Merge master into staging-next

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -100,6 +100,12 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 
 - `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.
 
+- [`services.grafana.settings.security.secret_key`](#opt-services.grafana.settings.security.secret_key) doesn't have a
+  default value anymore. Please generate your own key or hard-code the old one explicitly.
+  See the [upstream docs](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key) and
+  the [instructions on how to rotate](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets)
+  for further information.
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).

nixos/modules/services/monitoring/grafana.nix

@@ -889,7 +889,8 @@ in
                 to work around that. Look at the documentation for details:
                 <https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider>
               '';
-              type = types.str;
+              type = types.nullOr types.str;
+              default = null;
             };
 
             disable_gravatar = mkOption {
@@ -2060,6 +2061,17 @@ in
           || cfg.provision.alerting.muteTimings.path == null;
         message = "Cannot set both mute timings settings and mute timings path";
       }
+      {
+        assertion = cfg.settings.security.secret_key != null;
+        message = ''
+          Grafana's secret key (services.grafana.settings.security.secret_key) doesn't have a default
+          value anymore. Please generate your own and use a file-provider on this option! See also
+          https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key
+          for more information.
+
+          See https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets on how to re-encrypt.
+        '';
+      }
     ];
 
     systemd.services.grafana = {

nixos/tests/systemd-repart.nix

@@ -110,8 +110,7 @@ in
         machine.start()
         machine.wait_for_unit("multi-user.target")
 
-        systemd_repart_logs = machine.succeed("journalctl --boot --unit systemd-repart.service")
-        assert "Growing existing partition 1." in systemd_repart_logs
+        machine.succeed("journalctl --boot --grep 'Growing existing partition 1.' --identifier systemd-repart")
       '';
   };
 
@@ -173,8 +172,7 @@ in
         machine.start()
         machine.wait_for_unit("multi-user.target")
 
-        systemd_repart_logs = machine.succeed("journalctl --boot --unit systemd-repart.service")
-        assert "Encrypting future partition 2" in systemd_repart_logs
+        machine.succeed("journalctl --boot --grep 'Encrypting future partition 2' --identifier systemd-repart")
 
         assert "/dev/mapper/created-crypt" in machine.succeed("mount")
       '';
@@ -205,8 +203,7 @@ in
         machine.start()
         machine.wait_for_unit("multi-user.target")
 
-        systemd_repart_logs = machine.succeed("journalctl --unit systemd-repart.service")
-        assert "Growing existing partition 1." in systemd_repart_logs
+        machine.succeed("journalctl --grep 'Growing existing partition 1.' --identifier systemd-repart")
       '';
   };
 
@@ -273,8 +270,7 @@ in
         machine.start()
         machine.wait_for_unit("multi-user.target")
 
-        systemd_repart_logs = machine.succeed("journalctl --boot --unit systemd-repart.service")
-        assert "Adding new partition 2 to partition table." in systemd_repart_logs
+        machine.succeed("journalctl --boot --grep 'Adding new partition 2 to partition table.' --identifier systemd-repart")
       '';
   };
 

pkgs/applications/office/libreoffice/default.nix

@@ -186,15 +186,6 @@ let
     optionalString
     ;
 
-  notoSubset =
-    suffixes:
-    runCommand "noto-fonts-subset" { } ''
-      mkdir -p "$out/share/fonts/noto/"
-      ${concatMapStrings (x: ''
-        cp "${noto-fonts}/share/fonts/noto/NotoSans${x}["*.[ot]tf "$out/share/fonts/noto/"
-      '') suffixes}
-    '';
-
   fontsConf = makeFontsConf {
     fontDirectories = [
       amiri
@@ -207,9 +198,8 @@ let
       liberation_ttf_v2
       libertine
       linux-libertine-g
-      # Font priority issues in some tests in Still
       noto-fonts-lgc-plus
-      (if variant == "fresh" then noto-fonts else (notoSubset [ "Arabic" ]))
+      noto-fonts
       noto-fonts-cjk-sans
     ];
   };

pkgs/by-name/an/ansible-navigator/package.nix

@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-navigator";
-  version = "25.12.0";
+  version = "26.1.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "ansible_navigator";
-    hash = "sha256-i6yw282NWUaCZBtAYi3rQsLk+GGyp8QHyqBi7nwwIlo=";
+    hash = "sha256-WWbx4/BARcmDnCZDt7v2uCCyZUNlS8Ur8HYiCf5A/vE=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/bl/blocky/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.28.2";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GLVyPb2Qyn1jnRz+e74dFzL/AMloKqSe1BUUAGTquWA=";
+    hash = "sha256-8eFLmgTqK+WqJCPwLJXJqz2XCcP/1JDWfQQfzme9ELw=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-AzfI4SElD7GFIG8/REB4PU0/Haj5x5HUNj/3/n1OXZE=";
+  vendorHash = "sha256-H8AaK1jcdv10218ftMOrjfHd0XfaN9q3I0z4pGFirWA=";
 
   ldflags = [
     "-s"

pkgs/by-name/ca/calendar-cli/package.nix

@@ -40,6 +40,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     tzlocal
     click
     six
+    urllib3
     vobject
   ];
 

pkgs/by-name/ca/cargo-binstall/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-binstall";
-  version = "1.17.5";
+  version = "1.17.6";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uYHaVNRq8iTeDs/EW5f5wp/fNBicNYzab4PgEHuY814=";
+    hash = "sha256-+O6Zv/IHrPynsrxJZQCdkru2bY9O1vTGTg1F+rY5Kek=";
   };
 
-  cargoHash = "sha256-IFYY3bSqm2OfbjmIHXbc0vIRhiw6Wwss8Sa3fx5s1Pk=";
+  cargoHash = "sha256-WJLiq7t5suYYUP0oHcuCcOFTKzfLgzM6DEMAliHIRgM=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/cargo-chef/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-chef";
-  version = "0.1.73";
+  version = "0.1.75";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-zWyPVITx4wN0fd0bNVU5yt/ojsSVhbgIcoV6Z427RCA=";
+    hash = "sha256-FETYJrx5+yNOzMVIgJQ0yNLi2PB7cA128n8hAXIhx3E=";
   };
 
-  cargoHash = "sha256-diox0Vafn8881tW4Z5Udm6U2lNQKe9m/H5bRTRN3aGs=";
+  cargoHash = "sha256-4dMBGCEoLICnTjrTeTiXBE+AMH2siT9WLqdUfWN4UkU=";
 
   meta = {
     description = "Cargo-subcommand to speed up Rust Docker builds using Docker layer caching";

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.430.0";
+  version = "1.434.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-b2NMh+9JcPrMu0JHL2vdWOJhUA+PoCmj7M21rS9MS3o=";
+    hash = "sha256-GxbSgKy2UgDNjVEwmNrZe4BMYM5VIgP3goubdpLVnIA=";
     stripRoot = false;
   };
 

pkgs/by-name/fa/fan2go/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fan2go";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "markusressel";
     repo = "fan2go";
     tag = finalAttrs.version;
-    hash = "sha256-tfIjMUaUMwBiEF9HgWFKm3ChvQJqYUIz/isyXSkptO0=";
+    hash = "sha256-JU6hk3JJwoiC3R+Qx6QKzALnvhTA0/luQzO5X6Cpb/I=";
     leaveDotGit = true;
     postFetch = ''
       cd $out
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-JOScGakasPLZnWc2jGvG1rw0riuM3PqLCPkn/ja/P3A=";
+  vendorHash = "sha256-6rcU7Qtzz80WcygeLVftdpGYAuzGmWD0M+ZVxgGcgnI=";
 
   nativeBuildInputs = lib.optionals enableNVML [
     autoAddDriverRunpath

pkgs/by-name/fi/finit/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "finit";
-  version = "4.16-rc1";
+  version = "4.16";
 
   src = fetchFromGitHub {
     owner = "finit-project";
     repo = "finit";
     tag = finalAttrs.version;
-    hash = "sha256-hvTTvAxG0FnPpYepkw5Q1Fo59wx7w9MLjOj2h4WZsAo=";
+    hash = "sha256-DtocGgFvt7RLqwjHczwUbsszBD5MQI5fEuq9EB2tFp4=";
   };
 
   postPatch = ''

pkgs/by-name/fl/fleet/package.nix

@@ -12,12 +12,12 @@
 }:
 let
   pname = "fleet";
-  version = "4.79.1";
+  version = "4.81.0";
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${version}";
-    hash = "sha256-o/exnUy5vXi+Ey8smd36588M8B7GQlG5ZqtGyYySkxQ=";
+    hash = "sha256-LPbMcaQ3YIfh5qwIBB7BwJFgMPurCJudrOzUPm5+VcM=";
   };
 
   frontend = stdenvNoCC.mkDerivation {
@@ -32,7 +32,7 @@ let
 
     yarnOfflineCache = fetchYarnDeps {
       yarnLock = src + "/yarn.lock";
-      hash = "sha256-cCf0Q6g+VJaTCOZ12/7z8gcDf3+YT2LBTCJb39InJVw=";
+      hash = "sha256-9FuGmL9/hkPZo0ecneL4i9Hg6gkRbwhKGfIvn3/YpVo=";
     };
 
