Merge 31a7a9ee76 into haskell-updates

lib/systems/default.nix

@@ -389,6 +389,8 @@ let
               "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
             else if final.isWasi then
               "${pkgs.wasmtime}/bin/wasmtime"
+            else if final.isGhcjs then
+              "${pkgs.nodejs-slim}/bin/node"
             else if final.isMmix then
               "${pkgs.mmixware}/bin/mmix"
             else

maintainers/maintainer-list.nix

@@ -25159,6 +25159,13 @@
     githubId = 94006354;
     name = "steamwalker";
   };
+  Stebalien = {
+    email = "steven@stebalien.com";
+    github = "Stebalien";
+    githubId = 310393;
+    name = "Steven Allen";
+    keys = [ { fingerprint = "327B 20CE 21EA 68CF A774  8675 7C92 3221 5899 410C"; } ];
+  };
   steeleduncan = {
     email = "steeleduncan@hotmail.com";
     github = "steeleduncan";

maintainers/team-list.nix

@@ -300,6 +300,7 @@ with lib.maintainers;
 
   gitlab = {
     members = [
+      gabyx
       krav
       leona
       talyz

nixos/modules/services/databases/influxdb.nix

@@ -7,106 +7,7 @@
 let
   cfg = config.services.influxdb;
 
-  configOptions = lib.recursiveUpdate {
-    meta = {
-      bind-address = ":8088";
-      commit-timeout = "50ms";
-      dir = "${cfg.dataDir}/meta";
-      election-timeout = "1s";
-      heartbeat-timeout = "1s";
-      hostname = "localhost";
-      leader-lease-timeout = "500ms";
-      retention-autocreate = true;
-    };
-
-    data = {
-      dir = "${cfg.dataDir}/data";
-      wal-dir = "${cfg.dataDir}/wal";
-      max-wal-size = 104857600;
-      wal-enable-logging = true;
-      wal-flush-interval = "10m";
-      wal-partition-flush-delay = "2s";
-    };
-
-    cluster = {
-      shard-writer-timeout = "5s";
-      write-timeout = "5s";
-    };
-
-    retention = {
-      enabled = true;
-      check-interval = "30m";
-    };
-
-    http = {
-      enabled = true;
-      auth-enabled = false;
-      bind-address = ":8086";
-      https-enabled = false;
-      log-enabled = true;
-      pprof-enabled = false;
-      write-tracing = false;
-    };
-
-    monitor = {
-      store-enabled = false;
-      store-database = "_internal";
-      store-interval = "10s";
-    };
-
-    admin = {
-      enabled = true;
-      bind-address = ":8083";
-      https-enabled = false;
-    };
-
-    graphite = [
-      {
-        enabled = false;
-      }
-    ];
-
-    udp = [
-      {
-        enabled = false;
-      }
-    ];
-
-    collectd = [
-      {
-        enabled = false;
-        typesdb = "${pkgs.collectd-data}/share/collectd/types.db";
-        database = "collectd_db";
-        bind-address = ":25826";
-      }
-    ];
-
-    opentsdb = [
-      {
-        enabled = false;
-      }
-    ];
-
-    continuous_queries = {
-      enabled = true;
-      log-enabled = true;
-      recompute-previous-n = 2;
-      recompute-no-older-than = "10m";
-      compute-runs-per-interval = 10;
-      compute-no-more-than = "2m";
-    };
-
-    hinted-handoff = {
-      enabled = true;
-      dir = "${cfg.dataDir}/hh";
-      max-size = 1073741824;
-      max-age = "168h";
-      retry-rate-limit = 0;
-      retry-interval = "1s";
-    };
-  } cfg.extraConfig;
-
-  configFile = (pkgs.formats.toml { }).generate "config.toml" configOptions;
+  settingsFormat = pkgs.formats.toml { };
 in
 {
 
@@ -116,11 +17,7 @@ in
 
     services.influxdb = {
 
-      enable = lib.mkOption {
-        default = false;
-        description = "Whether to enable the influxdb server";
-        type = lib.types.bool;
-      };
+      enable = lib.mkEnableOption "the influxdb server";
 
       package = lib.mkPackageOption pkgs "influxdb" { };
 
@@ -142,10 +39,116 @@ in
         type = lib.types.path;
       };
 
-      extraConfig = lib.mkOption {
+      settings = lib.mkOption {
         default = { };
         description = "Extra configuration options for influxdb";
-        type = lib.types.attrs;
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          config =
+            let
+              mkAllOptionDefault = lib.mapAttrs (n: lib.mkOptionDefault);
+            in
+            {
+              meta = mkAllOptionDefault {
+                bind-address = ":8088";
+                commit-timeout = "50ms";
+                dir = "${cfg.dataDir}/meta";
+                election-timeout = "1s";
+                heartbeat-timeout = "1s";
+                hostname = "localhost";
+                leader-lease-timeout = "500ms";
+                retention-autocreate = true;
+              };
+
+              data = mkAllOptionDefault {
+                dir = "${cfg.dataDir}/data";
+                wal-dir = "${cfg.dataDir}/wal";
+                max-wal-size = 104857600;
+                wal-enable-logging = true;
+                wal-flush-interval = "10m";
+                wal-partition-flush-delay = "2s";
+              };
+
+              cluster = mkAllOptionDefault {
+                shard-writer-timeout = "5s";
+                write-timeout = "5s";
+              };
+
+              retention = mkAllOptionDefault {
+                enabled = true;
+                check-interval = "30m";
+              };
+
+              http = mkAllOptionDefault {
+                enabled = true;
+                auth-enabled = false;
+                bind-address = ":8086";
+                https-enabled = false;
+                log-enabled = true;
+                pprof-enabled = false;
+                write-tracing = false;
+              };
+
+              monitor = mkAllOptionDefault {
+                store-enabled = false;
+                store-database = "_internal";
+                store-interval = "10s";
+              };
+
+              admin = mkAllOptionDefault {
+                enabled = true;
+                bind-address = ":8083";
+                https-enabled = false;
+              };
+
+              # We can't make lists sensibly overrideable, so you have to override
+              # them whole
+              graphite = lib.mkOptionDefault [
+                {
+                  enabled = false;
+                }
+              ];
+
+              udp = lib.mkOptionDefault [
+                {
+                  enabled = false;
+                }
+              ];
+
+              collectd = lib.mkOptionDefault [
+                {
+                  enabled = false;
+                  typesdb = "${pkgs.collectd-data}/share/collectd/types.db";
+                  database = "collectd_db";
+                  bind-address = ":25826";
+                }
+              ];
+
+              opentsdb = lib.mkOptionDefault [
+                {
+                  enabled = false;
+                }
+              ];
+
+              continuous_queries = mkAllOptionDefault {
+                enabled = true;
+                log-enabled = true;
+                recompute-previous-n = 2;
+                recompute-no-older-than = "10m";
+                compute-runs-per-interval = 10;
+                compute-no-more-than = "2m";
+              };
+
+              hinted-handoff = mkAllOptionDefault {
+                enabled = true;
+                dir = "${cfg.dataDir}/hh";
+                max-size = 1073741824;
+                max-age = "168h";
+                retry-rate-limit = 0;
+                retry-interval = "1s";
+              };
+            };
+        };
       };
     };
   };
@@ -163,17 +166,16 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       serviceConfig = {
-        ExecStart = ''${cfg.package}/bin/influxd -config "${configFile}"'';
+        ExecStart = ''${cfg.package}/bin/influxd -config "${settingsFormat.generate "config.toml" cfg.settings}"'';
         User = cfg.user;
         Group = cfg.group;
         Restart = "on-failure";
       };
       postStart =
         let
-          scheme = if configOptions.http.https-enabled then "-k https" else "http";
-          bindAddr = (ba: if lib.hasPrefix ":" ba then "127.0.0.1${ba}" else "${ba}") (
-            toString configOptions.http.bind-address
-          );
+          scheme = if cfg.settings.http.https-enabled or false then "-k https" else "http";
+          inherit (cfg.settings.http) bind-address;
+          bindAddr = if lib.hasPrefix ":" bind-address then "127.0.0.1${bind-address}" else bind-address;
         in
         lib.mkBefore ''
           until ${pkgs.curl.bin}/bin/curl -s -o /dev/null ${scheme}://${bindAddr}/ping; do
@@ -182,7 +184,7 @@ in
         '';
     };
 
-    users.users = lib.optionalAttrs (cfg.user == "influxdb") {
+    users.users = lib.mkIf (cfg.user == "influxdb") {
       influxdb = {
         uid = config.ids.uids.influxdb;
         group = "influxdb";
@@ -190,9 +192,16 @@ in
       };
     };
 
-    users.groups = lib.optionalAttrs (cfg.group == "influxdb") {
+    users.groups = lib.mkIf (cfg.group == "influxdb") {
       influxdb.gid = config.ids.gids.influxdb;
     };
   };
 
+  imports = [
+    # FIXME remove after 26.11
+    (lib.mkRenamedOptionModule
+      [ "services" "influxdb" "extraConfig" ]
+      [ "services" "influxdb" "settings" ]
+    )
+  ];
 }

nixos/modules/services/display-managers/generic.nix

@@ -51,6 +51,8 @@ in
       '')
     ];
 
+    services.displayManager.enable = true;
+
     systemd.services.display-manager = {
       description = "Display Manager";
       after = [

nixos/modules/services/display-managers/ly.nix

@@ -17,13 +17,14 @@ let
   iniFmt = pkgs.formats.iniWithGlobalSection { };
 
   inherit (lib)
-    concatMapStrings
     attrNames
+    concatMapStrings
     getAttr
     mkIf
     mkOption
     mkEnableOption
     mkPackageOption
+    optionalAttrs
     ;
 
   xserverWrapper = pkgs.writeShellScript "xserver-wrapper" ''
@@ -47,6 +48,11 @@ let
     setup_cmd = dmcfg.sessionData.wrapper;
     brightness_up_cmd = "${lib.getExe pkgs.brightnessctl} -q -n s +10%";
     brightness_down_cmd = "${lib.getExe pkgs.brightnessctl} -q -n s 10%-";
+  }
+  // optionalAttrs dmcfg.autoLogin.enable {
+    auto_login_service = "ly-autologin";
+    auto_login_session = dmcfg.sessionData.autologinSession;
+    auto_login_user = dmcfg.autoLogin.user;
   };
 
   finalConfig = defaultConfig // cfg.settings;
@@ -84,17 +90,32 @@ in
 
     assertions = [
       {
-        assertion = !dmcfg.autoLogin.enable;
+        assertion = dmcfg.autoLogin.enable -> dmcfg.sessionData.autologinSession != null;
         message = ''
-          ly doesn't support auto login.
+          ly auto-login requires that services.displayManager.defaultSession is set.
         '';
       }
     ];
 
-    security.pam.services.ly = {
-      startSession = true;
-      unixAuth = true;
-      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+    security.pam.services = {
+      ly = {
+        startSession = true;
+        unixAuth = true;
+        enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+      };
+    }
+    // optionalAttrs dmcfg.autoLogin.enable {
+      ly-autologin.text = ''
+        auth      requisite pam_nologin.so
+        auth      required  pam_succeed_if.so uid >= 1000 quiet
+        auth      required  pam_permit.so
+
+        account   include   ly
+
+        password  include   ly
+
+        session   include   ly
+      '';
     };
 
     environment = {

nixos/modules/services/matrix/continuwuity.nix

@@ -11,6 +11,10 @@ let
 
   format = pkgs.formats.toml { };
   configFile = format.generate "continuwuity.toml" cfg.settings;
+
+  conduwuitWrapper = pkgs.writeShellScriptBin "conduwuit" ''
+    exec ${lib.getExe cfg.package} --config ${configFile} "$@"
+  '';
 in
 {
   meta.maintainers = with lib.maintainers; [
@@ -169,9 +173,22 @@ in
         for details on supported values.
       '';
     };
+
+    admin = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = cfg.enable;
+        defaultText = lib.literalExpression "config.services.matrix-continuwuity.enable";
+        description = "Add conduwuit command to PATH for administration";
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    environment = lib.mkIf cfg.admin.enable {
+      systemPackages = [ conduwuitWrapper ];
+    };
+
     assertions = [
       {
         assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);

nixos/modules/services/networking/coredns.nix

@@ -42,7 +42,6 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        PermissionsStartOnly = true;
         LimitNPROC = 512;
         LimitNOFILE = 1048576;
         CapabilityBoundingSet = "cap_net_bind_service";

nixos/modules/services/x11/picom.nix

@@ -20,8 +20,43 @@ let
 
   mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
 
-  libconfig = pkgs.formats.libconfig { };
-  configFile = libconfig.generate "picom.conf" cfg.settings;
+  # Basically a tinkered lib.generators.mkKeyValueDefault
+  # It either serializes a top-level definition "key: { values };"
+  # or an expression "key = { values };"
+  mkAttrsString =
+    top:
+    mapAttrsToList (
+      k: v:
+      let
+        sep = if (top && isAttrs v) then ":" else "=";
+      in
+      "${escape [ sep ] k}${sep}${mkValueString v};"
+    );
+
+  # This serializes a Nix expression to the libconfig format.
+  mkValueString =
+    v:
+    if types.bool.check v then
+      boolToString v
+    else if types.int.check v then
+      toString v
+    else if types.float.check v then
+      toString v
+    else if types.str.check v then
+      "\"${escape [ "\"" ] v}\""
+    else if builtins.isList v then
+      "[ ${concatMapStringsSep " , " mkValueString v} ]"
+    else if types.attrs.check v then
+      "{ ${concatStringsSep " " (mkAttrsString false v)} }"
+    else
+      throw ''
+        invalid expression used in option services.picom.settings:
+        ${v}
+      '';
+
+  toConf = attrs: concatStringsSep "\n" (mkAttrsString true cfg.settings);
+
+  configFile = pkgs.writeText "picom.conf" (toConf cfg.settings);
 
 in
 {
@@ -244,22 +279,56 @@ in
       '';
     };
 
