Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -8604,6 +8604,12 @@
     githubId = 1592375;
     name = "Walter Huf";
   };
+  hughmandalidis = {
+    name = "Hugh Mandalidis";
+    email = "mandalidis.hugh@gmail.com";
+    github = "ThanePatrol";
+    githubId = 23148089;
+  };
   hughobrien = {
     email = "github@hughobrien.ie";
     github = "hughobrien";

nixos/doc/manual/development/settings-options.section.md

@@ -46,6 +46,237 @@ have a predefined type and string generator already declared under
     `generate` to build a Java `.properties` file, taking
     care of the correct escaping, etc.
 
+`pkgs.formats.hocon` { *`generator`* ? `<derivation>`, *`validator`* ? `<derivation>`, *`doCheck`* ? true }
+
+:  A function taking an attribute set with values
+
+    `generator`
+
+    :   A derivation used for converting the JSON output
+        from the nix settings into HOCON. This might be
+        useful if your HOCON variant is slightly different
+        from the java-based one, or for testing purposes.
+
+    `validator`
+
+    :   A derivation used for verifying that the HOCON
+        output is correct and parsable. This might be
+        useful if your HOCON variant is slightly different
+        from the java-based one, or for testing purposes.
+
+    `doCheck`
+
+    :   Whether to enable/disable the validator check.
+
+    It returns an attrset with a `type`, `generate` function,
+    and a `lib` attset, as specified [below](#pkgs-formats-result).
+    Some of the lib functions will be best understood if you have
+    read the reference specification. You can find this
+    specification here:
+
+    <https://github.com/lightbend/config/blob/main/HOCON.md>
+
+    Inside of `lib`, you will find these functions
+
+    `mkInclude`
+
+    :   This is used together with a specially named
+        attribute `includes`, to include other HOCON
+        sources into the document.
+
+        The function has a shorthand variant where it
+        is up to the HOCON parser to figure out what type
+        of include is being used. The include will default
+        to being non-required. If you want to be more
+        explicit about the details of the include, you can
+        provide an attrset with following arguments
+
+        `required`
+
+        :   Whether the parser should fail upon failure
+            to include the document
+
+        `type`
+
+        :   Type of the source of the included document.
+            Valid values are `file`, `url` and `classpath`.
+            See upstream documentation for the semantics
+            behind each value
+
+        `value`
+
+        :   The URI/path/classpath pointing to the source of
+            the document to be included.
+
+        `Example usage:`
+
+        ```nix
+          let
+            format = pkgs.formats.hocon { };
+            hocon_file = pkgs.writeText "to_include.hocon" ''
+              a = 1;
+            '';
+          in {
+            some.nested.hocon.attrset = {
+              _includes = [
+                (format.lib.mkInclude hocon_file)
+                (format.lib.mkInclude "https://example.com/to_include.hocon")
+                (format.lib.mkInclude {
+                  required = true;
+                  type = "file";
+                  value = include_file;
+                })
+              ];
+              ...
+            };
+          }
+        ```
+
+    `mkAppend`
+
+    :   This is used to invoke the `+=` operator.
+        This can be useful if you need to add something
+        to a list that is included from outside of nix.
+        See upstream documentation for the semantics
+        behind the `+=` operation.
+
+        `Example usage:`
+
+        ```nix
+          let
+            format = pkgs.formats.hocon { };
+            hocon_file = pkgs.writeText "to_include.hocon" ''
+              a = [ 1 ];
+              b = [ 2 ];
+            '';
+          in {
+            _includes = [
+              (format.lib.mkInclude hocon_file)
+            ];
+
+            c = 3;
+            a = format.lib.mkAppend 3;
+            b = format.lib.mkAppend (format.lib.mkSubstitution "c");
+          }
+        ```
+
+    `mkSubstitution`
+
+    :   This is used to make HOCON substitutions.
+        Similarly to `mkInclude`, this function has
+        a shorthand variant where you just give it
+        the string with the substitution value.
+        The substitution is not optional by default.
+        Alternatively, you can provide an attrset
+        with more options
+
+        `optional`
+
+        :   Whether the parser should fail upon
+            failure to fetch the substitution value.
+
+        `value`
+
+        :   The name of the variable to use for
+            substitution.
+
+        See upstream documentation for semantics
+        behind the substitution functionality.
+
+        `Example usage:`
+
+        ```nix
+          let
+            format = pkgs.formats.hocon { };
+          in {
+            a = 1;
+            b = format.lib.mkSubstitution "a";
+            c = format.lib.mkSubstition "SOME_ENVVAR";
+            d = format.lib.mkSubstition {
+              value = "SOME_OPTIONAL_ENVVAR";
+              optional = true;
+            };
+          }
+        ```
+
+    `Implementation notes:`
+
+    - classpath includes are not implemented in pyhocon,
+      which is used for validating the HOCON output. This
+      means that if you are using classpath includes,
+      you will want to either use an alternative validator
+      or set `doCheck = false` in the format options.
+
+`pkgs.formats.libconfig` { *`generator`* ? `<derivation>`, *`validator`* ? `<derivation>` }
+
+:  A function taking an attribute set with values
+
+    `generator`
+
+    :   A derivation used for converting the JSON output
+        from the nix settings into libconfig. This might be
+        useful if your libconfig variant is slightly different
+        from the original one, or for testing purposes.
+
+    `validator`
+
+    :   A derivation used for verifying that the libconfig
+        output is correct and parsable. This might be
+        useful if your libconfig variant is slightly different
+        from the original one, or for testing purposes.
+
+    It returns an attrset with a `type`, `generate` function,
+    and a `lib` attset, as specified [below](#pkgs-formats-result).
+    Some of the lib functions will be best understood if you have
+    read the reference specification. You can find this
+    specification here:
+
+    <https://hyperrealm.github.io/libconfig/libconfig_manual.html#Configuration-Files>
+
+    Inside of `lib`, you will find these functions
+
+    `mkHex`, `mkOctal`, `mkFloat`
+
+    :   Use these to specify numbers in other formats.
+
+        `Example usage:`
+
+        ```nix
+          let
+            format = pkgs.formats.libconfig { };
+          in {
+            myHexValue = format.lib.mkHex "0x1FC3";
+            myOctalValue = format.lib.mkOctal "0027";
+            myFloatValue = format.lib.mkFloat "1.2E-3";
+          }
+        ```
+
+    `mkArray`, `mkList`
+
+    :   Use these to differentiate between whether
+        a nix list should be considered as a libconfig
+        array or a libconfig list. See the upstream
+        documentation for the semantics behind these types.
+
+        `Example usage:`
+
+        ```nix
+          let
+            format = pkgs.formats.libconfig { };
+          in {
+            myList = format.lib.mkList [ "foo" 1 true ];
+            myArray = format.lib.mkArray [ 1 2 3 ];
+          }
+        ```
+
+    `Implementation notes:`
+
+    - Since libconfig does not allow setting names to start with an underscore,
+      this is used as a prefix for both special types and include directives.
+
+    - The difference between 32bit and 64bit values became optional in libconfig
+      1.5, so we assume 64bit values for all numbers.
+
 `pkgs.formats.json` { }
 
 :   A function taking an empty attribute set (for future extensibility)

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -124,6 +124,8 @@
 
 - [foot](https://codeberg.org/dnkl/foot), a fast, lightweight and minimalistic Wayland terminal emulator. Available as [programs.foot](#opt-programs.foot.enable).
 
+- [ToDesk](https://www.todesk.com/linux.html), a remote desktop applicaton. Available as [services.todesk.enable](#opt-services.todesk.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:

nixos/modules/module-list.nix

@@ -929,6 +929,7 @@
   ./services/monitoring/teamviewer.nix
   ./services/monitoring/telegraf.nix
   ./services/monitoring/thanos.nix
+  ./services/monitoring/todesk.nix
   ./services/monitoring/tremor-rs.nix
   ./services/monitoring/tuptime.nix
   ./services/monitoring/unpoller.nix

nixos/modules/services/games/teeworlds.nix

@@ -368,6 +368,33 @@ in
           '';
         };
       };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/var/lib/teeworlds/teeworlds.env";
+        description = ''
+          Environment file as defined in {manpage}`systemd.exec(5)`.
+
+          Secrets may be passed to the service without adding them to the world-readable
+          Nix store, by specifying placeholder variables as the option value in Nix and
+          setting these variables accordingly in the environment file.
+
+          ```
+            # snippet of teeworlds-related config
+            services.teeworlds.password = "$TEEWORLDS_PASSWORD";
+          ```
+
+          ```
+            # content of the environment file
+            TEEWORLDS_PASSWORD=verysecretpassword
+          ```
+
+          Note that this file needs to be available on the host on which
+          `teeworlds` is running.
+        '';
+      };
+
     };
   };
 
@@ -383,7 +410,15 @@ in
 
       serviceConfig = {
         DynamicUser = true;
-        ExecStart = "${cfg.package}/bin/teeworlds_srv -f ${teeworldsConf}";
+        RuntimeDirectory = "teeworlds";
+        RuntimeDirectoryMode = "0700";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStartPre = ''
+          ${pkgs.envsubst}/bin/envsubst \
+            -i ${teeworldsConf} \
+            -o /run/teeworlds/teeworlds.yaml
+        '';
+        ExecStart = "${lib.getExe cfg.package} -f /run/teeworlds/teeworlds.yaml";
 
         # Hardening
         CapabilityBoundingSet = false;

nixos/modules/services/misc/radicle.nix

@@ -1,5 +1,4 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.radicle;
 