     NODE_ENV = "production";
@@ -54,7 +54,7 @@ in
 buildGoModule (finalAttrs: {
   inherit pname version src;
 
-  vendorHash = "sha256-CYqg8kHGUu+wd9l5UYURqmoR8/13HX9t5xHwjzdgJhU=";
+  vendorHash = "sha256-kudomUa5c0OJA2LgqLQ2Az0mDH/s9go3jHdyeALGgs8=";
 
   subPackages = [
     "cmd/fleet"

pkgs/by-name/ge/gemini-cli/package.nix

@@ -14,18 +14,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.29.5";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+gFSTq0CXMZa2OhP2gOuWa5WtteKW7Ys78lgnz7J72g=";
+    hash = "sha256-+w4w1cftPSj0gJ23Slw8Oexljmu0N/PZWH4IDjw75rs=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-RGiWtJkLFV1UfFahHPzxtzJIsPCseEwfSsPdLfBkavI=";
+  npmDepsHash = "sha256-Nkd5Q2ugRqsTqaFbCSniC3Obl++uEjVUmoa8MVT5++8=";
 
   dontPatchElf = stdenv.isDarwin;
 
@@ -90,6 +90,7 @@ buildNpmPackage (finalAttrs: {
     rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli
     rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli-core
     rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli-a2a-server
+    rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli-sdk
     rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli-test-utils
     rm -f $out/share/gemini-cli/node_modules/gemini-cli-vscode-ide-companion
     cp -r packages/cli $out/share/gemini-cli/node_modules/@google/gemini-cli

pkgs/by-name/gh/ghalint/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghalint";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "suzuki-shunsuke";
     repo = "ghalint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pfLXnMbrxXAMpfmjctah85z5GHfI/+NZDrIu1LcBH8M=";
+    hash = "sha256-xAXcvvSwcJjdG2BCItBLdsu6vZiID5FmRYYF9PZe1QE=";
   };
 
-  vendorHash = "sha256-VCv5ZCeUWHld+q7tkHSUyeVagMhSN9893vYHyO/VlAI=";
+  vendorHash = "sha256-XIalA/usvyvzrvGU7Ygf1DWSlTm1YYaN+X0Xm+YiiTI=";
 
   subPackages = [ "cmd/ghalint" ];
 

pkgs/by-name/gl/glaze/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optionals enableSSL [ openssl ];
+  propagatedBuildInputs = lib.optionals enableSSL [ openssl ];
 
   # https://github.com/stephenberry/glaze/blob/main/CMakeLists.txt
   cmakeFlags = [

pkgs/by-name/gu/guile-hoot/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "guile-hoot";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromCodeberg {
     owner = "spritely";
     repo = "hoot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mthEqyVsBrFhwz29VwatbFp4QgGmZ9sDoyTpRIEsOmI=";
+    hash = "sha256-b372dMUsDTa+hYrOwvj+/YcwVP52BCJxwSGRaqSSWZs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hy/hyprland/info.json

@@ -1,7 +1,7 @@
 {
-  "branch": "v0.53.3-b",
-  "commit_hash": "dd220efe7b1e292415bd0ea7161f63df9c95bfd3",
-  "commit_message": "version: bump to 0.53.3",
-  "date": "2026-01-24",
-  "tag": "v0.53.3"
+  "branch": "main",
+  "commit_hash": "0002f148c9a4fe421a9d33c0faa5528cdc411e62",
+  "commit_message": "version: bump to 0.54.0",
+  "date": "2026-02-27",
+  "tag": "v0.54.0"
 }

pkgs/by-name/hy/hyprland/package.nix

@@ -48,11 +48,6 @@
   enableXWayland ? true,
   withSystemd ? lib.meta.availableOn gcc15Stdenv.hostPlatform systemd,
   wrapRuntimeDeps ? true,
-  # deprecated flags
-  nvidiaPatches ? false,
-  hidpiXWayland ? false,
-  enableNvidiaPatches ? false,
-  legacyRenderer ? false,
 }:
 let
   inherit (builtins)
@@ -85,24 +80,16 @@ let
 
   customStdenv = foldl' (acc: adapter: adapter acc) gcc15Stdenv adapters;
 in
-assert assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been removed.";
-assert assertMsg (!enableNvidiaPatches) "The option `enableNvidiaPatches` has been removed.";
-assert assertMsg (!hidpiXWayland)
-  "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
-assert assertMsg (
-  !legacyRenderer
-) "The option `legacyRenderer` has been removed. Legacy renderer is no longer supported.";
-
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.53.3";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-as2crdrJUVOawO8XkWJEZBUNaFdPS8QuQiccTkM1la0=";
+    hash = "sha256-wfiduannx1mWvsGAfuMk8ipOU3AAFuJYPNV4D++dhPY=";
   };
 
   postPatch = ''
@@ -140,9 +127,6 @@ customStdenv.mkDerivation (finalAttrs: {
     hyprwire
     makeWrapper
     cmake
-    # meson + ninja are used to build the hyprland-protocols submodule
-    meson
-    ninja
     pkg-config
     wayland-scanner
     # for udis86
@@ -166,10 +150,11 @@ customStdenv.mkDerivation (finalAttrs: {
       hyprutils
       libGL
       libdrm
+      libgbm
       libinput
       libuuid
+      libxcursor
       libxkbcommon
-      libgbm
       muparser
       pango
       pciutils
@@ -177,15 +162,14 @@ customStdenv.mkDerivation (finalAttrs: {
       tomlplusplus
       wayland
       wayland-protocols
-      libxcursor
     ]
     (optionals customStdenv.hostPlatform.isBSD [ epoll-shim ])
     (optionals customStdenv.hostPlatform.isMusl [ libexecinfo ])
     (optionals enableXWayland [
       libxcb
-      libxdmcp
       libxcb-errors
       libxcb-wm
+      libxdmcp
       xwayland
     ])
     (optionals withSystemd [ systemd ])
@@ -202,7 +186,6 @@ customStdenv.mkDerivation (finalAttrs: {
     "NO_SYSTEMD" = !withSystemd;
     "CMAKE_DISABLE_PRECOMPILE_HEADERS" = true;
     "NO_UWSM" = !withSystemd;
-    "NO_HYPRPM" = true;
     "TRACY_ENABLE" = false;
   };
 

pkgs/by-name/hy/hyprviz/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprviz";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "timasoft";
     repo = "hyprviz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5w7+fkf2oB0x5N6xlKjSPbgsB7Ifr1NWW8qWDmGyFwU=";
+    hash = "sha256-CzuCBeJWtfHvCcWtV7X6suTagx0Sw+OagleHwwlyEms=";
   };
 
-  cargoHash = "sha256-+8MKYruPjCTooiY7pxwz5oqIpk4ZidugPrVlMZ1yMI0=";
+  cargoHash = "sha256-fg4bPn/18Pu7LUorF3egCeBd9di+3OmCQxTeWr1Pybw=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/im/imagemagick6/package.nix