-    settings = mkOption {
-      type = libconfig.type;
-      default = { };
-      example = literalExpression ''
-        blur =
-          { method = "gaussian";
-            size = 10;
-            deviation = 5.0;
+    settings =
+      with types;
+      let
+        scalar =
+          oneOf [
+            bool
+            int
+            float
+            str
+          ]
+          // {
+            description = "scalar types";
           };
-      '';
-      description = ''
-        Picom settings. Use this option to configure Picom settings not exposed
-        in a NixOS option or to bypass one.  For the available options see the
-        CONFIGURATION FILES section at {manpage}`picom(1)`.
-      '';
-    };
+
+        libConfig =
+          oneOf [
+            scalar
+            (listOf libConfig)
+            (attrsOf libConfig)
+          ]
+          // {
+            description = "libconfig type";
+          };
+
+        topLevel = attrsOf libConfig // {
+          description = ''
+            libconfig configuration. The format consists of an attributes
+            set (called a group) of settings. Each setting can be a scalar type
+            (boolean, integer, floating point number or string), a list of
+            scalars or a group itself
+          '';
+        };
+
+      in
+      mkOption {
+        type = topLevel;
+        default = { };
+        example = literalExpression ''
+          blur =
+            { method = "gaussian";
+              size = 10;
+              deviation = 5.0;
+            };
+        '';
+        description = ''
+          Picom settings. Use this option to configure Picom settings not exposed
+          in a NixOS option or to bypass one.  For the available options see the
+          CONFIGURATION FILES section at {manpage}`picom(1)`.
+        '';
+      };
   };
 
   config = mkIf cfg.enable {

nixos/modules/services/x11/xserver.nix

@@ -810,8 +810,6 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    services.displayManager.enable = true;
-
     services.xserver.displayManager.lightdm.enable =
       let
         dmConf = cfg.displayManager;

nixos/tests/all-tests.nix

@@ -1288,7 +1288,7 @@ in
       { };
   postfix-tlspol = runTest ./postfix-tlspol.nix;
   postgres-websockets = runTest ./postgres-websockets.nix;
-  postgresql = handleTest ./postgresql { };
+  postgresql = import ./postgresql { inherit runTest pkgs; };
   postgrest = runTest ./postgrest.nix;
   power-profiles-daemon = runTest ./power-profiles-daemon.nix;
   powerdns = runTest ./powerdns.nix;

nixos/tests/ly.nix

@@ -23,6 +23,18 @@ in
       services.displayManager.defaultSession = "none+icewm";
       services.xserver.windowManager.icewm.enable = true;
     };
+  nodes.machineAutologin =
+    { ... }:
+    lib.attrsets.recursiveUpdate machineBase {
+      services.displayManager.ly.x11Support = true;
+      services.xserver.enable = true;
+      services.displayManager.defaultSession = "none+icewm";
+      services.xserver.windowManager.icewm.enable = true;
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
+      };
+    };
   nodes.machineNoX11 =
     { ... }:
     lib.attrsets.recursiveUpdate machineBase {
@@ -83,6 +95,14 @@ in
       machine.sleep(2)
       machine.screenshot("icewm")
 
+      machineAutologin.wait_until_succeeds("getfacl /dev/dri/card0 | grep video")
+      machineAutologin.send_key("ctrl-alt-f1")
+      machineAutologin.wait_for_file("/run/user/${toString user.uid}/lyxauth")
+      machineAutologin.succeed("xauth merge /run/user/${toString user.uid}/lyxauth")
+      machineAutologin.wait_for_window("^IceWM ")
+      machineAutologin.sleep(2)
+      machineAutologin.screenshot("autologin-icewm")
+
       machineNoX11.wait_until_tty_matches("1", "password")
       machineNoX11.send_key("ctrl-alt-f1")
       machineNoX11.sleep(1)

nixos/tests/postgresql/anonymizer.nix

@@ -1,114 +1,115 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql_anonymizer-${package.name}";
-      meta.maintainers = [
-        lib.maintainers.leona
-        lib.maintainers.osnyx
-      ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "postgresql_anonymizer-${package.name}";
+        meta.maintainers = [
+          lib.maintainers.leona
+          lib.maintainers.osnyx
+        ];
 
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          environment.systemPackages = [ (pkgs.pg-dump-anon.override { postgresql = package; }) ];
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions = ps: [ ps.anonymizer ];
-            settings.shared_preload_libraries = [ "anon" ];
+        nodes.machine =
+          { pkgs, ... }:
+          {
+            environment.systemPackages = [ (pkgs.pg-dump-anon.override { postgresql = package; }) ];
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              extensions = ps: [ ps.anonymizer ];
+              settings.shared_preload_libraries = [ "anon" ];
+            };
           };
-        };
 
-      testScript = ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_for_unit("postgresql.target")
+        testScript = ''
+          start_all()
+          machine.wait_for_unit("multi-user.target")
+          machine.wait_for_unit("postgresql.target")
 
-        with subtest("Setup"):
-            machine.succeed("sudo -u postgres psql --command 'create database demo'")
-            machine.succeed(
-                "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
-                  create extension anon cascade;
-                  select anon.init();
-                  create table player(id serial, name text, points int);
-                  insert into player(id,name,points) values (1,'Foo', 23);
-                  insert into player(id,name,points) values (2,'Bar',42);
-                  security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name()';
-                  security label for anon on column player.points is 'MASKED WITH VALUE NULL';
-                ''}"
-            )
+          with subtest("Setup"):
+              machine.succeed("sudo -u postgres psql --command 'create database demo'")
+              machine.succeed(
+                  "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
+                    create extension anon cascade;
+                    select anon.init();
+                    create table player(id serial, name text, points int);
+                    insert into player(id,name,points) values (1,'Foo', 23);
+                    insert into player(id,name,points) values (2,'Bar',42);
+                    security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name()';
+                    security label for anon on column player.points is 'MASKED WITH VALUE NULL';
+                  ''}"
+              )
 
-        def get_player_table_contents():
-            return [
-                x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
-            ]
+          def get_player_table_contents():
+              return [
+                  x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
+              ]
 
-        def check_anonymized_row(row, id, original_name):
-            t.assertEqual(row[0], id)
-            t.assertNotEqual(row[1], original_name)
-            t.assertFalse(bool(row[2]))
+          def check_anonymized_row(row, id, original_name):
+              t.assertEqual(row[0], id)
+              t.assertNotEqual(row[1], original_name)
+              t.assertFalse(bool(row[2]))
 
-        def find_xsv_in_dump(dump, sep=','):
-            """
-            Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
+          def find_xsv_in_dump(dump, sep=','):
+              """
+              Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
 
-                COPY public.player ...
-                1,Shields,
-                2,Salazar,
-                \\.
+                  COPY public.player ...
+                  1,Shields,
+                  2,Salazar,
+                  \\.
 
-            in the given dump (the commas are tabs in case of pg_dump).
-                  Extract the CSV lines and split by `sep`.
-            """
+              in the given dump (the commas are tabs in case of pg_dump).
+                    Extract the CSV lines and split by `sep`.
+              """
 
-            try:
-                from itertools import dropwhile, takewhile
-                return [x.split(sep) for x in list(takewhile(
-                    lambda x: x != "\\.",
-                    dropwhile(
-                        lambda x: not x.startswith("COPY public.player"),
-                        dump.splitlines()
-                    )
-                ))[1:]]
-            except:
-                print(f"Dump to process: {dump}")
-                raise
+              try:
+                  from itertools import dropwhile, takewhile
+                  return [x.split(sep) for x in list(takewhile(
+                      lambda x: x != "\\.",
+                      dropwhile(
+                          lambda x: not x.startswith("COPY public.player"),
+                          dump.splitlines()
+                      )
+                  ))[1:]]
+              except:
+                  print(f"Dump to process: {dump}")
+                  raise
 
-        def check_original_data(output):
-            t.assertEqual(output[0], ["1", "Foo", "23"])
-            t.assertEqual(output[1], ["2", "Bar", "42"])
+          def check_original_data(output):
+              t.assertEqual(output[0], ["1", "Foo", "23"])
+              t.assertEqual(output[1], ["2", "Bar", "42"])
 
-        def check_anonymized_rows(output):
-            check_anonymized_row(output[0], '1', 'Foo')
-            check_anonymized_row(output[1], '2', 'Bar')
+          def check_anonymized_rows(output):
+              check_anonymized_row(output[0], '1', 'Foo')
+              check_anonymized_row(output[1], '2', 'Bar')
 
-        with subtest("Check initial state"):
-            check_original_data(get_player_table_contents())
+          with subtest("Check initial state"):
+              check_original_data(get_player_table_contents())
 
-        with subtest("Anonymous dumps"):
-            check_original_data(find_xsv_in_dump(
-                machine.succeed("sudo -u postgres pg_dump demo"),
-                sep='\t'
-            ))
-            check_anonymized_rows(find_xsv_in_dump(
-                machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
-                sep=','
-            ))
+          with subtest("Anonymous dumps"):
+              check_original_data(find_xsv_in_dump(
+                  machine.succeed("sudo -u postgres pg_dump demo"),
+                  sep='\t'
+              ))
+              check_anonymized_rows(find_xsv_in_dump(
+                  machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
+                  sep=','
+              ))
 
-        with subtest("Anonymize"):
-            machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
-            check_anonymized_rows(get_player_table_contents())
-      '';
-    };
+          with subtest("Anonymize"):
+              machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
+              check_anonymized_rows(get_player_table_contents())
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/default.nix

@@ -1,11 +1,8 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  pkgs,
 }:
 
-with import ../../lib/testing-python.nix { inherit system pkgs; };
-
 let
   inherit (pkgs.lib)
     recurseIntoAttrs
@@ -25,7 +22,12 @@ let
       }
     );
 
-  importWithArgs = path: import path { inherit pkgs makeTest genTests; };
+  importWithArgs =
+    path:
+    import path {
+      inherit runTest genTests;
+      inherit (pkgs) lib;
+    };
 in
 {
   # postgresql

nixos/tests/postgresql/pgjwt.nix

@@ -1,51 +1,52 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "pgjwt-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [
-          spinus
-        ];
-      };
-
-      nodes.master =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            extensions =
-              ps: with ps; [
-                pgjwt
-                pgtap
-              ];
-          };
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "pgjwt-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [
+            spinus
+          ];
         };
 
-      testScript =
-        { nodes, ... }:
-        let
-          sqlSU = "${nodes.master.services.postgresql.superUser}";
-          pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
-          inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
-        in
-        ''
-          start_all()
-          master.wait_for_unit("postgresql.target")
-          master.succeed(
-              "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
-          )
-        '';
-    };
+        nodes.master =
+          { ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              extensions =
+                ps: with ps; [
+                  pgjwt
+                  pgtap
+                ];
+            };
+          };
+
+        testScript =
+          { nodes, ... }:
+          let
+            sqlSU = "${nodes.master.services.postgresql.superUser}";
+            pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
+            inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
+          in
+          ''
+            start_all()
+            master.wait_for_unit("postgresql.target")
+            master.succeed(
+                "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
+            )
+          '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/postgresql-jit.nix

@@ -1,53 +1,54 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-jit-${package.name}";
-      meta.maintainers = with lib.maintainers; [ ma27 ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "postgresql-jit-${package.name}";
+        meta.maintainers = with lib.maintainers; [ ma27 ];
 
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            enableJIT = true;
-            initialScript = pkgs.writeText "init.sql" ''
-              create table demo (id int);
-              insert into demo (id) select generate_series(1, 5);
-            '';
+        nodes.machine =
+          { pkgs, ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              enableJIT = true;
+              initialScript = pkgs.writeText "init.sql" ''
+                create table demo (id int);
+                insert into demo (id) select generate_series(1, 5);
+              '';
+            };
           };
-        };
 
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("postgresql.target")
+        testScript = ''
+          machine.start()
+          machine.wait_for_unit("postgresql.target")
 
-        with subtest("JIT is enabled"):
-            machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
+          with subtest("JIT is enabled"):
+              machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
 
-        with subtest("Test JIT works fine"):
-            output = machine.succeed(
-                "cat ${pkgs.writeText "test.sql" ''
-                  set jit_above_cost = 1;
-                  EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
-                  SELECT CONCAT('jit result = ', SUM(id)) from demo;
-                ''} | sudo -u postgres psql"
-            )
-            t.assertIn("JIT:", output)
-            t.assertIn("jit result = 15", output)
+          with subtest("Test JIT works fine"):
+              output = machine.succeed(
+                  "cat ${pkgs.writeText "test.sql" ''
+                    set jit_above_cost = 1;
+                    EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
+                    SELECT CONCAT('jit result = ', SUM(id)) from demo;
+                  ''} | sudo -u postgres psql"
+              )
+              t.assertIn("JIT:", output)
+              t.assertIn("jit result = 15", output)
 
-        machine.shutdown()
-      '';
-    };
+          machine.shutdown()
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

nixos/tests/postgresql/postgresql-replication.nix

@@ -1,125 +1,127 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
 
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-replication-${package.name}";
-      meta.maintainers = with lib.maintainers; [ bouk ];
+    runTest (
+      { lib, ... }:
+      {
+        name = "postgresql-replication-${package.name}";
+        meta.maintainers = with lib.maintainers; [ bouk ];
 
-      nodes = {
-        primary =
-          { ... }:
-          {
-            services.postgresql = {
-              inherit package;
-              enable = true;
-              enableTCPIP = true;
-              settings = {
-                wal_level = "replica";
-                max_wal_senders = 10;
-                max_replication_slots = 10;
+        nodes = {
+          primary =
+            { ... }:
+            {
+              services.postgresql = {
+                inherit package;
+                enable = true;
+                enableTCPIP = true;
+                settings = {
+                  wal_level = "replica";
+                  max_wal_senders = 10;
+                  max_replication_slots = 10;
+                };
+                authentication = ''
+                  local replication postgres peer
+                  host replication replication all trust
+                '';
+                ensureUsers = [
+                  {
+                    name = "replication";
+                    ensureClauses.replication = true;
+                  }
+                ];
               };
-              authentication = ''
-                local replication postgres peer
-                host replication replication all trust
-              '';
-              ensureUsers = [
-                {
-                  name = "replication";
-                  ensureClauses.replication = true;
-                }
-              ];
+              networking.firewall.allowedTCPPorts = [ 5432 ];
             };
-            networking.firewall.allowedTCPPorts = [ 5432 ];
-          };
 
-        replica =
-          { nodes, ... }:
-          {
-            services.postgresql = {
-              inherit package;
-              enable = true;
-              settings = {
-                hot_standby = "on";
-                primary_conninfo = "host=${nodes.primary.networking.primaryIPAddress} user=replication";
-                primary_slot_name = "replica_slot";
+          replica =
+            { nodes, ... }:
+            {
+              services.postgresql = {
+                inherit package;
+                enable = true;
+                settings = {
+                  hot_standby = "on";
+                  primary_conninfo = "host=${nodes.primary.networking.primaryIPAddress} user=replication";
+                  primary_slot_name = "replica_slot";
+                };
               };
             };
-          };
-      };
+        };
 