@@ -14,18 +13,18 @@ let
   # Convenient wrapper to run `rad` in the namespaces of `radicle-node.service`
   rad-system = pkgs.writeShellScriptBin "rad-system" ''
     set -o allexport
-    ${toShellVars env}
+    ${lib.toShellVars env}
     # Note that --env is not used to preserve host's envvars like $TERM
-    exec ${getExe' pkgs.util-linux "nsenter"} -a \
-      -t "$(${getExe' config.systemd.package "systemctl"} show -P MainPID radicle-node.service)" \
-      -S "$(${getExe' config.systemd.package "systemctl"} show -P UID radicle-node.service)" \
-      -G "$(${getExe' config.systemd.package "systemctl"} show -P GID radicle-node.service)" \
-      ${getExe' cfg.package "rad"} "$@"
+    exec ${lib.getExe' pkgs.util-linux "nsenter"} -a \
+      -t "$(${lib.getExe' config.systemd.package "systemctl"} show -P MainPID radicle-node.service)" \
+      -S "$(${lib.getExe' config.systemd.package "systemctl"} show -P UID radicle-node.service)" \
+      -G "$(${lib.getExe' config.systemd.package "systemctl"} show -P GID radicle-node.service)" \
+      ${lib.getExe' cfg.package "rad"} "$@"
   '';
 
   commonServiceConfig = serviceName: {
     environment = env // {
-      RUST_LOG = mkDefault "info";
+      RUST_LOG = lib.mkDefault "info";
     };
     path = [
       pkgs.gitMinimal
@@ -41,11 +40,11 @@ let
       "network-online.target"
     ];
     wantedBy = [ "multi-user.target" ];
-    serviceConfig = mkMerge [
+    serviceConfig = lib.mkMerge [
       {
         BindReadOnlyPaths = [
           "${cfg.configFile}:${env.RAD_HOME}/config.json"
-          "${if types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
+          "${if lib.types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
         ];
         KillMode = "process";
         StateDirectory = [ "radicle" ];
@@ -107,7 +106,7 @@ let
         pkgs.gitMinimal
         cfg.package
         pkgs.iana-etc
-        (getLib pkgs.nss)
+        (lib.getLib pkgs.nss)
         pkgs.tzdata
       ];
     };
@@ -116,11 +115,11 @@ in
 {
   options = {
     services.radicle = {
-      enable = mkEnableOption "Radicle Seed Node";
-      package = mkPackageOption pkgs "radicle-node" { };
-      privateKeyFile = mkOption {
+      enable = lib.mkEnableOption "Radicle Seed Node";
+      package = lib.mkPackageOption pkgs "radicle-node" { };
+      privateKeyFile = lib.mkOption {
         # Note that a key encrypted by systemd-creds is not a path but a str.
-        type = with types; either path str;
+        type = with lib.types; either path str;
         description = ''
           Absolute file path to an SSH private key,
           usually generated by `rad auth`.
@@ -130,44 +129,44 @@ in
           and the string after as a path encrypted with `systemd-creds`.
         '';
       };
-      publicKey = mkOption {
-        type = with types; either path str;
+      publicKey = lib.mkOption {
+        type = with lib.types; either path str;
         description = ''
           An SSH public key (as an absolute file path or directly as a string),
           usually generated by `rad auth`.
         '';
       };
       node = {
-        listenAddress = mkOption {
-          type = types.str;
+        listenAddress = lib.mkOption {
+          type = lib.types.str;
           default = "[::]";
           example = "127.0.0.1";
           description = "The IP address on which `radicle-node` listens.";
         };
-        listenPort = mkOption {
-          type = types.port;
+        listenPort = lib.mkOption {
+          type = lib.types.port;
           default = 8776;
           description = "The port on which `radicle-node` listens.";
         };
-        openFirewall = mkEnableOption "opening the firewall for `radicle-node`";
-        extraArgs = mkOption {
-          type = with types; listOf str;
+        openFirewall = lib.mkEnableOption "opening the firewall for `radicle-node`";
+        extraArgs = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [ ];
           description = "Extra arguments for `radicle-node`";
         };
       };
-      configFile = mkOption {
-        type = types.package;
+      configFile = lib.mkOption {
+        type = lib.types.package;
         internal = true;
         default = (json.generate "config.json" cfg.settings).overrideAttrs (previousAttrs: {
           preferLocalBuild = true;
           # None of the usual phases are run here because runCommandWith uses buildCommand,
           # so just append to buildCommand what would usually be a checkPhase.
-          buildCommand = previousAttrs.buildCommand + optionalString cfg.checkConfig ''
+          buildCommand = previousAttrs.buildCommand + lib.optionalString cfg.checkConfig ''
             ln -s $out config.json
             install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
             export RAD_HOME=$PWD
-            ${getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
+            ${lib.getExe' pkgs.buildPackages.radicle-node "rad"} config >/dev/null || {
               cat -n config.json
               echo "Invalid config.json according to rad."
               echo "Please double-check your services.radicle.settings (producing the config.json above),"
@@ -177,13 +176,13 @@ in
           '';
         });
       };
-      checkConfig = mkEnableOption "checking the {file}`config.json` file resulting from {option}`services.radicle.settings`" // { default = true; };
-      settings = mkOption {
+      checkConfig = lib.mkEnableOption "checking the {file}`config.json` file resulting from {option}`services.radicle.settings`" // { default = true; };
+      settings = lib.mkOption {
         description = ''
           See https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/tree/radicle/src/node/config.rs#L275
         '';
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             web.pinned.repositories = [
               "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5" # heartwood
@@ -191,27 +190,27 @@ in
             ];
           }
         '';
-        type = types.submodule {
+        type = lib.types.submodule {
           freeformType = json.type;
         };
       };
       httpd = {
-        enable = mkEnableOption "Radicle HTTP gateway to radicle-node";
-        package = mkPackageOption pkgs "radicle-httpd" { };
-        listenAddress = mkOption {
-          type = types.str;
+        enable = lib.mkEnableOption "Radicle HTTP gateway to radicle-node";
+        package = lib.mkPackageOption pkgs "radicle-httpd" { };
+        listenAddress = lib.mkOption {
+          type = lib.types.str;
           default = "127.0.0.1";
           description = "The IP address on which `radicle-httpd` listens.";
         };
-        listenPort = mkOption {
-          type = types.port;
+        listenPort = lib.mkOption {
+          type = lib.types.port;
           default = 8080;
           description = "The port on which `radicle-httpd` listens.";
         };
-        nginx = mkOption {
+        nginx = lib.mkOption {
           # Type of a single virtual host, or null.
-          type = types.nullOr (types.submodule (
-            recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
+          type = lib.types.nullOr (lib.types.submodule (
+            lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
               options.serverName = {
                 default = "radicle-${config.networking.hostName}.${config.networking.domain}";
                 defaultText = "radicle-\${config.networking.hostName}.\${config.networking.domain}";
@@ -219,7 +218,7 @@ in
             }
           ));
           default = null;
-          example = literalExpression ''
+          example = lib.literalExpression ''
             {
               serverAliases = [
                 "seed.''${config.networking.domain}"
@@ -237,8 +236,8 @@ in
             If this is set to null (the default), no nginx virtual host will be configured.
           '';
         };
-        extraArgs = mkOption {
-          type = with types; listOf str;
+        extraArgs = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [ ];
           description = "Extra arguments for `radicle-httpd`";
         };
@@ -246,19 +245,19 @@ in
     };
   };
 
-  config = mkIf cfg.enable (mkMerge [
+  config = lib.mkIf cfg.enable (lib.mkMerge [
     {
-      systemd.services.radicle-node = mkMerge [
+      systemd.services.radicle-node = lib.mkMerge [
         (commonServiceConfig "radicle-node")
         {
           description = "Radicle Node";
           documentation = [ "man:radicle-node(1)" ];
           serviceConfig = {
-            ExecStart = "${getExe' cfg.package "radicle-node"} --force --listen ${cfg.node.listenAddress}:${toString cfg.node.listenPort} ${escapeShellArgs cfg.node.extraArgs}";
-            Restart = mkDefault "on-failure";
+            ExecStart = "${lib.getExe' cfg.package "radicle-node"} --force --listen ${cfg.node.listenAddress}:${toString cfg.node.listenPort} ${lib.escapeShellArgs cfg.node.extraArgs}";
+            Restart = lib.mkDefault "on-failure";
             RestartSec = "30";
             SocketBindAllow = [ "tcp:${toString cfg.node.listenPort}" ];
-            SystemCallFilter = mkAfter [
+            SystemCallFilter = lib.mkAfter [
               # Needed by git upload-pack which calls alarm() and setitimer() when providing a rad clone
               "@timer"
             ];
@@ -271,11 +270,11 @@ in
         {
           serviceConfig =
             let keyCred = builtins.split ":" "${cfg.privateKeyFile}"; in
-            if length keyCred > 1
+            if lib.length keyCred > 1
             then {
               LoadCredentialEncrypted = [ cfg.privateKeyFile ];
               # Note that neither %d nor ${CREDENTIALS_DIRECTORY} works in BindReadOnlyPaths=
-              BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/${head keyCred}:${env.RAD_HOME}/keys/radicle" ];
+              BindReadOnlyPaths = [ "/run/credentials/radicle-node.service/${lib.head keyCred}:${env.RAD_HOME}/keys/radicle" ];
             }
             else {
               LoadCredential = [ "radicle:${cfg.privateKeyFile}" ];
@@ -288,7 +287,7 @@ in
         rad-system
       ];
 
-      networking.firewall = mkIf cfg.node.openFirewall {
+      networking.firewall = lib.mkIf cfg.node.openFirewall {
         allowedTCPPorts = [ cfg.node.listenPort ];
       };
 
@@ -304,19 +303,19 @@ in
       };
     }
 
-    (mkIf cfg.httpd.enable (mkMerge [
+    (lib.mkIf cfg.httpd.enable (lib.mkMerge [
       {
-        systemd.services.radicle-httpd = mkMerge [
+        systemd.services.radicle-httpd = lib.mkMerge [
           (commonServiceConfig "radicle-httpd")
           {
             description = "Radicle HTTP gateway to radicle-node";
             documentation = [ "man:radicle-httpd(1)" ];
             serviceConfig = {
-              ExecStart = "${getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${escapeShellArgs cfg.httpd.extraArgs}";
-              Restart = mkDefault "on-failure";
+              ExecStart = "${lib.getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${lib.escapeShellArgs cfg.httpd.extraArgs}";
+              Restart = lib.mkDefault "on-failure";
               RestartSec = "10";
               SocketBindAllow = [ "tcp:${toString cfg.httpd.listenPort}" ];
-              SystemCallFilter = mkAfter [
+              SystemCallFilter = lib.mkAfter [
                 # Needed by git upload-pack which calls alarm() and setitimer() when providing a git clone
                 "@timer"
               ];
@@ -328,12 +327,12 @@ in
         ];
       }
 