@@ -1,196 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  libtool,
-  bzip2Support ? true,
-  bzip2,
-  zlibSupport ? true,
-  zlib,
-  libX11Support ? !stdenv.hostPlatform.isMinGW,
-  libx11,
-  libXtSupport ? !stdenv.hostPlatform.isMinGW,
-  libxt,
-  fontconfigSupport ? true,
-  fontconfig,
-  freetypeSupport ? true,
-  freetype,
-  ghostscriptSupport ? false,
-  ghostscript,
-  libjpegSupport ? true,
-  libjpeg,
-  djvulibreSupport ? true,
-  djvulibre,
-  lcms2Support ? true,
-  lcms2,
-  openexrSupport ? !stdenv.hostPlatform.isMinGW,
-  openexr,
-  libpngSupport ? true,
-  libpng,
-  liblqr1Support ? true,
-  liblqr1,
-  librsvgSupport ? !stdenv.hostPlatform.isMinGW,
-  librsvg,
-  libtiffSupport ? true,
-  libtiff,
-  libxml2Support ? true,
-  libxml2,
-  openjpegSupport ? !stdenv.hostPlatform.isMinGW,
-  openjpeg,
-  libwebpSupport ? !stdenv.hostPlatform.isMinGW,
-  libwebp,
-  libheifSupport ? true,
-  libheif,
-  libde265Support ? true,
-  libde265,
-  fftw,
-  testers,
-}:
-
-let
-  arch =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      "i686"
-    else if
-      stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin"
-    then
-      "x86-64"
-    else if stdenv.hostPlatform.system == "armv7l-linux" then
-      "armv7l"
-    else if
-      stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin"
-    then
-      "aarch64"
-    else if stdenv.hostPlatform.system == "powerpc64le-linux" then
-      "ppc64le"
-    else
-      null;
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "imagemagick";
-  version = "6.9.13-38";
-
-  src = fetchFromGitHub {
-    owner = "ImageMagick";
-    repo = "ImageMagick6";
-    rev = finalAttrs.version;
-    sha256 = "sha256-49o1jFFs7GrQMBvkoUvTmlI5TDnS1mVycghuaOfDrIc=";
-  };
-
-  outputs = [
-    "out"
-    "dev"
-    "doc"
-  ]; # bin/ isn't really big
-  outputMan = "out"; # it's tiny
-
-  enableParallelBuilding = true;
-
-  configureFlags = [
-    "--with-frozenpaths"
-    (lib.withFeatureAs (arch != null) "gcc-arch" arch)
-    (lib.withFeature librsvgSupport "rsvg")
-    (lib.withFeature liblqr1Support "lqr")
-    (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")
-    (lib.withFeature ghostscriptSupport "gslib")
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isMinGW [
-    # due to libxml2 being without DLLs ATM
-    "--enable-static"
-    "--disable-shared"
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    libtool
-  ];
-
-  buildInputs =
-    [ ]
-    ++ lib.optional zlibSupport zlib
-    ++ lib.optional fontconfigSupport fontconfig
-    ++ lib.optional ghostscriptSupport ghostscript
-    ++ lib.optional liblqr1Support liblqr1
-    ++ lib.optional libpngSupport libpng
-    ++ lib.optional libtiffSupport libtiff
-    ++ lib.optional libxml2Support libxml2
-    ++ lib.optional libheifSupport libheif
-    ++ lib.optional libde265Support libde265
-    ++ lib.optional djvulibreSupport djvulibre
-    ++ lib.optional openexrSupport openexr
-    ++ lib.optional librsvgSupport librsvg
-    ++ lib.optional openjpegSupport openjpeg;
-
-  propagatedBuildInputs = [
-    fftw
-  ]
-  ++ lib.optional bzip2Support bzip2
-  ++ lib.optional freetypeSupport freetype
-  ++ lib.optional libjpegSupport libjpeg
-  ++ lib.optional lcms2Support lcms2
-  ++ lib.optional libX11Support libx11
-  ++ lib.optional libXtSupport libxt
-  ++ lib.optional libwebpSupport libwebp;
-
-  doCheck = false; # fails 2 out of 76 tests
-
-  postInstall = ''
-    (cd "$dev/include" && ln -s ImageMagick* ImageMagick)
-    moveToOutput "bin/*-config" "$dev"
-    moveToOutput "lib/ImageMagick-*/config-Q16" "$dev" # includes configure params
-    for file in "$dev"/bin/*-config; do
-      substituteInPlace "$file" --replace "${pkg-config}/bin/pkg-config -config" \
-        ${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config
-      substituteInPlace "$file" --replace ${pkg-config}/bin/pkg-config \
-        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config'"
-    done
-  ''
-  + lib.optionalString ghostscriptSupport ''
-    for la in $out/lib/*.la; do
-      sed 's|-lgs|-L${lib.getLib ghostscript}/lib -lgs|' -i $la
-    done
-  '';
-
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
-  meta = {
-    homepage = "https://legacy.imagemagick.org/";
-    changelog = "https://legacy.imagemagick.org/script/changelog.php";
-    description = "Software suite to create, edit, compose, or convert bitmap images";
-    pkgConfigModules = [
-      "ImageMagick"
-      "MagickWand"
-    ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    maintainers = [ ];
-    license = lib.licenses.asl20;
-    knownVulnerabilities = [
-      "CVE-2019-13136"
-      "CVE-2019-17547"
-      "CVE-2020-25663"
-      "CVE-2020-27768"
-      "CVE-2020-27769"
-      "CVE-2020-27829"
-      "CVE-2021-20243"
-      "CVE-2021-20244"
-      "CVE-2021-20310"
-      "CVE-2021-20311"
-      "CVE-2021-20312"
-      "CVE-2021-20313"
-      "CVE-2021-3596"
-      "CVE-2022-0284"
-      "CVE-2022-2719"
-      "CVE-2023-1289"
-      "CVE-2023-2157"
-      "CVE-2023-34151"
-      "CVE-2023-34152"
-      "CVE-2023-34153"
-      "CVE-2023-3428"
-      "CVE-2023-34474"
-      "CVE-2023-34475"
-      "CVE-2023-5341"
-    ];
-  };
-})

pkgs/by-name/io/iosevka/package.nix

@@ -58,16 +58,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "34.1.0";
+  version = "34.2.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-vdjf2MkKP9DHl/hrz9xJMWMuT2AsonRdt14xQTSsVmU=";
+    hash = "sha256-AK1lIC16F2CKSfRtF4SwOLAZr+v6VdjZIEOrios1uaw=";
   };
 
-  npmDepsHash = "sha256-YMfePtKg4kpZ4iCpkq7PxfyDB4MIRg/tgCNmLD31zKo=";
+  npmDepsHash = "sha256-N5IxbuwchR0hIaOVR5m3SQmkopCMhu86QqhD1pztoB4=";
 
   nativeBuildInputs = [
     remarshal

pkgs/by-name/jr/jreleaser-cli/package.nix

@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jreleaser-cli";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "https://github.com/jreleaser/jreleaser/releases/download/v${version}/jreleaser-tool-provider-${version}.jar";
-    hash = "sha256-3EMv+yzn8eNFf9UIkKRXH72UKrfH2XtXGZZ+scbpvSU=";
+    hash = "sha256-NSJn4KSm8xC4HMXzh4m1EqlLUPGVu1SWfDUHT4umKTI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ka/karakeep/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "karakeep";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "karakeep-app";
     repo = "karakeep";
     tag = "cli/v${finalAttrs.version}";
-    hash = "sha256-Ssr/KcQHRtEloz4YPAUfUmcbicMumkIQ+wOjxe9PTXM=";
+    hash = "sha256-++aNTkLOkwgkzRxg/WdrHfchXQwUUir0qqmb7WfdZJ0=";
   };
 
   patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
 
     fetcherVersion = 3;
-    hash = "sha256-ZCsG+Zjiy3hmROgBKnqxGlJjvIYqAeQMlfXUnNQIsiI=";
+    hash = "sha256-+MbKG0h3cD0kZua0OkdQsUeTjAY4ysK41KXUSaOSKHA=";
   };
   buildPhase = ''
     runHook preBuild

pkgs/by-name/ka/kas/package.nix

@@ -8,14 +8,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "kas";
-  version = "5.1";
+  version = "5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "siemens";
     repo = "kas";
     tag = finalAttrs.version;
-    hash = "sha256-SQeoRm2bjcQmhfMUJCSxgKu7/qcIEv9ItWcLWkkNwAs=";
+    hash = "sha256-lEhgEotQE5ceH1NEBlTzD33W09NQjzo4bCpZi9rcQE0=";
   };
 
   patches = [ ./pass-terminfo-env.patch ];

pkgs/by-name/li/libpcap/package.nix

@@ -46,14 +46,14 @@ stdenv.mkDerivation (finalAttrs: {
     bash
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ libnl ]
-  ++ lib.optionals withRemote [ libxcrypt ];
+  ++ lib.optionals withRemote [ libxcrypt ]
+  ++ lib.optionals withBluez [ bluez ];
 
   nativeBuildInputs = [
     flex
     bison
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]
-  ++ lib.optionals withBluez [ bluez.dev ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
   # We need to force the autodetection because detection doesn't
   # work in pure build environments.