-      testScript = ''
-        start_all()
-        primary.wait_for_unit("postgresql.target")
+        testScript = ''
+          start_all()
+          primary.wait_for_unit("postgresql.target")
 
-        primary.succeed(
-            "sudo -u postgres psql -c \"SELECT * FROM pg_create_physical_replication_slot('replica_slot');\""
-        )
+          primary.succeed(
+              "sudo -u postgres psql -c \"SELECT * FROM pg_create_physical_replication_slot('replica_slot');\""
+          )
 
-        primary.succeed(
-            "sudo -u postgres pg_basebackup -D /tmp/basebackup -S replica_slot -X stream"
-        )
-        primary.succeed("tar -C /tmp -cf /tmp/shared/basebackup.tar basebackup")
+          primary.succeed(
+              "sudo -u postgres pg_basebackup -D /tmp/basebackup -S replica_slot -X stream"
+          )
+          primary.succeed("tar -C /tmp -cf /tmp/shared/basebackup.tar basebackup")
 
-        replica.wait_for_unit("postgresql.target")
-        replica.succeed("systemctl stop postgresql")
+          replica.wait_for_unit("postgresql.target")
+          replica.succeed("systemctl stop postgresql")
 
-        replica_data_dir = "/var/lib/postgresql/${package.psqlSchema}"
-        replica.succeed(f"rm -rf {replica_data_dir}")
-        replica.succeed(f"mkdir -p {replica_data_dir}")
-        replica.succeed(f"tar -C {replica_data_dir} --strip-components=1 -xf /tmp/shared/basebackup.tar")
-        replica.succeed(f"touch {replica_data_dir}/standby.signal")
-        replica.succeed(f"chown -R postgres:postgres {replica_data_dir}")
-        replica.succeed(f"chmod 700 {replica_data_dir}")
+          replica_data_dir = "/var/lib/postgresql/${package.psqlSchema}"
+          replica.succeed(f"rm -rf {replica_data_dir}")
+          replica.succeed(f"mkdir -p {replica_data_dir}")
+          replica.succeed(f"tar -C {replica_data_dir} --strip-components=1 -xf /tmp/shared/basebackup.tar")
+          replica.succeed(f"touch {replica_data_dir}/standby.signal")
+          replica.succeed(f"chown -R postgres:postgres {replica_data_dir}")
+          replica.succeed(f"chmod 700 {replica_data_dir}")
 
-        replica.succeed("systemctl start postgresql")
-        replica.wait_for_unit("postgresql.target")
+          replica.succeed("systemctl start postgresql")
+          replica.wait_for_unit("postgresql.target")
 
-        replica.wait_until_succeeds(
-            "sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();' | grep t"
-        )
+          replica.wait_until_succeeds(
+              "sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();' | grep t"
+          )
 
-        primary.succeed(
-            "sudo -u postgres psql -c 'CREATE TABLE test_replication (id serial PRIMARY KEY, data text);'"
-        )
-        primary.succeed(
-            "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('hello');\""
-        )
+          primary.succeed(
+              "sudo -u postgres psql -c 'CREATE TABLE test_replication (id serial PRIMARY KEY, data text);'"
+          )
+          primary.succeed(
+              "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('hello');\""
+          )
 
-        replica.wait_until_succeeds(
-            "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep hello",
-            timeout=30
-        )
+          replica.wait_until_succeeds(
+              "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep hello",
+              timeout=30
+          )
 
-        with subtest("Verify replica is in recovery mode"):
-            result = replica.succeed("sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();'")
-            t.assertEqual(result.strip(), "t")
+          with subtest("Verify replica is in recovery mode"):
+              result = replica.succeed("sudo -u postgres psql -tAc 'SELECT pg_is_in_recovery();'")
+              t.assertEqual(result.strip(), "t")
 
-        with subtest("Verify replication slot is active"):
-            result = primary.succeed(
-                "sudo -u postgres psql -tAc \"SELECT active FROM pg_replication_slots WHERE slot_name = 'replica_slot';\""
-            )
-            t.assertEqual(result.strip(), "t")
+          with subtest("Verify replication slot is active"):
+              result = primary.succeed(
+                  "sudo -u postgres psql -tAc \"SELECT active FROM pg_replication_slots WHERE slot_name = 'replica_slot';\""
+              )
+              t.assertEqual(result.strip(), "t")
 
-        with subtest("Insert more data and verify replication"):
-            primary.succeed(
-                "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('world');\""
-            )
-            replica.wait_until_succeeds(
-                "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep world",
-                timeout=30
-            )
+          with subtest("Insert more data and verify replication"):
+              primary.succeed(
+                  "sudo -u postgres psql -c \"INSERT INTO test_replication (data) VALUES ('world');\""
+              )
+              replica.wait_until_succeeds(
+                  "sudo -u postgres psql -c 'SELECT * FROM test_replication;' | grep world",
+                  timeout=30
+              )
 
-        primary.shutdown()
-        replica.shutdown()
-      '';
-    };
+          primary.shutdown()
+          replica.shutdown()
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -1,145 +1,147 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
-  runWithOpenSSL =
-    file: cmd:
-    pkgs.runCommand file {
-      buildInputs = [ pkgs.openssl ];
-    } cmd;
-  caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  caCert = runWithOpenSSL "ca.crt" ''
-    openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
-  '';
-  serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  serverKeyPath = "/var/lib/postgresql";
-  serverCert = runWithOpenSSL "server.crt" ''
-    openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
-    openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
-      -CAcreateserial -out $out -days 36500 -sha256
-  '';
-  clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-  clientCert = runWithOpenSSL "client.crt" ''
-    openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
-    openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
-      -CAcreateserial -out $out -days 36500 -sha256
-  '';
-  clientKeyPath = "/root";
-
   makeTestFor =
     package:
-    makeTest {
-      name = "postgresql-tls-client-cert-${package.name}";
-      meta.maintainers = with lib.maintainers; [ erictapen ];
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        runWithOpenSSL =
+          file: cmd:
+          pkgs.runCommand file {
+            buildInputs = [ pkgs.openssl ];
+          } cmd;
+        caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        caCert = runWithOpenSSL "ca.crt" ''
+          openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
+        '';
+        serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        serverKeyPath = "/var/lib/postgresql";
+        serverCert = runWithOpenSSL "server.crt" ''
+          openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
+          openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
+            -CAcreateserial -out $out -days 36500 -sha256
+        '';
+        clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+        clientCert = runWithOpenSSL "client.crt" ''
+          openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
+          openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
+            -CAcreateserial -out $out -days 36500 -sha256
+        '';
+        clientKeyPath = "/root";
+      in
+      {
+        name = "postgresql-tls-client-cert-${package.name}";
+        meta.maintainers = with lib.maintainers; [ erictapen ];
 
-      nodes.server =
-        { ... }:
-        {
-          systemd.services.create-keys = {
-            wantedBy = [ "postgresql.target" ];
+        nodes.server =
+          { ... }:
+          {
+            systemd.services.create-keys = {
+              wantedBy = [ "postgresql.target" ];
 
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+
+              script = ''
+                mkdir -p '${serverKeyPath}'
+                cp '${serverKey}' '${serverKeyPath}/server.key'
+                chown postgres:postgres '${serverKeyPath}/server.key'
+                chmod 600 '${serverKeyPath}/server.key'
+              '';
             };
-
-            script = ''
-              mkdir -p '${serverKeyPath}'
-              cp '${serverKey}' '${serverKeyPath}/server.key'
-              chown postgres:postgres '${serverKeyPath}/server.key'
-              chmod 600 '${serverKeyPath}/server.key'
-            '';
-          };
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            enableTCPIP = true;
-            ensureUsers = [
-              {
-                name = "test";
-                ensureDBOwnership = true;
-              }
-            ];
-            ensureDatabases = [ "test" ];
-            settings = {
-              ssl = "on";
-              ssl_ca_file = toString caCert;
-              ssl_cert_file = toString serverCert;
-              ssl_key_file = "${serverKeyPath}/server.key";
-            };
-            authentication = ''
-              hostssl test test ::/0 cert clientcert=verify-full
-            '';
-          };
-          networking = {
-            interfaces.eth1 = {
-              ipv6.addresses = [
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              enableTCPIP = true;
+              ensureUsers = [
                 {
-                  address = "fc00::1";
-                  prefixLength = 120;
+                  name = "test";
+                  ensureDBOwnership = true;
                 }
               ];
+              ensureDatabases = [ "test" ];
+              settings = {
+                ssl = "on";
+                ssl_ca_file = toString caCert;
+                ssl_cert_file = toString serverCert;
+                ssl_key_file = "${serverKeyPath}/server.key";
+              };
+              authentication = ''
+                hostssl test test ::/0 cert clientcert=verify-full
+              '';
             };
-            firewall.allowedTCPPorts = [ 5432 ];
-          };
-        };
-
-      nodes.client =
-        { ... }:
-        {
-          systemd.services.create-keys = {
-            wantedBy = [ "multi-user.target" ];
-
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-
-            script = ''
-              mkdir -p '${clientKeyPath}'
-              cp '${clientKey}' '${clientKeyPath}/client.key'
-              chown root:root '${clientKeyPath}/client.key'
-              chmod 600 '${clientKeyPath}/client.key'
-            '';
-          };
-          environment = {
-            variables = {
-              PGHOST = "db.test.example";
-              PGPORT = "5432";
-              PGDATABASE = "test";
-              PGUSER = "test";
-              PGSSLMODE = "verify-full";
-              PGSSLCERT = clientCert;
-              PGSSLKEY = "${clientKeyPath}/client.key";
-              PGSSLROOTCERT = caCert;
-            };
-            systemPackages = [ package ];
-          };
-          networking = {
-            interfaces.eth1 = {
-              ipv6.addresses = [
-                {
-                  address = "fc00::2";
-                  prefixLength = 120;
-                }
-              ];
-            };
-            hosts = {
-              "fc00::1" = [ "db.test.example" ];
+            networking = {
+              interfaces.eth1 = {
+                ipv6.addresses = [
+                  {
+                    address = "fc00::1";
+                    prefixLength = 120;
+                  }
+                ];
+              };
+              firewall.allowedTCPPorts = [ 5432 ];
             };
           };
-        };
 
-      testScript = ''
-        server.wait_for_unit("multi-user.target")
-        client.wait_for_unit("multi-user.target")
-        client.succeed("psql -c \"SELECT 1;\"")
-      '';
-    };
+        nodes.client =
+          { ... }:
+          {
+            systemd.services.create-keys = {
+              wantedBy = [ "multi-user.target" ];
+
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+
+              script = ''
+                mkdir -p '${clientKeyPath}'
+                cp '${clientKey}' '${clientKeyPath}/client.key'
+                chown root:root '${clientKeyPath}/client.key'
+                chmod 600 '${clientKeyPath}/client.key'
+              '';
+            };
+            environment = {
+              variables = {
+                PGHOST = "db.test.example";
+                PGPORT = "5432";
+                PGDATABASE = "test";
+                PGUSER = "test";
+                PGSSLMODE = "verify-full";
+                PGSSLCERT = clientCert;
+                PGSSLKEY = "${clientKeyPath}/client.key";
+                PGSSLROOTCERT = caCert;
+              };
+              systemPackages = [ package ];
+            };
+            networking = {
+              interfaces.eth1 = {
+                ipv6.addresses = [
+                  {
+                    address = "fc00::2";
+                    prefixLength = 120;
+                  }
+                ];
+              };
+              hosts = {
+                "fc00::1" = [ "db.test.example" ];
+              };
+            };
+          };
+
+        testScript = ''
+          server.wait_for_unit("multi-user.target")
+          client.wait_for_unit("multi-user.target")
+          client.succeed("psql -c \"SELECT 1;\"")
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -1,111 +1,112 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    let
-      postgresqlDataDir = "/var/lib/postgresql/${package.psqlSchema}";
-      replicationUser = "wal_receiver_user";
-      replicationSlot = "wal_receiver_slot";
-      replicationConn = "postgresql://${replicationUser}@localhost";
-      baseBackupDir = "/var/cache/wals/pg_basebackup";
-      walBackupDir = "/var/cache/wals/pg_wal";
-      recoveryFile = pkgs.writeTextDir "recovery.signal" "";
-    in
-    makeTest {
-      name = "postgresql-wal-receiver-${package.name}";
-      meta.maintainers = with lib.maintainers; [ euxane ];
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        postgresqlDataDir = "/var/lib/postgresql/${package.psqlSchema}";
+        replicationUser = "wal_receiver_user";
+        replicationSlot = "wal_receiver_slot";
+        replicationConn = "postgresql://${replicationUser}@localhost";
+        baseBackupDir = "/var/cache/wals/pg_basebackup";
+        walBackupDir = "/var/cache/wals/pg_wal";
+        recoveryFile = pkgs.writeTextDir "recovery.signal" "";
+      in
+      {
+        name = "postgresql-wal-receiver-${package.name}";
+        meta.maintainers = with lib.maintainers; [ euxane ];
 
-      nodes.machine =
-        { ... }:
-        {
-          systemd.tmpfiles.rules = [
-            "d /var/cache/wals 0750 postgres postgres - -"
-          ];
+        nodes.machine =
+          { ... }:
+          {
+            systemd.tmpfiles.rules = [
+              "d /var/cache/wals 0750 postgres postgres - -"
+            ];
 
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            settings = {
-              max_replication_slots = 10;
-              max_wal_senders = 10;
-              recovery_end_command = "touch recovery.done";
-              restore_command = "cp ${walBackupDir}/%f %p";
-              wal_level = "archive"; # alias for replica on pg >= 9.6
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              settings = {
+                max_replication_slots = 10;
+                max_wal_senders = 10;
+                recovery_end_command = "touch recovery.done";
+                restore_command = "cp ${walBackupDir}/%f %p";
+                wal_level = "archive"; # alias for replica on pg >= 9.6
+              };
+              authentication = ''
+                host replication ${replicationUser} all trust
+              '';
+              initialScript = pkgs.writeText "init.sql" ''
+                create user ${replicationUser} replication;
+                select * from pg_create_physical_replication_slot('${replicationSlot}');
+              '';
             };
-            authentication = ''
-              host replication ${replicationUser} all trust
-            '';
-            initialScript = pkgs.writeText "init.sql" ''
-              create user ${replicationUser} replication;
-              select * from pg_create_physical_replication_slot('${replicationSlot}');
-            '';
+
+            services.postgresqlWalReceiver.receivers.main = {
+              postgresqlPackage = package;
+              connection = replicationConn;
+              slot = replicationSlot;
+              directory = walBackupDir;
+            };
+            # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
+            # default 60sec is fine for real system, but is too much for a test
+            systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+            systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
           };
 