-      (mkIf (cfg.httpd.nginx != null) {
+      (lib.mkIf (cfg.httpd.nginx != null) {
         services.nginx.virtualHosts.${cfg.httpd.nginx.serverName} = lib.mkMerge [
           cfg.httpd.nginx
           {
-            forceSSL = mkDefault true;
-            enableACME = mkDefault true;
+            forceSSL = lib.mkDefault true;
+            enableACME = lib.mkDefault true;
             locations."/" = {
               proxyPass = "http://${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort}";
               recommendedProxySettings = true;
@@ -342,8 +341,8 @@ in
         ];
 
         services.radicle.settings = {
-          node.alias = mkDefault cfg.httpd.nginx.serverName;
-          node.externalAddresses = mkDefault [
+          node.alias = lib.mkDefault cfg.httpd.nginx.serverName;
+          node.externalAddresses = lib.mkDefault [
             "${cfg.httpd.nginx.serverName}:${toString cfg.node.listenPort}"
           ];
         };

nixos/modules/services/monitoring/todesk.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.todesk;
+in
+{
+  options = {
+    services.todesk.enable = lib.mkEnableOption "ToDesk daemon";
+    services.todesk.package = lib.mkPackageOption pkgs "todesk" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.todeskd = {
+      description = "ToDesk Daemon Service";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+        "display-manager.service"
+        "nss-lookup.target"
+      ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${cfg.package}/bin/todesk service";
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGINT $MAINPID";
+        Restart = "on-failure";
+        WorkingDirectory = "/var/lib/todesk";
+        PrivateTmp = true;
+        StateDirectory = "todesk";
+        StateDirectoryMode = "0777"; # Desktop application read and write /opt/todesk/config/config.ini. Such a pain!
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        RemoveIPC = "yes";
+      };
+    };
+  };
+}

nixos/tests/nixos-rebuild-specialisations.nix

@@ -21,6 +21,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         pkgs.grub2
       ];
 
+      system.switch.enable = true;
+
       virtualisation = {
         cores = 2;
         memorySize = 4096;

pkgs/applications/emulators/vbam/default.nix

@@ -19,12 +19,12 @@
 
 stdenv.mkDerivation rec {
   pname = "visualboyadvance-m";
-  version = "2.1.9";
+  version = "2.1.10";
   src = fetchFromGitHub {
     owner = "visualboyadvance-m";
     repo = "visualboyadvance-m";
     rev = "v${version}";
-    sha256 = "sha256-t5/CM5KXDG0OCByu7mUyuC5NkYmB3BFmEHHgnMY05nE=";
+    sha256 = "sha256-ca+BKedHuOwHOCXgjLkkpR6Pd+59X2R66dbPWEg2O5A=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 ];

pkgs/applications/networking/browsers/ladybird/default.nix

@@ -58,13 +58,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2024-08-12";
+  version = "0-unstable-2024-09-08";
 
   src = fetchFromGitHub {
     owner = "LadybirdWebBrowser";
     repo = "ladybird";
-    rev = "7e57cc7b090455e93261c847064f12a61d686ff3";
-    hash = "sha256-8rkgxEfRH8ERuC7iplQKOzKb1EJ4+SNGDX5gTGpOmQo=";
+    rev = "8d6f36f8d6c0aea0253df8c84746f8c99bf79b4d";
+    hash = "sha256-EB26SAh9eckpq/HrO8O+PivMMmLpFtCdCNkOJcLQvZw=";
   };
 
   postPatch = ''

pkgs/applications/networking/irc/weechat/default.nix

@@ -36,14 +36,14 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "4.4.1";
+      version = "4.4.2";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-        hash = "sha256-5d4L0UwqV6UFgTqDw9NyZI0tlXPccoNoV78ocXMmk2w=";
+        hash = "sha256-1N8ompxbygOm1PrgBuUgNwZO8Dutb76VnFOPMZdDTew=";
       };
 
       # Why is this needed? https://github.com/weechat/weechat/issues/2031

pkgs/applications/version-management/srvc/default.nix

@@ -1,34 +0,0 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin, git }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "srvc";
-  version = "0.20.0";
-
-  src = fetchFromGitHub {
-    owner = "insilica";
-    repo = "rs-srvc";
-    rev = "v${version}";
-    hash = "sha256-pnlbMU/uoP9ZK8kzTRYTMY9+X9VIKJHwW2qMXXD8Udg=";
-  };
-
-  cargoHash = "sha256-+m8WJMn1aq3FBDO5c/ZwbcK2G+UE5pSwHTgOl2s6pDw=";
-
-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.Security
-  ];
-
-  nativeCheckInputs = [ git ];
-
-  # remove timeouts in tests to make them less flaky
-  TEST_SRVC_DISABLE_TIMEOUT = 1;
-
-  meta = with lib; {
-    description = "Sysrev version control";
-    homepage = "https://github.com/insilica/rs-srvc";
-    changelog = "https://github.com/insilica/rs-srvc/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ john-shaffer ];
-    mainProgram = "sr";
-  };
-}

pkgs/applications/video/hyperion-ng/default.nix

@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub
 , cmake, wrapQtAppsHook, perl
 , flatbuffers, protobuf, mbedtls
-, hidapi, libcec, libusb1
+, alsa-lib, hidapi, libcec, libusb1
 , libX11, libxcb, libXrandr, python3
 , qtbase, qtserialport, qtsvg, qtx11extras
 , withRPiDispmanx ? false, libraspberrypi
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperion.ng";
-  version = "2.0.14";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = "hyperion-project";
     repo = pname;
     rev = version;
-    hash = "sha256-Y1PZ+YyPMZEX4fBpMG6IVT1gtXR9ZHlavJMCQ4KAenc=";
+    hash = "sha256-nQPtJw9DOKMPGI5trxZxpP+z2PYsbRKqOQEyaGzvmmA=";
     # needed for `dependencies/external/`:
     # * rpi_ws281x` - not possible to use as a "system" lib
     # * qmdnsengine - not in nixpkgs yet
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
+    alsa-lib
     hidapi
     libusb1
     libX11

pkgs/by-name/fi/firefly-iii-data-importer/package.nix

@@ -13,13 +13,13 @@
 
 let
   pname = "firefly-iii-data-importer";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     rev = "v${version}";
-    hash = "sha256-XnPdoNtUoJpOpKVzQlFirh7u824H4xKAe2VRXfGIKeg=";
+    hash = "sha256-nAeLXxUwaw/wHYh3NywI4/mFi82i/2b3McFfCFGAIjE=";
   };
 in
 
@@ -42,12 +42,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-EjEco8zBR787eQuPhNsRScfuPQ6eS6TIJmMJOcmZA+Q=";
+  vendorHash = "sha256-yLu/FMKn/uUy5g6td3mfPAb9ptjJne4vd478fjaS9U0=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
     name = "${pname}-npm-deps";
-    hash = "sha256-VP1wM0+ca17aQU4FJ9gSbT2Np/sxb8wZ4pCJ6FV1V7w=";
+    hash = "sha256-35mS+0Ea69CAwV9liTU3lcKp3ww3qLbTRWlF0AQNx5w=";
   };
 
   composerRepository = php83.mkComposerRepository {

pkgs/by-name/fi/fireplace/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ncurses,
+}:
+stdenv.mkDerivation {
+  pname = "fireplace";
+  version = "0-unstable-2020-02-02";
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 fireplace -t $out/bin
+
+    runHook postInstall
+  '';
+
+  src = fetchFromGitHub {
+    owner = "Wyatt915";
+    repo = "fireplace";
+    rev = "aa2070b73be9fb177007fc967b066d88a37e3408";
+    hash = "sha256-2NUE/zaFoGwkZxgvVCYXxToiL23aVUFwFNlQzEq9GEc=";
+  };
+
+  meta = {
+    description = "Cozy fireplace in your terminal";
+    homepage = "https://github.com/Wyatt915/fireplace";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      multivac61
+      eclairevoyant
+    ];
+    mainProgram = "fireplace";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/gh/gh-markdown-preview/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-yfl50izjjyPmyV0Er0al/PPd87Yizqc8PnFV/FMpfEU=";
+    hash = "sha256-y9AiHmBfDSJ6oCevUAUkg18qHe/oP7A6PLiz3MZqU0s=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";

pkgs/by-name/gi/gitea/package.nix

@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
@@ -20,7 +19,7 @@ let
     pname = "gitea-frontend";
     inherit (gitea) src version;
 
-    npmDepsHash = "sha256-gXBBiDIIS0aW6qK37HcF0AuJOliblinznRVXoo6DV1s=";
+    npmDepsHash = "sha256-Sp3xBe5IXys2Qro4x4HKs9dQOnlbstAmtIG6xOOktEk=";
 
     # use webpack directly instead of 'make frontend' as the packages are already installed
     buildPhase = ''
@@ -34,16 +33,18 @@ let
   };
 in buildGoModule rec {
   pname = "gitea";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${gitea.version}";
-    hash = "sha256-s7su3gMdXv2sT1uYYtx29n7QDvmPU9QB3QR6ctOlE58=";
+    hash = "sha256-PwA23cbRgw5crzZmngDjAAIODMtguwBCqc9NqWMjF3o=";
   };
 
-  vendorHash = "sha256-nzhjIfQMzSf1nuBMTIe0xn+NMDFbDZ9jRHu8Nwzmp4w=";
+  proxyVendor = true;
+
+  vendorHash = "sha256-rMTKmztQNse/9CK1qFGWmSwqunwh918EvcuIHk6BSTY=";
 
   outputs = [ "out" "data" ];
 

pkgs/by-name/le/lefthook/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.7.14";
+  version = "1.7.15";
 in
 buildGoModule {
   inherit pname version;
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-yGxEeNn6YnzivvQW+HXMAkSaKZ5mmAflyDlNYfjqguc=";
+    hash = "sha256-N79unpeeOwcdHJo9IbsGa/gmTyg+QQCJF599cshV3sc=";
   };
 