pkgs/by-name/lo/logstalgia/package.nix

@@ -4,6 +4,7 @@
   fetchurl,
   SDL2,
   ftgl,
+  autoreconfHook,
   pkg-config,
   libpng,
   libjpeg,
@@ -27,7 +28,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-wEnv9AXpJANSIu2ya8xse18AoIkmq9t7Rn4kSSQnkKk=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  postPatch = ''
+    # Fix build with boost 1.89
+    rm m4/ax_boost_system.m4
+    substituteInPlace configure.ac \
+      --replace-fail "AX_BOOST_SYSTEM" ""
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
   buildInputs = [
     glew
     SDL2

pkgs/by-name/ma/manifold/package.nix

@@ -5,27 +5,25 @@
   cmake,
   clipper2,
   gtest,
-  glm,
   onetbb,
   python3Packages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.3.2";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-583/phb0boc5ASFJN+DDn6bogeNPVYPBTgtcD/d/AS8=";
+    hash = "sha256-9h1MLEcqLpiFg8U5rRkR9Qa+ohzehEDCn5rNsN6swlQ=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
     gtest
-    glm
     onetbb
   ];
 
@@ -38,13 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DMANIFOLD_PAR=TBB"
   ];
 
-  excludedTestPatterns = lib.optionals stdenv.isDarwin [
-    # https://github.com/elalish/manifold/issues/1306
-    "Manifold.Simplify"
+  excludedTestPatterns = [
   ];
   doCheck = true;
   checkPhase = ''
-    test/manifold_test --gtest_filter=-${builtins.concatStringsSep ":" finalAttrs.excludedTestPatterns}
+    test/manifold_test --gtest_filter=-${lib.escapeShellArg (builtins.concatStringsSep ":" finalAttrs.excludedTestPatterns)}
   '';
 
   passthru = {

pkgs/by-name/mc/mcp-grafana/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.0";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oLhah+MHUeiARIul39Yt32cQgc9fUmdGv89MuZYEXrM=";
+    hash = "sha256-HqNKbpmZCrEST2wesUo/swkT5wcnV2ZOpwYmqq+2EzA=";
   };
 
   vendorHash = "sha256-w4v1/RqnNfGFzapmWd96UTT4Sc18lSVX5HvsXWWmhSY=";

pkgs/by-name/mu/museum/package.nix

@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.3.13";
+  version = "1.3.16";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-Wh4jAYMM71PEyjYPaKqJNs2rnBNbf+cR9+dP2ZpnuaU=";
+    hash = "sha256-0Ks29rlCAacOolVXcWX3zedrm6U90Dfe3Mr2uZYfUf4=";
   };
 
-  vendorHash = "sha256-napF55nA/9P8l5lddnEHQMjLXWSyTzgblIQCbSZ20MA=";
+  vendorHash = "sha256-r/zAAWyLe6VYztsZuYlwg0jozGf8cScUKIcIdtZ0LvQ=";
 
   sourceRoot = "${finalAttrs.src.name}/server";
 

pkgs/by-name/ni/nickel/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nickel";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "tweag";
     repo = "nickel";
     tag = finalAttrs.version;
-    hash = "sha256-NGivq2V4wdJapzU5iLcuHrz2RDz2WhnikmCq+75a338=";
+    hash = "sha256-G+ik4tMr+WsDpiEFYv80ruBR/SpeEg9agUWqgXrq7UI=";
   };
 
-  cargoHash = "sha256-uCy/Qo92yZ4pjjgW64nWYH21EbdMMwGXP5522tl8MAE=";
+  cargoHash = "sha256-E3UBkLxd7AC/Pk1Zgy+KvHTPXgATqIr7lZXPB8vlSWs=";
 
   cargoBuildFlags = [
     "--package"

pkgs/by-name/pe/peacock/package.nix

@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "peacock";
-  version = "8.3.0";
+  version = "8.7.0";
 
   src = fetchFromGitHub {
     owner = "thepeacockproject";
     repo = "Peacock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AegJ5h2sxs8iheBLbIBwZXjjZLk5GdcDVLbF4ldcmZ0=";
+    hash = "sha256-kDR2ObXzo8UudjfqU/lQl6dqblFhIEgnr20EKjiWKVw=";
   };
 
   nativeBuildInputs = [
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-sB0oag0sheimho8pn25HSc8GMeuS1RTmHLZUPiSSDqE=";
+    hash = "sha256-Ecpls4iGBVqSLm/4kyY0EsRa6NINodHc05DtwOfZYG4=";
   };
 
   meta = {

pkgs/by-name/po/poptracker/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "poptracker";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "black-sliver";
     repo = "PopTracker";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3JcE963GSAUs82OF59Yf7PjQV0FHKsCYx+q3TWQsHpY=";
+    hash = "sha256-4sdwW4P+5Y+JHy2dU55Fobedh0toXoU6pIWTN294GMc=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/pr/pretix-banktool/package.nix

@@ -4,7 +4,14 @@
   fetchFromGitHub,
 }:
 
-python3Packages.buildPythonApplication (finalAttrs: {
+let
+  pythonPackages = python3Packages.overrideScope (
+    self: super: {
+      fints = self.fints_4;
+    }
+  );
+in
+pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix-banktool";
   version = "1.1.0";
   pyproject = true;
@@ -16,9 +23,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hash = "sha256-x6P+WqrOak5/gmMEmBkHrx6kPsbSOAXbKRbndFG3IJU=";
   };
 
-  build-system = with python3Packages; [ setuptools ];
+  build-system = with pythonPackages; [ setuptools ];
 
-  dependencies = with python3Packages; [
+  dependencies = with pythonPackages; [
     click
     fints
     requests

pkgs/by-name/ra/radicale/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "radicale";
-  version = "3.6.0";
+  version = "3.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FzCNmmlQeka+Z7h1Dp631coKPF7gc0LOWnyca994bgs=";
+    hash = "sha256-NPebEqLSDsR+FSA3vM0k8JJ8ciIDaRs34z4DBvr5GOE=";
   };
 
   build-system = with python3.pkgs; [

pkgs/by-name/ra/radicle-node/package.nix

@@ -14,17 +14,23 @@
   stdenv,
   xdg-utils,
   versionCheckHook,
+
+  version ? "1.6.1",
+  srcHash ? "sha256-7kwtWuYdYG3MDHThCkY5OZmx4pWaQXMYoOlJszmV2rM=",
+  cargoHash ? "sha256-59RyfSUJNoQ7EtQK3OSYOIO/YVEjeeM9ovbojHFX4pI=",
+  updateScript ? ./update.sh,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
+  inherit version cargoHash;
+
   pname = "radicle-node";
-  version = "1.6.1";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.xyz";
     repo = "z3gqcJUoA1n9HaHKufZs5FCSGazv5";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-7kwtWuYdYG3MDHThCkY5OZmx4pWaQXMYoOlJszmV2rM=";
+    hash = srcHash;
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse HEAD > $out/.git_head
@@ -33,8 +39,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-59RyfSUJNoQ7EtQK3OSYOIO/YVEjeeM9ovbojHFX4pI=";
-
   env.RADICLE_VERSION = finalAttrs.version;
 
   nativeBuildInputs = [
@@ -112,34 +116,40 @@ rustPlatform.buildRustPackage (finalAttrs: {
     done
   '';
 
-  passthru.updateScript = ./update.sh;
-  passthru.tests = {
-    basic =
-      runCommand "radicle-node-basic-test"
-        {
-          nativeBuildInputs = [
-            jq
-            openssh
-            finalAttrs.finalPackage
-          ];
-        }
-        ''
-          set -e
-          export RAD_HOME="$PWD/.radicle"
-          mkdir -p "$RAD_HOME/keys"
-          ssh-keygen -t ed25519 -N "" -f "$RAD_HOME/keys/radicle" > /dev/null
-          jq -n '.node.alias |= "nix"' > "$RAD_HOME/config.json"
+  passthru = {
+    inherit updateScript;
+    tests = {
+      basic =
+        runCommand "radicle-node-basic-test"
+          {
+            nativeBuildInputs = [
+              jq
+              openssh
+              finalAttrs.finalPackage
+            ];
+          }
+          ''
+            set -e
+            export RAD_HOME="$PWD/.radicle"
+            mkdir -p "$RAD_HOME/keys"
+            ssh-keygen -t ed25519 -N "" -f "$RAD_HOME/keys/radicle" > /dev/null
+            jq -n '.node.alias |= "nix"' > "$RAD_HOME/config.json"
 
-          rad config > /dev/null
-          rad debug | jq -e '
-              (.sshVersion | contains("${openssh.version}"))
-            and
-              (.gitVersion | contains("${gitMinimal.version}"))
-          '
+            rad config > /dev/null
+            rad debug | jq -e '
+                (.sshVersion | contains("${openssh.version}"))
+              and
+                (.gitVersion | contains("${gitMinimal.version}"))
+            '
 
