Merge master into staging-next

maintainers/maintainer-list.nix

@@ -5479,6 +5479,11 @@
     githubId = 2430469;
     name = "Gavin Rogers";
   };
+  gaykitty = {
+    github = "gaykitty";
+    githubId = 126119280;
+    name = "Kitty Pride";
+  };
   gazally = {
     email = "gazally@runbox.com";
     github = "gazally";
@@ -6902,6 +6907,12 @@
     githubId = 6874204;
     name = "Jason Carr";
   };
+  jasonodoom = {
+    email = "jasonodoom@riseup.net";
+    github = "jasonodoom";
+    githubId = 6789916;
+    name = "Jason Odoom";
+  };
   javaguirre = {
     email = "contacto@javaguirre.net";
     github = "javaguirre";

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -137,7 +137,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.
 
-- The `services.kubo.settings` option is now no longer stateful. If you changed any of the options in `services.kubo.settings` in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
+- The [services.kubo.settings](#opt-services.kubo.settings) option is now no longer stateful. If you changed any of the options in [services.kubo.settings](#opt-services.kubo.settings) in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
+
+- The Kubo HTTP API will no longer listen on localhost and will instead only listen on a Unix domain socket by default. Read the [services.kubo.settings.Addresses.API](#opt-services.kubo.settings.Addresses.API) option description for more information.
 
 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
   This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
@@ -340,7 +342,7 @@ In addition to numerous new and upgraded packages, this release has the followin
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
-- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when 'autoMount` is enabled.
+- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when `autoMount` is enabled.
 
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 

nixos/modules/programs/regreet.nix

@@ -50,7 +50,7 @@ in
   config = lib.mkIf cfg.enable {
     services.greetd = {
       enable = lib.mkDefault true;
-      settings.default_session.command = lib.mkDefault "${lib.getExe pkgs.cage} -s -- ${lib.getExe cfg.package}";
+      settings.default_session.command = lib.mkDefault "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe cfg.package}";
     };
 
     environment.etc = {

nixos/modules/programs/zsh/zsh.nix

@@ -236,6 +236,9 @@ in
           setopt ${concatStringsSep " " cfg.setOptions}
         ''}
 
+        # Alternative method of determining short and full hostname.
+        HOST=${config.networking.fqdnOrHostName}
+
         # Setup command line history.
         # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.
         SAVEHIST=${toString cfg.histSize}

nixos/modules/services/mail/roundcube.nix

@@ -7,7 +7,7 @@ let
   fpm = config.services.phpfpm.pools.roundcube;
   localDB = cfg.database.host == "localhost";
   user = cfg.database.username;
-  phpWithPspell = pkgs.php80.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
+  phpWithPspell = pkgs.php81.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
 in
 {
   options.services.roundcube = {

nixos/modules/services/network-filesystems/kubo.nix

@@ -22,6 +22,18 @@ let
 
   configFile = settingsFormat.generate "kubo-config.json" customizedConfig;
 
+  # Create a fake repo containing only the file "api".
+  # $IPFS_PATH will point to this directory instead of the real one.
+  # For some reason the Kubo CLI tools insist on reading the
+  # config file when it exists. But the Kubo daemon sets the file
+  # permissions such that only the ipfs user is allowed to read
+  # this file. This prevents normal users from talking to the daemon.
+  # To work around this terrible design, create a fake repo with no
+  # config file, only an api file and everything should work as expected.
+  fakeKuboRepo = pkgs.writeTextDir "api" ''
+    /unix/run/ipfs.sock
+  '';
+
   kuboFlags = utils.escapeSystemdExecArgs (
     optional cfg.autoMount "--mount" ++
     optional cfg.enableGC "--enable-gc" ++
@@ -38,6 +50,22 @@ let
 
   splitMulitaddr = addrRaw: lib.tail (lib.splitString "/" addrRaw);
 
+  multiaddrsToListenStreams = addrIn:
+    let
+      addrs = if builtins.typeOf addrIn == "list"
+      then addrIn else [ addrIn ];
+      unfilteredResult = map multiaddrToListenStream addrs;
+    in
+      builtins.filter (addr: addr != null) unfilteredResult;
+
+  multiaddrsToListenDatagrams = addrIn:
+    let
+      addrs = if builtins.typeOf addrIn == "list"
+      then addrIn else [ addrIn ];
+      unfilteredResult = map multiaddrToListenDatagram addrs;
+    in
+      builtins.filter (addr: addr != null) unfilteredResult;
+
   multiaddrToListenStream = addrRaw:
     let
       addr = splitMulitaddr addrRaw;
@@ -154,13 +182,18 @@ in
 
           options = {
             Addresses.API = mkOption {
-              type = types.str;
-              default = "/ip4/127.0.0.1/tcp/5001";
-              description = lib.mdDoc "Where Kubo exposes its API to";
+              type = types.oneOf [ types.str (types.listOf types.str) ];
+              default = [ ];
+              description = lib.mdDoc ''
+                Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on.
+                In addition to the multiaddrs listed here, the daemon will also listen on a Unix domain socket.
+                To allow the ipfs CLI tools to communicate with the daemon over that socket,
+                add your user to the correct group, e.g. `users.users.alice.extraGroups = [ config.services.kubo.group ];`
+              '';
             };
 
             Addresses.Gateway = mkOption {
-              type = types.str;
+              type = types.oneOf [ types.str (types.listOf types.str) ];
               default = "/ip4/127.0.0.1/tcp/8080";
               description = lib.mdDoc "Where the IPFS Gateway can be reached";
             };
@@ -248,7 +281,7 @@ in
     ];
 
     environment.systemPackages = [ cfg.package ];
-    environment.variables.IPFS_PATH = cfg.dataDir;
+    environment.variables.IPFS_PATH = fakeKuboRepo;
 
     # https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size
     boot.kernel.sysctl."net.core.rmem_max" = mkDefault 2500000;
@@ -338,27 +371,23 @@ in
       wantedBy = [ "sockets.target" ];
       socketConfig = {
         ListenStream =
-          let
-            fromCfg = multiaddrToListenStream cfg.settings.Addresses.Gateway;
-          in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+          [ "" ] ++ (multiaddrsToListenStreams cfg.settings.Addresses.Gateway);
         ListenDatagram =
-          let
-            fromCfg = multiaddrToListenDatagram cfg.settings.Addresses.Gateway;
-          in
-          [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+          [ "" ] ++ (multiaddrsToListenDatagrams cfg.settings.Addresses.Gateway);
       };
     };
 
     systemd.sockets.ipfs-api = {
       wantedBy = [ "sockets.target" ];
-      # We also include "%t/ipfs.sock" because there is no way to put the "%t"
-      # in the multiaddr.
-      socketConfig.ListenStream =
-        let
-          fromCfg = multiaddrToListenStream cfg.settings.Addresses.API;
-        in
-        [ "" "%t/ipfs.sock" ] ++ lib.optional (fromCfg != null) fromCfg;
+      socketConfig = {
+        # We also include "%t/ipfs.sock" because there is no way to put the "%t"
+        # in the multiaddr.
+        ListenStream =
+          [ "" "%t/ipfs.sock" ] ++ (multiaddrsToListenStreams cfg.settings.Addresses.API);
+        SocketMode = "0660";
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+      };
     };
   };
 

nixos/tests/all-tests.nix

@@ -359,7 +359,7 @@ in {
   ksm = handleTest ./ksm.nix {};
   kthxbye = handleTest ./kthxbye.nix {};
   kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};
-  kubo = handleTest ./kubo.nix {};
+  kubo = runTest ./kubo.nix;
   ladybird = handleTest ./ladybird.nix {};
   languagetool = handleTest ./languagetool.nix {};
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };

nixos/tests/kubo.nix

@@ -1,10 +1,10 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+{ lib, ...} : {
   name = "kubo";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mguentner ];
+  meta = with lib.maintainers; {
+    maintainers = [ mguentner Luflosi ];
   };
 
