {
-      name = "fix-import-error-without-torch_distributed.patch";
-      url = "https://github.com/huggingface/accelerate/commit/42048092eabd67a407ea513a62f2acde97079fbc.patch";
-      hash = "sha256-9lvnU6z5ZEFc5RVw2bP0cGVyrwAp/pxX4ZgnmCN7qH8=";
-    })
-  ];
-
  nativeBuildInputs = [ setuptools ];

  propagatedBuildInputs = [
@@ -46,6 +39,7 @@ buildPythonPackage rec {
    packaging
    psutil
    pyyaml
+    safetensors
    torch
  ];

@@ -83,9 +77,6 @@ buildPythonPackage rec {
  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
    # RuntimeError: torch_shm_manager: execl failed: Permission denied
    "CheckpointTest"
-  ] ++ lib.optionals (pythonAtLeast "3.11") [
-    # python3.11 not yet supported for torch.compile
-    "test_dynamo_extract_model"
  ];

  disabledTestPaths = lib.optionals (!(stdenv.isLinux && stdenv.isx86_64)) [
@@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.81";
+  version = "9.2.82";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-ovV6BlhED9Du/jKQzgBFSp+XPYVAkNONU5iOEd52e2s=";
+    hash = "sha256-jDejI5e2ASoQUMPS9Ajis14RF66HnbkoOK6+Xs8ydis=";
  };

  nativeBuildInputs = [
@@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.81";
+  version = "9.2.82";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ckak602Uz8YqBDVmh3iDh9d9/SPNRZMil8PskUbrjLA=";
+    hash = "sha256-3DqR1p2VK9Xe2Yk+gZ81GM4Cn39TDrx1LSivu4xVDOI=";
  };

  propagatedBuildInputs = [
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.81";
+  version = "9.2.82";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-e/13v2hm0yYoO2A/kz6ekvN1FP8XNqqypfZdHKGEItM=";
+    hash = "sha256-uK42wbP6zZFRR6JqHs3Ag5zsPT9JFyKviDRxLDa1QjY=";
  };

  nativeBuildInputs = [
@@ -31,7 +31,7 @@ buildPythonPackage rec {
      cp39 = "sha256-BzMOVue7E1S1+5+XTcPELko81ujc9MbmqLhNsU7pqO0=";
      cp310 = "sha256-eUD9pQu9GsbV8MPD1MiF3Ihr+zYioSOo6P15hYIwPYo=";
      cp311 = "sha256-rAmkI3EIZPYiXrxFowfDC0Gf3kRw0uX0i6Kx6Zu+hNM=";
-    }.${pyShortVersion};
+    }.${pyShortVersion} or (throw "${pname} is missing hash for ${pyShortVersion}");
  };

  propagatedBuildInputs = [
@@ -8,13 +8,11 @@
 , numba
 , numpy
 , pandas
-, pytest
 , setuptools
 , cloudpickle
 , pytestCheckHook
 , scipy
 , packaging
-, typing-extensions
 , pythonOlder
 , xarray
 , xarray-einstats
@@ -33,7 +31,7 @@

 buildPythonPackage rec {
  pname = "arviz";
-  version = "0.16.1";
+  version = "0.17.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -42,7 +40,7 @@ buildPythonPackage rec {
    owner = "arviz-devs";
    repo = "arviz";
    rev = "refs/tags/v${version}";
-    hash = "sha256-kixWGj0M0flTq5rXSiPB0nfZaGYRvvMBGAJpehdW8KY=";
+    hash = "sha256-DqVwbiNJHdRxK3Ppfa6sqPJzDqMaj1mtlAJHFq09u2Y=";
  };