-          touch $out
-        '';
-    nixos-run = nixosTests.radicle;
+            touch $out
+          '';
+      nixos-run = nixosTests.radicle.extendNixOS {
+        module = {
+          services.radicle.package = finalAttrs.finalPackage;
+        };
+      };
+    };
   };
 
   meta = {

pkgs/by-name/ra/radicle-node/unstable.nix

@@ -0,0 +1,8 @@
+{ radicle-node }:
+
+radicle-node.override {
+  version = "1.7.0-rc.1";
+  srcHash = "sha256-eq7rUzTbmPb0pRfcFnWP4vrbCTbXW9N4BleDCMUnLH8=";
+  cargoHash = "sha256-OkgWdu+7FY1tq0bjMbhjqjlJT9ZUgR8i12LhqyFJi+A=";
+  updateScript = ./update-unstable.sh;
+}

pkgs/by-name/ra/radicle-node/update-unstable.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils gnugrep common-updater-scripts nix-update
+
+version=$(list-git-tags | grep -oP '^releases/\K\d+\.\d+\.\d+.*' | sort -rV | head -1)
+nix-update --version="$version" radicle-node-unstable --override-filename pkgs/by-name/ra/radicle-node/unstable.nix

pkgs/by-name/ra/rapidraw/package.nix

@@ -42,13 +42,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rapidraw";
-  version = "1.4.12";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "CyberTimon";
     repo = "RapidRAW";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-esNw3JmQZ0Qbqtwno5SREVwIxR7DBi50GS9BCjgNGuA=";
+    hash = "sha256-PzPw7TJQK6ojsdw8cypS/drtc/ec93IYGIjTEdpIraI=";
     fetchSubmodules = true;
 
     # darwin/linux hash mismatch in rawler submodule
@@ -58,11 +58,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-F5fN14dv8iFUub3bYci+MC8fuyLLZKuoF9W1cfJ7NLo=";
+  cargoHash = "sha256-cgqNGft6LK5XNGv1CDLw5v+m8a9xmu7albfoGJnkE34=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-jenSEANarab/oQnC80NoM1jWmvdeXF3bJ9I/vOGcBb0=";
+    hash = "sha256-4PbNSM4BIMOpmPcys/Vt5gzy/Pu9L6rPcG0lGnTDvGo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/resources/package.nix

@@ -23,18 +23,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "resources";
-  version = "1.10.0";
+  version = "1.10.1-1";
 
   src = fetchFromGitHub {
     owner = "nokyan";
     repo = "resources";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8iUBmEqDlqwczpkkS9lI+oflyc95IxPhd8c9Vsw1LQ=";
+    hash = "sha256-NjzHGz90MhdjBHP88+qBI/5usCpPPrukSaVHoOJJXSI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-6xIyLNblcTzB3V/LfbJkEEVB5KiR/RZccFG1l1ahlr0=";
+    hash = "sha256-wATJxWemn5VxRsRat5I4uEnymsfMM6AX+hP422cUtBo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/resterm/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.23.3";
+  version = "0.23.6";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-FS+pStcAuoslrso1kmriyKhr2I8MdvvUnH262hMKLEg=";
+    sha256 = "sha256-MVcLyPPnQIn0IZcGOoELRSQkI+BEIXSZfWeeZv6AILI=";
   };
 
-  vendorHash = "sha256-UnjH2d0w+ttIE2QTsYvpvNVYT6m9d0TGcrIhNE0SjTI=";
+  vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
 
   # modernc.org/libc (via modernc.org/sqlite) tries to read /etc/protocols
   modPostBuild = ''

pkgs/by-name/si/siyuan/package.nix

@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.5.5";
+  version = "3.5.8";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iGwREddg5Pzr6fM/YTYj28g+p8tkQa9EiM6py94UlSc=";
+    hash = "sha256-mXDro4m2QZEUcljpQNC5JqhVbRZgBVU1Wfiq1JtS0B0=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-4yqUUP6b2KL+xLKQTiTPqIISyqdIsHpf+p1jsG/kquI=";
+    vendorHash = "sha256-i7eq8RDbuv+FzreClW8JFocUs7R8A02cOZ8NaAGBMfA=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-i11Hr/KA7Q27Z26AOmc6GNwSW/ZcwSyaNtNBJii5r2A=";
+    hash = "sha256-GLwREEnDf3NIbQsX+LA/n6zZYvTlyiJaozfKyk04go8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

pkgs/by-name/st/streamripper/package.nix

@@ -35,6 +35,13 @@ stdenv.mkDerivation rec {
       patch = "873964-http";
       hash = "sha256-D6koUCbnJHtRuq2zZy9VrxymuGXN1COacbQhphgB8qo=";
     })
+    # fix build with gcc 15
+    (fetchDebianPatch {
+      inherit pname version;
+      debianRevision = "4";
+      patch = "1097944-gcc15";
+      hash = "sha256-yBFDxd2sNlavQDmg/MCORFdpJY8p1Lzo131T4sBby5g=";
+    })
     # fix SR_ERROR_INVALID_METADATA caused by HTTP chunking
     # (https://sourceforge.net/p/streamripper/bugs/193/#6a82)
     (fetchpatch {
@@ -57,5 +64,6 @@ stdenv.mkDerivation rec {
     description = "Application that lets you record streaming mp3 to your hard drive";
     license = lib.licenses.gpl2;
     mainProgram = "streamripper";
+    maintainers = with lib.maintainers; [ cybershadow ];
   };
 }

pkgs/development/beam-modules/rebar3-release.nix

@@ -74,7 +74,9 @@ let
 
         inherit src;
 
-        env.REBAR_IGNORE_DEPS = beamDeps != [ ];
+        env = (attrs.env or { }) // {
+          REBAR_IGNORE_DEPS = beamDeps != [ ];
+        };
 
         configurePhase = ''
           runHook preConfigure

pkgs/development/interpreters/php/8.2.nix

@@ -1,59 +0,0 @@
-{ callPackage, ... }@_args:
-
-let
-  base = callPackage ./generic.nix (
-    _args
-    // {
-      version = "8.2.30";
-      hash = "sha256-EEggtsj8lZ3eSzNCE19CvavyRuhpGKFjgaF9hEfIZvo=";
-    }
-  );
-in
-base.withExtensions (
-  { all, ... }:
-  with all;
-  [
-    bcmath
-    calendar
-    curl
-    ctype
-    dom
-    exif
-    fileinfo
-    filter
-    ftp
-    gd
-    gettext
-    gmp
-    iconv
-    imap
-    intl
-    ldap
-    mbstring
-    mysqli
-    mysqlnd
-    opcache
-    openssl
-    pcntl
-    pdo
-    pdo_mysql
-    pdo_odbc
-    pdo_pgsql
-    pdo_sqlite
-    pgsql
-    posix
-    readline
-    session
-    simplexml
-    sockets
-    soap
-    sodium
-    sysvsem
-    sqlite3
-    tokenizer
-    xmlreader
-    xmlwriter
-    zip
-    zlib
-  ]
-)

pkgs/development/interpreters/php/8.3.nix

@@ -1,59 +0,0 @@
-{ callPackage, ... }@_args:
-
-let
-  base = callPackage ./generic.nix (
-    _args
-    // {
-      version = "8.3.30";
-      hash = "sha256-gAt7btULc8jueETuXy98xhL6p4daCqfEUp6O1YZqUDA=";
-    }
-  );
-in
-base.withExtensions (
-  { all, ... }:
-  with all;
-  [
-    bcmath
-    calendar
-    curl
-    ctype
-    dom
-    exif
-    fileinfo
-    filter
-    ftp
-    gd
-    gettext
-    gmp
-    iconv
-    imap
-    intl
-    ldap
-    mbstring
-    mysqli
-    mysqlnd
-    opcache
-    openssl
-    pcntl
-    pdo
-    pdo_mysql
-    pdo_odbc
-    pdo_pgsql
-    pdo_sqlite
-    pgsql
-    posix
-    readline
-    session
-    simplexml
-    sockets
-    soap
-    sodium
-    sysvsem
-    sqlite3
-    tokenizer
-    xmlreader
-    xmlwriter
-    zip
-    zlib
-  ]
-)