-  nodes.machine = { ... }: {
+  nodes.machine = { config, ... }: {
     services.kubo = {
       enable = true;
       # Also will add a unix domain socket socket API address, see module.
@@ -12,58 +12,74 @@ import ./make-test-python.nix ({ pkgs, ...} : {
       settings.Addresses.API = "/ip4/127.0.0.1/tcp/2324";
       dataDir = "/mnt/ipfs";
     };
+    users.users.alice = {
+      isNormalUser = true;
+      extraGroups = [ config.services.kubo.group ];
+    };
   };
 
-  nodes.fuse = { ... }: {
+  nodes.fuse = { config, ... }: {
     services.kubo = {
       enable = true;
-      settings.Addresses.API = "/ip4/127.0.0.1/tcp/2324";
       autoMount = true;
     };
+    users.users.alice = {
+      isNormalUser = true;
+      extraGroups = [ config.services.kubo.group ];
+    };
+    users.users.bob = {
+      isNormalUser = true;
+    };
   };
 
   testScript = ''
     start_all()
 
-    # IPv4 activation
-
-    machine.succeed("ipfs --api /ip4/127.0.0.1/tcp/2324 id")
-    ipfs_hash = machine.succeed(
-        "echo fnord | ipfs --api /ip4/127.0.0.1/tcp/2324 add | awk '{ print $2 }'"
-    )
-
-    machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord")
-
-    # Unix domain socket activation
+    with subtest("Automatic socket activation"):
+        ipfs_hash = machine.succeed(
+            "echo fnord0 | su alice -l -c 'ipfs add --quieter'"
+        )
+        machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord0")
 
     machine.stop_job("ipfs")
 
-    ipfs_hash = machine.succeed(
-        "echo fnord2 | ipfs --api /unix/run/ipfs.sock add | awk '{ print $2 }'"
-    )
-    machine.succeed(
-        f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
-    )
+    with subtest("IPv4 socket activation"):
+        machine.succeed("ipfs --api /ip4/127.0.0.1/tcp/2324 id")
+        ipfs_hash = machine.succeed(
+            "echo fnord | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter"
+        )
+        machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord")
 
-    # Test if setting dataDir works properly with the hardened systemd unit
-    machine.succeed("test -e /mnt/ipfs/config")
-    machine.succeed("test ! -e /var/lib/ipfs/")
+    machine.stop_job("ipfs")
 
-    # Test FUSE mountpoint
-    # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
-    # See https://github.com/ipfs/kubo/issues/9044.
-    # Workaround: using CID Version 1 avoids that.
-    ipfs_hash = fuse.succeed(
-        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter --cid-version=1"
-    ).strip()
+    with subtest("Unix domain socket activation"):
+        ipfs_hash = machine.succeed(
+            "echo fnord2 | ipfs --api /unix/run/ipfs.sock add --quieter"
+        )
+        machine.succeed(
+            f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
+        )
 
-    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+    with subtest("Setting dataDir works properly with the hardened systemd unit"):
+        machine.succeed("test -e /mnt/ipfs/config")
+        machine.succeed("test ! -e /var/lib/ipfs/")
 
-    # Force Kubo to crash and wait for it to restart
-    # Tests the unmounting of /ipns and /ipfs
-    fuse.systemctl("kill --signal=SIGKILL ipfs.service")
-    fuse.wait_for_unit("ipfs.service", timeout = 30)
+    with subtest("FUSE mountpoint"):
+        fuse.fail("echo a | su bob -l -c 'ipfs add --quieter'")
+        # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
+        # See https://github.com/ipfs/kubo/issues/9044.
+        # Workaround: using CID Version 1 avoids that.
+        ipfs_hash = fuse.succeed(
+            "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
+        ).strip()
 
-    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+
+    with subtest("Unmounting of /ipns and /ipfs"):
+        # Force Kubo to crash and wait for it to restart
+        fuse.systemctl("kill --signal=SIGKILL ipfs.service")
+        fuse.wait_for_unit("ipfs.service", timeout = 30)
+
+        fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
   '';
-})
+}

pkgs/applications/misc/gallery-dl/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.25.1";
+  version = "1.25.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-us9lzchdsCD4sY4XQ1f4j3wKuFtEZnEuBrlSa3FpDP4=";
+    sha256 = "sha256-T9PzvjOdcLaO7iTxBZxucQdiAPVpk1+9wDfcpShIBdM=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/shavee/default.nix