-  vendorHash = "sha256-YrBFcRQoqZPe/USZj3oJK5KR7y0LimCVGS9w4uNMG6M=";
+  vendorHash = "sha256-rJdtax3r5Nwew+ptY4kIAUtxqPguwrFMMRk78zrZUcU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ma/marwaita-mint/package.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "marwaita-mint";
-  version = "20.3.1";
+  version = "21";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = "marwaita-mint";
     rev = finalAttrs.version;
-    hash = "sha256-0IgQbBragalLO0zVU36ZWxF3Q47cfEQ15HxQ2j9QhIc=";
+    hash = "sha256-RzQmBD4nlnzZN1BCS6EOqbuSxmjHPAgf/uv99xgAUYU=";
   };
 
   buildInputs = [

pkgs/by-name/me/melonDS/package.nix

@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "0.9.5-unstable-2024-08-21";
+  version = "0.9.5-unstable-2024-09-06";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "4f6498c99c5dcdb780371fe936d49e32df148e6e";
-    hash = "sha256-GfcPWWWAO9zQrqr2+CxNMaIxcfswZhDw1DFjrmpWZ2Q=";
+    rev = "268c4f14c194b72ced33f520688fb0d3d096fad5";
+    hash = "sha256-D7tponrkD+YI6MYeilP5YlpIJ3brdZYKpDV/YE9vOFA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mo/mouse-actions-gui/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mouse-actions-gui";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "jersou";
     repo = "mouse-actions";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-02E4HrKIoBV3qZPVH6Tjz9Bv/mh5C8amO1Ilmd+YO5g=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-44F4CdsDHuN2FuijnpfmoFy4a/eAbYOoBYijl9mOctg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/config-editor";
@@ -58,16 +58,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-Rnr5jRupdUu6mIsWvdN6AnQnsxB5h31n/24pYslGs5g=";
+    hash = "sha256-amDTYAvEoDHb7+dg39+lUne0dv0M9vVe1vHoXk2agZA=";
   };
 
   cargoRoot = "src-tauri";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
-    inherit (finalAttrs) src;
+    inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.sourceRoot}/${finalAttrs.cargoRoot}";
-    hash = "sha256-VQFRatnxzmywAiMLfkVgB7g8AFoqfWFYjt/vezpE1o8=";
+    hash = "sha256-H8TMpYFJWp227jPA5H2ZhSqTMiT/U6pT6eLyjibuoLU=";
   };
 
   buildPhase = ''

pkgs/by-name/ni/nitrokey-fido2-firmware/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeShellScriptBin,
+  gcc-arm-embedded,
+  pynitrokey,
+  python3,
+
+  # The make target to run
+  makeTarget ? "release-buildv",
+  # Whether the firmware should include the production public key for the bootloader
+  release ? true,
+}:
+
+let
+  # The latest release is found on the releases page; do not rely on the latest tag.
+  # They normally contain the suffix `.nitrokey`.
+  # https://github.com/Nitrokey/nitrokey-fido2-firmware/releases
+  version = "2.4.1";
+
+  # The firmware version is pulled from `git` so we stub it here to avoid pulling the whole program.
+  fakeGit = writeShellScriptBin "git" ''
+    echo "${version}.nitrokey"
+  '';
+
+in
+stdenv.mkDerivation {
+  pname = "nitrokey-fido2-firmware";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Nitrokey";
+    repo = "nitrokey-fido2-firmware";
+    rev = "${version}.nitrokey";
+    hash = "sha256-7AsnxRf8mdybI6Mup2mV01U09r5C/oUX6fG2ymkkOOo=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    # Remove a duplicate firmware_version definition. Without this,
+    # firmware_version is defined multiple times, triggering a build error.
+    substituteInPlace fido2/version.h \
+      --replace-fail "const version_t firmware_version ;" ""
+  '';
+
+  nativeBuildInputs = [
+    fakeGit
+    # only gcc-arm-embedded includes libc_nano.a
+    gcc-arm-embedded
+    pynitrokey
+    python3
+  ];
+
+  preBuild = ''
+    cd targets/stm32l432
+  '';
+
+  makeFlags = [
+    "${makeTarget}"
+    "RELEASE=${toString release}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    cp -r release $out
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Firmware for the Nitrokey FIDO2 device";
+    homepage = "https://github.com/Nitrokey/nitrokey-fido2-firmware";
+    maintainers = with lib.maintainers; [
+      amerino
+      kiike
+      imadnyc
+    ];
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/ni/nitrokey-pro-firmware/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeShellScriptBin,
+  python3,
+  srecord,
+  gcc-arm-embedded,
+}:
+
+let
+  version = "0.15";
+
+  # The firmware version is pulled from `git` so we stub it here to avoid pulling the whole program.
+  fakeGit = writeShellScriptBin "git" ''
+    echo "${version}.nitrokey"
+  '';
+
+in
+
+stdenv.mkDerivation {
+  pname = "nitrokey-pro-firmware";
+  inherit version;
+  src = fetchFromGitHub {
+    owner = "Nitrokey";
+    repo = "nitrokey-pro-firmware";
+    rev = "v${version}";
+    hash = "sha256-q+kbEOLA05xR6weAWDA1hx4fVsaN9UNKiOXGxPRfXuI=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    patchShebangs dapboot/libopencm3/scripts
+  '';
+
+  nativeBuildInputs = [
+    fakeGit
+    gcc-arm-embedded
+    python3
+    srecord
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D build/gcc/bootloader.hex $out/bootloader.hex
+    install -D build/gcc/nitrokey-pro-firmware.hex $out/firmware.hex
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Firmware for the Nitrokey Pro device";
+    homepage = "https://github.com/Nitrokey/nitrokey-pro-firmware";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      imadnyc
+      kiike
+      amerino
+    ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/qt/qtalarm/package.nix

@@ -0,0 +1,81 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  libsForQt5,
+  qt5,
+  makeDesktopItem,
+  nix-update-script,
+  copyDesktopItems,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qtalarm";
+  version = "2.5.1";
+
+  src = fetchFromGitHub {
+    owner = "CountMurphy";
+    repo = "QTalarm";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-87w5YFQ9olLnCfPF04jOnIMn1NtE2M2n5WZX4e69UGU=";
+  };
+
+  buildInputs = [
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
+  ];
+
+  installPhase =
+    ''
+      runHook preInstall
+    ''
+    + (
+      if stdenv.isDarwin then
+        ''
+          mkdir -p $out/Applications
+          mv qtalarm.app $out/Applications
+        ''
+      else
+        ''
+          install -Dm755 qtalarm -t $out/bin
+          install -Dm644 Icons/1349069370_Alarm_Clock.png $out/share/icons/hicolor/48x48/apps/qtalarm.png
+          install -Dm644 Icons/1349069370_Alarm_Clock24.png $out/share/icons/hicolor/24x24/apps/qtalarm.png
+          install -Dm644 Icons/1349069370_Alarm_Clock16.png $out/share/icons/hicolor/16x16/apps/qtalarm.png
+        ''
+    )
+    + ''
+      runHook postInstall
+    '';
+
+  nativeBuildInputs = [
+    qt5.wrapQtAppsHook
+    qt5.qmake
+    copyDesktopItems
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "QTalarm";
+      exec = "qtalarm";
+      icon = "qtalarm";
+      desktopName = "QTalarm";
+      genericName = "Nifty alarm clock";
+      categories = [
+        "Application"
+        "Utility"
+      ];
+      terminal = false;
+    })
+  ];
+  meta = {
+    description = "Nifty alarm clock written in QT";
+    changelog = "https://github.com/CountMurphy/QTalarm/releases/tag/${finalAttrs.version}";
+    homepage = "https://github.com/CountMurphy/QTalarm";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "qtalarm";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/ra/radicle-node/package.nix

@@ -18,7 +18,7 @@
 , xdg-utils
 }: rustPlatform.buildRustPackage rec {
   pname = "radicle-node";
-  version = "1.0.0-rc.17";
+  version = "1.0.0";
   env.RADICLE_VERSION = version;
 
   src = fetchgit {
@@ -26,7 +26,7 @@
     rev = "refs/namespaces/z6MksFqXN3Yhqk8pTJdUGLwATkRfQvwZXPqR2qMEhbS9wzpT/refs/tags/v${version}";
     hash = "sha256-sb0GroWfZWC9YCGby88eiPnhFCdDA9EUhVpoyuAA+Mk=";
   };
-  cargoHash = "sha256-5xqoWW3pPU/vQs1ewPb24/fv/oKBF+ZZzbsYhC7LopM=";
+  cargoHash = "sha256-+VjYX1gGf5aIGSQRMtvK6JI118X50HaxFwg5H14Vq7g=";
 
   nativeBuildInputs = [ asciidoctor installShellFiles makeWrapper ];
   nativeCheckInputs = [ git ];

pkgs/by-name/sb/sby/package.nix

@@ -20,13 +20,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sby";
-  version = "0.44";
+  version = "0.45";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "sby";
     rev = "yosys-${version}";
-    hash = "sha256-/oDbbdZuWPdg0Xrh+c4i283vML9QTfyWVu8kryb4WaE=";
+    hash = "sha256-HRQ5ZL0w3GLUySTFekE/T/VlxJLFIQQr0bW8l7rp/zs=";
   };
 
   nativeBuildInputs = [ bash ];

pkgs/by-name/sn/snpguest/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "snpguest";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "virtee";
     repo = "snpguest";
-    rev = "v${version}";
-    hash = "sha256-9TchRaZPQKAsncs+mlHvzeie9IIVZeea/LfBLXOLuNg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qc7WooUJQa0+tzoS0z0GPV3N3WGM1WQ4ewZj8zUWHZE=";
   };
 
-  cargoHash = "sha256-1UX5GiwH38W+IgZO+0EA3M86iWMylM8fgr48DRD187A=";
+  cargoHash = "sha256-GYLJGkEI7AYUxuE57fGz4NM9hZ+Z73tq8wnOzANtwnM=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/sn/snphost/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "snphost";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "virtee";
     repo = "snphost";
-    rev = "v${version}";
-    hash = "sha256-ChB745I+4CuN/qvWW5e5gPWBdTDJdrUMiHO3LkmTwtk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-GaeNoLx/fV/NNUS2b2auGvylhW6MOFp98Xi0sdDV3VM=";
   };
 
-  cargoHash = "sha256-yXjrTxCRI+1IMRmBYLw9+uHr9BVVhRXx6zU2q3sYf9s=";
+  cargoHash = "sha256-fG3MTCHfIfYeFK03Ee9uzq8e7f5NN/h8LIye7Y3+0uI=";
 
   nativeBuildInputs = [
     asciidoctor

pkgs/by-name/th/thrift-ls/package.nix

@@ -17,6 +17,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-YoZ2dku84065Ygh9XU6dOwmCkuwX0r8a0Oo8c1HPsS4=";
 