pkgs/development/interpreters/php/8.4.nix

@@ -1,58 +0,0 @@
-{ callPackage, ... }@_args:
-
-let
-  base = callPackage ./generic.nix (
-    _args
-    // {
-      version = "8.4.18";
-      hash = "sha256-WGsy2Szrz7yklcX2rRozZAVT0KnAv9LmcVM02VnPmFg=";
-    }
-  );
-in
-base.withExtensions (
-  { all, ... }:
-  with all;
-  [
-    bcmath
-    calendar
-    curl
-    ctype
-    dom
-    exif
-    fileinfo
-    filter
-    ftp
-    gd
-    gettext
-    gmp
-    iconv
-    intl
-    ldap
-    mbstring
-    mysqli
-    mysqlnd
-    opcache
-    openssl
-    pcntl
-    pdo
-    pdo_mysql
-    pdo_odbc
-    pdo_pgsql
-    pdo_sqlite
-    pgsql
-    posix
-    readline
-    session
-    simplexml
-    sockets
-    soap
-    sodium
-    sysvsem
-    sqlite3
-    tokenizer
-    xmlreader
-    xmlwriter
-    zip
-    zlib
-  ]
-)

pkgs/development/interpreters/php/8.5.nix

@@ -1,57 +0,0 @@
-{ callPackage, ... }@_args:
-
-let
-  base = callPackage ./generic.nix (
-    _args
-    // {
-      version = "8.5.3";
-      hash = "sha256-/F7KvBg862TZ/KPc04e9KbK2dEgyavmY/eADEkkWgjs=";
-    }
-  );
-in
-base.withExtensions (
-  { all, ... }:
-  with all;
-  [
-    bcmath
-    calendar
-    curl
-    ctype
-    dom
-    exif
-    fileinfo
-    filter
-    ftp
-    gd
-    gettext
-    gmp
-    iconv
-    intl
-    ldap
-    mbstring
-    mysqli
-    mysqlnd
-    openssl
-    pcntl
-    pdo
-    pdo_mysql
-    pdo_odbc
-    pdo_pgsql
-    pdo_sqlite
-    pgsql
-    posix
-    readline
-    session
-    simplexml
-    sockets
-    soap
-    sodium
-    sysvsem
-    sqlite3
-    tokenizer
-    xmlreader
-    xmlwriter
-    zip
-    zlib
-  ]
-)

pkgs/development/interpreters/php/default.nix

@@ -1,4 +1,5 @@
 {
+  lib,
   callPackage,
   stdenv,
   llvmPackages,
@@ -6,16 +7,81 @@
 }:
 
 let
-  commonArgs = {
-    stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
-    pcre2 = pcre2.override {
-      withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
-    };
-  };
+  mkPhp =
+    { version, hash }:
+    let
+      base = callPackage ./generic.nix {
+        stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
+        pcre2 = pcre2.override {
+          withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
+        };
+        inherit version hash;
+      };
+    in
+    base.withExtensions (
+      { all, ... }:
+      with all;
+      [
+        bcmath
+        calendar
+        curl
+        ctype
+        dom
+        exif
+        fileinfo
+        filter
+        ftp
+        gd
+        gettext
+        gmp
+        iconv
+        intl
+        ldap
+        mbstring
+        mysqli
+        mysqlnd
+        openssl
+        pcntl
+        pdo
+        pdo_mysql
+        pdo_odbc
+        pdo_pgsql
+        pdo_sqlite
+        pgsql
+        posix
+        readline
+        session
+        simplexml
+        sockets
+        soap
+        sodium
+        sysvsem
+        sqlite3
+        tokenizer
+        xmlreader
+        xmlwriter
+        zip
+        zlib
+      ]
+      ++ lib.optionals (lib.versionOlder version "8.4") [ all.imap ]
+      ++ lib.optionals (lib.versionOlder version "8.5") [ all.opcache ]
+    );
 in
 {
-  php82 = callPackage ./8.2.nix commonArgs;
-  php83 = callPackage ./8.3.nix commonArgs;
-  php84 = callPackage ./8.4.nix commonArgs;
-  php85 = callPackage ./8.5.nix commonArgs;
+  php82 = mkPhp {
+    version = "8.2.30";
+    hash = "sha256-EEggtsj8lZ3eSzNCE19CvavyRuhpGKFjgaF9hEfIZvo=";
+  };
+  php83 = mkPhp {
+    version = "8.3.30";
+    hash = "sha256-gAt7btULc8jueETuXy98xhL6p4daCqfEUp6O1YZqUDA=";
+  };
+  php84 = mkPhp {
+    version = "8.4.18";
+    hash = "sha256-WGsy2Szrz7yklcX2rRozZAVT0KnAv9LmcVM02VnPmFg=";
+  };
+  php85 = mkPhp {
+    version = "8.5.3";
+    hash = "sha256-/F7KvBg862TZ/KPc04e9KbK2dEgyavmY/eADEkkWgjs=";
+  };
 }

pkgs/development/interpreters/php/generic.nix

@@ -382,14 +382,14 @@ let
                       jq
                     ]
                   }
-                  new_version=$(curl --silent "https://www.php.net/releases/active" | jq --raw-output '."${lib.versions.major version}"."${lib.versions.majorMinor version}".version')
+                  new_version=$(curl --silent "https://www.php.net/releases/active.php" | jq --raw-output '."${lib.versions.major version}"."${lib.versions.majorMinor version}".version')
                   update-source-version "$UPDATE_NIX_ATTR_PATH.unwrapped" "$new_version" "--file=$1"
                 '';
               in
               [
                 script
                 # Passed as an argument so that update.nix can ensure it does not become a store path.
-                (./. + "/${lib.versions.majorMinor version}.nix")
+                ./default.nix
               ];
             buildEnv = mkBuildEnv { } [ ];
             withExtensions = mkWithExtensions { } [ ];

pkgs/development/python-modules/adblock/default.nix

@@ -60,7 +60,7 @@ buildPythonPackage rec {
     libiconv
   ];
 
-  PSL_PATH = "${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat";
+  env.PSL_PATH = "${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat";
 
   nativeCheckInputs = [
     pytestCheckHook

pkgs/development/python-modules/atproto/default.nix

@@ -36,7 +36,7 @@ buildPythonPackage rec {
     hash = "sha256-0NogKxYO+lCtNhK2ZWwRLQTV7rHU5Oz+lnE4awsoPsM=";
   };
 
-  POETRY_DYNAMIC_VERSIONING_BYPASS = version;
+  env.POETRY_DYNAMIC_VERSIONING_BYPASS = version;
 
   build-system = [
     poetry-core

pkgs/development/python-modules/backrefs/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "backrefs";
-  version = "6.1";
+  version = "6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "backrefs";
     tag = version;
-    hash = "sha256-MeQsEKHIB7WnITMUtRP4vLLr2DjvrorKHKWxgd07qko=";
+    hash = "sha256-y0scI6FBvjuvWLx1V3AHiGhtLB2Mk7jCx4hEjOv+ETA=";
   };
 
   build-system = [

pkgs/development/python-modules/banks/default.nix

@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-wa3refEIYQIPmtl8NGtoyg2PTY3zQt6R4EgXUbcUgrk=";
   };
 
-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   build-system = [ hatchling ];
 

pkgs/development/python-modules/bimmer-connected/default.nix

@@ -33,7 +33,7 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  PBR_VERSION = version;
+  env.PBR_VERSION = version;
 
   dependencies = [
     httpx

pkgs/development/python-modules/carbon/default.nix

@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   # Carbon-s default installation is /opt/graphite. This env variable ensures
   # carbon is installed as a regular Python module.
-  GRAPHITE_NO_PREFIX = "True";
+  env.GRAPHITE_NO_PREFIX = "True";
 
   postPatch = ''
     substituteInPlace setup.py \

pkgs/development/python-modules/cassandra-driver/default.nix

@@ -66,7 +66,7 @@ buildPythonPackage rec {
   ++ lib.concatAttrValues optional-dependencies;
 
   # This is used to determine the version of cython that can be used
-  CASS_DRIVER_ALLOWED_CYTHON_VERSION = cython.version;
+  env.CASS_DRIVER_ALLOWED_CYTHON_VERSION = cython.version;
 
   preBuild = ''
     export CASS_DRIVER_BUILD_CONCURRENCY=$NIX_BUILD_CORES

pkgs/development/python-modules/cppe/default.nix

@@ -42,7 +42,9 @@ buildPythonPackage {
 
   buildInputs = [ pybind11 ] ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
 
-  NIX_CFLAGS_LINK = lib.optional stdenv.cc.isClang "-lomp";
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_LINK = "-lomp";
+  };
 
   hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";
 

pkgs/development/python-modules/cython/0.nix

@@ -58,7 +58,7 @@ buildPythonPackage rec {
     ncurses
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   patches = [
     # backport Cython 3.0 trashcan support (https://github.com/cython/cython/pull/2842) to 0.X series.