@@ -0,0 +1,39 @@
+{ lib, pkgs, rustPlatform, fetchFromGitHub, pkg-config, openssl, zlib,stdenv, pam }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "shavee";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "ashuio";
+    repo = "shavee";
+    rev = "v${version}";
+    sha256 = "sha256-41wJ3QBZdmCl7v/6JetXhzH2zF7tsKYMKZY1cKhByX8=";
+  };
+
+  cargoSha256 = "sha256-iNGn5KknSNgazFSu6Nur7AkKVb6qKMxuFwTdCz5djWU=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    zlib
+    pam
+  ];
+
+   # these tests require network access
+  checkFlags = [
+    "--skip=filehash::tests::remote_file_hash"
+    "--skip=filehash::tests::get_filehash_unit_test"
+  ];
+
+  meta = with lib; {
+    description = "A Program to automatically decrypt and mount ZFS datasets using Yubikey HMAC as 2FA or any File on USB/SFTP/HTTPS.";
+    homepage = "https://github.com/ashuio/shavee";
+    license = licenses.mit;
+    maintainers = with maintainers; [jasonodoom];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "112.0.5615.49",
-    "sha256": "0hgzbbmz40235binfn3vkkxzvwxilaxg04dclqrz980z7hvkgzfx",
-    "sha256bin64": "0jq5pbyayk8pa9ksxp2dk3k7j2jic506mfpkq1a1z48j1l4fkr5i",
+    "version": "112.0.5615.121",
+    "sha256": "1qbsgcsw3jgy9b76i8ypiq91fkm9zy1hy77l52w2xbw53ghjfwlw",
+    "sha256bin64": "1zh674vpczs1nyzbijpcgs2j2r0hdgp7bkwyn5l8w1hcj6az6k3n",
     "deps": {
       "gn": {
         "version": "2023-02-17",
@@ -12,16 +12,16 @@
       }
     },
     "chromedriver": {
-      "version": "112.0.5615.28",
-      "sha256_linux": "13i2y1zd3dxjvs9575m00gg8xxll1g08sn7dayl7l8qr3zy74p98",
-      "sha256_darwin": "0mw8h7ijc0nf7c2j731w30ajh6djy1lk6nak81fpksgk98vkv64f",
-      "sha256_darwin_aarch64": "103b3n7vxqvim4ks8vi5b29d41wdldkj1rz94fnqvgw04lykm9sk"
+      "version": "112.0.5615.49",
+      "sha256_linux": "0acp7hck7p9v1ysyzdyyrj43z2azlj35l8sw2f8fn5nfbl4bsbkf",
+      "sha256_darwin": "14205fqfinlqw9kbs2p6pzb666mnz8rbfim1crpdkzsrfn5dlb9h",
+      "sha256_darwin_aarch64": "17v9k9k5p3rwq1i58xw19p93hzirp0r0aiq5s3gc20i7ka3bk1xj"
     }
   },
   "beta": {
-    "version": "113.0.5672.24",
-    "sha256": "1z7yv5lqi1n4ycymkf0kz1v8ig06n430a37ik8hri3a6db8r9lv8",
-    "sha256bin64": "1y9jaw47dgphqr2l8yc36s7k9lf4qrbmfll1d2d1zdjd5ma3slab",
+    "version": "113.0.5672.37",
+    "sha256": "0hmn7h5l8q161f6hwp5g7zbxfdsplwqh5j3yby56qgljgca8pj7f",
+    "sha256bin64": "0j4hl2sbh8cig00rpn4ssxi2087wr33749b5sdcrk93kfzqinrix",
     "deps": {
       "gn": {
         "version": "2023-03-18",
@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "112.0.5615.50",
-    "sha256": "006x62z7cpb2aqi2q67l1n3nq1wyrmdgdnkdc46xjw751jax8h8j",
-    "sha256bin64": null,
+    "version": "112.0.5615.121",
+    "sha256": "1qbsgcsw3jgy9b76i8ypiq91fkm9zy1hy77l52w2xbw53ghjfwlw",
+    "sha256bin64": "1zh674vpczs1nyzbijpcgs2j2r0hdgp7bkwyn5l8w1hcj6az6k3n",
     "deps": {
       "gn": {
         "version": "2023-02-17",
@@ -56,8 +56,8 @@
         "sha256": "075p4jwk1apvwmqmvhwfw5f669ci7nxwjq9mz5aa2g5lz4fkdm4c"
       },
       "ungoogled-patches": {
-        "rev": "112.0.5615.50-1",
-        "sha256": "0axz76hbcc5h6gqv41yxd0yy9vcldps5xn9ffx98iyzghi76z1sa"
+        "rev": "112.0.5615.121-1",
+        "sha256": "1zdk0sn84sj5zwcjjxikm0sc8mfpw0gri6w1fmpcbwyqawwjmi4f"
       }
     }
   }

pkgs/applications/networking/cluster/pachyderm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.5.2";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-COtOYR1toSr+oiRZ5Hfbgfy2InF9jFThT0ozwrcSVio=";
+    hash = "sha256-VYHSExQDIyK86kCz3gzIR+Q5iYrhkAPx56vST73vPOo=";
   };
 
   vendorHash = "sha256-XmIPifozTYd1rV2wm0dU0GPvg/+HFoSLGHB6DDrkzVc=";

pkgs/applications/networking/cluster/stern/default.nix

@@ -1,7 +1,5 @@
 { stdenv, lib, buildPackages, buildGoModule, fetchFromGitHub, installShellFiles }:
-let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 
-in
 buildGoModule rec {
   pname = "stern";
   version = "1.24.0";
@@ -19,12 +17,11 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  ldflags =
-    [ "-s" "-w" "-X github.com/stern/stern/cmd.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/stern/stern/cmd.version=${version}" ];
 
-  postInstall =
-    let stern = if isCrossBuild then buildPackages.stern else "$out";
-    in
+  postInstall = let
+    stern = if stdenv.buildPlatform.canExecute stdenv.hostPlatform then "$out" else buildPackages.stern;
+  in
     ''
       for shell in bash zsh; do
         ${stern}/bin/stern --completion $shell > stern.$shell

pkgs/applications/networking/flexget/default.nix

@@ -19,7 +19,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.6.0";
+  version = "3.6.3";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -27,7 +27,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VsXiWsvEjRhWckwqHcUPx2B9mwOUmRLLHIM5ALoW9GI=";
+    hash = "sha256-Z1tiIs4NHHsWa7agAl1dnwliQbgFEl/SPT6QLQkqTVA=";
   };
 
   postPatch = ''

pkgs/applications/virtualization/podman/default.nix

@@ -15,6 +15,7 @@
 , nixosTests
 , python3
 , makeWrapper
+, runtimeShell
 , symlinkJoin
 , extraPackages ? [ ]
 , runc
@@ -61,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.4.4";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-rLXq+sveSxeoD3gyXSnfgGFx6alOBKSRCdDHGwwvPm4=";
+    hash = "sha256-udvvTdkpL8xvY0iIMBgBFQk5sybpn9vCFFXP0ZqOajM=";
   };
 
   patches = [
@@ -99,6 +100,7 @@ buildGoModule rec {
   buildPhase = ''
     runHook preBuild
     patchShebangs .
+    substituteInPlace Makefile --replace "/bin/bash" "${runtimeShell}"
     ${if stdenv.isDarwin then ''
       make podman-remote # podman-mac-helper uses FHS paths
     '' else ''

pkgs/development/compilers/openjdk/13.nix

@@ -61,6 +61,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="

pkgs/development/compilers/openjdk/14.nix

@@ -56,6 +56,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="

pkgs/development/compilers/openjdk/15.nix

@@ -59,6 +59,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-pre="

pkgs/development/compilers/openjdk/16.nix

@@ -61,6 +61,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"

pkgs/development/compilers/openjdk/17.nix

@@ -78,6 +78,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"

pkgs/development/compilers/openjdk/18.nix

@@ -68,6 +68,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"

pkgs/development/compilers/openjdk/19.nix

@@ -80,6 +80,11 @@ let
       patchShebangs --build configure
     '';
 