+  postInstall = ''
+    mv $out/bin/thrift-ls $out/bin/thriftls
+  '';
+
   ldflags = [
     "-s"
     "-w"
@@ -26,7 +30,10 @@ buildGoModule rec {
     description = "Thrift Language Server";
     homepage = "https://github.com/joyme123/thrift-ls";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ callumio ];
-    mainProgram = "thrift-ls";
+    maintainers = with lib.maintainers; [
+      callumio
+      hughmandalidis
+    ];
+    mainProgram = "thriftls";
   };
 }

pkgs/by-name/to/todesk/package.nix

@@ -0,0 +1,144 @@
+{
+  stdenv,
+  lib,
+  procps,
+  fetchurl,
+  dpkg,
+  writeShellScript,
+  buildFHSEnv,
+  nspr,
+  kmod,
+  systemdMinimal,
+  glib,
+  pulseaudio,
+  libXext,
+  libX11,
+  libXrandr,
+  glibc,
+  cairo,
+  libva,
+  libdrm,
+  coreutils,
+  libXi,
+  libGL,
+  bash,
+  libXcomposite,
+  libXdamage,
+  libXfixes,
+  libXtst,
+  nss,
+  libXxf86vm,
+  gtk3,
+  gdk-pixbuf,
+  pango,
+  libz,
+  libayatana-appindicator,
+}:
+
+let
+  version = "4.7.2.0";
+  todesk-unwrapped = stdenv.mkDerivation (finalAttrs: {
+    pname = "todesk-unwrapped";
+    version = version;
+    src = fetchurl {
+      url = "https://newdl.todesk.com/linux/todesk-v${finalAttrs.version}-amd64.deb";
+      hash = "sha256-v7VpXXFVaKI99RpzUWfAc6eE7NHGJeFrNeUTbVuX+yg=";
+      curlOptsList = [
+        "--user-agent"
+        "Mozilla/5.0"
+      ];
+    };
+    nativeBuildInputs = [ dpkg ];
+
+    unpackPhase = ''
+      runHook preUnpack
+      dpkg -x $src ./todesk-src
+      runHook postUnpack
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p "$out/lib"
+      cp -r todesk-src/* "$out"
+      cp "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1" "$out/opt/todesk/bin/libappindicator3.so.1"
+      mv "$out/opt/todesk/bin" "$out/bin"
+      cp "$out/bin/libmfx.so.1" "$out/lib"
+      cp "$out/bin/libglut.so.3" "$out/lib"
+      mkdir "$out/opt/todesk/config"
+      mkdir "$out/opt/todesk/bin"
+      mkdir -p "$out/share/applications"
+      mkdir "$out/share/icons"
+      runHook postInstall
+    '';
+
+  });
+
+in
+buildFHSEnv {
+  inherit version;
+  name = "todesk";
+  targetPkgs = pkgs: [
+    todesk-unwrapped
+    pulseaudio
+    nspr
+    kmod
+    libXi
+    systemdMinimal
+    glib
+    libz
+    bash
+    coreutils
+    libX11
+    libXext
+    libXrandr
+    glibc
+    libdrm
+    libGL
+    procps
+    cairo
+    libXcomposite
+    libXdamage
+    libXfixes
+    libXtst
+    nss
+    libXxf86vm
+    gtk3
+    gdk-pixbuf
+    pango
+    libva
+  ];
+  extraBwrapArgs = [
+    "--bind /var/lib/todesk /opt/todesk/config" # create the folder before bind to avoid permission denided.
+    "--bind ${todesk-unwrapped}/bin /opt/todesk/bin"
+    "--bind /var/lib/todesk /etc/todesk" # service write uuid here. Such a pain!
+  ]; # soft link doesn't work so that we should bind ourselves
+  runScript = writeShellScript "ToDesk.sh" ''
+    export LIBVA_DRIVER_NAME=iHD
+    export LIBVA_DRIVERS_PATH=${todesk-unwrapped}/bin
+    if [ "''${1}" = 'service' ]
+    then
+        /opt/todesk/bin/ToDesk_Service
+    else
+        /opt/todesk/bin/ToDesk
+    fi
+  ''; # a small script to choose what to exec
+  extraInstallCommands = ''
+    mkdir -p "$out/share/applications"
+    mkdir -p "$out/share/icons"
+    cp ${todesk-unwrapped}/usr/share/applications/todesk.desktop $out/share/applications
+    cp -rf ${todesk-unwrapped}/usr/share/icons/* $out/share/icons
+    substituteInPlace "$out/share/applications/todesk.desktop" \
+      --replace-fail '/opt/todesk/bin/ToDesk' "$out/bin/todesk desktop"
+    substituteInPlace "$out/share/applications/todesk.desktop" \
+      --replace-fail '/opt/todesk/bin' "${todesk-unwrapped}/lib"
+  '';
+  meta = {
+    description = "Remote Desktop Application";
+    homepage = "https://www.todesk.com/linux.html";
+    license = lib.licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "todesk";
+  };
+}

pkgs/by-name/uv/uv/Cargo.lock

@@ -1040,6 +1040,7 @@ dependencies = [
  "platform-tags",
  "pypi-types",
  "rkyv",
+ "rustc-hash",
  "schemars",
  "serde",
  "serde_json",
@@ -1047,6 +1048,7 @@ dependencies = [
  "tracing",
  "url",
  "urlencoding",
+ "uv-cache-info",
  "uv-fs",
  "uv-git",
  "uv-normalize",
@@ -1779,6 +1781,7 @@ dependencies = [
  "tempfile",
  "thiserror",
  "tracing",
+ "uv-cache-info",
  "uv-fs",
  "uv-normalize",
  "uv-warnings",
@@ -2825,9 +2828,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.6"
+version = "0.11.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba92fb39ec7ad06ca2582c0ca834dfeadcaf06ddfc8e635c80aa7e1c05315fdd"
+checksum = "ea0a9b3a42929fad8a7c3de7f86ce0814cfa893328157672680e9fb1145549c5"
 dependencies = [
  "bytes",
  "rand",
@@ -4441,7 +4444,7 @@ checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
 
 [[package]]
 name = "uv"
-version = "0.4.7"
+version = "0.4.8"
 dependencies = [
  "anstream",
  "anyhow",
@@ -4497,6 +4500,7 @@ dependencies = [
  "url",
  "uv-auth",
  "uv-cache",
+ "uv-cache-info",
  "uv-cli",
  "uv-client",
  "uv-configuration",
@@ -4594,11 +4598,24 @@ dependencies = [
  "tempfile",
  "tracing",
  "url",
+ "uv-cache-info",
  "uv-fs",
  "uv-normalize",
  "walkdir",
 ]
 
+[[package]]
+name = "uv-cache-info"
+version = "0.0.1"
+dependencies = [
+ "fs-err",
+ "schemars",
+ "serde",
+ "thiserror",
+ "toml",
+ "tracing",
+]
+
 [[package]]
 name = "uv-cli"
 version = "0.0.1"
@@ -4680,6 +4697,7 @@ name = "uv-configuration"
 version = "0.0.1"
 dependencies = [
  "anyhow",
+ "cache-key",
  "clap",
  "distribution-types",
  "either",
@@ -4695,6 +4713,7 @@ dependencies = [
  "url",
  "uv-auth",
  "uv-cache",
+ "uv-cache-info",
  "uv-normalize",
 ]
 
@@ -4792,6 +4811,7 @@ dependencies = [
  "tracing",
  "url",
  "uv-cache",
+ "uv-cache-info",
  "uv-client",
  "uv-configuration",
  "uv-extract",
@@ -4895,6 +4915,7 @@ dependencies = [
  "tracing",
  "url",
  "uv-cache",
+ "uv-cache-info",
  "uv-configuration",
  "uv-distribution",
  "uv-extract",
@@ -4983,6 +5004,7 @@ dependencies = [
  "tracing",
  "url",
  "uv-cache",
+ "uv-cache-info",
  "uv-client",
  "uv-extract",
  "uv-fs",
@@ -5115,6 +5137,7 @@ dependencies = [
  "thiserror",
  "toml",
  "tracing",
+ "uv-cache-info",
  "uv-configuration",
  "uv-fs",
  "uv-macros",
@@ -5194,7 +5217,7 @@ dependencies = [
 
 [[package]]
 name = "uv-version"
-version = "0.4.7"
+version = "0.4.8"
 
 [[package]]
 name = "uv-virtualenv"
@@ -5225,6 +5248,8 @@ dependencies = [
 name = "uv-workspace"
 version = "0.0.1"
 dependencies = [
+ "anyhow",
+ "assert_fs",
  "either",
  "fs-err",
  "glob",
@@ -5238,6 +5263,7 @@ dependencies = [
  "same-file",
  "schemars",
  "serde",
+ "tempfile",
  "thiserror",
  "tokio",
  "toml",

pkgs/by-name/uv/uv/package.nix

@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "uv";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = "refs/tags/${version}";
-    hash = "sha256-81fxSvYRr0aSUlxYklA44emfa5E4SQBENkYAKoHAStc=";
+    hash = "sha256-Rdeq6M3uZhXMALHkHEtYUr5Q1ghkfQmaBUMQGduZ5Qw=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {

pkgs/by-name/wh/when-cli/package.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  fetchCrate,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "when-cli";
+  version = "0.4.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-LWssrLl2HKul24N3bJdf2ePqeR4PCROrTiVY5sqzB2M=";
+  };
+
+  cargoHash = "sha256-9emY0yhAKVzuk1Tlzi0kW8oR9jRqLdg8wbTcJMBrxMw=";
+
+  meta = {
+    description = "Command line tool for converting between timezones";
+    homepage = "https://github.com/mitsuhiko/when";
+    mainProgram = "when";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ loicreynier ];
+  };
+}

pkgs/development/compilers/jasmin-compiler/default.nix

@@ -17,12 +17,12 @@ stdenv.mkDerivation rec {
     mpfr
     ppl
   ] ++ (with ocamlPackages; [
-    angstrom
     apron
     yojson
   ]);
 
   propagatedBuildInputs = with ocamlPackages; [
+    angstrom
     batteries
     menhirLib
     zarith

pkgs/development/libraries/ctranslate2/default.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ctranslate2";
-  version = "4.3.1";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     rev = "v${version}";
-    hash = "sha256-ApmGto9RzT8t49bsZVwk8aQnIau9sQyFvt9qnWKUGAE=";
+    hash = "sha256-E/ulk+Oo1zEP+sCKMZuMVSoO0MDjQ2opTflSwLmCJMw=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/gtk-layer-shell/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk-layer-shell";
-  version = "0.8.2";
+  version = "0.9.0";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # for demo
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "wmww";
     repo = "gtk-layer-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8wpfoZcgusJdEbKGZ02UtOOcSogMTNP9Lm+ujo/eKdA=";
+    hash = "sha256-9hQE1NY5QCuj+5R5aSjJ0DaMUQuO7HPpZooj+1+96RY=";
   };
 
   strictDeps = true;

pkgs/development/libraries/gtk4-layer-shell/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk4-layer-shell";
-  version = "1.0.2";
+  version = "1.0.3";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc";
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "wmww";
     repo = "gtk4-layer-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-decjPkFkYy7kIjyozsB7BEmw33wzq1EQyIBrxO36984=";
+    hash = "sha256-oGtU1H1waA8ZAjaLMdb+x0KIIwgjhdn38ra/eFVWfFI=";
   };
 
   strictDeps = true;

pkgs/development/libraries/intel-gmmlib/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.4.1";
+  version = "22.5.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-z8FPSqWlSubtt+gurntWnkeKsdO2B+KZXTv2Y+TL7t4=";
+    hash = "sha256-YHloVW5TtNI583GOEhx7S27jzHEVTSdbJSDOzv7KZiI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/aioairzone/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.9.0";
+  version = "0.9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone";
     rev = "refs/tags/${version}";
-    hash = "sha256-32fd4+y3EICVesrtSZUf/jYUEIqvPPnSp4hrpgXZoxU=";
+    hash = "sha256-snZtM5iDaJjqRSTf4kZVjro2k2h/b6XiT4UUCw1gF1g=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/aioautomower/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aioautomower";
-  version = "2024.8.0";
+  version = "2024.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Thomas55555";
     repo = "aioautomower";
     rev = "refs/tags/${version}";
-    hash = "sha256-FrQpRz+HESmk837L4bLDiRpJOZXstMJQ8Ic58B9Ac10=";
+    hash = "sha256-M+RiO5XTiJ1Cpmf3wbQYzcjH/VAZUlLV9ZdWJCkF6HA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bindep/default.nix