pkgs/development/python-modules/django-annoying/default.nix

@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     six
   ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   nativeCheckInputs = [
     pytest-django

pkgs/development/python-modules/django-cacheops/default.nix

@@ -54,7 +54,7 @@ buildPythonPackage rec {
     redisTestHook
   ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   meta = {
     description = "Slick ORM cache with automatic granular event-driven invalidation for Django";

pkgs/development/python-modules/django-celery-email/default.nix

@@ -28,7 +28,7 @@ buildPythonPackage rec {
     celery
   ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   nativeCheckInputs = [
     pytest-django

pkgs/development/python-modules/django-ckeditor/default.nix

@@ -31,7 +31,7 @@ buildPythonPackage rec {
     pillow
   ];
 
-  DJANGO_SETTINGS_MODULE = "ckeditor_demo.settings";
+  env.DJANGO_SETTINGS_MODULE = "ckeditor_demo.settings";
 
   checkInputs = [
     django-extensions

pkgs/development/python-modules/django-hierarkey/default.nix

@@ -39,7 +39,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   enabledTestPaths = [ "tests" ];
 

pkgs/development/python-modules/django-sekizai/default.nix

@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "sekizai" ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   meta = {
     description = "Define placeholders where your blocks get rendered and append to those blocks";

pkgs/development/python-modules/django-tinymce/default.nix

@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   dependencies = [ django ];
 
-  DJANGO_SETTINGS_MODULE = "tests.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.settings";
 
   checkInputs = [
     pytest-django

pkgs/development/python-modules/djmail/default.nix

@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ glibcLocales ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   propagatedBuildInputs = [
     celery

pkgs/development/python-modules/ducc0/default.nix

@@ -30,8 +30,10 @@ buildPythonPackage rec {
     substituteInPlace pyproject.toml --replace-fail '"pybind11>=2.13.6", ' ""
   '';
 
-  DUCC0_USE_NANOBIND = "";
-  DUCC0_OPTIMIZATION = "portable";
+  env = {
+    DUCC0_USE_NANOBIND = "";
+    DUCC0_OPTIMIZATION = "portable";
+  };
 
   build-system = [
     cmake

pkgs/development/python-modules/emailthreads/default.nix

@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ unittestCheckHook ];
 
-  PKGVER = version;
+  env.PKGVER = version;
 
   meta = {
     homepage = "https://github.com/emersion/python-emailthreads";

pkgs/development/python-modules/fints/4.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  setuptools,
+  fetchFromGitHub,
+  bleach,
+  mt-940,
+  pretix-banktool,
+  requests,
+  sepaxml,
+  pytestCheckHook,
+  pytest-mock,
+}:
+
+buildPythonPackage rec {
+  version = "4.2.4";
+  pname = "fints";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "raphaelm";
+    repo = "python-fints";
+    tag = "v${version}";
+    hash = "sha256-la5vpWBoZ7hZsAyjjCqHpFfOykDVosI/S9amox1dmzY=";
+  };
+
+  pythonRemoveDeps = [ "enum-tools" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    bleach
+    mt-940
+    requests
+    sepaxml
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  pythonImportsCheck = [ "fints" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  meta = {
+    homepage = "https://github.com/raphaelm/python-fints/";
+    description = "Pure-python FinTS (formerly known as HBCI) implementation";
+    license = lib.licenses.lgpl3Only;
+    inherit (pretix-banktool.meta) maintainers;
+  };
+}

pkgs/development/python-modules/fints/default.nix

@@ -4,6 +4,7 @@
   setuptools,
   fetchFromGitHub,
   bleach,
+  lxml,
   mt-940,
   requests,
   sepaxml,
@@ -12,7 +13,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.2.4";
+  version = "5.0.0";
   pname = "fints";
   pyproject = true;
 
@@ -20,7 +21,7 @@ buildPythonPackage rec {
     owner = "raphaelm";
     repo = "python-fints";
     tag = "v${version}";
-    hash = "sha256-la5vpWBoZ7hZsAyjjCqHpFfOykDVosI/S9amox1dmzY=";
+    hash = "sha256-ll2+PtcGQiY5nbQTKVetd2ecDBVSXgzWP4Vzzri1Trs=";
   };
 
   pythonRemoveDeps = [ "enum-tools" ];
@@ -29,6 +30,7 @@ buildPythonPackage rec {
 
   dependencies = [
     bleach
+    lxml
     mt-940
     requests
     sepaxml

pkgs/development/python-modules/flashinfer/default.nix

@@ -87,7 +87,7 @@ buildPythonPackage rec {
     export MAX_JOBS="$NIX_BUILD_CORES"
   '';
 
-  FLASHINFER_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
+  env.FLASHINFER_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
 
   pythonRemoveDeps = [
     "nvidia-cudnn-frontend"

pkgs/development/python-modules/flatbuffers/default.nix

@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   # flatbuffers needs VERSION environment variable for setting the correct
   # version, otherwise it uses the current date.
-  VERSION = version;
+  env.VERSION = version;
 
   pythonImportsCheck = [ "flatbuffers" ];
 

pkgs/development/python-modules/fs/default.nix

@@ -54,7 +54,7 @@ buildPythonPackage rec {
     glibcLocales
   ];
 
-  LC_ALL = "en_US.utf-8";
+  env.LC_ALL = "en_US.utf-8";
 
   preCheck = ''
     HOME=$(mktemp -d)

pkgs/development/python-modules/google-cloud-storage-control/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-storage-control";
-  version = "1.9.0";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
     tag = "google-cloud-storage-control-v${finalAttrs.version}";
-    hash = "sha256-5xQ4p9xi/6Y8oi7dWo+fdVT8X8U7UGmdKtSsoEanRso=";
+    hash = "sha256-dgQdfHyGHwdEaJllbz97J/xW4Y0LrpE6ad6LRdax1G4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/google-cloud-storage-control";

pkgs/development/python-modules/grpcio/default.nix

@@ -64,10 +64,12 @@ buildPythonPackage rec {
     unset AR
   '';
 
-  GRPC_BUILD_WITH_BORING_SSL_ASM = "";
-  GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
-  GRPC_PYTHON_BUILD_SYSTEM_ZLIB = 1;
-  GRPC_PYTHON_BUILD_SYSTEM_CARES = 1;
+  env = {
+    GRPC_BUILD_WITH_BORING_SSL_ASM = "";
+    GRPC_PYTHON_BUILD_SYSTEM_OPENSSL = 1;
+    GRPC_PYTHON_BUILD_SYSTEM_ZLIB = 1;
+    GRPC_PYTHON_BUILD_SYSTEM_CARES = 1;
+  };
 
   # does not contain any tests
   doCheck = false;

pkgs/development/python-modules/icalendar-searcher/default.nix

@@ -1,10 +1,10 @@
 {
   buildPythonPackage,
   fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
   icalendar,
   lib,
-  poetry-core,
-  poetry-dynamic-versioning,
   pyicu,
   pytestCheckHook,
   recurring-ical-events,
@@ -12,19 +12,19 @@
 
 buildPythonPackage rec {
   pname = "icalendar-searcher";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-caldav";
     repo = "icalendar-searcher";
     tag = "v${version}";
-    hash = "sha256-CHW1++VHoTfNw5GkRfDDTERZGA/RJxc8iME8OPx1q/o=";
+    hash = "sha256-x11gdW6FuSCktMGtPxTg39C98J0/0C7F07jIHN0ewbY=";
   };
 
   build-system = [
-    poetry-core
-    poetry-dynamic-versioning
+    hatch-vcs
+    hatchling
   ];
 
   dependencies = [

pkgs/development/python-modules/ifcopenshell/default.nix

@@ -130,7 +130,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "ifcopenshell" ];
 
-  PYTHONUSERBASE = ".";
+  env.PYTHONUSERBASE = ".";
 
   # We still build with python to generate ifcopenshell_wrapper.py and ifcopenshell_wrapper.so
   cmakeFlags = [

pkgs/development/python-modules/jax/default.nix

@@ -64,7 +64,7 @@ buildPythonPackage rec {
 
   # The version is automatically set to ".dev" if this variable is not set.
   # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
-  JAX_RELEASE = "1";
+  env.JAX_RELEASE = "1";
 
   dependencies = [
     jaxlib

pkgs/development/python-modules/kaldi-active-grammar/default.nix

@@ -34,8 +34,10 @@ buildPythonPackage rec {
     sha256 = "sha256-VyVshIEVp/ep4Ih7Kj66GF02JEZ4nwgJOtgR2DarzdY=";
   };
 