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
     configureFlags = [
       "--with-boot-jdk=${openjdk-bootstrap.home}"
       "--with-version-build=${version.build}"

pkgs/development/coq-modules/LibHyps/default.nix

@@ -4,7 +4,7 @@ mkCoqDerivation {
   pname = "LibHyps";
   owner = "Matafou";
   inherit version;
-  defaultVersion = if (lib.versions.range "8.11" "8.16") coq.version then "2.0.4.1" else null;
+  defaultVersion = if (lib.versions.range "8.11" "8.17") coq.version then "2.0.4.1" else null;
   release = {
     "2.0.4.1".sha256 = "09p89701zhrfdmqlpxw3mziw8yylj1w1skb4b0xpbdwd1vsn4k3h";
   };

pkgs/development/coq-modules/addition-chains/default.nix

@@ -12,7 +12,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.13" "8.16"; out = "0.6"; }
+    { case = range "8.13" "8.17"; out = "0.6"; }
     { case = range "8.11" "8.12"; out = "0.4"; }
   ] null;
 

pkgs/development/coq-modules/category-theory/default.nix

@@ -17,7 +17,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.16"; out = "1.0.0"; }
+    { case = range "8.14" "8.17"; out = "1.0.0"; }
     { case = range "8.10" "8.15"; out = "20211213"; }
     { case = range "8.8" "8.9"; out = "20190414"; }
     { case = range "8.6" "8.7"; out = "20180709"; }

pkgs/development/coq-modules/coq-record-update/default.nix

@@ -5,7 +5,7 @@
   owner = "tchajed";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.10" "8.16";  out = "0.3.1"; }
+    { case = range "8.10" "8.17";  out = "0.3.1"; }
   ] null;
   release."0.3.1".sha256 = "sha256-DyGxO2tqmYZZluXN6Oy5Tw6fuLMyuyxonj8CCToWKkk=";
   release."0.3.0".sha256 = "1ffr21dd6hy19gxnvcd4if2450iksvglvkd6q5713fajd72hmc0z";

pkgs/development/coq-modules/metalib/default.nix

@@ -5,7 +5,7 @@ mkCoqDerivation {
   owner = "plclub";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.16"; out = "8.15"; }
+    { case = range "8.14" "8.17"; out = "8.15"; }
     { case = range "8.10" "8.13"; out = "8.10"; }
   ] null;
   releaseRev = v: "coq${v}";

pkgs/development/coq-modules/semantics/default.nix

@@ -15,7 +15,7 @@ mkCoqDerivation rec {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.10" "8.16"; out = "8.14.0"; }
+    { case = range "8.10" "8.17"; out = "8.14.0"; }
     { case = "8.9"; out = "8.9.0"; }
     { case = "8.8"; out = "8.8.0"; }
     { case = "8.7"; out = "8.7.0"; }

pkgs/development/coq-modules/trakt/default.nix

@@ -9,7 +9,7 @@ mkCoqDerivation {
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version ] [
-    { cases = [ (range "8.13" "8.16") ]; out = "1.0"; }
+    { cases = [ (range "8.13" "8.17") ]; out = "1.0"; }
   ] null;
 
   propagatedBuildInputs = [ coq-elpi ];

pkgs/development/misc/datafusion/default.nix

@@ -7,17 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "datafusion-cli";
-  version = "15.0.0";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
+    name = "datafusion-cli-source";
     owner = "apache";
     repo = "arrow-datafusion";
     rev = version;
-    sha256 = "sha256-s+gQoczTesJGOpz4W5hBPDdxo4eQnf+D10+V2kx65Io=";
+    sha256 = "sha256-TWvbtuLmAdYS8otD2TpVlZx2FJS6DF03U2zM28FNsfc=";
   };
-  sourceRoot = "source/datafusion-cli";
 
-  cargoSha256 = "sha256-w+/5Ig+U8y4nwu7QisnZvc3UlZaEU/kovV6birOWndE=";
+  sourceRoot = "datafusion-cli-source/datafusion-cli";
+
+  cargoSha256 = "sha256-muWWVJDKm4rbpCK0SS7Zj6umFoMKGMScEAd2ZyZ5An8=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
@@ -26,6 +28,8 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # fails even outside the Nix sandbox
     "--skip=object_storage::tests::s3_region_validation"
+    # broken
+    "--skip=exec::tests::create_object_store_table_gcs"
   ];
 
   meta = with lib; {

pkgs/development/nim-packages/illwillwidgets/default.nix

@@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "illwillwidgets";
+  version = "0.1.11";
+
+  src = fetchFromGitHub {
+    owner = "enthus1ast";
+    repo = "illwillWidgets";
+    rev = "04f507cfd651df430b1421403b3a70cb061c4624";
+    hash = "sha256-YVNdgs8jquJ58qbcyNMMJt+hJYcvahYpkSrDBbO4ILU=";
+  };
+
+  meta = with lib;
+    src.meta // {
+      description = "Mouse enabled widgets for illwill";
+
+      license = [ licenses.mit ];
+      maintainers = with maintainers; [ marcusramberg ];
+    };
+}

pkgs/development/python-modules/datafusion/default.nix

@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, fetchurl
 , buildPythonPackage
 , fetchPypi
 , fetchFromGitHub
@@ -8,39 +7,45 @@
 , pytestCheckHook
 , libiconv
 , numpy
-, pandas
+, protobuf
 , pyarrow
 }:
 
 let
   arrow-testing = fetchFromGitHub {
+    name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "5bab2f264a23f5af68f69ea93d24ef1e8e77fc88";
-    hash = "sha256-Pxx8ohUpXb5u1995IvXmxQMqWiDJ+7LAll/AjQP7ph8=";
+    rev = "47f7b56b25683202c1fd957668e13f2abafc0f12";
+    hash = "sha256-ZDznR+yi0hm5O1s9as8zq5nh1QxJ8kXCRwbNQlzXpnI=";
   };
 
   parquet-testing = fetchFromGitHub {
+    name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "5b82793ef7196f7b3583e85669ced211cd8b5ff2";
-    hash = "sha256-gcOvk7qFHZgJWE9CpucC8zwayYw47VbC3lmSRu4JQFg=";
+    rev = "b2e7cc755159196e3a068c8594f7acbaecfdaaac";
+    hash = "sha256-IFvGTOkaRSNgZOj8DziRj88yH5JRF+wgSDZ5N0GNvjk=";
   };
 in
 
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "0.7.0";
+  version = "22.0.0";
   format = "pyproject";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-XYXZMorPs2Ue7E38DASd4rmxvX0wlx8A6sCpAbYUh4I=";
+  src = fetchFromGitHub {
+    name = "datafusion-source";
+    owner = "apache";
+    repo = "arrow-datafusion-python";
+    rev = "22.0.0";
+    hash = "sha256-EKurQ4h5IOTU3JiGN+MHrDciQUadUrywNRhnv9S/9iY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
+    name = "datafusion-cargo-deps";
     inherit src pname version;
-    hash = "sha256-6mPdKwsEN09Gf4eNsd/v3EBHVezHmff/KYB2lsXgzcA=";
+    hash = "sha256-0kfavTFqsQ1Uvg5nQw6VFGlvih8ysOyS2KGT4cTIsVI=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -48,15 +53,11 @@ buildPythonPackage rec {
     maturinBuildHook
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  propagatedBuildInputs = [
-    numpy
-    pandas
-    pyarrow
-  ];
+  propagatedBuildInputs = [ pyarrow ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ pytestCheckHook numpy ];
   pythonImportsCheck = [ "datafusion" ];
   pytestFlagsArray = [ "--pyargs" pname ];
 

pkgs/development/python-modules/deepdiff/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "deepdiff";
-  version = "6.2.3";
+  version = "6.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "seperman";
     repo = "deepdiff";
     rev = "refs/tags/${version}";
-    hash = "sha256-rlMksUi+R48fIEjVv2E3yOETDezTghZ8+Zsypu8fAnQ=";
+    hash = "sha256-txZ1X1J8DwueDRpLP3OuRA+S9hc5G3YCmEG+AS6ZAkI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/hahomematic/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.3.0";
+  version = "2023.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ZclhJoJg80P0iysA0G7+gTg8S3qJaaAbHsr4v6DUGKQ=";
+    hash = "sha256-LS46I3f6ivBnQ5mLrh6tVCQBfjsMJx0RD6fgyczLQr4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pooch/default.nix