@@ -1,47 +1,49 @@
 {
   lib,
-  fetchPypi,
   buildPythonPackage,
   distro,
-  pbr,
-  setuptools,
+  fetchPypi,
   packaging,
   parsley,
+  pbr,
+  setuptools,
 }:
+
 buildPythonPackage rec {
   pname = "bindep";
   version = "2.11.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-rLLyWbzh/RUIhzR5YJu95bmq5Qg3hHamjWtqGQAufi8=";
   };
 
-  buildInputs = [
+  env.PBR_VERSION = version;
+
+  build-system = [
     distro
     pbr
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     parsley
     pbr
     packaging
     distro
   ];
 
-  patchPhase = ''
-    # Setting the pbr version will skip any version checking logic
-    # This is required because pbr thinks it gets it's own version from git tags
-    # See https://docs.openstack.org/pbr/latest/user/packagers.html
-    export PBR_VERSION=5.11.1
-  '';
+  # Checks moved to 'passthru.tests' to workaround infinite recursion
+  doCheck = false;
+
+  pythonImportsCheck = [ "bindep" ];
 
   meta = with lib; {
     description = "Bindep is a tool for checking the presence of binary packages needed to use an application / library";
     homepage = "https://docs.opendev.org/opendev/bindep/latest/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ melkor333 ];
+    mainProgram = "bindep";
+    maintainers = teams.openstack.members;
   };
 }

pkgs/development/python-modules/dissect-shellitem/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-shellitem";
-  version = "3.9";
+  version = "3.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.shellitem";
     rev = "refs/tags/${version}";
-    hash = "sha256-bkh8eiq07cspRQfs1amiyDuFmoXSBwG/fS/6nn9KV/Y=";
+    hash = "sha256-BS+c9QbMMsaoZHyuv6jMxbQFQNJeLt3da8Fq/wwXesQ=";
   };
 
   build-system = [

pkgs/development/python-modules/geoparquet/default.nix

@@ -34,7 +34,7 @@ buildPythonPackage {
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
-  pythonImportCheck = "geoparquet";
+  pythonImportsCheck = [ "geoparquet" ];
 
   doCheck = false; # no tests
 

pkgs/development/python-modules/openstackdocstheme/default.nix

@@ -6,19 +6,20 @@
   pbr,
   sphinx,
   pythonAtLeast,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "openstackdocstheme";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "3.3.0";
+  pyproject = true;
 
   # breaks on import due to distutils import through pbr.packaging
   disabled = pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PwSWLJr5Hjwz8cRXXutnE4Jc+vLcL3TJTZl6biK/4E4=";
+    hash = "sha256-wmZJmX5bQKM1uwqWxynkY5jPJaBn+Y2eqSRkE2Ub0qM=";
   };
 
   postPatch = ''
@@ -27,7 +28,9 @@ buildPythonPackage rec {
     rm test-requirements.txt
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     dulwich
     pbr
     sphinx

pkgs/development/python-modules/openstacksdk/default.nix

@@ -23,10 +23,10 @@
 
 buildPythonPackage rec {
   pname = "openstacksdk";
-  version = "3.3.0";
+  version = "4.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BghpDKN8pzMnsPo3YdF+ZTlb43/yALhzXY8kJ3tPSYA=";
+    hash = "sha256-54YN2WtwUxMJI8EdVx0lgCuWjx4xOIRct8rHxrMzv0s=";
   };
 
   postPatch = ''
@@ -44,14 +44,15 @@ buildPythonPackage rec {
       --replace-fail "'sphinxcontrib.rsvgconverter'," "#'sphinxcontrib.rsvgconverter',"
   '';
 
-  build-system = [
+  nativeBuildInputs = [
     openstackdocstheme
-    setuptools
     sphinxHook
   ];
 
   sphinxBuilders = [ "man" ];
 
+  build-system = [ setuptools ];
+
   dependencies = [
     platformdirs
     cryptography

pkgs/development/python-modules/openstacksdk/tests.nix

@@ -56,6 +56,7 @@ buildPythonPackage {
       openstack.tests.unit.image.v2.test_proxy.TestImageProxy.test_wait_for_task_wait
       openstack.tests.unit.image.v2.test_proxy.TestTask.test_wait_for_task_error_396
       openstack.tests.unit.image.v2.test_proxy.TestTask.test_wait_for_task_wait
+      openstack.tests.unit.test_resource.TestWaitForDelete.test_callback
       openstack.tests.unit.test_resource.TestWaitForDelete.test_callback_without_progress
       openstack.tests.unit.test_resource.TestWaitForDelete.test_status
       openstack.tests.unit.test_resource.TestWaitForDelete.test_success_not_found

pkgs/development/python-modules/oslo-config/default.nix

@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-config";
-  version = "9.5.0";
+  version = "9.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.config";
     inherit version;
-    hash = "sha256-qlAARIhrbFX3ZXfLWpNJKkWWxfkoM3Z2DqeFLMScmaM=";
+    hash = "sha256-nwXvcOSNmmGo0Mm+04naJPLvWonfW26N63x0HWETZn4=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyairports/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   doCheck = false;
 
-  pythonImportChecks = [ "pyairports" ];
+  pythonImportsCheck = [ "pyairports" ];
 
   meta = with lib; {
     description = "pyairports is a package which enables airport lookup by 3-letter IATA code.";

pkgs/development/python-modules/pyfunctional/default.nix

@@ -34,7 +34,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
-  pythonImportCheck = "pyfunctional";
+  pythonImportsCheck = [ "functional" ];
 
   meta = {
     description = "Python library for creating data pipelines with chain functional programming";

pkgs/development/python-modules/python-cinderclient/default.nix

@@ -4,29 +4,46 @@
   fetchPypi,
   ddt,
   keystoneauth1,
+  openstackdocstheme,
   oslo-i18n,
   oslo-serialization,
   oslo-utils,
   pbr,
   requests,
   prettytable,
+  pythonOlder,
+  reno,
   requests-mock,
+  setuptools,
   simplejson,
+  sphinxHook,
   stestr,
   stevedore,
 }:
 
 buildPythonPackage rec {
   pname = "python-cinderclient";
-  version = "9.5.0";
-  format = "setuptools";
+  version = "9.6.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G51xev+TytQgBF+2xS9jdqty8IX4GTEwiSAg7EbJNVU=";
+    hash = "sha256-P+/eJoJS5S4w/idz9lgienjG3uN4/LEy0xyG5uybojg=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    openstackdocstheme
+    reno
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     simplejson
     keystoneauth1
     oslo-i18n
@@ -45,7 +62,9 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     stestr run
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "cinderclient" ];

pkgs/development/python-modules/python-designateclient/default.nix

@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "python-designateclient";
-  version = "6.0.1";
+  version = "6.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,21 +32,24 @@ buildPythonPackage rec {
     owner = "openstack";
     repo = "python-designateclient";
     rev = version;
-    hash = "sha256-vuaouOA69REx+ZrzXjLGVz5Az1/d6x4WRT1h78xeebk=";
+    hash = "sha256-MwcpRQXH8EjWv41iHxorbFL9EpYu8qOLkDeUx6inEAU=";
   };
 
   env.PBR_VERSION = version;
 
-  build-system = [
+  nativeBuildInputs = [
     openstackdocstheme
-    pbr
-    setuptools
     sphinxHook
     sphinxcontrib-apidoc
   ];
 
   sphinxBuilders = [ "man" ];
 
+  build-system = [
+    pbr
+    setuptools
+  ];
+
   dependencies = [
     debtcollector
     jsonschema
@@ -57,8 +60,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  doCheck = true;
-
   nativeCheckInputs = [
     oslotest
     requests-mock

pkgs/development/python-modules/python-ffmpeg/default.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ pyee ];
 
   nativeBuildInputs = [ setuptools-scm ];
-  pythonImportCheck = [ "ffmpeg" ];
+  pythonImportsCheck = [ "ffmpeg" ];
 
   meta = {
     homepage = "https://github.com/jonghwanhyeon/python-ffmpeg";

pkgs/development/python-modules/python-keystoneclient/default.nix

@@ -9,6 +9,7 @@
   pbr,
   pythonOlder,
   requests-mock,
+  setuptools,
   stestr,
   testresources,
   testscenarios,
@@ -16,17 +17,19 @@
 
 buildPythonPackage rec {
   pname = "python-keystoneclient";
-  version = "5.4.0";
-  format = "setuptools";
+  version = "5.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-srS9vp2vews1O4gHZy7u0B+H3QO0+LQtDQYbCbiTH0E=";
+    hash = "sha256-wvWTT5VXaTbJjkW/WZrUi8sKxFFZPl+DROv1LLD0EfU=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     keystoneauth1
     oslo-config
     oslo-serialization
@@ -42,7 +45,9 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     stestr run
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "keystoneclient" ];

pkgs/development/python-modules/python-novaclient/default.nix

@@ -6,29 +6,43 @@
   iso8601,
   keystoneauth1,
   openssl,
+  openstackdocstheme,
   oslo-i18n,
   oslo-serialization,
   pbr,
   prettytable,
   pythonOlder,
   requests-mock,
+  setuptools,
+  sphinxcontrib-apidoc,
+  sphinxHook,
   stestr,
   testscenarios,
 }:
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.6.0";
-  format = "setuptools";
+  version = "18.7.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VzwQqkILCJjTX7FG7di7AFgGv/8BMa4rWjDKIqyJR3s=";
+    hash = "sha256-lMrQ8PTBYc7VKl7NhdE0/Wc7mX2nGUoDHAymk0Q0Cw0=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
+    openstackdocstheme
+    sphinxcontrib-apidoc
+    sphinxHook
+  ];
+
+  sphinxBuilders = [ "man" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     iso8601
     keystoneauth1
     oslo-i18n
@@ -46,12 +60,14 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
+    runHook preCheck
     stestr run -e <(echo "
     novaclient.tests.unit.test_shell.ParserTest.test_ambiguous_option
     novaclient.tests.unit.test_shell.ParserTest.test_not_really_ambiguous_option
     novaclient.tests.unit.test_shell.ShellTest.test_osprofiler
     novaclient.tests.unit.test_shell.ShellTestKeystoneV3.test_osprofiler
     ")
+    runHook postCheck
   '';
 
   pythonImportsCheck = [ "novaclient" ];

pkgs/development/python-modules/stevedore/default.nix

@@ -1,38 +1,49 @@
 {
   lib,
   buildPythonPackage,
+  callPackage,
   fetchPypi,
   pythonOlder,
   importlib-metadata,
   pbr,
   setuptools,
-  six,
 }:
 
 buildPythonPackage rec {
   pname = "stevedore";
-  version = "5.2.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.6";
+  version = "5.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rrk8pA4RFM6pPXOKbB42U5aYG7a7eMJwRbdYfJRzVE0=";
+    hash = "sha256-mmQmX0BgMSgoFRwgTvvpt6mFKg2SKHVjRNvH5AI+N1o=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
     pbr
     setuptools
-    six
-  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  ];
 