-          services.postgresqlWalReceiver.receivers.main = {
-            postgresqlPackage = package;
-            connection = replicationConn;
-            slot = replicationSlot;
-            directory = walBackupDir;
-          };
-          # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
-          # default 60sec is fine for real system, but is too much for a test
-          systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
-          systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
-        };
+        testScript = ''
+          # make an initial base backup
+          machine.wait_for_unit("postgresql.target")
+          machine.wait_for_unit("postgresql-wal-receiver-main")
+          # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
+          # required only for 9.4
+          machine.sleep(5)
+          machine.succeed(
+              "${package}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
+          )
 
-      testScript = ''
-        # make an initial base backup
-        machine.wait_for_unit("postgresql.target")
-        machine.wait_for_unit("postgresql-wal-receiver-main")
-        # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
-        # required only for 9.4
-        machine.sleep(5)
-        machine.succeed(
-            "${package}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
-        )
+          # create a dummy table with 100 records
+          machine.succeed(
+              "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
+          )
 
-        # create a dummy table with 100 records
-        machine.succeed(
-            "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
-        )
+          # stop postgres and destroy data
+          machine.systemctl("stop postgresql")
+          machine.systemctl("stop postgresql-wal-receiver-main")
+          machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
 
-        # stop postgres and destroy data
-        machine.systemctl("stop postgresql")
-        machine.systemctl("stop postgresql-wal-receiver-main")
-        machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
+          # restore the base backup
+          machine.succeed(
+              "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
+          )
 
-        # restore the base backup
-        machine.succeed(
-            "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
-        )
+          # prepare WAL and recovery
+          machine.succeed("chmod a+rX -R ${walBackupDir}")
+          machine.execute(
+              "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
+          )  # make use of partial segments too
+          machine.succeed(
+              "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
+          )
 
-        # prepare WAL and recovery
-        machine.succeed("chmod a+rX -R ${walBackupDir}")
-        machine.execute(
-            "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
-        )  # make use of partial segments too
-        machine.succeed(
-            "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
-        )
+          # replay WAL
+          machine.systemctl("start postgresql")
+          machine.wait_for_file("${postgresqlDataDir}/recovery.done")
+          machine.systemctl("restart postgresql")
+          machine.wait_for_unit("postgresql.target")
 
-        # replay WAL
-        machine.systemctl("start postgresql")
-        machine.wait_for_file("${postgresqlDataDir}/recovery.done")
-        machine.systemctl("restart postgresql")
-        machine.wait_for_unit("postgresql.target")
-
-        # check that our records have been restored
-        machine.succeed(
-            "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
-        )
-      '';
-    };
+          # check that our records have been restored
+          machine.succeed(
+              "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
+          )
+        '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/postgresql.nix

@@ -1,12 +1,11 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  lib,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
     lib.recurseIntoAttrs {
@@ -15,263 +14,271 @@ let
       postgresql-clauses = makeEnsureTestFor package;
     };
 
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
-    CREATE TABLE sth (
-      id int
-    );
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    CREATE TABLE xmltest ( doc xml );
-    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-
-    -- check if hardening gets relaxed
-    CREATE EXTENSION plv8;
-    -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-    DO $$
-      let xs = [];
-      for (let i = 0, n = 400000; i < n; i++) {
-          xs.push(Math.round(Math.random() * n))
-      }
-      console.log(xs.reduce((acc, x) => acc + x, 0));
-    $$ LANGUAGE plv8;
-  '';
-
   makeTestForWithBackupAll =
     package: backupAll:
-    makeTest {
-      name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ zagy ];
-      };
+    runTest (
+      { lib, pkgs, ... }:
+      let
+        test-sql = pkgs.writeText "postgresql-test" ''
+          CREATE EXTENSION pgcrypto; -- just to check if lib loading works
+          CREATE TABLE sth (
+            id int
+          );
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          INSERT INTO sth (id) VALUES (1);
+          CREATE TABLE xmltest ( doc xml );
+          INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
 
-      nodes.machine =
-        { config, ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            identMap = ''
-              postgres root postgres
-            '';
-            # TODO(@Ma27) split this off into its own VM test and move a few other
-            # extension tests to use postgresqlTestExtension.
-            extensions = ps: with ps; [ plv8 ];
-          };
+          -- check if hardening gets relaxed
+          CREATE EXTENSION plv8;
+          -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
+          DO $$
+            let xs = [];
+            for (let i = 0, n = 400000; i < n; i++) {
+                xs.push(Math.round(Math.random() * n))
+            }
+            console.log(xs.reduce((acc, x) => acc + x, 0));
+          $$ LANGUAGE plv8;
+        '';
 
-          services.postgresqlBackup = {
-            enable = true;
-            databases = lib.optional (!backupAll) "postgres";
-            pgdumpOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-            pgdumpAllOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-          };
+      in
+      {
+        name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [ zagy ];
         };
 
-      testScript =
-        let
-          backupName = if backupAll then "all" else "postgres";
-          backupService = if backupAll then "postgresqlBackup" else "postgresqlBackup-postgres";
-          backupFileBase = "/var/backup/postgresql/${backupName}";
-        in
-        ''
-          def check_count(statement, lines):
-              return 'test $(psql -U postgres postgres -tAc "{}"|wc -l) -eq {}'.format(
-                  statement, lines
-              )
+        nodes.machine =
+          { config, ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              identMap = ''
+                postgres root postgres
+              '';
+              # TODO(@Ma27) split this off into its own VM test and move a few other
+              # extension tests to use postgresqlTestExtension.
+              extensions = ps: with ps; [ plv8 ];
+            };
+
+            services.postgresqlBackup = {
+              enable = true;
+              databases = lib.optional (!backupAll) "postgres";
+              pgdumpOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+              pgdumpAllOptions = "--restrict-key=ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+            };
+          };
+
+        testScript =
+          let
+            backupName = if backupAll then "all" else "postgres";
+            backupService = if backupAll then "postgresqlBackup" else "postgresqlBackup-postgres";
+            backupFileBase = "/var/backup/postgresql/${backupName}";
+          in
+          ''
+            def check_count(statement, lines):
+                return 'test $(psql -U postgres postgres -tAc "{}"|wc -l) -eq {}'.format(
+                    statement, lines
+                )
 
 
-          machine.start()
-          machine.wait_for_unit("postgresql.target")
+            machine.start()
+            machine.wait_for_unit("postgresql.target")
 
-          with subtest("Postgresql is available just after unit start"):
-              machine.succeed(
-                  "cat ${test-sql} | sudo -u postgres psql"
-              )
+            with subtest("Postgresql is available just after unit start"):
+                machine.succeed(
+                    "cat ${test-sql} | sudo -u postgres psql"
+                )
 
-          with subtest("Postgresql survives restart (bug #1735)"):
-              machine.shutdown()
-              import time
-              time.sleep(2)
-              machine.start()
-              machine.wait_for_unit("postgresql.target")
+            with subtest("Postgresql survives restart (bug #1735)"):
+                machine.shutdown()
+                import time
+                time.sleep(2)
+                machine.start()
+                machine.wait_for_unit("postgresql.target")
 
-          machine.fail(check_count("SELECT * FROM sth;", 3))
-          machine.succeed(check_count("SELECT * FROM sth;", 5))
-          machine.fail(check_count("SELECT * FROM sth;", 4))
-          machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
+            machine.fail(check_count("SELECT * FROM sth;", 3))
+            machine.succeed(check_count("SELECT * FROM sth;", 5))
+            machine.fail(check_count("SELECT * FROM sth;", 4))
+            machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
 
-          with subtest("killing postgres process should trigger an automatic restart"):
-              machine.succeed("systemctl kill -s KILL postgresql")
+            with subtest("killing postgres process should trigger an automatic restart"):
+                machine.succeed("systemctl kill -s KILL postgresql")
 
-              machine.wait_until_succeeds("systemctl is-active postgresql.service")
-              machine.wait_until_succeeds("systemctl is-active postgresql.target")
+                machine.wait_until_succeeds("systemctl is-active postgresql.service")
+                machine.wait_until_succeeds("systemctl is-active postgresql.target")
 
-          with subtest("Backup service works"):
-              machine.succeed(
-                  "systemctl start ${backupService}.service",
-                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
-                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-              )
-          with subtest("Backup service removes prev files"):
-              machine.succeed(
-                  # Create dummy prev files.
-                  "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
-                  "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
+            with subtest("Backup service works"):
+                machine.succeed(
+                    "systemctl start ${backupService}.service",
+                    "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
+                    "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+                )
+            with subtest("Backup service removes prev files"):
+                machine.succeed(
+                    # Create dummy prev files.
+                    "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
+                    "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
 
-                  # Run backup.
-                  "systemctl start ${backupService}.service",
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
+                    # Run backup.
+                    "systemctl start ${backupService}.service",
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
 
-                  # Since nothing has changed in the database, the cur and prev files
-                  # should match.
-                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-                  "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
+                    # Since nothing has changed in the database, the cur and prev files
+                    # should match.
+                    "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                    "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
 
-                  # The prev files with unused suffix should be removed.
-                  "[ ! -f '${backupFileBase}.prev.sql' ]",
-                  "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
+                    # The prev files with unused suffix should be removed.
+                    "[ ! -f '${backupFileBase}.prev.sql' ]",
+                    "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
 
-                  # Both cur and prev file should only be accessible by the postgres user.
-                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-                  "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
-              )
-          with subtest("Backup service fails gracefully"):
-              # Sabotage the backup process
-              machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
-              machine.fail(
-                  "systemctl start ${backupService}.service",
-              )
-              machine.succeed(
-                  "ls -hal /var/backup/postgresql/ >/dev/console",
-                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-                  "stat ${backupFileBase}.in-progress.sql.gz",
-              )
-              # In a previous version, the second run would overwrite prev.sql.gz,
-              # so we test a second run as well.
-              machine.fail(
-                  "systemctl start ${backupService}.service",
-              )
-              machine.succeed(
-                  "stat ${backupFileBase}.in-progress.sql.gz",
-                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-              )
+                    # Both cur and prev file should only be accessible by the postgres user.
+                    "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+                    "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
+                )
+            with subtest("Backup service fails gracefully"):
+                # Sabotage the backup process
+                machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
+                machine.fail(
+                    "systemctl start ${backupService}.service",
+                )
+                machine.succeed(
+                    "ls -hal /var/backup/postgresql/ >/dev/console",
+                    "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+                    "stat ${backupFileBase}.in-progress.sql.gz",
+                )
+                # In a previous version, the second run would overwrite prev.sql.gz,
+                # so we test a second run as well.
+                machine.fail(
+                    "systemctl start ${backupService}.service",
+                )
+                machine.succeed(
+                    "stat ${backupFileBase}.in-progress.sql.gz",
+                    "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+                )
 
 
-          with subtest("Initdb works"):
-              machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
+            with subtest("Initdb works"):
+                machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
 
-          machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+            machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
 
-          machine.shutdown()
-        '';
-    };
+            machine.shutdown()
+          '';
+      }
+    );
 
   makeEnsureTestFor =
     package:
-    makeTest {
-      name = "postgresql-clauses-${package.name}";
-      meta = with lib.maintainers; {
-        maintainers = [ zagy ];
-      };
-
-      nodes.machine =
-        { ... }:
-        {
-          services.postgresql = {
-            inherit package;
-            enable = true;
-            ensureUsers = [
-              {
-                name = "all-clauses";
-                ensureClauses = {
-                  superuser = true;
-                  createdb = true;
-                  createrole = true;
-                  "inherit" = true;
-                  login = true;
-                  replication = true;
-                  bypassrls = true;
-                  # SCRAM-SHA-256 hashed password for "password"
-                  password = "SCRAM-SHA-256$4096:SZEJF5Si4QZ6l4fedrZZWQ==$6u3PWVcz+dts+NdpByPIjKa4CaSnoXGG3M2vpo76bVU=:WSZ0iGUCmVtKYVvNX0pFOp/60IgsdJ+90Y67Eun+QE0=";
-                  connection_limit = 5;
-                };
-              }
-              {
-                name = "default-clauses";
-              }
-            ];
-          };
+    runTest (
+      { lib, ... }:
+      {
+        name = "postgresql-clauses-${package.name}";
+        meta = with lib.maintainers; {
+          maintainers = [ zagy ];
         };
 
-      testScript =
-        let
-          getClausesQuery =
-            user:
-            lib.concatStringsSep " " [
-              "SELECT row_to_json(row)"
-              "FROM ("
-              "SELECT"
-              "rolsuper,"
-              "rolinherit,"
-              "rolcreaterole,"
-              "rolcreatedb,"
-              "rolcanlogin,"
-              "rolreplication,"
-              "rolbypassrls,"
-              "rolconnlimit,"
-              "rolpassword"
-              "FROM pg_authid"
-              "WHERE rolname = '${user}'"
-              ") row;"
-            ];
-        in
-        ''
-          import json
-          machine.start()
-          machine.wait_for_unit("postgresql.target")
+        nodes.machine =
+          { ... }:
+          {
+            services.postgresql = {
+              inherit package;
+              enable = true;
+              ensureUsers = [
+                {
+                  name = "all-clauses";
+                  ensureClauses = {
+                    superuser = true;
+                    createdb = true;
+                    createrole = true;
+                    "inherit" = true;
+                    login = true;
+                    replication = true;
+                    bypassrls = true;
+                    # SCRAM-SHA-256 hashed password for "password"
+                    password = "SCRAM-SHA-256$4096:SZEJF5Si4QZ6l4fedrZZWQ==$6u3PWVcz+dts+NdpByPIjKa4CaSnoXGG3M2vpo76bVU=:WSZ0iGUCmVtKYVvNX0pFOp/60IgsdJ+90Y67Eun+QE0=";
+                    connection_limit = 5;
+                  };
+                }
+                {
+                  name = "default-clauses";
+                }
+              ];
+            };
+          };
 