@@ -7,6 +7,9 @@
 , packaging
 , appdirs
 , requests
+, tqdm
+, paramiko
+, xxhash
 }:
 
 buildPythonPackage rec {
@@ -44,6 +47,14 @@ buildPythonPackage rec {
     "integration"
   ];
 
+  passthru = {
+    optional-dependencies = {
+      progress = [ tqdm ];
+      sftp = [ paramiko ];
+      xxhash = [ xxhash ];
+    };
+  };
+
   meta = with lib; {
     description = "A friend to fetch your data files.";
     homepage = "https://github.com/fatiando/pooch";

pkgs/development/python-modules/pymilvus/default.nix

@@ -11,20 +11,13 @@
 }:
 buildPythonPackage rec {
   pname = "pymilvus";
-  version = "2.2.4";
+  version = "2.2.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gj+psVoS6vcM4bNWzpwvKJJETTeCmZe6RwlzDkcvWo8=";
+    hash = "sha256-/i3WObwoY6Ffqw+Guij6+uGbKYKET2AJ+d708efmSx0=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "grpcio-tools>=1.47.0, <=1.48.0" "grpcio-tools>=1.47.0, <=1.52.0" \
-      --replace "grpcio>=1.47.0,<=1.48.0" "grpcio>=1.47.0,<=1.53.0" \
-      --replace "ujson>=2.0.0,<=5.4.0" "ujson>=2.0.0,<=5.7.0"
-    '';
-
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   propagatedBuildInputs = [

pkgs/development/python-modules/tensorflow/default.nix

@@ -98,7 +98,7 @@ let
 
   tfFeature = x: if x then "1" else "0";
 
-  version = "2.11.0";
+  version = "2.11.1";
   variant = lib.optionalString cudaSupport "-gpu";
   pname = "tensorflow${variant}";
 
@@ -207,7 +207,7 @@ let
       owner = "tensorflow";
       repo = "tensorflow";
       rev = "refs/tags/v${version}";
-      hash = "sha256-OYh61/83yv+ycivylfdS8yFUIUAk8euAPvmfjPzldGs=";
+      hash = "sha256-q59cUW6613byHk4LGl+sefO5czLSWxOrSyLbJ1pkNEY=";
     };
 
     # On update, it can be useful to steal the changes from gentoo
@@ -394,11 +394,11 @@ let
     fetchAttrs = {
       sha256 = {
       x86_64-linux = if cudaSupport
-        then "sha256-/wB9EpaDPg3TrD9qggdA4vPgzvmaKc6dDnLjoYTJC5o="
-        else "sha256-QgOaUaq0V5HG9BOv9nEw8OTSlzINNFvbnyP8Vx+r9Xw=";
-      aarch64-linux = "sha256-zjnRtTG1j9cZTbP0Xnk2o/zWTNsP8T0n4Ai8IiAT3PE=";
-      x86_64-darwin = "sha256-RBLox9rzBKcZMm4NwnT7vQ/EjapWQJkqxuQ0LIdaM1E=";
-      aarch64-darwin = "sha256-tTk2KPFK4+0wA22xzb2C6qODgAbSxVbue0xk9JOjU04=";
+        then "sha256-rcTPOMoBfmKFuuCanMlhmtFtOQzOICfEXTZey/rQEdM="
+        else "sha256-JGLH64F81xwSUl9RCWJhBLNRBQandImsVafEF5s+ap0=";
+      aarch64-linux = "sha256-g6JUZQQalCTSjvAarkI7+gq13cPhFg/O9LPQDGNvrII=";
+      x86_64-darwin = "sha256-phmJ71l0DvJUVx1sHGS3nkDqJ18yOO7I3N1ODnfrrYc=";
+      aarch64-darwin = "sha256-qZvqXi6pvIrZpZdR4BcbOh2C/A4ZHJgXgFINhVJmmcs=";
       }.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
     };
 
@@ -448,27 +448,6 @@ let
       maintainers = with maintainers; [ abbradar ];
       platforms = with platforms; linux ++ darwin;
       broken = !(xlaSupport -> cudaSupport);
-      knownVulnerabilities = [
-        "CVE-2023-27579"
-        "CVE-2023-25801"
-        "CVE-2023-25676"
-        "CVE-2023-25675"
-        "CVE-2023-25674"
-        "CVE-2023-25673"
-        "CVE-2023-25671"
-        "CVE-2023-25670"
-        "CVE-2023-25669"
-        "CVE-2023-25668"
-        "CVE-2023-25667"
-        "CVE-2023-25665"
-        "CVE-2023-25666"
-        "CVE-2023-25664"
-        "CVE-2023-25663"
-        "CVE-2023-25662"
-        "CVE-2023-25660"
-        "CVE-2023-25659"
-        "CVE-2023-25658"
-      ];
     } // lib.optionalAttrs stdenv.isDarwin {
       timeout = 86400; # 24 hours
       maxSilent = 14400; # 4h, double the default of 7200s

pkgs/development/python-modules/twisted/default.nix

@@ -142,7 +142,7 @@ buildPythonPackage rec {
   # Generate Twisted's plug-in cache. Twisted users must do it as well. See
   # http://twistedmatrix.com/documents/current/core/howto/plugin.html#auto3
   # and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477103 for details.
-  postFixup = ''
+  postFixup = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     $out/bin/twistd --help > /dev/null
   '';
 

pkgs/development/tools/electron/binary/default.nix

@@ -24,7 +24,7 @@ let
 in
 rec {
 
-  electron-bin = electron_23-bin;
+  electron-bin = electron_24-bin;
 
   electron_9-bin = mkElectron "9.4.4" {
     x86_64-linux = "781d6ca834d415c71078e1c2c198faba926d6fce19e31448bbf4450869135450";
@@ -151,21 +151,30 @@ rec {
     headers = "0zvwd3gz5y3yq5jgkswnarv75j05lfaz58w37fidq5aib1hi50hn";
   };
 