+  dependencies = [
+    importlib-metadata
+    setuptools
+  ];
+
+  # Checks moved to 'passthru.tests' to workaround infinite recursion
   doCheck = false;
+
+  passthru.tests = {
+    tests = callPackage ./tests.nix { };
+  };
+
   pythonImportsCheck = [ "stevedore" ];
 
   meta = with lib; {
     description = "Manage dynamic plugins for Python applications";
     homepage = "https://docs.openstack.org/stevedore/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fab ];
+    maintainers = teams.openstack.members ++ (with maintainers; [ fab ]);
   };
 }

pkgs/development/python-modules/stevedore/tests.nix

@@ -0,0 +1,29 @@
+{
+  buildPythonPackage,
+  docutils,
+  sphinx,
+  stestr,
+  stevedore,
+}:
+
+buildPythonPackage {
+  pname = "stevedore-tests";
+  inherit (stevedore) version src;
+  format = "other";
+
+  dontBuild = true;
+  dontInstall = true;
+
+  nativeCheckInputs = [
+    docutils
+    sphinx
+    stestr
+    stevedore
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    stestr run
+    runHook postCheck
+  '';
+}

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1227";
+  version = "3.0.1228";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-nHTsUYyGqM/4S4B8F8iz0A7MPpotTNp1S/yPL0KCkok=";
+    hash = "sha256-YNGehz2pTTJ6D2sZM95YLZ0Fr/rhcN+IsZT3mQCBgP0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/yalexs/default.nix

@@ -10,12 +10,13 @@
   freenub,
   poetry-core,
   pyjwt,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-freezegun,
   pytestCheckHook,
   python-dateutil,
   python-socketio,
   pythonOlder,
-  pytest-asyncio,
-  pytest-cov-stub,
   requests-mock,
   requests,
   typing-extensions,
@@ -23,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs";
-  version = "8.6.3";
+  version = "8.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,7 +33,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "yalexs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-z01q+sUuj9BvcN56+c3vti8xUnWhYGuV/BTXhvcTl30=";
+    hash = "sha256-KUm+e/ZrfkrS4MA0Wb3VAo9URYmC0ucKw3L+yMMoMtU=";
   };
 
   build-system = [ poetry-core ];
@@ -54,9 +55,10 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     aioresponses
     aiounittest
-    pytestCheckHook
     pytest-asyncio
     pytest-cov-stub
+    pytest-freezegun
+    pytestCheckHook
     requests-mock
   ];
 

pkgs/development/tools/bashate/default.nix

@@ -1,39 +1,42 @@
-{ lib
-, babel
-, buildPythonApplication
-, fetchPypi
-, fixtures
-, mock
-, pbr
-, pytestCheckHook
-, pythonOlder
-, setuptools
-, testtools
+{
+  lib,
+  fetchPypi,
+  python3Packages,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "bashate";
   version = "2.1.1";
-  disabled = pythonOlder "3.5";
+  pyproject = true;
+
+  disabled = python3Packages.pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-S6tul3+DBacgU1+Pk/H7QsUh/LxKbCs9PXZx9C8iH0w=";
   };
 
-  propagatedBuildInputs = [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
     babel
     pbr
     setuptools
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3Packages; [
     fixtures
     mock
-    pytestCheckHook
+    stestr
     testtools
   ];
 
+  checkPhase = ''
+    runHook preCheck
+    stestr run
+    runHook postCheck
+  '';
+
   pythonImportsCheck = [ "bashate" ];
 
   meta = with lib; {
@@ -41,6 +44,6 @@ buildPythonApplication rec {
     mainProgram = "bashate";
     homepage = "https://opendev.org/openstack/bashate";
     license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ fab ];
+    maintainers = teams.openstack.members ++ (with maintainers; [ fab ]);
   };
 }

pkgs/development/tools/coursier/default.nix

@@ -8,11 +8,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coursier";
-  version = "2.1.10";
+  version = "2.1.11";
 
   src = fetchurl {
     url = "https://github.com/coursier/coursier/releases/download/v${version}/coursier";
-    hash = "sha256-fiZwmDDuaafBbYQdOxPpTrleMLOSakCteizpKwcGStk=";
+    hash = "sha256-Gd5RM7QdFUmafr6ceQEvFjbQsWooHCiMDslG1MYFcrI=";
   };
 
   dontUnpack = true;

pkgs/development/tools/golangci-lint/default.nix

@@ -2,16 +2,16 @@
 
 buildGo123Module rec {
   pname = "golangci-lint";
-  version = "1.60.3";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-0ScdJ5td2N8WF1dwHQ3dBSjyr1kqgrzCfBzbRg9cRrw=";
+    hash = "sha256-2YzVNOdasal27R92l6eVdeS81mAp0ZU6kYsC/Jfvkcg=";
   };
 
-  vendorHash = "sha256-ixeswsfx36D0Tg103swbBD8UXXLNYbxSMYDE+JOm+uw=";
+  vendorHash = "sha256-mFDCRxbLq08yRd0ko3CCPJD2BZiCB0Gwd1g+/1oR6w8=";
 
   subPackages = [ "cmd/golangci-lint" ];
 

pkgs/development/tools/jira-cli-go/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, less, more, installShellFiles, testers, jira-cli-go, nix-update-script }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, less, more, installShellFiles, testers, jira-cli-go, nix-update-script }:
 
 buildGoModule rec {
   pname = "jira-cli-go";
@@ -34,9 +34,10 @@ buildGoModule rec {
   };
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd jira \
       --bash <($out/bin/jira completion bash) \
+      --fish <($out/bin/jira completion fish) \
       --zsh <($out/bin/jira completion zsh)
 
     $out/bin/jira man --generate --output man

pkgs/development/tools/language-servers/lua-language-server/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.10.5";
+  version = "3.10.6";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = finalAttrs.version;
-    hash = "sha256-lFNguQxrpldOE+6KrSC3QeDJzmG4Lwq92vFHjOGX9s4=";
+    hash = "sha256-K5+xGRGmd6X3eYF1BzhqFbbfVJXSduo/9930HxLGQCo=";
     fetchSubmodules = true;
   };
 

pkgs/development/tools/reno/default.nix

@@ -1,33 +1,44 @@
-{ lib
-, git
-, gnupg1
-, python3Packages
-, fetchPypi
+{
+  lib,
+  fetchPypi,
+  git,
+  gnupg1,
+  python3Packages,
 }:
 
-with python3Packages; buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "reno";
-  version = "3.1.0";
+  version = "4.1.0";
+  pyproject = true;
 
   # Must be built from python sdist because of versioning quirks
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2510e3aae4874674187f88f22f854e6b0ea1881b77039808a68ac1a5e8ee69b6";
+    hash = "sha256-+ZLx/b0WIV7J3kevCBMdU6KDDJ54Q561Y86Nan9iU3A=";
   };
 
-  propagatedBuildInputs = [
+  # remove b/c doesn't list all dependencies, and requires a few packages not in nixpkgs
+  postPatch = ''
+    rm test-requirements.txt
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
     dulwich
     pbr
     pyyaml
     setuptools  # required for finding pkg_resources at runtime
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3Packages; [
     # Python packages
-    pytestCheckHook
     docutils
     fixtures
     sphinx
+    stestr
     testtools
     testscenarios
 
@@ -36,17 +47,30 @@ with python3Packages; buildPythonApplication rec {
     gnupg1
   ];
 
-  # remove b/c doesn't list all dependencies, and requires a few packages not in nixpkgs
-  postPatch = ''
-    rm test-requirements.txt
+  checkPhase = ''
+    runHook preCheck
+    export HOME=$TMPDIR
+    stestr run -e <(echo "
+      # Expects to be run from a git repository
+      reno.tests.test_cache.TestCache.test_build_cache_db
+      reno.tests.test_semver.TestSemVer.test_major_post_release
+      reno.tests.test_semver.TestSemVer.test_major_working_and_post_release
+      reno.tests.test_semver.TestSemVer.test_major_working_copy
+      reno.tests.test_semver.TestSemVer.test_minor_post_release
+      reno.tests.test_semver.TestSemVer.test_minor_working_and_post_release
+      reno.tests.test_semver.TestSemVer.test_minor_working_copy
+      reno.tests.test_semver.TestSemVer.test_patch_post_release
+      reno.tests.test_semver.TestSemVer.test_patch_working_and_post_release
+      reno.tests.test_semver.TestSemVer.test_patch_working_copy
+      reno.tests.test_semver.TestSemVer.test_same
+      reno.tests.test_semver.TestSemVer.test_same_with_note
+    ")
+    runHook postCheck
   '';
 
-  disabledTests = [
-    "test_build_cache_db" # expects to be run from a git repository
-  ];
+  pythonImportsCheck = [ "reno" ];
 
-  # verify executable
-  postCheck = ''
+  postInstallCheck = ''
     $out/bin/reno -h
   '';
 
@@ -55,6 +79,6 @@ with python3Packages; buildPythonApplication rec {
     mainProgram = "reno";
     homepage = "https://docs.openstack.org/reno/latest";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger guillaumekoenig ];
+    maintainers = teams.openstack.members ++ (with maintainers; [ drewrisinger guillaumekoenig ]);
   };
 }

pkgs/os-specific/linux/kernel/generic.nix

@@ -230,7 +230,6 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
   passthru = previousAttrs.passthru or { } // basicArgs // {
     features = kernelFeatures;
     inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre;
-    isVanilla = !(isHardened || isLibre || isZen);
     isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
 