-  KALDI_BRANCH = "foo";
-  KALDIAG_SETUP_RAW = "1";
+  env = {
+    KALDI_BRANCH = "foo";
+    KALDIAG_SETUP_RAW = "1";
+  };
 
   patches = [
     # Makes sure scikit-build doesn't try to build the dependencies for us

pkgs/development/python-modules/libarchive-c/default.nix

@@ -30,7 +30,7 @@ buildPythonPackage rec {
     })
   ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   postPatch = ''
     substituteInPlace libarchive/ffi.py --replace-fail \

pkgs/development/python-modules/lunatone-rest-api-client/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "lunatone-rest-api-client";
-  version = "0.7.0";
+  version = "0.7.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "lunatone-public";
     repo = "lunatone-rest-api-client";
     tag = "v${version}";
-    hash = "sha256-Hw4sH2CYhE205iDc8QWvg9LJVHJSpqI1ziJZoQyXFts=";
+    hash = "sha256-x9L65L5wEbJMOGlNBoQfPjS8/Ijr+fzaISoDD+cMWzU=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/mail-parser/default.nix

@@ -22,7 +22,7 @@ buildPythonPackage rec {
     hash = "sha256-wwLUD/k26utugK/Yx9eXYEdSOvrk0Cy6RkXGDnzZ+fE=";
   };
 
-  LC_ALL = "en_US.utf-8";
+  env.LC_ALL = "en_US.utf-8";
 
   nativeBuildInputs = [ glibcLocales ];
 

pkgs/development/python-modules/musicbrainzngs/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   buildInputs = [ pkgs.glibcLocales ];
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
 
   preCheck = ''
     # Remove tests that rely on networking (breaks sandboxed builds)

pkgs/development/python-modules/mxnet/default.nix

@@ -30,7 +30,7 @@ buildPythonPackage {
     "numpy"
   ];
 
-  LD_LIBRARY_PATH = lib.makeLibraryPath [ pkgs.mxnet ];
+  env.LD_LIBRARY_PATH = toString (lib.makeLibraryPath [ pkgs.mxnet ]);
 
   postPatch = ''
     # Required to support numpy >=1.24 where np.bool is removed in favor of just bool

pkgs/development/python-modules/mypyllant/default.nix

@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "mypyllant";
-  version = "0.9.9";
+  version = "0.9.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "signalkraft";
     repo = "myPyllant";
     tag = "v${version}";
-    hash = "sha256-wvqlTlcNy/ue2yfrQyS93vfRSOTsHbvARI+7BKuUuYs=";
+    hash = "sha256-hsuRoh8meAlPd5+WlYkjbGhNKDLV5XsKn27zQWnrELQ=";
   };
 
   build-system = [

pkgs/development/python-modules/nbconflux/default.nix

@@ -47,7 +47,7 @@ buildPythonPackage rec {
     rm versioneer.py
   '';
 
-  JUPYTER_PATH = "${nbconvert}/share/jupyter";
+  env.JUPYTER_PATH = "${nbconvert}/share/jupyter";
   disabledTests = [
     "test_post_to_confluence"
     "test_optional_components"

pkgs/development/python-modules/nbsphinx/default.nix

@@ -42,7 +42,7 @@ buildPythonPackage rec {
   # The package has not tests
   doCheck = false;
 
-  JUPYTER_PATH = "${nbconvert}/share/jupyter";
+  env.JUPYTER_PATH = "${nbconvert}/share/jupyter";
 
   pythonImportsCheck = [ "nbsphinx" ];
 

pkgs/development/python-modules/oslo-log/default.nix

@@ -37,7 +37,7 @@ buildPythonPackage rec {
 
   # Manually set version because prb wants to get it from the git upstream repository (and we are
   # installing from tarball instead)
-  PBR_VERSION = version;
+  env.PBR_VERSION = version;
 
   build-system = [ setuptools ];
 

pkgs/development/python-modules/psycopg/default.nix

@@ -134,12 +134,6 @@ buildPythonPackage rec {
 
   sphinxRoot = "../docs";
 
-  # Introduce this file necessary for the docs build via environment var
-  LIBPQ_DOCS_FILE = fetchurl {
-    url = "https://raw.githubusercontent.com/postgres/postgres/496a1dc44bf1261053da9b3f7e430769754298b4/doc/src/sgml/libpq.sgml";
-    hash = "sha256-JwtCngkoi9pb0pqIdNgukY8GbG5pUDZvrGAHZqjFOw4";
-  };
-
   inherit patches;
 
   # only move to sourceRoot after patching, makes patching easier
@@ -185,6 +179,11 @@ buildPythonPackage rec {
   ++ optional-dependencies.pool;
 
   env = {
+    # Introduce this file necessary for the docs build via environment var
+    LIBPQ_DOCS_FILE = fetchurl {
+      url = "https://raw.githubusercontent.com/postgres/postgres/496a1dc44bf1261053da9b3f7e430769754298b4/doc/src/sgml/libpq.sgml";
+      hash = "sha256-JwtCngkoi9pb0pqIdNgukY8GbG5pUDZvrGAHZqjFOw4";
+    };
     postgresqlEnableTCP = 1;
     PGUSER = "psycopg";
     PGDATABASE = "psycopg";

pkgs/development/python-modules/pycontrol4/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pycontrol4";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lawtancool";
     repo = "pyControl4";
     tag = "v${version}";
-    hash = "sha256-CDo2tphWN62ZHz2nWa6oWWfzcPDhSLCu0B2NxEI8yMw=";
+    hash = "sha256-4qgyn2ekxo0pjPixfNpRqHE+jgsNQGk9fbESbUTDxMg=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pycrypto/default.nix

@@ -9,7 +9,7 @@ buildPythonPackage rec {
   format = "setuptools";
 
   # Cannot build wheel otherwise (zip 1980 issue)
-  SOURCE_DATE_EPOCH = 315532800;
+  env.SOURCE_DATE_EPOCH = 315532800;
 
   # We need to have a dist-info folder, so let's create one with setuptools
   unpackPhase = ''

pkgs/development/python-modules/pyerfa/default.nix

@@ -38,7 +38,7 @@ buildPythonPackage rec {
   '';
 
   # See https://github.com/liberfa/pyerfa/issues/112#issuecomment-1721197483
-  NIX_CFLAGS_COMPILE = "-O2";
+  env.NIX_CFLAGS_COMPILE = "-O2";
   nativeCheckInputs = [
     pytestCheckHook
     pytest-doctestplus

pkgs/development/python-modules/pygit2/default.nix

@@ -50,7 +50,7 @@ buildPythonPackage rec {
 
   # Tests require certificates
   # https://github.com/NixOS/nixpkgs/pull/72544#issuecomment-582674047
-  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
   pythonImportsCheck = [ "pygit2" ];
 

pkgs/development/python-modules/pyhepmc/default.nix

@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  CMAKE_ARGS = [ "-DEXTERNAL_PYBIND11=ON" ];
+  env.CMAKE_ARGS = toString [ "-DEXTERNAL_PYBIND11=ON" ];
 
   nativeCheckInputs = [
     graphviz

pkgs/development/python-modules/pylint-odoo/default.nix

@@ -31,7 +31,7 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pylint_odoo" ];
 
-  BUILD_README = true; # Enables more tests
+  env.BUILD_README = true; # Enables more tests
 
   nativeCheckInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/pynest2d/default.nix

@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   strictDeps = true;
 
-  CLIPPER_PATH = "${clipper.out}";
+  env.CLIPPER_PATH = clipper.out;
 
   postPatch = ''
     sed -i 's#''${Python3_SITEARCH}#${placeholder "out"}/${python.sitePackages}#' cmake/SIPMacros.cmake

pkgs/development/python-modules/pypdf3/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-yUbzJzQZ43JY415yJz9JkEqxVyPYenYcERXvmXmfjF8=";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  env.LC_ALL = "en_US.UTF-8";
   buildInputs = [ glibcLocales ];
 
   checkPhase = ''

pkgs/development/python-modules/pyportainer/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyportainer";
-  version = "1.0.27";
+  version = "1.0.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erwindouna";
     repo = "pyportainer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h/z4CUPxOmcA57gkclEJdIWRFGfsG8v6VS8vNLneS3A=";
+    hash = "sha256-NfK6Ce99bXtI0QgObdsalpTf9MiaOBdWOp6nTrAipY4=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pysptk/default.nix

@@ -20,7 +20,7 @@ buildPythonPackage rec {
     hash = "sha256-eLHJM4v3laQc3D/wP81GmcQBwyP1RjC7caGXEAeNCz8=";
   };
 
-  PYSPTK_BUILD_VERSION = 0;
+  env.PYSPTK_BUILD_VERSION = 0;
 
   nativeBuildInputs = [ cython ];