-  electron_22-bin = mkElectron "22.1.0" {
-    armv7l-linux = "9bad02cd8e8604400eb90d9bd8fa58b6e400321cea8db7e774908611f4fca2a2";
-    aarch64-linux = "1d3e0011761f5ba05faf994a7f78cf518e49e0fef7e4528853e1bff9378d02cf";
-    x86_64-linux = "543e5fa7f2b602c3cd7e62a358441faf6f490e738de9b0bd796ad65d6bbd35ee";
-    x86_64-darwin = "969cad3fad6a03cbbc1658722cbf87547a8465c90dd4287fd5c03bd15bbf8a5b";
-    aarch64-darwin = "4ebf838308e93ad9956f3ce3a14b8d41607ffec5cd2054818d0c91b79df101a2";
-    headers = "1vydsk4fxk5hlpcs0r1s21gdr1kvxip8qc88ncs5w7ybqg31hzsh";
+  electron_22-bin = mkElectron "22.3.6" {
+    armv7l-linux = "ecc7a4e793873bdafd581a812ec593113f4a8bf4c4c5aafbab8dba2a99a2f767";
+    aarch64-linux = "ffe50eefa4440e7f6168c68901a6cd7dc23ce56c7cc0c1373b9b65add6a0d0ad";
+    x86_64-linux = "63c88f21382c65771b214520f8caddaf663ec53945153792d653930dd71ddff8";
+    x86_64-darwin = "002adcb1114a49bcfbdaa1e9d6e2850a568c199f319a8326133d34fc8f0367ee";
+    aarch64-darwin = "72777700b5c3d02f3b0b5691b3621fcbdc391467bd6f1aa40974a1ea05a999f9";
+    headers = "1m8a1n99fdy0fc06mwdj866b06dzp8plxh84ikgz0g9sdis6zcj7";
   };
 
-  electron_23-bin = mkElectron "23.1.1" {
-    armv7l-linux = "0f2db28e672021b3c03309155e36d94ec59c7541497847140d500fdec45baf09";
-    aarch64-linux = "5b5b6bf0a40d063e2a21e2868f3f97ce08a400690389355f2b68d606d4ae614f";
-    x86_64-linux = "4e820dc1ca957fbe9dbd168925ddf496b9b14c2001bbe5362159411a6bed0cea";
-    x86_64-darwin = "fb93e045e57410ecf046aee46a0baf413c55256ab7cf170f648a53b5d2e2a055";
-    aarch64-darwin = "49b0357aa21f317832dd8f620ff18cbf6bcd9aef264113ac67b9d306186c8eef";
-    headers = "1jq77kqkcy234nsqlizkcmzqs3wsy53438r4cnhhyfr6zx50f5sb";
+  electron_23-bin = mkElectron "23.2.4" {
+    armv7l-linux = "5e01b087d0715dfa770edff0b3f7f5ca48236474b405faf83bb105ad1ce6e3fb";
+    aarch64-linux = "2dec49bfdff22390ac965f3867384aa8a464f9a13a29c5bb757be328bb734964";
+    x86_64-linux = "c2886b453dddd04ebd08462ce2fa521afd7c7a2df418d5b9d29f1836f5726aa7";
+    x86_64-darwin = "cbf14eb732146f383be3282512c5d22960aa0ae208aacdccae96321a1de9944c";
+    aarch64-darwin = "5aed024ef988a53325aa8a2ff715080ead6a8d2a9830a43e24d268bb658a4558";
+    headers = "1yhz4q72a4sgr2aia9nfvnayq341dh4alwpmpkqnfa3iw9fc9wp6";
+  };
+
+  electron_24-bin = mkElectron "24.1.2" {
+    armv7l-linux = "dc190382e38e18851d37ff0f901a9737a3e59bf1b5f7171cb65d167f244e6712";
+    aarch64-linux = "a66dc286a43e92ddcb1c03df9019ee8db19a3f27381ac9273bf3996f322fdab7";
+    x86_64-linux = "a5b3c6d9847733e705b3c5cc7694f3bcb4996f7047bb8c02dd443ad27258f7f8";
+    x86_64-darwin = "ffe6a7c23d360b31bbc4dc05e05eb15b4261e72f1aac7d98ca7fbbd29bbba5e7";
+    aarch64-darwin = "3644b29ab2dde6cac0ac455fb5e965f739c4faaaad7e678bd4379c72723ea40a";
+    headers = "1p5g6nj3lrv068gsfcr5nyiv1ayb7s4gximbkpvbv5znnrlsn9q6";
   };
 }

pkgs/development/tools/electron/binary/generic.nix

@@ -32,7 +32,7 @@ let
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
       ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = optional (versionOlder version "21.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "22.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {

pkgs/development/tools/electron/binary/print-hashes.sh

@@ -24,7 +24,7 @@ headers="$(nix-prefetch-url "https://artifacts.electronjs.org/headers/dist/v${VE
 
 # Entry similar to the following goes in default.nix:
 
-echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"
+echo "  electron_${VERSION%%.*}-bin = mkElectron \"${VERSION}\" {"
 
 for S in "${!SYSTEMS[@]}"; do
   hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ' || :)"

pkgs/development/web/deno/default.nix

@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zltMn8ped1Euia/zRCvkpSUzJwFTpbZgrnot21x5tSA=";
+    hash = "sha256-yTTvfhOeU8zBwC+btscSlQygwEwjFlpvQQtiYunPCTI=";
   };
-  cargoHash = "sha256-XDs3f44ta9MaJlaMWRVkNZd9DaOfoSHJluUmL68DWOw=";
+  cargoHash = "sha256-GgOqo0q9sQyoYWUZkuBW6kxWXzpI3/+0YgRPhVD0GhM=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/servers/chatgpt-retrieval-plugin/default.nix

@@ -24,6 +24,7 @@ python3Packages.buildPythonApplication {
       --replace 'python-dotenv = "^0.21.1"' 'python-dotenv = "*"' \
       --replace 'python-multipart = "^0.0.6"' 'python-multipart = "^0.0.5"' \
       --replace 'tiktoken = "^0.2.0"' 'tiktoken = "^0.3.0"' \
+      --replace 'redis = "4.5.1"' 'redis = "^4.5.1"' \
       --replace 'packages = [{include = "server"}]' 'packages = [{include = "server"}, {include = "models"}, {include = "datastore"}, {include = "services"}]'
 
     substituteInPlace server/main.py \

pkgs/servers/gemini/stargazer/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, fetchFromSourcehut
+, rustPlatform
+, installShellFiles
+, scdoc
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "stargazer";
+  version = "1.0.5";
+
+  src = fetchFromSourcehut {
+    owner = "~zethra";
+    repo = "stargazer";
+    rev = version;
+    hash = "sha256-n88X3RJD7PqOcVRK/bp/gMNLVrbwnJ2iwi2rCpsfp+o=";
+  };
+
+  cargoHash = "sha256-Yqh3AQIOahKz2mLeVNm58Yr6vhjU4aQwN62y3Z5/EJc=";
+
+  doCheck = false; # Uses extenal testing framework that requires network
+
+  nativeBuildInputs = [ installShellFiles scdoc ];
+
+  postInstall = ''
+    scdoc < doc/stargazer.scd  > stargazer.1
+    scdoc < doc/stargazer-ini.scd  > stargazer.ini.5
+    installManPage stargazer.1
+    installManPage stargazer.ini.5
+    installShellCompletion completions/stargazer.{bash,zsh,fish}
+  '';
+
+  meta = with lib; {
+    description = "A fast and easy to use Gemini server";
+    homepage = "https://sr.ht/~zethra/stargazer/";
+    license = licenses.agpl3Plus;
+    changelog = "https://git.sr.ht/~zethra/stargazer/refs/${version}";
+    maintainers = with maintainers; [ gaykitty ];
+    platforms = platforms.linux;
+  };
+}