     # Adds dependencies needed to edit the config:

pkgs/os-specific/linux/zfs/generic.nix

@@ -203,7 +203,7 @@ let
       inherit enableMail kernelModuleAttribute;
       latestCompatibleLinuxPackages = lib.pipe linuxKernel.packages [
         builtins.attrValues
-        (builtins.filter (kPkgs: (builtins.tryEval kPkgs).success && kPkgs ? kernel && kPkgs.kernel.passthru.isVanilla && kPkgs.kernel.pname == "linux" && kernelCompatible kPkgs.kernel))
+        (builtins.filter (kPkgs: (builtins.tryEval kPkgs).success && kPkgs ? kernel && kPkgs.kernel.pname == "linux" && kernelCompatible kPkgs.kernel))
         (builtins.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)))
         lib.last
       ];

pkgs/pkgs-lib/formats/hocon/default.nix

@@ -27,13 +27,9 @@ let
   '';
 in
 {
-  # https://github.com/lightbend/config/blob/main/HOCON.md
   format = {
     generator ? hocon-generator
     , validator ? hocon-validator
-    # `include classpath("")` is not implemented in pyhocon.
-    # In the case that you need this functionality,
-    # you will have to disable pyhocon validation.
     , doCheck ? true
   }: let
     hoconLib = {

pkgs/pkgs-lib/formats/libconfig/default.nix

@@ -3,14 +3,6 @@
 }:
 let
   inherit (pkgs) buildPackages callPackage;
-  # Implementation notes:
-  #   Libconfig spec: https://hyperrealm.github.io/libconfig/libconfig_manual.html
-  #
-  #   Since libconfig does not allow setting names to start with an underscore,
-  #   this is used as a prefix for both special types and include directives.
-  #
-  #   The difference between 32bit and 64bit values became optional in libconfig
-  #   1.5, so we assume 64bit values for all numbers.
 
   libconfig-generator = buildPackages.rustPlatform.buildRustPackage {
     name = "libconfig-generator";

pkgs/servers/web-apps/livebook/default.nix

@@ -1,7 +1,7 @@
 { lib, beamPackages, makeWrapper, rebar3, elixir, erlang, fetchFromGitHub, nixosTests }:
 beamPackages.mixRelease rec {
   pname = "livebook";
-  version = "0.13.3";
+  version = "0.14.0";
 
   inherit elixir;
 
@@ -13,13 +13,13 @@ beamPackages.mixRelease rec {
     owner = "livebook-dev";
     repo = "livebook";
     rev = "v${version}";
-    hash = "sha256-luvqH6fjovRhVQrsP00XLSQ/rjHZgUbUWmL2B5XCyKI=";
+    hash = "sha256-8z6t7AzOPS7zxNdS5+qGE1DpvhWNbHnDLCta7igA5vY=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-/U/UmNVtl7H0rdgXpibM/bYvRbio8WzVRTv4tQ7GQcY=";
+    hash = "sha256-7avxuqbZtNWgUfalbq/OtggmUI/4QK+S792iqcCjRHM=";
   };
 
   postInstall = ''

pkgs/tools/networking/htpdate/default.nix

@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.7";
+  version = "2.0.0";
   pname = "htpdate";
 
   src = fetchFromGitHub {
     owner = "twekkel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XdqQQw87gvWvdx150fQhnCio478PNCQBMw/g/l/T1ZA=";
+    sha256 = "sha256-X7r95Uc4oGB0eVum5D7pC4tebZIyyz73g6Q/D0cjuFM=";
   };
 
   makeFlags = [

pkgs/tools/networking/veilid/default.nix

@@ -9,6 +9,7 @@
 , cmake
 , testers
 , veilid
+, gitUpdater
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -54,9 +55,12 @@ rustPlatform.buildRustPackage rec {
     moveToOutput "lib" "$lib"
   '';
 
-  passthru.tests = {
-    veilid-version = testers.testVersion {
-      package = veilid;
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
+    tests = {
+      veilid-version = testers.testVersion {
+        package = veilid;
+      };
     };
   };
 

pkgs/tools/package-management/nfpm/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.39.0";
+  version = "2.40.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0afwPA4OIIBYxXwkdm36JmVXDJ+gqESOPjEp5Tkxxa8=";
+    hash = "sha256-hBA15pHCYgBKTeHBVBZkhPqoMnDkd13wx9afygTDPWk=";
   };
 
-  vendorHash = "sha256-LJM9F9NTAMvDwsaRvjnZyjKSI0AjZvVM4srOYuGLA7w=";
+  vendorHash = "sha256-d4MuoKc7LF5KCXhLxIwuqS2Xu7ClLhyJZH4/+/LYm3w=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 

pkgs/tools/package-management/nix/common.nix

@@ -243,6 +243,9 @@ self = stdenv.mkDerivation {
   # See https://github.com/NixOS/nix/issues/5687
   + lib.optionalString (atLeast25 && stdenv.isDarwin) ''
     echo "exit 99" > tests/gc-non-blocking.sh
+  '' # TODO: investigate why this broken
+  + lib.optionalString (atLeast25 && stdenv.hostPlatform.system == "aarch64-linux") ''
+    echo "exit 0" > tests/functional/flakes/show.sh
   '' + ''
     # nixStatic otherwise does not find its man pages in tests.
     export MANPATH=$man/share/man:$MANPATH

pkgs/tools/package-management/nix/default.nix

@@ -184,9 +184,9 @@ in lib.makeExtensible (self: ({
     self_attribute_name = "nix_2_23";
   };
 
-  nix_2_24 = ((common {
-    version = "2.24.5";
-    hash = "sha256-mYvdPwl4gcc17UAomkbbOJEgxBQpowmJDrRMWtlYzFY=";
+  nix_2_24 = (common {
+    version = "2.24.6";
+    hash = "sha256-kgq3B+olx62bzGD5C6ighdAoDweLq+AebxVHcDnKH4w=";
     self_attribute_name = "nix_2_24";
   }).override (lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
     # Fix the following error with the default x86_64-darwin SDK:
@@ -197,20 +197,16 @@ in lib.makeExtensible (self: ({
     # allocation function Clang uses with this setting actually works
     # all the way back to 10.6.
     stdenv = overrideSDK stdenv { darwinMinVersion = "10.13"; };
-  })).overrideAttrs (o: {
-    meta.knownVulnerabilities = [
-      "Nix >= 2.24.0 and master have a vulnerability. Please downgrade from nix_2_24 to nix_2_23"
-    ];
   });
 
-  git = ((common rec {
+  git = (common rec {
     version = "2.25.0";
-    suffix = "pre20240807_${lib.substring 0 8 src.rev}";
+    suffix = "pre20240910_${lib.substring 0 8 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "cfe66dbec325d5dcb601b642bd9c149ae1353147";
-      hash = "sha256-1hqjl4br3MRK1pkzDrhBSxKUhdfQ/P4b5KbLfGua64g=";
+      rev = "b9d3cdfbd2b873cf34600b262247d77109dfd905";
+      hash = "sha256-7zH8TU5g3Bsg6ES0O8RcTm6JGYOMuDCGlSI3AQKbKy8=";
     };
     self_attribute_name = "git";
   }).override (lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
@@ -222,13 +218,9 @@ in lib.makeExtensible (self: ({
     # allocation function Clang uses with this setting actually works
     # all the way back to 10.6.
     stdenv = overrideSDK stdenv { darwinMinVersion = "10.13"; };
-  })).overrideAttrs (o: {
-    meta.knownVulnerabilities = [
-      "Nix >= 2.24.0 and master have a vulnerability. Please downgrade from nixVersions.git to nixVersions.nix_2_23"
-    ];
   });
 
-  latest = self.nix_2_23;
+  latest = self.nix_2_24;
 
   # The minimum Nix version supported by Nixpkgs
   # Note that some functionality *might* have been backported into this Nix version,

pkgs/top-level/aliases.nix

@@ -1466,6 +1466,7 @@ mapAliases ({
   spotify-unwrapped = spotify; # added 2022-11-06
   spring-boot = spring-boot-cli; # added 2020-04-24
   squid4 = throw "'squid4' has been renamed to/replaced by 'squid'"; # Converted to throw 2023-09-10
+  srvc = throw "'srvc' has been removed, as it was broken and unmaintained"; # Added 2024-09-09
   ssb = throw "'ssb' has been removed, as it was broken and unmaintained"; # Added 2023-12-21
   ssm-agent = amazon-ssm-agent; # Added 2023-10-17
   starboard-octant-plugin = throw "starboard-octant-plugin has been dropped due to needing octant which is archived"; # Added 2023-09-29

pkgs/top-level/all-packages.nix

@@ -3369,7 +3369,9 @@ with pkgs;
 
   base16384 = callPackage ../tools/text/base16384 { };
 
-  bashate = python3Packages.callPackage ../development/tools/bashate { };
+  bashate = python3Packages.callPackage ../development/tools/bashate {
+    python3Packages = python311Packages;
+  };
 
   bash-my-aws = callPackage ../tools/admin/bash-my-aws { };
 
@@ -3791,8 +3793,8 @@ with pkgs;
   lesspass-cli = callPackage ../tools/security/lesspass-cli { };
 
   livebook = callPackage ../servers/web-apps/livebook {
-    elixir = elixir_1_16;
-    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_16; });
+    elixir = elixir_1_17;
+    beamPackages = beamPackages.extend (self: super: { elixir = elixir_1_17; });
   };
 
   lsix = callPackage ../tools/graphics/lsix { };
@@ -6000,8 +6002,6 @@ with pkgs;
 
   spacevim = callPackage ../applications/editors/spacevim { };
 
-  srvc = callPackage ../applications/version-management/srvc { };
-
   ssmsh = callPackage ../tools/admin/ssmsh { };
 
   stacs = callPackage ../tools/security/stacs { };
@@ -18713,7 +18713,9 @@ with pkgs;
 
   regex-cli = callPackage ../development/tools/misc/regex-cli { };
 
-  reno = callPackage ../development/tools/reno { };
+  reno = callPackage ../development/tools/reno {
+    python3Packages = python311Packages;
+  };
 
   re2c = callPackage ../development/tools/parsing/re2c { };
 
@@ -30569,9 +30571,7 @@ with pkgs;
 
   hydroxide = callPackage ../applications/networking/hydroxide { };
 
-  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
-    protobuf = protobuf_21;
-  };
+  hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng { };
 
   hyperledger-fabric = callPackage ../tools/misc/hyperledger-fabric { };