-          with subtest("All user permissions are set according to the ensureClauses attr"):
-              clauses = json.loads(
-                machine.succeed(
-                    "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
+        testScript =
+          let
+            getClausesQuery =
+              user:
+              lib.concatStringsSep " " [
+                "SELECT row_to_json(row)"
+                "FROM ("
+                "SELECT"
+                "rolsuper,"
+                "rolinherit,"
+                "rolcreaterole,"
+                "rolcreatedb,"
+                "rolcanlogin,"
+                "rolreplication,"
+                "rolbypassrls,"
+                "rolconnlimit,"
+                "rolpassword"
+                "FROM pg_authid"
+                "WHERE rolname = '${user}'"
+                ") row;"
+              ];
+          in
+          ''
+            import json
+            machine.start()
+            machine.wait_for_unit("postgresql.target")
+
+            with subtest("All user permissions are set according to the ensureClauses attr"):
+                clauses = json.loads(
+                  machine.succeed(
+                      "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
+                  )
                 )
-              )
-              print(clauses)
-              t.assertTrue(clauses["rolsuper"])
-              t.assertTrue(clauses["rolinherit"])
-              t.assertTrue(clauses["rolcreaterole"])
-              t.assertTrue(clauses["rolcreatedb"])
-              t.assertTrue(clauses["rolcanlogin"])
-              t.assertTrue(clauses["rolreplication"])
-              t.assertTrue(clauses["rolbypassrls"])
-              t.assertTrue(clauses["rolconnlimit"] == 5)
-              t.assertTrue(clauses["rolpassword"])
-              machine.succeed(
-                "PGPASSWORD='password' psql -h localhost -U all-clauses -d postgres -c \"SELECT 1\""
-              )
-
-          with subtest("All user permissions default when ensureClauses is not provided"):
-              clauses = json.loads(
+                print(clauses)
+                t.assertTrue(clauses["rolsuper"])
+                t.assertTrue(clauses["rolinherit"])
+                t.assertTrue(clauses["rolcreaterole"])
+                t.assertTrue(clauses["rolcreatedb"])
+                t.assertTrue(clauses["rolcanlogin"])
+                t.assertTrue(clauses["rolreplication"])
+                t.assertTrue(clauses["rolbypassrls"])
+                t.assertTrue(clauses["rolconnlimit"] == 5)
+                t.assertTrue(clauses["rolpassword"])
                 machine.succeed(
-                    "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
+                  "PGPASSWORD='password' psql -h localhost -U all-clauses -d postgres -c \"SELECT 1\""
                 )
-              )
-              t.assertFalse(clauses["rolsuper"])
-              t.assertTrue(clauses["rolinherit"])
-              t.assertFalse(clauses["rolcreaterole"])
-              t.assertFalse(clauses["rolcreatedb"])
-              t.assertTrue(clauses["rolcanlogin"])
-              t.assertFalse(clauses["rolreplication"])
-              t.assertFalse(clauses["rolbypassrls"])
-              t.assertFalse(clauses["rolconnlimit"] == 5)
-              t.assertFalse(clauses["rolpassword"])
 
-          machine.shutdown()
-        '';
-    };
+            with subtest("All user permissions default when ensureClauses is not provided"):
+                clauses = json.loads(
+                  machine.succeed(
+                      "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
+                  )
+                )
+                t.assertFalse(clauses["rolsuper"])
+                t.assertTrue(clauses["rolinherit"])
+                t.assertFalse(clauses["rolcreaterole"])
+                t.assertFalse(clauses["rolcreatedb"])
+                t.assertTrue(clauses["rolcanlogin"])
+                t.assertFalse(clauses["rolreplication"])
+                t.assertFalse(clauses["rolbypassrls"])
+                t.assertFalse(clauses["rolconnlimit"] == 5)
+                t.assertFalse(clauses["rolpassword"])
+
+            machine.shutdown()
+          '';
+      }
+    );
 in
 genTests { inherit makeTestFor; }

nixos/tests/postgresql/wal2json.nix

@@ -1,47 +1,48 @@
 {
-  pkgs,
-  makeTest,
+  runTest,
   genTests,
+  ...
 }:
 
 let
-  inherit (pkgs) lib;
-
   makeTestFor =
     package:
-    makeTest {
-      name = "wal2json-${package.name}";
-      meta.maintainers = with pkgs.lib.maintainers; [ euank ];
+    runTest (
+      { lib, pkgs, ... }:
+      {
+        name = "wal2json-${package.name}";
+        meta.maintainers = with pkgs.lib.maintainers; [ euank ];
 
-      nodes.machine = {
-        services.postgresql = {
-          inherit package;
-          enable = true;
-          extensions = with package.pkgs; [ wal2json ];
-          settings = {
-            wal_level = "logical";
-            max_replication_slots = "10";
-            max_wal_senders = "10";
+        nodes.machine = {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extensions = with package.pkgs; [ wal2json ];
+            settings = {
+              wal_level = "logical";
+              max_replication_slots = "10";
+              max_wal_senders = "10";
+            };
           };
         };
-      };
 
-      testScript = ''
-        machine.wait_for_unit("postgresql.target")
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
-        )
-        machine.succeed(
-            "diff ${./wal2json/example2.out} /tmp/example2.out"
-        )
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./wal2json/example3.sql} postgres > /tmp/example3.out"
-        )
-        machine.succeed(
-            "diff ${./wal2json/example3.out} /tmp/example3.out"
-        )
-      '';
-    };
+        testScript = ''
+          machine.wait_for_unit("postgresql.target")
+          machine.succeed(
+              "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
+          )
+          machine.succeed(
+              "diff ${./wal2json/example2.out} /tmp/example2.out"
+          )
+          machine.succeed(
+              "sudo -u postgres psql -qAt -f ${./wal2json/example3.sql} postgres > /tmp/example3.out"
+          )
+          machine.succeed(
+              "diff ${./wal2json/example3.out} /tmp/example3.out"
+          )
+        '';
+      }
+    );
 in
 genTests {
   inherit makeTestFor;

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -1008,6 +1008,9 @@ let
           # missing optional dependencies
           conda = addPackageRequires super.conda [ self.projectile ];
 
+          # https://github.com/NixOS/nixpkgs/issues/483425
+          consult = addPackageRequires super.consult [ self.flymake ];
+
           # needs network during compilation, also native-ice
           consult-gh = ignoreCompilationError (
             super.consult-gh.overrideAttrs (old: {

pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix

@@ -10,12 +10,12 @@
   vimUtils,
 }:
 let
-  version = "6b01f95-unstable-2026-01-24";
+  version = "0523fe3-unstable-2026-01-25";
   src = fetchFromGitHub {
     owner = "dmtrKovalenko";
     repo = "fff.nvim";
-    rev = "6b01f95ca6305511ef28175c42b250925376f181";
-    hash = "sha256-vI1oOVzpTpYZ0ea6w0e2wyKa0TsyLFFauOZkhYbXLYM=";
+    rev = "0523fe39ffc59373de0648ba636705d35a6fdfc2";
+    hash = "sha256-7rP6C/zPhpTMcsewR9LZlB23Ot7W23E2WM7Fnj89rlA=";
   };
   fff-nvim-lib = rustPlatform.buildRustPackage {
     pname = "fff-nvim-lib";

pkgs/applications/editors/vscode/extensions/augment.vscode-augment/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-augment";
     publisher = "augment";
-    version = "0.754.2";
-    hash = "sha256-PWcJr6hTCGeDLMG0h54x5D2n6zrK/bEqv7kygSZS/qo=";
+    version = "0.754.3";
+    hash = "sha256-y7vBumet1aiLFP45QRSXMYFqqqkGvBMRD0k8A/CPoC8=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1005,8 +1005,8 @@ let
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "1.11.6";
-          hash = "sha256-yMhbOnG7jVO0oPzLa+El5i7KlD1GCYTOcfF0cOUf5hQ=";
+          version = "1.12.2";
+          hash = "sha256-0ZX0EQnPIqREsIy5dSML94PXD0Z+UZCIKwdqXVYTc1Q=";
         };
         meta = {
           description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";

pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.37.1";
-    hash = "sha256-xucPJrYqKM+uCxHktfx0o4c0btpluIBMyNigr7d1FJU=";
+    version = "1.37.2";
+    hash = "sha256-5ZkC84924JZe53EcXHHKeMw840O6DIFjydd6zT1QzLQ=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";

pkgs/applications/editors/vscode/extensions/oracle.oracle-java/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "oracle-java";
     publisher = "oracle";
-    version = "25.0.0";
-    hash = "sha256-e0DO+42+3CyMP3+25gj0kLDFK53vkv4UqD2pQhXmqng=";
+    version = "25.0.1";
+    hash = "sha256-6l1StFyGixGCvOfpq4iyHkoGQb1UZGlB4j0IQxAuXl8=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/teamtype.teamtype/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "teamtype";
     name = "teamtype";
-    version = "0.8.0";
-    hash = "sha256-p9bynTMmCn6pu7SVEABeSawv9VjWpE8KecQOeIsE/LE=";
+    version = "0.8.2";
+    hash = "sha256-qVZf+fOrdnDJzRUVA3GhTUDLhdJrH2tPRgvYW+ymVGw=";
   };
 
   meta = {

pkgs/applications/editors/vscode/vscode.nix

@@ -36,20 +36,20 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-qYthiZlioD6fWCyDPfg7Yfo5PqCHzcenk8NjgobLW7c=";
-      x86_64-darwin = "sha256-zwvdrstg6UtoG8EE87VXjDORT3zEbbKCFdAP0wPsD9s=";
-      aarch64-linux = "sha256-7DBRwwdQm06nyxRMR3wOH+4DqlnPvXGL/rMdq7jpxTw=";
-      aarch64-darwin = "sha256-YXmTzpsRSwdtbmoQLDRcJ5hcDURZnrkh5p8e8rYnA0Y=";
-      armv7l-linux = "sha256-VQ4/Ae4qeZYCFAJcTh8h8BWM15u8QEAfyJpkFx+1Xc8=";
+      x86_64-linux = "sha256-RqBae6s6y2XnXqtKbrKkMRwALKLfNE7mBFwOwwomG10=";
+      x86_64-darwin = "sha256-3N7xZIJsgQPX6izaH8ZoXy3SLcbXCNwJvE8ahFwVfF8=";
+      aarch64-linux = "sha256-8WigXl83hXEA7qsG6dOYKVSVISRDDpqJyv7L+9ks40Q=";
+      aarch64-darwin = "sha256-ZJ0QKqkFQYz3V7TEalM3sFJnqYnKBgQVqPXdsi2c+80=";
+      armv7l-linux = "sha256-m78hRkaI1nlqdeeP3t0HiNCUzNneMXxyenC8RmtuC68=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.108.1";
+  version = "1.108.2";
 
   # This is used for VS Code - Remote SSH test
-  rev = "585eba7c0c34fd6b30faac7c62a42050bfbc0086";
+  rev = "c9d77990917f3102ada88be140d28b038d1dd7c7";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -82,7 +82,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-YilQLV1vQ1vHLa9pztvDIsaRz1CKzxcjT/INETrJy1I=";
+      hash = "sha256-bUnM+editWCYiiqR3mlIw4BRrM5gHd6T2GO65VKTDSE=";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-01-20";
+  version = "0-unstable-2026-01-25";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "c69ecd250eb76cdceae1dbb962116f706e4fa661";
-    hash = "sha256-cCUHTaHDNn7k5mK589RoNXiPgFvEBCxCSyp+8azUtpg=";
+    rev = "38c84798aac5239a06d75e85469225a2ad9c4707";
+    hash = "sha256-3N2/v9yv44GdSEoPjC2yne43f4WqLTlWr8dYRrb+GxY=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-01-16";
+  version = "0-unstable-2026-01-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "3f0f44787b3c9f51eaad3abfbeb86f345d6d8fb1";
-    hash = "sha256-ZrJIZqkJC39vreiNPeEm764vDW42uv6kZb0rFo4bAXw=";
+    rev = "c858c9c5eebef46ea1a69427091853f9f1edbd23";
+    hash = "sha256-3Rzoy2G517Pc3mAQY+b2dvAMDxUoUmyR8FCyg4BR5bc=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2026-01-19";
+  version = "0-unstable-2026-01-26";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "bf245b03076b97eed14abd54c79537a59ecc2bd9";
-    hash = "sha256-2Tm/CQt+LwAIEWsBRtgm/rZngSHqEohx45UlkaTCHbA=";
+    rev = "900e599dd26e4b292ff55738cc8881530eed46ce";
+    hash = "sha256-9lr7RDSdQ/FN3mgoh8ZTsL1J8vXyab+TqhvM8yp7G7c=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix

@@ -81,7 +81,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   postFixup = ''
-    wrapPythonProgramsIn "$out/share/inkscape/extensions/" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/inkscape/extensions/" "$out ''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/applications/graphics/inkscape/extensions/textext/default.nix

@@ -113,7 +113,7 @@ python3.pkgs.buildPythonApplication rec {
 
   postFixup = ''
     # Wrap the project so it can find runtime dependencies.
-    wrapPythonProgramsIn "$out/share/inkscape/extensions/textext" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/inkscape/extensions/textext" "$out ''${pythonPath[*]}"
     cp ${launchScript} $out/share/inkscape/extensions/textext/launch.sh
   '';
 

pkgs/applications/misc/dupeguru/default.nix

@@ -67,7 +67,7 @@ python3Packages.buildPythonApplication rec {
   # Executable in $out/bin is a symlink to $out/share/dupeguru/run.py
   # so wrapPythonPrograms hook does not handle it automatically.
   postFixup = ''
-    wrapPythonProgramsIn "$out/share/dupeguru" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/dupeguru" "$out ''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/applications/misc/pure-maps/default.nix

@@ -50,7 +50,7 @@ mkDerivation rec {
   pythonPath = with python3.pkgs; [ gpxpy ];
 
   preInstall = ''
-    buildPythonPath "$pythonPath"
+    buildPythonPath "''${pythonPath[*]}"
     qtWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
   '';
 

pkgs/applications/networking/browsers/chromium/info.json

@@ -813,7 +813,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "144.0.7559.96",
+    "version": "144.0.7559.109",
     "deps": {
       "depot_tools": {
         "rev": "2e88a3f08bd8c4a0014eae82729beca935f7f188",
@@ -825,16 +825,16 @@
         "hash": "sha256-04h38X/hqWwMiAOVsVu4OUrt8N+S7yS/JXc5yvRGo1I="
       },
       "ungoogled-patches": {
-        "rev": "144.0.7559.96-1",
-        "hash": "sha256-gbEKKGGi6FBhRoCEerSdJJtn5vXaFo9G74lYHDsz0Xs="
+        "rev": "144.0.7559.109-1",
+        "hash": "sha256-PPZ87jk8zISyWcoI3cf5/Z11uA15+cb+K9EKxT93u0M="
       },
       "npmHash": "sha256-13sgV/5BD7QvDLBAEmoLN5vongw+S5v5znvZcctxhWc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "d7b80622cfab91c265741194e7942eefd2d21811",
-        "hash": "sha256-Cz3iDS0raJHRh+byrs7GYp6sck54mJq7yzsjLUWDWqA=",
+        "rev": "6a8d5e49388fcc8a7d56d2a275e4ef424eb10960",
+        "hash": "sha256-3Wwc7Vb8dM2VGqQs6GOPehsTVBgcZ9in+kC1vN9S1FI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1619,8 +1619,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "6c2c296f23a5487ccb2536cf7c90d01f35d03077",
-        "hash": "sha256-gBzwGvl/tqj4Z6acdLN326I80kBLEk+Nn8oN6D193o4="
+        "rev": "d75d178c137447df1a3e8830eae86b0bd72b9ac6",
+        "hash": "sha256-5oQP3+kpnKfUInGBYcTvL/uLK9UlcWCz1mDFGeXBnmM="
       }
     }
   }