pkgs/servers/prowlarr/default.nix

@@ -21,15 +21,15 @@ let
   }.${stdenv.hostPlatform.system} or unsupported;
 
   hash = {
-    aarch64-darwin = "sha256-S9CrYDCwIssAtcP4pI1csbOOFKaZgM6UKEDNBp2VwVo=";
-    aarch64-linux = "sha256-UkoTWD4ljSfx/FzH5kQBpp/Bg+xwvc7n9KLBrqNNSR0=";
-    x86_64-darwin = "sha256-Wru+pwISVgjnSVe8HbiwU4M1aIIK5AGzml/2yqMGIlo=";
-    x86_64-linux = "sha256-eJRJ1LvQsmlMeWoUmGrAyLfoebG8g/Kl2lBQxMjIyTY=";
+    aarch64-darwin = "sha256-pBhAWR0+UKUKDkXsSIyR+VAV5Kl1vhuoDUVpUqXojg8=";
+    aarch64-linux = "sha256-gNq2Cial4oSVNlPnFu7U7LSMpAhK5skdbYazob7kQuI=";
+    x86_64-darwin = "sha256-6QTBJacl/1/NAmbu0kBLung2KPfR/cuICHeIVpTmu6Y=";
+    x86_64-linux = "sha256-T7WQmKuvKB9B61Ku7vZ/fV+DlzA5KVlOOPmZzRpUvgY=";
   }.${stdenv.hostPlatform.system} or unsupported;
 
 in stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.2.2.2699";
+  version = "1.3.2.3006";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";

pkgs/tools/admin/lxd/default.nix

@@ -32,17 +32,17 @@
 
 buildGoModule rec {
   pname = "lxd";
-  version = "5.12";
+  version = "5.13";
 
   src = fetchurl {
     urls = [
       "https://linuxcontainers.org/downloads/lxd/lxd-${version}.tar.gz"
       "https://github.com/lxc/lxd/releases/download/lxd-${version}/lxd-${version}.tar.gz"
     ];
-    hash = "sha256-YGH/M0aw56snNt3s8drcJYHZPYkVW993YilF228nMhw=";
+    hash = "sha256-kys8zfqhkpJqq4ICg6dOsoJEoxJ209GwdjGRrfrZ7j0=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   postPatch = ''
     substituteInPlace shared/usbid/load.go \

pkgs/tools/admin/meshcentral/default.nix

@@ -1,11 +1,11 @@
 { lib, fetchpatch, fetchzip, yarn2nix-moretea, nodejs-16_x, jq, dos2unix }:
 
 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.4.tgz";
-    sha256 = "1q13d01ar3nhg3v7w22byn02sga5qkzxbjzpzp30qrvb3gx8prmp";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.5.tgz";
+    sha256 = "1djdqfcmfk35q7hfbdn4rnh4di2lk1gk7icfasjmihrgpnsxrrir";
   };
 
   patches = [ ./fix-js-include-paths.patch ];

pkgs/tools/admin/meshcentral/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "keywords": [
     "Remote Device Management",
     "Remote Device Monitoring",

pkgs/tools/backup/rustic-rs/default.nix

@@ -17,15 +17,12 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  ## v0.5.0 panics when trying to generate zsh completions due to a bug.
-  ## See https://github.com/rustic-rs/rustic/issues/533
-  ## and https://github.com/rustic-rs/rustic/pull/536
   postInstall = ''
-    for shell in {ba,fi}sh; do
+    for shell in {ba,fi,z}sh; do
       $out/bin/rustic completions $shell > rustic.$shell
     done
 
-    installShellCompletion rustic.{ba,fi}sh
+    installShellCompletion rustic.{ba,fi,z}sh
   '';
 
   passthru.updateScript = nix-update-script { };

pkgs/tools/misc/promexplorer/default.nix

@@ -0,0 +1,22 @@
+{ lib, nimPackages, fetchFromGitHub }:
+nimPackages.buildNimPackage rec {
+  pname = "promexplorer";
+  version = "0.0.3";
+  nimBinOnly = true;
+  src = fetchFromGitHub {
+    owner = "marcusramberg";
+    repo = "promexplorer";
+    rev = "v${version}";
+    hash = "sha256-q+m4+aWT3IiI/XGmAm7jrJAxRbzzHr+p58eiHqjEbV0=";
+  };
+
+  buildInputs = with nimPackages; [ illwill illwillwidgets ];
+
+  meta = with lib; {
+    description = "A simple tool to explore prometheus exporter metrics";
+    homepage = "https://github.com/marcusramberg/promexplorer";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ marcusramberg ];
+  };
+}

pkgs/tools/networking/sshed/default.nix

@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "sshed";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "trntv";
+    repo = pname;
+    rev = version;
+    hash = "sha256-y8IQzOGs78T44jLcNNjPlfopyptX3Mhv2LdawqS1T+U=";
+  };
+
+  vendorHash = "sha256-21Vh5Zaja5rx9RVCTFQquNvMNvaUlUV6kfhkIvXwbVw=";
+
+  postFixup = ''
+    mv $out/bin/cmd $out/bin/sshed
+  '';
+
+  meta = with lib; {
+    description = "ssh config editor and bookmarks manager";
+    homepage = "https://github.com/trntv/sshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ocfox ];
+  };
+}

pkgs/tools/networking/ssldump/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ssldump";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "adulau";
     repo = "ssldump";
     rev = "v${version}";
-    sha256 = "sha256-mK8n+Dn7fUzmclUzlIqGjO2zzIVKQEhSRvYeuFwVJx8=";
+    sha256 = "sha256-BFE42wWqnGGTTjwej3LkH4XW2M4jP7XNSKHLnF2GFJo=";
   };
 
   nativeBuildInputs = [

pkgs/tools/networking/uwimap/default.nix

@@ -9,12 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "0a2a00hbakh0640r2wdpnwr8789z59wnk7rfsihh3j0vbhmmmqak";
   };
 
-  makeFlags = [ (if stdenv.isDarwin
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "RANLIB=${stdenv.cc.targetPrefix}ranlib"
+    (if stdenv.isDarwin
     then "osx"
-    else "lnp") ]  # Linux with PAM modules;
-    # -fPIC is required to compile php with imap on x86_64 systems
-    ++ lib.optional stdenv.isx86_64 "EXTRACFLAGS=-fPIC"
-    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ "CC=${stdenv.hostPlatform.config}-gcc" "RANLIB=${stdenv.hostPlatform.config}-ranlib" ];
+    else "lnp") # Linux with PAM modules;
+  ] ++ lib.optional stdenv.isx86_64 "EXTRACFLAGS=-fPIC"; # -fPIC is required to compile php with imap on x86_64 systems
+
 
   hardeningDisable = [ "format" ];
 
@@ -34,6 +36,10 @@ stdenv.mkDerivation rec {
     sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${lib.getLib openssl}/lib,'
   '';
 
+  preConfigure = ''
+    makeFlagsArray+=("ARRC=${stdenv.cc.targetPrefix}ar rc")
+  '';
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin
     "-I${openssl.dev}/include/openssl";
 