  propagatedBuildInputs = [
@@ -86,6 +84,7 @@ buildPythonPackage rec {

  disabledTests = [
    # Tests require network access
+    "test_plot_ppc_transposed"
    "test_plot_separation"
    "test_plot_trace_legend"
    "test_cov"
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pybind11
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "binary2strings";
+  version = "0.1.13";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "glmcdona";
+    repo = "binary2strings";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-3UPT0PdnPAhOu3J2vU5NxE3f4Nb1zwuX3hJiy87nLD0=";
+  };
+
+  nativeBuildInputs = [
+    pybind11
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "binary2strings"
+  ];
+
+  pytestFlagsArray = [
+    "tests/test.py"
+  ];
+
+  meta = with lib; {
+    description = "Module to extract Ascii, Utf8, and Unicode strings from binary data";
+    homepage = "https://github.com/glmcdona/binary2strings";
+    changelog = "https://github.com/glmcdona/binary2strings/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "clarifai-grpc";
-  version = "9.11.2";
+  version = "9.11.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Clarifai";
    repo = "clarifai-python-grpc";
    rev = "refs/tags/${version}";
-    hash = "sha256-ImfZ5g/EhAqkP4CbA7AZHWHQ88KBVCwMVU/j0OQCilg=";
+    hash = "sha256-uCXtd9m2phIgP85syIPtoFIxM9dkBzFxxK6OOF0VWAA=";
  };

  nativeBuildInputs = [
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.81";
+  version = "9.2.82";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6DqIeLoJzpONte4WHI5EeV3iDDh1lNhegrNiKIgSAbY=";
+    hash = "sha256-veJd3M2Jf6snXZsR4P0wQpC0rSbIFT92QgyFFI5Er4Y=";
  };

  nativeBuildInputs = [
@@ -16,14 +16,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.81";
+  version = "9.2.82";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-42J6uBM5Ek1uv5gc4ZwtWpVgUdS3Sd4Y+ge2hkG8QTA=";
+    hash = "sha256-fUp0nS4ILU90uvROH3qNy3kYrpt7yHzbCG5TE/0BqKU=";
  };

 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-NS3yi5Ysu0s5PcqnLYOUYI0qpfOX4/E/UDmReX7aNGM=";
+    hash = "sha256-wzRHYgnZPLDgcf1IlXxY2a52mbeImejj/F8DUAuB1VU=";
  };

  nativeBuildInputs = [
@@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "cloudpathlib";
-  version = "0.16.0";
+  version = "0.17.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -29,8 +29,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "drivendataorg";
    repo = "cloudpathlib";
-    rev = "v${version}";
-    hash = "sha256-d4CbzPy3H5HQ4YmSRCRMEYaTpwB7F0Bznd26aKWiHTA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rj8v4EUMPdB5zmbP4VQli2H6GjDor3BHaA95GwoKS5E=";
  };

  nativeBuildInputs = [
@@ -6,34 +6,46 @@
 , fetchPypi
 , knack
 , pythonRelaxDepsHook
-, setuptools-scm }:
+, setuptools-scm
+}:

 buildPythonPackage rec {
  pname = "dvc-azure";
-  version = "2.22.1";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-v3VRCN1OoST5RlfUOP9Dpfmf3o9C/ckusmh91Ya2Cik=";
+    hash = "sha256-TB7yY5b2AWBFt8+AnxyKyP6hoXi6cdHVjtffapRVfHc=";
  };

  # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];

-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];

  propagatedBuildInputs = [
-    adlfs azure-identity dvc-objects knack
+    adlfs
+    azure-identity
+    dvc-objects
+    knack
  ];

  # Network access is needed for tests
  doCheck = false;

-  pythonImportsCheck = [ "dvc_azure" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_azure"
+  # ];

  meta = with lib; {
-    description = "azure plugin for dvc";
+    description = "Azure plugin for dvc";
    homepage = "https://pypi.org/project/dvc-azure/${version}";
    changelog = "https://github.com/iterative/dvc-azure/releases/tag/${version}";
    license = licenses.asl20;
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "dvc-data";
-  version = "3.0.1";
+  version = "3.5.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = "dvc-data";
    rev = "refs/tags/${version}";
-    hash = "sha256-OySGTJFHBb+Ot5NUZsQZ4gJkbc6ojrSyDWDPp32q74E=";
+    hash = "sha256-vLSb+RIaebF+ili+6bvU8wplcpycPVRadUkhkLHdqi8=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -4,29 +4,41 @@
 , fetchPypi
 , gcsfs
 , pythonRelaxDepsHook
-, setuptools-scm }:
+, setuptools-scm
+}:

 buildPythonPackage rec {
  pname = "dvc-gs";
-  version = "2.22.1";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-IKDwdSfolZwv8TvHHicVV42PYeULhskv8csbkiJzLbk=";
+    hash = "sha256-5UMKKX+4GCNm98S8kQsasQTY5cwi9hGhm84FFl3/7NQ=";
  };

  # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];

-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];

-  propagatedBuildInputs = [ gcsfs dvc-objects ];
+  propagatedBuildInputs = [
+    gcsfs
+    dvc-objects
+  ];

  # Network access is needed for tests
  doCheck = false;

-  pythonImportsCheck = [ "dvc_gs" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_gs"
+  # ];

  meta = with lib; {
    description = "gs plugin for dvc";
@@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "dvc-objects";
-  version = "2.0.1";
+  version = "3.0.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = "dvc-objects";
    rev = "refs/tags/${version}";
-    hash = "sha256-nxZN0Q9mRAZJUOoxfE58lXZVOrY0r05iROcuo+nV99A=";
+    hash = "sha256-hpiDbECVXbBkewJa+RwrgTQFEFAb3Ir2qs0ENYuJtwI=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -7,36 +7,48 @@
 , flatten-dict
 , pythonRelaxDepsHook
 , s3fs
-, setuptools-scm }:
+, setuptools-scm
+}:

 buildPythonPackage rec {
  pname = "dvc-s3";
-  version = "2.23.0";
-  format = "setuptools";
+  version = "3.0.1";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-HyhZj1sN70o1CTNCiroGKjaMk7tBGqPG2PRsrnm1uVc=";
+    hash = "sha256-ax2Wsjfvu4hoF99eDPT2sbFhl30wuYtGdEonYCCkJMY=";
  };

  # Prevent circular dependency
-  pythonRemoveDeps = [ "dvc" ];
+  pythonRemoveDeps = [
+    "dvc"
+  ];

  # dvc-s3 uses boto3 directly, we add in propagatedBuildInputs
  postPatch = ''
    substituteInPlace setup.cfg --replace 'aiobotocore[boto3]' 'aiobotocore'
  '';

-  nativeBuildInputs = [ setuptools-scm pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    setuptools-scm
+    pythonRelaxDepsHook
+  ];

  propagatedBuildInputs = [
-    aiobotocore boto3 dvc-objects flatten-dict s3fs
+    aiobotocore
+    boto3
+    dvc-objects
+    flatten-dict s3fs
  ];

  # Network access is needed for tests
  doCheck = false;

-  pythonImportsCheck = [ "dvc_s3" ];
+  # Circular dependency
+  # pythonImportsCheck = [
+  #   "dvc_s3"
+  # ];

  meta = with lib; {
    description = "s3 plugin for dvc";
@@ -55,14 +55,14 @@

 buildPythonPackage rec {
  pname = "dvc";
-  version = "3.33.4";
+  version = "3.37.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-NWu12FVJDSSuxYGVWFNlbAEUINg05s64EJ6gIaErQ9E=";
+    hash = "sha256-mO6fhPUub09nWmiFSciwNhuS4VJAjQgIukc+lQWB7Qg=";
  };

  pythonRelaxDeps = [
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "dvclive";
-  version = "3.4.1";
+  version = "3.5.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-apk1akdFLtps5fq28GUgLef2VEgZulj7vuhxsGpCqJE=";
+    hash = "sha256-QsA8HZ6wIWKvtQ+f3nyRKKZRNJS56eZ1sKw+KNHxfXc=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "gpxpy";
-  version = "1.5.0";
+  version = "1.6.2";
  format = "setuptools";
  disabled = pythonOlder "3.6";

@@ -10,7 +10,7 @@ buildPythonPackage rec {
    owner = "tkrajina";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Fkl2dte1WkPi2hBOdT23BMfNflR0j4GeNH86d46WNQk=";
+    hash = "sha256-s65k0u4LIwHX9RJMJIYMkNS4/Z0wstzqYVPAjydo2iI=";
  };

  propagatedBuildInputs = [ lxml ];
@@ -50,7 +50,7 @@ buildPythonPackage rec {
  prePatch =
    let
      cmakeCommands = ''
-        include_directories(${h3}/include/h3)
+        include_directories(${lib.getDev h3}/include/h3)
        link_directories(${h3}/lib)
      '';
    in ''
@@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "ipykernel";
-  version = "6.27.1";
+  version = "6.28.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fV1ZS2aQZUtNKZ7bpehy3Be7c5ao0GCcl8t7ihxgXeY=";
+    hash = "sha256-acEUA9Jt5p3wIiWRb5FrN+pLmvQX2gqMgn+EMo2I5fM=";
  };