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "148.0b6";
+  version = "148.0b8";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a8dfcff028d28d63dc635f9cda8e2dcf2f6b55363ac4e1686561c77aff56216d3f897b1d3686bf32f388eed4e1df146d3795a55eb2a696523dc7c176bb63cd07";
+    sha512 = "7fc53c1f4545d09e5ec790ba12e1a0eb1d3c3949a5d92ff98f294e80bd6e37e1ba2ef6b76661cdd9717043ad7823ff9392f7138070f3f2418b414072f020b316";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "148.0b4";
+  version = "148.0b8";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "951da65733ab4226839cf23fa0f667d8bcdeeb8c2e729b6395d7ee39b10263a4409380eebde132156f8acc56ab5b4bf96eed1991a31820037b57214a1d22e520";
+    sha512 = "28c0efc1d7d287f6ed77b6e3d4c8e4a3d65b9dc6dc4ef48f9a6da9a889c24e1d03ef2bd1d484e67f260e08ababbe1c32a81cfb81e36934b54beb4e26dc11f726";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "34.0.0";
+  version = "34.0.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-TC/Lmn/be2RR0De3DgIo9zWm0IumlOju+CuMCJ8Rggs=";
+          hash = "sha256-kZ0MCMtAzSzGZomoB/dtNgSsPfFLZXitGSZ9aB1K/9g=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-LGZP1sVS0LYZmHE9l68RPa/BOew5bgCDqyxXs0BYLjw=";
+          hash = "sha256-yhnQuRtyl5nLn1ggG6zjUTXM0ym7510QXMe+jvwG9GM=";
         };
       };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -54,11 +54,11 @@
     "vendorHash": "sha256-ogQLStDbsM0aRf4QIbITB8Z+L9DUtZwoAPK6T4xylXI="
   },
   "aminueza_minio": {
-    "hash": "sha256-gl1mD4Ital/xhtWZW9UbalTJqYLJ2tr8ImDFLiTyyFg=",
+    "hash": "sha256-Rhwf0vnVzCxbv2Ikyk6YSGn/mJshEFfmqOSOZORfU2M=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.13.0",
+    "rev": "v3.14.0",
     "spdx": "AGPL-3.0",
     "vendorHash": "sha256-6Tw4rCOzrvN2pK83NejdJJBjljfDfHEniIX+EdfqujA="
   },
@@ -364,13 +364,13 @@
     "vendorHash": "sha256-u/ycUCnEYlCBrDcI0VCkob4CGXrXYdGWwiw5EeJyuiw="
   },
   "e-breuninger_netbox": {
-    "hash": "sha256-nY0V4Pi5sF2ZiXBDfbXeJKz9ystKZpwhntoWRYMiefg=",
+    "hash": "sha256-gIqmj/skEUOmpZocx3nazRueUrNdvWcBszveqTOcblw=",
     "homepage": "https://registry.terraform.io/providers/e-breuninger/netbox",
     "owner": "e-breuninger",
     "repo": "terraform-provider-netbox",
-    "rev": "v5.0.1",
+    "rev": "v5.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-6dmHJzJGnpMWzYYelIuriMIrjOXD0KyJeVo1AUuYIRo="
+    "vendorHash": "sha256-dzgI9WOABHVv8bJ1p36RAty4/2UAqDHagVJFPdEAnRU="
   },
   "equinix_equinix": {
     "hash": "sha256-F9WKIO8msltYTmxVjbF5FXkUX1jLK91zecOIq6xrGqY=",
@@ -1247,11 +1247,11 @@
     "vendorHash": "sha256-HWAUI0mowVP8FPw44xYaFOTh6jjkfXa7fuPk2zoSZJ8="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-0KjAzRrPsjBh1SadyKT4KTLvF7+cl5Hq5mWbv6uHNaA=",
+    "hash": "sha256-aPOqAzK/FdDDTbl2WMKxA99a5w6ZM0xK/BLjzPnvuws=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.232.1",
+    "rev": "v1.232.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Cj7RVITkFxIjAZAqHFhnoTa4lTZFXG22ny801g0Y+NE="
   },
@@ -1310,11 +1310,11 @@
     "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-kXdu7rtGo4J9waREkVMWqFf4/Ki22fm6p/Nhtts/Ycs=",
+    "hash": "sha256-l5aywIsyAlQCX8SjvjJkEizqH+aZGmFN9zBbt/V/ri8=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.57",
+    "rev": "v1.82.62",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1499,12 +1499,12 @@
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-lNVCxNXYai+da2Hcg1+tcoYzoYRLRoCjzAQ/UB1WW4g=",
+    "hash": "sha256-UyrHFZDY2mQqF0yosPc1xS/Zm9nrGGhMH6awf3pdFdI=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.179.0",
+    "rev": "v0.181.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JW8aCDhY0XLoeFN864bM9ZWPxDrGk7VGTAUhx3PiQ+E="
+    "vendorHash": "sha256-Gj6ApI9xUL42KF4xYdvC8uwsAPNHJmouRkoz69yVVXQ="
   }
 }

pkgs/applications/networking/cluster/terraform/default.nix

@@ -194,8 +194,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.14.3";
-    hash = "sha256-QPVKWtpm67z13hmPgM/YXm+CBOqiI8qZwttx2h6LboU=";
+    version = "1.14.4";
+    hash = "sha256-fEuIAKmR+shKHNldUlU6qvel9tjYFdKnc25JWtxRPHs=";
     vendorHash = "sha256-NDtBLa8vokrSRDCNX10lQyfMDzTrodoEj5zbDanL4bk=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/networking/mailreaders/astroid/default.nix

@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pythonPath = with python3.pkgs; requiredPythonModules extraPythonPackages;
   preFixup = ''
-    buildPythonPath "$out $pythonPath"
+    buildPythonPath "$out ''${pythonPath[*]}"
     gappsWrapperArgs+=(
       --prefix PYTHONPATH : "$program_PYTHONPATH"
     )

pkgs/applications/science/logic/easycrypt/default.nix

@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     runHook preInstall
     dune install --prefix $out easycrypt
     rm $out/bin/ec-runtest
-    wrapPythonProgramsIn "$out/lib/easycrypt/commands" "$pythonPath"
+    wrapPythonProgramsIn "$out/lib/easycrypt/commands" "''${pythonPath[*]}"
     runHook postInstall
   '';
 

pkgs/applications/science/robotics/sumorobot-manager/default.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     patchShebangs $out/opt/sumorobot-manager/main.py
-    wrapPythonProgramsIn "$out/opt" "$pythonPath"
+    wrapPythonProgramsIn "$out/opt" "''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/applications/system/coolercontrol/coolercontrold.nix

@@ -52,7 +52,7 @@ rustPlatform.buildRustPackage {
   postFixup = ''
     addDriverRunpath "$out/bin/coolercontrold"
 
-    buildPythonPath "$pythonPath"
+    buildPythonPath "''${pythonPath[*]}"
     wrapProgram "$out/bin/coolercontrold" \
       --prefix PATH : $program_PATH \
       --prefix PYTHONPATH : $program_PYTHONPATH

pkgs/applications/version-management/cgit/default.nix

@@ -102,7 +102,7 @@ stdenv.mkDerivation {
     mkdir -p "$out/share/man/man5"
     cp cgitrc.5 "$out/share/man/man5"
 
-    wrapPythonProgramsIn "$out/lib/cgit/filters" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/lib/cgit/filters" "$out ''${pythonPath[*]}"
 
     for script in $out/lib/cgit/filters/*.sh $out/lib/cgit/filters/html-converters/txt2html; do
       wrapProgram $script --prefix PATH : '${

pkgs/applications/video/kodi/addons/youtube/default.nix

@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.3.0.1";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-e9V58R6hMaDGS0RKqtAU5IAjY9HED6bYMBz6hQJ606o=";
+    hash = "sha256-IEfgpl/uuELQ+4dVqek7/iCHW+sooVZ5eiASNXnm5EA=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/virtualization/docker/buildx.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.30.1";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-SffXgJWPPB+ZImknbYWU8AyypAfk2coXxyqWy6UCNMk=";
+    hash = "sha256-SQO9wAU+OS4ct+Evny2ZZXP7AUU2IyNwwgR1AaEzTmA=";
   };
 
   doCheck = false;

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -46,14 +46,14 @@ let
 
   # "use of glibc_multi is only supported on x86_64-linux"
   isMultiBuild = multiArch && stdenv.system == "x86_64-linux";
-  # What should lib be linked to: lib32 or lib64?
+  # What should $out/usr/lib be linked to: lib32 or lib64?
   defaultLib =
-    {
-      "i686-linux" = "lib32";
-      "x86_64-linux" = "lib64";
-      "aarch64-linux" = "lib64";
-    }
-    .${stdenv.system} or (throw "Please expand list of system with defaultLib for '${stdenv.system}'");
+    if stdenv.hostPlatform.is64bit then
+      "lib64"
+    else if stdenv.hostPlatform.is32bit then
+      "lib32"
+    else
+      throw "buildFHSEnvBubblewrap: defaultLib cannot handle system ${stdenv.hostPlatform.system} (expected 64bit or 32bit)";
 
   # list of packages (usually programs) which match the host's architecture
   # (which includes stuff from multiPkgs)

pkgs/by-name/_3/_3cpio/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "3cpio";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "bdrung";
     repo = "3cpio";
     tag = version;
-    hash = "sha256-4ERSH5Kz/e2MuIIgi3XQVnhW0csBPDIvdmEw05OdREA=";
+    hash = "sha256-LZu+g5ISpG/9ZZimTedvTjUEofhAaYKJdpLTex3ehQE=";
   };
 
-  cargoHash = "sha256-ER1OQZHHtHBNPoEl4NJ5p5KYjzFgJnFR8nXcmCk2HTA=";
+  cargoHash = "sha256-YP6fCmY9fQD4hmKV6gLoElvce/BlRc9vAqyli7aaBNI=";
 
   # Tests attempt to access arbitrary filepaths
   doCheck = false;

pkgs/by-name/ai/airwindows/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2026-01-18";
+  version = "0-unstable-2026-01-25";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "fe67011732dada5da0cdba5550d4244c657d0aaa";
-    hash = "sha256-/eAa8qLRoplQoEYocdrczEI5RSCTMTxSezw0WAtk47w=";
+    rev = "597fcb482ef48a7f7a68736ea37b0badeecbb3c7";
+    hash = "sha256-J+ZtneHb7hXZ1W7vt+5MSYS1P466tUVjH7zKMzn284Y=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-01-20";
+  version = "0-unstable-2026-01-22";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "e1f6574e77386282cbb917b981c968648fbab601";
-    hash = "sha256-TR+c6OACVrETAVAlza62JSIKBvKMrDg/G4xBdMkJJlk=";
+    rev = "6c6ec8e27ccaf8da4544f30af8a65440e3cb8915";
+    hash = "sha256-nDFaF1DqO0jTUY5+VbkQTADPk3jc224QVFarCJDrR/8=";
   };
 
   dontConfigure = true;

pkgs/by-name/an/anki/addons/anki-utils.nix

@@ -21,6 +21,7 @@
           runHook preBuild
           runHook postBuild
         '',
+        strictDeps ? true,
         dontPatchELF ? true,
         dontStrip ? true,
         passthru ? { },
@@ -35,6 +36,7 @@
         inherit
           configurePhase
           buildPhase
+          strictDeps
           dontPatchELF
           dontStrip
           ;

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-18i2xiVDjIRG0RD5R7t2BsyB9N+hhYOOByV6snGBCkM=";
+    hash = "sha256-7KDyTXqIM4hUnNVJt4xwsuUdP0eYSF+fSBRuSKs8VzQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-P8/0VSx4JfWgbMUuvo1Z0BhtC1TgGITSHLMHSzigeEg=";
+  vendorHash = "sha256-vHTJCfXVlbBLQXC/tsXJsGoACcxAhJmFlU/tq10836Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ap/appium-inspector/package.nix

@@ -11,7 +11,7 @@
 
 let
   electron = electron_39;
-  version = "2026.1.2";
+  version = "2026.1.3";
 in
 
 buildNpmPackage {
@@ -22,10 +22,10 @@ buildNpmPackage {
     owner = "appium";
     repo = "appium-inspector";
     tag = "v${version}";
-    hash = "sha256-uNRm6XHgK55gayl4ab9atV4+i9uCnxEcl4C6HEOX6Ro=";
+    hash = "sha256-9WhSQq3is2qucL1cGQIYPuLM9VkCFIWq2XVU2QioRMo=";
   };
 
-  npmDepsHash = "sha256-MraVLbKNgEhwT9sTyNhi4uDfyXOEAGOznvSs0B+mEUA=";
+  npmDepsHash = "sha256-2DNUTvZ6yFL9U8JKw4ZFR81a6Mv9rPXtRu/v/Il/Rhw=";
   npmFlags = [ "--ignore-scripts" ];
 
   nativeBuildInputs = [

pkgs/by-name/ar/arubaotp-seed-extractor/package.nix

@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication {
     mkdir -p "$libdir"
     cp scripts/* "$libdir"
     chmod +x "$libdir/main.py"
-    wrapPythonProgramsIn "$libdir" "$pythonPath"
+    wrapPythonProgramsIn "$libdir" "''${pythonPath[*]}"
     mkdir -p $out/bin
     ln -s "$libdir/main.py" $out/bin/arubaotp-seed-extractor
   '';

pkgs/by-name/aw/aws-encryption-sdk-cli/package.nix

@@ -3,46 +3,28 @@
   aws-encryption-sdk-cli,
   fetchPypi,
   nix-update-script,
-  python3,
+  python3Packages,
   testers,
 }:
 