@@ -55,11 +61,4 @@ stdenv.mkDerivation rec {
   passthru = {
     withSSL = true;
   };
-} // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
-  # This is set here to prevent rebuilds on native compilation.
-  # Configure phase is a no-op there, because this package doesn't use ./configure scripts.
-  configurePhase = ''
-    echo "Cross-compilation, injecting make flags"
-    makeFlagsArray+=("ARRC=${stdenv.hostPlatform.config}-ar rc")
-  '';
 }

pkgs/tools/security/pinentry/default.nix

@@ -62,6 +62,8 @@ pinentryMkDerivation rec {
   ];
 
   configureFlags = [
+    "--with-libgpg-error-prefix=${libgpg-error.dev}"
+    "--with-libassuan-prefix=${libassuan.dev}"
     (lib.enableFeature withLibsecret "libsecret")
   ] ++ (map enableFeaturePinentry (lib.attrNames flavorInfo));
 

pkgs/tools/security/sslscan/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslscan";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = "rbsec";
     repo = "sslscan";
     rev = version;
-    sha256 = "sha256-YUczZYdrFGNYHoVZJ/HRbULgYWILKeo7lqyndSQO2Kw=";
+    sha256 = "sha256-1j5p9cuSxc8u6/+puP9ywHEljeva18m+WO3M8gbpkIU=";
   };
 
   buildInputs = [ openssl ];

pkgs/tools/text/mdcat/default.nix

@@ -12,20 +12,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdcat";
-  version = "1.1.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = "mdcat";
     rev = "mdcat-${version}";
-    sha256 = "sha256-E/ISQn+uTcay9JSZ1wVbb9WLv3BHV65CvbGSj99bqCs=";
+    sha256 = "sha256-N5/Fr1LgTOgaV6AEBuL7K+Q/zuioU4NpmOqxUAYXgn4=";
   };
 
   nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "sha256-ym1xVnUw4DymPusSXSUG8+StOe8dmbJjoQJLgjBfP1c=";
+  cargoSha256 = "sha256-HBWudlY7HkyBz6bpKxkih4KNcC+OrTUKWAnJjb8IXF0=";
 
   nativeCheckInputs = [ ansi2html ];
   # Skip tests that use the network and that include files.

pkgs/tools/video/rav1e/default.nix

@@ -10,10 +10,29 @@
 , zlib
 , libiconv
 , Security
+, buildPackages
 }:
 
 let
   rustTargetPlatformSpec = rust.toRustTargetSpec stdenv.hostPlatform;
+
+  # TODO: if another package starts using cargo-c (seems likely),
+  # factor this out into a makeCargoChook expression in
+  # pkgs/build-support/rust/hooks/default.nix
+  ccForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc";
+  cxxForBuild = "${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}c++";
+  ccForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+  cxxForHost = "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+  rustBuildPlatform = rust.toRustTarget stdenv.buildPlatform;
+  rustTargetPlatform = rust.toRustTarget stdenv.hostPlatform;
+  setEnvVars = ''
+    env \
+      "CC_${rustBuildPlatform}"="${ccForBuild}" \
+      "CXX_${rustBuildPlatform}"="${cxxForBuild}" \
+      "CC_${rustTargetPlatform}"="${ccForHost}" \
+      "CXX_${rustTargetPlatform}"="${cxxForHost}" \
+  '';
+
 in rustPlatform.buildRustPackage rec {
   pname = "rav1e";
   version = "0.6.3";
@@ -38,11 +57,13 @@ in rustPlatform.buildRustPackage rec {
 
   checkType = "debug";
 
-  postBuild = ''
+  postBuild =  ''
+    ${setEnvVars} \
     cargo cbuild --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 
   postInstall = ''
+    ${setEnvVars} \
     cargo cinstall --release --frozen --prefix=${placeholder "out"} --target ${rustTargetPlatformSpec}
   '';
 

pkgs/top-level/all-packages.nix

@@ -1639,6 +1639,8 @@ with pkgs;
 
   speedtest-rs = callPackage ../tools/networking/speedtest-rs { };
 
+  stargazer = callPackage ../servers/gemini/stargazer { };
+
   steamtinkerlaunch = callPackage ../tools/games/steamtinkerlaunch { };
 
   supermin = callPackage ../tools/virtualization/supermin { };
@@ -10375,6 +10377,8 @@ with pkgs;
 
   pnmixer = callPackage ../tools/audio/pnmixer { };
 
+  promexplorer = callPackage ../tools/misc/promexplorer { };
+
   pulsemixer = callPackage ../tools/audio/pulsemixer { };
 
   pwsafe = callPackage ../applications/misc/pwsafe { };
@@ -12291,6 +12295,8 @@ with pkgs;
 
   ssh-askpass-fullscreen = callPackage ../tools/networking/ssh-askpass-fullscreen { };
 
+  sshed = callPackage ../tools/networking/sshed { };
+
   sshguard = callPackage ../tools/security/sshguard { };
 
   sshping = callPackage ../tools/networking/sshping { };
@@ -14501,7 +14507,7 @@ with pkgs;
 
   comby = callPackage ../development/tools/comby { };
 
-  inherit (coqPackages) compcert;
+  inherit (coqPackages_8_16) compcert;
 
   computecpp-unwrapped = callPackage ../development/compilers/computecpp { };
   computecpp = wrapCCWith rec {
@@ -17392,7 +17398,8 @@ with pkgs;
     electron_20-bin
     electron_21-bin
     electron_22-bin
-    electron_23-bin;
+    electron_23-bin
+    electron_24-bin;
 
   electron = electron-bin;
   electron_9 = electron_9-bin;
@@ -17410,6 +17417,7 @@ with pkgs;
   electron_21 = electron_21-bin;
   electron_22 = electron_22-bin;
   electron_23 = electron_23-bin;
+  electron_24 = electron_24-bin;
 
   autobuild = callPackage ../development/tools/misc/autobuild { };
 
@@ -33524,6 +33532,8 @@ with pkgs;
 
   shadowfox = callPackage ../tools/networking/shadowfox { };
 
+  shavee = callPackage ../applications/misc/shavee { };
+
   shell_gpt = callPackage ../tools/misc/shell_gpt { };
 
   shfmt = callPackage ../tools/text/shfmt { };

pkgs/top-level/coq-packages.nix

@@ -183,7 +183,7 @@ in rec {
   coqPackages_8_15 = mkCoqPackages coq_8_15;
   coqPackages_8_16 = mkCoqPackages coq_8_16;
   coqPackages_8_17 = mkCoqPackages coq_8_17;
-  coqPackages = recurseIntoAttrs coqPackages_8_16;
+  coqPackages = recurseIntoAttrs coqPackages_8_17;
   coq = coqPackages.coq;
 
 }

pkgs/top-level/nim-packages.nix

@@ -49,6 +49,8 @@ lib.makeScope newScope (self:
 
     illwill = callPackage ../development/nim-packages/illwill { };
 
+    illwillwidgets = callPackage ../development/nim-packages/illwillwidgets { };
+
     jester = callPackage ../development/nim-packages/jester { };
 
     jsonschema = callPackage ../development/nim-packages/jsonschema { };