  # debugpy is optional, see https://github.com/ipython/ipykernel/pull/767
@@ -68,6 +68,7 @@ buildPythonPackage rec {
  meta = {
    description = "IPython Kernel for Jupyter";
    homepage = "https://ipython.org/";
+    changelog = "https://github.com/ipython/ipykernel/releases/tag/v${version}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ fridh ] ++ lib.teams.jupyter.members;
  };
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "langsmith";
-  version = "0.0.72";
+  version = "0.0.75";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "langchain-ai";
    repo = "langsmith-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-o7KERA+fYo69jR8LSsa901nE1r3GD38rYO7sj0QsOgM=";
+    hash = "sha256-BbDB3xP3OCRXxbOqFIzFNrpK5+wHbIZ/VlurNXrXpTw=";
  };

  sourceRoot = "${src.name}/python";
@@ -1,22 +1,27 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "ndms2-client";
-  version = "0.1.2";
+  version = "0.1.3";

-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "foxel";
    repo = "python_ndms2_client";
    rev = version;
-    hash = "sha256-cM36xNLymg5Xph3bvbUGdAEmMABJ9y3/w/U8re6ZfB4=";
+    hash = "sha256-A19olC1rTHTy0xyeSP45fqvv9GUynQSrMgXBgW8ySOs=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  nativeCheckInputs = [
    pytestCheckHook
  ];
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "nsz";
-  version = "4.6.0";
+  version = "4.6.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "nicoboss";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-2Df+xvfDHtZt3XW4ShKZFsjsFigW+3Avz8uStVtC1i4=";
+    hash = "sha256-ch4HzQFa95o3HMsi7R0LpPWmhN/Z9EYfrmCdUZLwPSE=";
  };

  propagatedBuildInputs = [
@@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "oelint-parser";
-  version = "2.12.1";
+  version = "2.12.3";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "oelint_parser";
-    hash = "sha256-So9Kyj4jMRiaBRQGXE88DSWgLEPqQkv8R/Sd8tyRvE0=";
+    hash = "sha256-fzHEy9/BxstPAYhVTG0o7Gn2D9UKuSZvI0X5ynZ+oEk=";
  };

  buildInputs = [ pip ];
@@ -0,0 +1,69 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, setuptools
+, numpy
+, pydicom
+, pylibjpeg-libjpeg
+}:
+
+let
+  pylibjpeg-data = buildPythonPackage rec {
+    pname = "pylibjpeg-data";
+    version = "1.0.0dev0";
+    pyproject = true;
+
+    nativeBuildInputs = [ setuptools ];
+
+    src = fetchFromGitHub {
+      owner = "pydicom";
+      repo = "pylibjpeg-data";
+      rev = "2ab4b8a65b070656eca2582bd23197a3d01cdccd";
+      hash = "sha256-cFE1XjrqyGqwHCYGRucXK+q4k7ftUIbYwBw4WwIFtEc=";
+    };
+
+    doCheck = false;
+  };
+in
+
+buildPythonPackage rec {
+  pname = "pylibjpeg";
+  version = "1.4.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pydicom";
+    repo = "pylibjpeg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Px1DyYDkKAUdYo+ZxZ1w7TkPzWN++styiFl02iQOvyQ=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [ numpy ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pydicom
+    pylibjpeg-data
+    pylibjpeg-libjpeg
+  ];
+
+  pythonImportsCheck = [ "pylibjpeg" ];
+
+  meta = with lib; {
+    description = "Python framework for decoding JPEG images, with a focus on supporting Pydicom";
+    homepage = "https://github.com/pydicom/pylibjpeg";
+    changelog = "https://github.com/pydicom/pylibjpeg/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+    # several test failures of form
+    # "pydicom.errors.InvalidDicomError: File is missing DICOM File Meta Information header or the 'DICM' prefix is missing from the header. ..."
+    broken = stdenv.isDarwin;
+  };
+}
--- a/Show More
+++ b/Show More