-let
-  localPython = python3.override {
-    self = localPython;
-    packageOverrides = final: prev: {
-      urllib3 = prev.urllib3.overridePythonAttrs (prev: rec {
-        version = "1.26.18";
-        build-system = with final; [
-          setuptools
-        ];
-        postPatch = null;
-        src = prev.src.override {
-          inherit version;
-          hash = "sha256-+OzBu6VmdBNFfFKauVW/jGe0XbeZ0VkGYmFxnjKFgKA=";
-        };
-      });
-    };
-  };
-in
-
-localPython.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "aws-encryption-sdk-cli";
-  version = "4.2.0";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-gORrscY+Bgmz2FrKdSBd56jP0yuEklytMeA3wr8tTZU=";
+    inherit version;
+    pname = "aws_encryption_sdk_cli";
+    hash = "sha256-FfLgR7gocZ0cLV7bxqvKNI+Fs7kQF0XhR3zf6tHXwOE=";
   };
 
   pythonRelaxDeps = [ "aws-encryption-sdk" ];
 
-  build-system = with localPython.pkgs; [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  dependencies = with localPython.pkgs; [
+  dependencies = with python3Packages; [
     attrs
     aws-encryption-sdk
     base64io
@@ -52,7 +34,7 @@ localPython.pkgs.buildPythonApplication rec {
 
   doCheck = true;
 
-  nativeCheckInputs = with localPython.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     pytest-mock
     pytest7CheckHook

pkgs/by-name/ba/bada-bib/package.nix

@@ -69,7 +69,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   postFixup = ''
-    wrapPythonProgramsIn "$out/libexec" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/libexec" "$out ''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/by-name/bc/bcc/package.nix

@@ -118,7 +118,7 @@ python3Packages.buildPythonApplication rec {
   pythonImportsCheck = [ "bcc" ];
 
   postFixup = ''
-    wrapPythonProgramsIn "$out/share/bcc/tools" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/bcc/tools" "$out ''${pythonPath[*]}"
   '';
 
   outputs = [

pkgs/by-name/be/better-control/package.nix

@@ -88,7 +88,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   postFixup = ''
-    wrapPythonProgramsIn "$out/share/better-control" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/better-control" "$out ''${pythonPath[*]}"
   '';
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/bi/biome/package.nix

@@ -7,19 +7,20 @@
   rust-jemalloc-sys,
   zlib,
   gitMinimal,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.3.12";
+  version = "2.3.13";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-v/m7yS9bE3/WpfuqZoW+tgIEm1ARsXze/0PRUWi+mHA=";
+    hash = "sha256-WvEY3YslLu0FdIG8OcL4pPpfB945coU+W+YGLLecTc0=";
   };
 
-  cargoHash = "sha256-ldxw6znHscxfgg91BpaexsEvy3Dw2UMjcvI72VLUKG0=";
+  cargoHash = "sha256-iIKs6tzhMZ7f8tKh95Db+FdE21vqiw3ksT72xacpPf8=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -57,6 +58,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     unset BIOME_VERSION
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Toolchain of the web";
     homepage = "https://biomejs.dev/";

pkgs/by-name/bl/blender/package.nix

@@ -345,7 +345,7 @@ stdenv'.mkDerivation (finalAttrs: {
       mv $out/Blender.app $out/Applications
     ''
     + ''
-      buildPythonPath "$pythonPath"
+      buildPythonPath "''${pythonPath[*]}"
       wrapProgram $blenderExecutable \
         --prefix PATH : $program_PATH \
         --prefix PYTHONPATH : "$program_PYTHONPATH" \

pkgs/by-name/bl/blender/wrapper.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r $src/share/doc $out/share
     cp -r $src/share/icons $out/share
 
-    buildPythonPath "$pythonPath"
+    buildPythonPath "''${pythonPath[*]}"
 
     makeWrapper ${blender}/bin/blender $out/bin/${finalAttrs.finalPackage.pname} \
       --prefix PATH : $program_PATH \

pkgs/by-name/bl/blightmud/package.nix

@@ -55,9 +55,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
         "test_tls_init_no_verify"
         "test_tls_init_verify"
       ];
-      skipFlag = test: "--skip " + test;
     in
-    builtins.concatStringsSep " " (map skipFlag skipList);
+    builtins.map (x: "--skip=" + x) skipList;
 
   meta = {
     description = "Terminal MUD client written in Rust";

pkgs/by-name/bl/blueberry/package.nix

@@ -84,7 +84,7 @@ python3Packages.buildPythonApplication rec {
 
   postFixup = ''
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-    wrapPythonProgramsIn $out/lib "$out $pythonPath"
+    wrapPythonProgramsIn $out/lib "$out ''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/by-name/bl/blueman/package.nix

@@ -89,8 +89,8 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     # This mimics ../../../development/interpreters/python/wrap.sh
-    wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
-    wrapPythonProgramsIn "$out/libexec" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/bin" "$out ''${pythonPath[*]}"
+    wrapPythonProgramsIn "$out/libexec" "$out ''${pythonPath[*]}"
   '';
 
   meta = {

pkgs/by-name/bo/botamusique/package.nix

@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share $out/bin
     cp -r . $out/share/botamusique
     chmod +x $out/share/botamusique/mumbleBot.py
-    wrapPythonProgramsIn $out/share/botamusique "$out $pythonPath"
+    wrapPythonProgramsIn $out/share/botamusique "$out ''${pythonPath[*]}"
 
     # Convenience binary and wrap with ffmpeg dependency
     makeWrapper $out/share/botamusique/mumbleBot.py $out/bin/botamusique \

pkgs/by-name/bu/budgie-media-player-applet/package.nix

@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = ''
-    buildPythonPath "$out $pythonPath"
+    buildPythonPath "$out ''${pythonPath[*]}"
     patchPythonScript "$out/lib/budgie-desktop/plugins/budgie-media-player-applet/applet.py"
   '';
 

pkgs/by-name/bu/bun/package.nix

@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
-  version = "1.3.6";
+  version = "1.3.7";
   pname = "bun";
 
   src =
@@ -71,35 +71,29 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           && !(stdenvNoCC.hostPlatform.isDarwin && stdenvNoCC.hostPlatform.isx86_64)
         )
         ''
-          completions_dir=$(mktemp -d)
-
-          SHELL="bash" $out/bin/bun completions $completions_dir
-          SHELL="zsh" $out/bin/bun completions $completions_dir
-          SHELL="fish" $out/bin/bun completions $completions_dir
-
-          installShellCompletion --name bun \
-            --bash $completions_dir/bun.completion.bash \
-            --zsh $completions_dir/_bun \
-            --fish $completions_dir/bun.fish
+          installShellCompletion --cmd bun \
+            --bash <(SHELL="bash" $out/bin/bun completions) \
+            --zsh <(SHELL="zsh" $out/bin/bun completions) \
+            --fish <(SHELL="fish" $out/bin/bun completions)
         '';
 
   passthru = {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-aarch64.zip";
-        hash = "sha256-KvHshDd1mrBbOw6kIf6eIubHBctMsHUcMmmCZC2s6Po=";
+        hash = "sha256-FnAeSUmY5HZNSa8vvmLSXsWc88ee5pbrod7yz+kEnWQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-aarch64.zip";
-        hash = "sha256-Wv0Ss2a6LYKXJFzCnAOUFjNN2HIVLB2wLlyKqMZulrE=";
+        hash = "sha256-1cfWUUI8K8WuP5LTaDf/st3G7pGElnJQC3/o5aUVn7w=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-stiZTUz3BkE2bWm4dCC4BdHZhPTqfhajUt8VaUlHT6U=";
+        hash = "sha256-nCwa7m1y6WGVwwUfkSMlBHWVB6qusJPVtw+IaX4ajq8=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${finalAttrs.version}/bun-linux-x64.zip";
-        hash = "sha256-m6mNITRVDWaQh1sjpPXEjnS3yyZ+jMG49SYFkhxsEe8=";
+        hash = "sha256-K9Lg4L3wlIO+Z6cEYHhI6+csKEIIJOTOdyzj2mLCPWU=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ca/cambalache/package.nix

@@ -79,7 +79,7 @@ python3.pkgs.buildPythonApplication rec {
 
   postFixup = ''
     # Wrap a helper script in an unusual location.
-    wrapPythonProgramsIn "$out/${python3.sitePackages}/cambalache/priv/merengue" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/${python3.sitePackages}/cambalache/priv/merengue" "$out ''${pythonPath[*]}"
   '';
 
   passthru = {

pkgs/by-name/ca/cargo-bisect-rustc/package.nix

@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-SigRm2ZC7jH1iCEGRpka1G/e9kBEieFVU0YDBl2LfTM=";
 
   checkFlags = [
-    "--skip test_github" # requires internet
+    "--skip=test_github" # requires internet
   ];
 
   meta = {

pkgs/by-name/ca/cargo-deadlinks/package.nix

@@ -20,15 +20,16 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # uses internet
-    "--skip non_existent_http_link --skip working_http_check"
+    "--skip=non_existent_http_link"
+    "--skip=working_http_check"
     # makes assumption about HTML paths that changed in rust 1.82.0
-    "--skip simple_project::it_checks_okay_project_correctly"
-    "--skip cli_args::it_passes_arguments_through_to_cargo"
+    "--skip=simple_project::it_checks_okay_project_correctly"
+    "--skip=cli_args::it_passes_arguments_through_to_cargo"
   ]
-  ++
-    lib.optional (stdenv.hostPlatform.system != "x86_64-linux")
-      # assumes the target is x86_64-unknown-linux-gnu
-      "--skip simple_project::it_checks_okay_project_correctly";
+  ++ lib.optionals (stdenv.hostPlatform.system != "x86_64-linux") [
+    # assumes the target is x86_64-unknown-linux-gnu
+    "--skip=simple_project::it_checks_okay_project_correctly"
+  ];
 
   meta = {
     description = "Cargo subcommand to check rust documentation for broken links";

pkgs/by-name/ca/cargo-geiger/package.nix

@@ -53,21 +53,21 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # skip tests with networking or other failures
   checkFlags = [
     # panics
-    "--skip serialize_test2_quick_report"
-    "--skip serialize_test3_quick_report"
-    "--skip serialize_test6_quick_report"
-    "--skip serialize_test2_report"
-    "--skip serialize_test3_report"
-    "--skip serialize_test6_report"
+    "--skip=serialize_test2_quick_report"
+    "--skip=serialize_test3_quick_report"
+    "--skip=serialize_test6_quick_report"
+    "--skip=serialize_test2_report"
+    "--skip=serialize_test3_report"
+    "--skip=serialize_test6_report"
     # requires networking
-    "--skip test_package::case_2"
-    "--skip test_package::case_3"
-    "--skip test_package::case_6"
-    "--skip test_package::case_9"
+    "--skip=test_package::case_2"
+    "--skip=test_package::case_3"
+    "--skip=test_package::case_6"
+    "--skip=test_package::case_9"
     # panics, snapshot assertions fails
-    "--skip test_package_update_readme::case_2"
-    "--skip test_package_update_readme::case_3"
-    "--skip test_package_update_readme::case_5"
+    "--skip=test_package_update_readme::case_2"
+    "--skip=test_package_update_readme::case_3"
+    "--skip=test_package_update_readme::case_5"
   ];
 
   passthru.tests.version = testers.testVersion {

pkgs/by-name/ca/cargo-sweep/package.nix

@@ -19,9 +19,9 @@ rustPlatform.buildRustPackage rec {
 
   checkFlags = [
     # Requires a rustup toolchain to be installed.
-    "--skip check_toolchain_listing_on_multiple_projects"
+    "--skip=check_toolchain_listing_on_multiple_projects"
     # Does not work with a `--target` build in the environment
-    "--skip empty_project_output"
+    "--skip=empty_project_output"
   ];
 
   meta = {

pkgs/by-name/ca/cargo-valgrind/package.nix

@@ -33,9 +33,9 @@ rustPlatform.buildRustPackage rec {
   '';
 
   checkFlags = [
-    "--skip tests_are_runnable"
-    "--skip default_cargo_project_reports_no_violations"
-    "--skip empty_tests_not_leak_in_release_mode"
+    "--skip=tests_are_runnable"
+    "--skip=default_cargo_project_reports_no_violations"
+    "--skip=empty_tests_not_leak_in_release_mode"
   ];
 
   meta = {

pkgs/by-name/ca/carla/package.nix

@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # Also sets program_PYTHONPATH and program_PATH variables
     wrapPythonPrograms
-    wrapPythonProgramsIn "$out/share/carla/resources" "$out $pythonPath"
+    wrapPythonProgramsIn "$out/share/carla/resources" "$out ''${pythonPath[*]}"
 
     find "$out/share/carla" -maxdepth 1 -type f -not -name "*.py" -print0 | while read -d "" f; do
       patchPythonScript "$f"

pkgs/by-name/ca/cartridges/package.nix

@@ -60,7 +60,7 @@ python3Packages.buildPythonApplication rec {
   makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
 
   postFixup = ''
-    wrapPythonProgramsIn $out/libexec $out $pythonPath
+    wrapPythonProgramsIn $out/libexec "$out ''${pythonPath[*]}"
   '';
 
   # NOTE: `postCheck` is intentionally not used here, as the entire checkPhase

pkgs/by-name/cc/ccze/package.nix

@@ -42,6 +42,13 @@ stdenv.mkDerivation (finalAttrs: {
   # provide correct pcre2-config for cross
   env.PCRE_CONFIG = lib.getExe' (lib.getDev pcre2) "pcre2-config";
 
+  outputs = [
+    "out"
+    "man"
+    "dev"
+    "lib"
+  ];
+
   meta = {
     mainProgram = "ccze";
     description = "Fast, modular log colorizer";

pkgs/by-name/cd/cdk8s-cli/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.203.18";
+  version = "2.204.3";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P/I8e7FWC4HgqPUe5839oh8sRrIQoCJqCvlw6+Wz/aw=";
+    hash = "sha256-2f9ddwSpNg+7ZMKlHw1Lu10Qp/MoJTqBOz++0yCrXH0=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-IefCjyrUlHAFC8563M5/UM7d+4Sx9zvW7QMLxW5pJgQ=";
+    hash = "sha256-dO/h9ebnaH4KSASht8Nec/p/fq0LHJyL7fFgCYvsq6w=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ch/check-jsonschema/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.36.0";
+  version = "0.36.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     tag = version;
-    hash = "sha256-volbCQ0qxd614CDu0GIFKPXF1qSvgf5tTnJ8skcnnTg=";
+    hash = "sha256-s8a/9kWKSu+WuHQyoBsK4Vn30c+EA/eld/OD3kHYvbk=";
   };
 
   build-system = with python3Packages; [ setuptools ];

pkgs/by-name/ch/checkmake/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "checkmake";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "checkmake";
     repo = "checkmake";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W+4bKERQL4nsPxrcCP19uYAwSw+tK9mAQp/fufzYcYg=";
+    hash = "sha256-5GIqmcIj1jU4lOqrFxuI8lDNYYpsRnUSft6RYGRbiAE=";
   };
 
   vendorHash = "sha256-Iv3MFhHnwDLIuUH7G6NYyQUSAaivBYqYDWephHnBIho=";

pkgs/by-name/ch/chirpstack-rest-api/package.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "chirpstack-rest-api";
-  version = "4.15.0";
+  version = "4.16.1";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-rest-api";
     rev = "v${version}";
-    hash = "sha256-YSMdE0f3usedyUItSvdtJ77L/x4rwrgIJa1TTg9ODek=";
+    hash = "sha256-utXayqQGlBYzmf7xW+s1Fh4oRhpBdfnV5g73X2ILKko=";
   };
 
-  vendorHash = "sha256-+lAfgFb45WxZYh5fzONECRwTlXA64nl58rfstOPsDEg=";
+  vendorHash = "sha256-JnQaClgU+Yyz07lELoEyLYHLJwcmET5SLci2XQoFGKc=";
 
   ldflags = [
     "-s"

pkgs/by-name/ci/ciscoPacketTracer9/package.nix

@@ -0,0 +1,90 @@
+{
+  appimageTools,
+  dpkg,
+  lib,
+  libpng,
+  libxkbfile,
+  requireFile,
+  stdenvNoCC,
+  version ? "9.0.0",
+}:
+
+let
+  pname = "ciscoPacketTracer9";
+
+  appimage = stdenvNoCC.mkDerivation {
+    pname = "ciscoPacketTracer9-appimage";
+    inherit version;
+
+    src =
+      let
+        sources = {
+          "9.0.0" = {
+            name = "CiscoPacketTracer_900_Ubuntu_64bit.deb";
+            hash = "sha256-3ZrA1Mf8N9y2j2J/18fm+m1CAMFEklJuVhi5vRcu2SA=";
+          };
+        };
+      in
+      requireFile {
+        inherit (sources."${version}") name hash;
+        url = "https://www.netacad.com/resources/lab-downloads";
+      };
+
+    nativeBuildInputs = [
+      dpkg
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      cp opt/pt/packettracer.AppImage $out
+
+      runHook postInstall
+    '';
+  };
+
+in
+appimageTools.wrapType2 rec {
+  inherit pname version;
+  src = appimage;
+
+  extraPkgs = _: [
+    libpng
+    libxkbfile
+  ];
+
+  extraBwrapArgs = [
+    # fixes launch on wayland when the user sets QT_QPA_PLATFORM=wayland:
+    # "Fatal: This application failed to start because no Qt platform plugin could be initialized."
+    "--setenv QT_QPA_PLATFORM xcb"
+  ];
+
+  extraInstallCommands =
+    let
+      contents = appimageTools.extract { inherit pname version src; };
+    in
+    ''
+      mv $out/bin/${pname} $out/bin/packettracer9
+
+      install -Dm444 ${contents}/CiscoPacketTracer-9.0.0.desktop $out/share/applications/cisco-packet-tracer-9.desktop
+      install -Dm444 ${contents}/CiscoPacketTracerPtsa-9.0.0.desktop $out/share/applications/cisco-packet-tracer-ptsa-9.desktop
+      substituteInPlace $out/share/applications/* \
+        --replace-fail "Exec=@EXEC_PATH@" "Exec=packettracer9" \
+        --replace-fail "Icon=app" "Icon=cisco-packet-tracer-9"
+
+      install -Dm444 ${contents}/usr/share/icons/hicolor/48x48/apps/app.png $out/share/icons/hicolor/48x48/apps/cisco-packet-tracer-9.png
+      cp -r ${contents}/usr/share/icons/gnome/48x48/mimetypes $out/share/icons/hicolor/48x48/
+    '';
+
+  meta = {
+    description = "Network simulation tool from Cisco";
+    homepage = "https://www.netacad.com/courses/packet-tracer";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
+    mainProgram = "packettracer9";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/cl/clapper-enhancers/package.nix

@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postFixup = ''
-    buildPythonPath "$out $pythonPath"
+    buildPythonPath "$out ''${pythonPath[*]}"
     for yt_plugin in $out/lib/clapper-enhancers/plugins/yt-dlp/*.py; do
       patchPythonScript $yt_plugin
     done

pkgs/by-name/cl/claude-code-bin/manifest.json

@@ -1,34 +1,34 @@
 {
-  "version": "2.1.20",
-  "buildDate": "2026-01-27T00:41:34Z",
+  "version": "2.1.21",
+  "buildDate": "2026-01-28T01:39:36Z",
   "platforms": {
     "darwin-arm64": {
-      "checksum": "c5703596ed854ae8e5775cf38de5d71d8a56ecfe3f36904812870e9e34178c8c",
-      "size": 181661168
+      "checksum": "e8265d8719f131ab8f2863e66ce69cc829c4f55387ae2286e45d4a06b802c6fd",
+      "size": 181892336
     },
     "darwin-x64": {
-      "checksum": "0d38292770c88bd9b13b0684afb0d2dc0028a1437d0c09be3449d2b3d369b045",
-      "size": 187958208
+      "checksum": "1824c9a01e0266bef1c0da880503e49db08823cf7eb6a54fef2a385028c2bb05",
+      "size": 188189376
     },
     "linux-arm64": {
-      "checksum": "eb8801c7a4a8501b21c235f36674f17328e65e796cf8a6196b3bf9a23ae16f99",
-      "size": 216047898
+      "checksum": "e043ed95e4df4282a9adb34eb51ee14d59a53f2feeeb19884a6b4edeccbe7f3a",
+      "size": 216288068
     },
     "linux-x64": {
-      "checksum": "f9d3698f5378a486db2d4eea5c80f95c2ceb410fbcea9ffc5703b5aac9574fcc",
-      "size": 223852550
+      "checksum": "35fcccfced2e8669dc4aacf2bb76fab9816bcc5fc566e66b5ae42f4e7b4474b1",
+      "size": 224093184
     },
     "linux-arm64-musl": {
-      "checksum": "2a7d24d2b85068c5aca6c014dd5f3f94bd8d55803a06f0d39eea776ab3282d76",
-      "size": 211311930
+      "checksum": "5e453c59b3c8fea4e6848e0972ab093e8eda4711e2be20b68dd4ebaea12db4e1",
+      "size": 211552100
     },
     "linux-x64-musl": {
-      "checksum": "0b392cc1c268f0e48ceedee384535451013f69887a61e23f989e3b743373796a",
-      "size": 216541126
+      "checksum": "afa929dbccd23f746b01821699b1985eb7cc35018d0a8e9bbab678764ea58fb7",
+      "size": 216781760
     },
     "win32-x64": {
-      "checksum": "12e88d78570b6e979f5cf290652dc45ca8b9327f43bb27e275f87146190bef05",
-      "size": 233703072
+      "checksum": "325abe8bb0b907c008e229085815c938037864411ced6c553dbb52e0be587efe",
+      "size": 233936544
     }
   }
 }

pkgs/by-name/cl/clickhouse/lts.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.8.14.17-lts";
-  rev = "85bdcee459593cd55faef3154a5e487b60119ff4";
-  hash = "sha256-Ydx46Y7uFHVUzsqY8dBExg2r78Y+PeJUkMSIVAn6eXQ=";
+  version = "25.8.15.35-lts";
+  rev = "7a0b36cf8934881236312e9fea094baaf5c709a4";
+  hash = "sha256-zCMqZaw+QO/MAdJhgyrZYvdFPO8o11EXbuGHS5++dZw=";
   lts = true;
 }

pkgs/by-name/cl/clojure/package.nix

@@ -13,12 +13,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.12.4.1582";
+  version = "1.12.4.1602";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/Vhk8ivy7DAxH5zjyvPTF5ngTWU7ZX7NtPCDb+ly/yE=";
+    hash = "sha256-B9ld7oGEVcoI/QJb/SBHGAhSI7E1vc1LXQA5scxvkqM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/comma/package.nix

@@ -12,14 +12,14 @@
   buildPackages,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "comma";
   version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-dNek1a8Yt3icWc8ZpVe1NGuG+eSoTDOmAAJbkYmMocU=";
   };
 
@@ -67,4 +67,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "comma";
     maintainers = with lib.maintainers; [ artturin ];
   };
-}
+})

pkgs/by-name/co/complgen/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "complgen";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fHSDYrfCoLQ4tU1DbrpD3iApufBv5qAGTIFri229pyE=";
+    hash = "sha256-DNmStSwuAFsLGC4pLU6dO2qhBQgxObPiUJxZoJf1d5A=";
   };
 
-  cargoHash = "sha256-a6bGE2xxv8IdKlo98X8KNeQl8e//dc9pfaBgGHhx+5M=";
+  cargoHash = "sha256-whve1rNmqOLWjrM8gqxgocRTTWpEQ/VxT/0t+12uSKw=";
 
   meta = {
     changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";

pkgs/by-name/cu/cue/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cue";
-  version = "0.15.3";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "cue-lang";
     repo = "cue";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xonTaZyJ3oyk4jcnyLIlOEP201jfM4cB7jNR6GxfK1E=";
+    hash = "sha256-5qu+CilTLYdTCfW15ifGIhr/fVH7NshrFxecwED1hkQ=";
   };
 
   vendorHash = "sha256-ivFw62+pg503EEpRsdGSQrFNah87RTUrRXUSPZMFLG4=";

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -8,7 +8,7 @@
   openjdk21,
   gnused,
   autoPatchelfHook,
-  autoSignDarwinBinariesHook,
+  darwin,
   wrapGAppsHook3,
   gtk3,
   glib,
@@ -55,7 +55,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [
     undmg
-    autoSignDarwinBinariesHook
+    darwin.autoSignDarwinBinariesHook
   ];
 
   dontConfigure = true;
@@ -144,7 +144,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.asl20;
-    platforms = with lib.platforms; linux ++ darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [
       gepbird
       mkg20001

pkgs/by-name/de/deck/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.54.0";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     tag = "v${version}";
-    hash = "sha256-DVj4VHmU3yORL4zytWzXIPEjrS1P+WLE18Vdcdbibos=";
+    hash = "sha256-Xw8IROfseCo4e0yDC5Y6aD/aTu9JYsGYjeSzSVIXd+E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ buildGoModule rec {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-x+nL+bnwXio/z3XFC9A9G9T7mtB5BsnNgLWT54OJLCE=";
+  vendorHash = "sha256-LmYsPrHKTYu07jLkAo7UsIV74sVyLSdhAwUV6Cu0JNQ=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd deck \

pkgs/by-name/de/deno/package.nix

@@ -29,17 +29,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.6.5";
+  version = "2.6.6";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-oNZXPBW61IQdA3MFS1gxNoInSCt6mUitedAXx+tuFaw=";
+    hash = "sha256-QqzV4Ikr5iWrOX+KJH/65S1HHhxOB0SmHj7yejVJp3M=";
   };
 
-  cargoHash = "sha256-H1vX/aiB5inK6Fo0l3sEZnvqgRImTpjkxRZHLBPgz0U=";
+  cargoHash = "sha256-soJ2ZKpxlBskl2b3pz4pn6zMaWUXjYOBRKBuoxHokes=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch

pkgs/by-name/do/doppler/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.75.1";
+  version = "3.75.2";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    hash = "sha256-YyhDvBgdcy3CtVpQj60XQ0aqE2zT1LV9QXQJiJvlaic=";
+    hash = "sha256-S6g2wtF676Cc3nEKP1GpyhQRYyjKUQa9ACe41269vHY=";
   };
 
-  vendorHash = "sha256-tSRtgkDPvDlEfwuNhahvs3Pvt4h7QAJrJtb1XQXGaFM=";
+  vendorHash = "sha256-u6SB3SXCqu7Y2aUoTAJ01mtDCxMofVQLAde1jDxVvks=";
 
   ldflags = [
     "-s -w"

pkgs/by-name/du/dunst/package.nix

@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dunst";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HPmIcOLoYDD1GEgTh1elA9xiZGFKt1In4vsAtRsOukE=";
+    hash = "sha256-F7CONYJ95aKNZ+BpWNUerCBMflgJYgSaLAqp6XJ1G5k=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/du/duplicity/package.nix

@@ -143,7 +143,7 @@ let
       # tests need writable $HOME
       HOME=$PWD/.home
 
-      wrapPythonProgramsIn "$PWD/testing/overrides/bin" "$pythonPath"
+      wrapPythonProgramsIn "$PWD/testing/overrides/bin" "''${pythonPath[*]}"
     '';
 
     doCheck = true;

pkgs/by-name/ed/editorconfig-checker/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "editorconfig-checker";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HQYZXwxysGpbNDAzgAruzBtSlPxfwrLuzirkZSV2Xhs=";
+    hash = "sha256-kvRORmfquabvNoIchQdXEXKYKLpNjy8tgvkS6a0vmEk=";
   };
 
-  vendorHash = "sha256-zlARI7bKf+4bdgCha9AlDZyTRbrOHtmvHeExJWhB85I=";
+  vendorHash = "sha256-Olp21Sbey3zW/OCc59w0wqcnq8lwRigu/De7A82H6YU=";
 
   # Tests run on source and don't expect vendor dir.
   doCheck = false;

pkgs/by-name/eg/ego/package.nix

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   # requires access to /root
   checkFlags = [
-    "--skip tests::test_check_user_homedir"
+    "--skip=tests::test_check_user_homedir"
   ];
 
   postInstall = ''

pkgs/by-name/ei/eigenwallet/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eigenwallet";
-  version = "3.6.6";
+  version = "3.6.7";
 
   src = fetchurl {
     url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-2K1sls8YYvDirk9knVDoL5KDfjlxD7UbeKLIe+Z+wrc=";
+    hash = "sha256-kIu0TLFw5hxUnCItgSNB+XuxpC1gKXvu+k4vQH1UitA=";
   };
 
   nativeBuildInputs = [