Merge master into staging-next

nixos/modules/programs/clash-verge.nix

···
           ProtectControlGroups = true;
           LockPersonality = true;
           RestrictRealtime = true;
+          RuntimeDirectory = "clash-verge-rev";
           ProtectClock = true;
           MemoryDenyWriteExecute = true;
           RestrictSUIDSGID = true;
-          RestrictNamespaces = [ "~user cgroup ipc mnt uts" ];
+          RestrictNamespaces = [ "~user cgroup mnt uts" ];
           RestrictAddressFamilies = [
-            "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_RAW"
+            "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_UNIX"
           ];
           CapabilityBoundingSet = [
             "CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_MKNOD"

pkgs/build-support/rust/build-rust-crate/configure-crate.nix

···
      IFS="$_OLDIFS"
 
      CRATENAME=$(echo ${crateName} | sed -e "s/\(.*\)-sys$/\U\1/" -e "s/-/_/g")
-     CRATEVERSION=$(echo ${crateVersion} | sed -e "s/[\.\+]/_/g")
+     # SemVer allows version numbers to contain alphanumeric characters and `.+-`
+     # which aren't legal bash identifiers.
+     # https://semver.org/#backusnaur-form-grammar-for-valid-semver-versions
+     CRATEVERSION=$(echo ${crateVersion} | sed -e "s/[\.\+-]/_/g")
      grep -P "^cargo:(?!:?(rustc-|warning=|rerun-if-changed=|rerun-if-env-changed))" target/build/${crateName}.opt \
        | awk -F= "/^cargo::metadata=/ {  gsub(/-/, \"_\", \$2); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$2) \"=\" \"\\\"\"\$3\"\\\"\"; next }
                   /^cargo:/ { sub(/^cargo::?/, \"\", \$1); gsub(/-/, \"_\", \$1); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$1) \"=\" \"\\\"\"\$2\"\\\"\"; print \"export \" toupper(\"DEP_$(echo $CRATENAME)_$(echo $CRATEVERSION)_\" \$1) \"=\" \"\\\"\"\$2\"\\\"\"; next }" > target/env

pkgs/by-name/cl/clash-verge-rev/0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch

···
+From 75296a3059419b91f638ee45215e56781bfda256 Mon Sep 17 00:00:00 2001
+From: wxt <[e-mail]>
+Date: Sat, 28 Jun 2025 14:30:23 +0800
+Subject: [PATCH] IPC: move path to /run/clash-verge-rev/service.sock
+
+---
+ src/service/ipc.rs | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/service/ipc.rs b/src/service/ipc.rs
+index df39787..f441cd2 100644
+--- a/src/service/ipc.rs
++++ b/src/service/ipc.rs
+@@ -20,7 +20,7 @@ use std::ffi::OsStr;
+ const IPC_SOCKET_NAME: &str = if cfg!(windows) {
+     r"\\.\pipe\clash-verge-service"
+ } else {
+-    "/tmp/clash-verge-service.sock"
++    "/run/clash-verge-rev/service.sock"
+ };
+ 
+ /// 消息时间有效期(秒)
+@@ -660,4 +660,4 @@ fn handle_unix_connection_sync(mut stream: std::os::unix::net::UnixStream) -> Re
+         .context("写入响应内容失败")?;
+     
+     Ok(())
+-} 
+\ No newline at end of file
++} 
+-- 
+2.49.0
+

pkgs/by-name/cl/clash-verge-rev/service.nix

···
   sourceRoot = "${src-service.name}";
 
   patches = [
-    # FIXME: remove until upstream fix these
-    # https://github.com/clash-verge-rev/clash-verge-rev/issues/3428
+    # I want to keep these patches because it's not harmful.
 
     # Patch: Restrict bin_path in spawn_process to be under the clash-verge-service directory.
     # This prevents arbitrary code execution by ensuring only trusted binaries from the Nix store are allowed to run.
···
     # Patch: Add validation to prevent overwriting existing files.
     # This mitigates arbitrary file overwrite risks by ensuring a file does not already exist before writing.
     ./0002-core-prevent-overwriting-existing-file-by-validating.patch
+
+    # Patch: move IPC directory from /tmp to /run/clash-verge-rev/service.lock
+    # This allows we enable ProtectSystem="strict" and PrivateTmp
+    ./0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch
   ];
 
   nativeBuildInputs = [

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

···
     # If you need a newer version, you can override the mihomo input of the wrapped package
     sed -i -e '/Mihomo Alpha/d' ./src/components/setting/mods/clash-core-viewer.tsx
 
+    # See service.nix for reasons
+    substituteInPlace src-tauri/src/core/service_ipc.rs \
+      --replace-fail "/tmp/clash-verge-service.sock" "/run/clash-verge-rev/service.sock"
+
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
       --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
 

pkgs/by-name/co/copilot-language-server/package.nix

···
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.337.0";
+  version = "1.339.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-native-${finalAttrs.version}.zip";
-    hash = "sha256-F8D45LrL4vzmAH6J4hVWvEIkwzSRaCeMluPFimJPiXk=";
+    hash = "sha256-UgBe78MZla2FLfP10VfM4meMaiZWAyj2PUBiZ7M+OXU=";
     stripRoot = false;
   };
 

pkgs/by-name/gi/git-statuses/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "git-statuses";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "bircni";
+    repo = "git-statuses";
+    tag = finalAttrs.version;
+    hash = "sha256-pnqg32FH26NTtt7N5db/JGjjR3MbPOFPtMA2iZNFiSI=";
+  };
+
+  patches = [
+    # This commit requires Rust 1.88, which is not yet in Nixpkgs.
+    (fetchpatch {
+      url = "https://github.com/bircni/git-statuses/commit/8bc32d1bd47d2a9e48f1408a9137213bae925912.patch";
+      hash = "sha256-JNWsv0DjwrSbMu/j2+XMoZKgvB1OgUA3b2BNuZTM/cA=";
+      revert = true;
+    })
+  ];
+
+  # fix tests, ref. https://github.com/bircni/git-statuses/pull/8
+  postPatch = ''
+    substituteInPlace src/tests/gitinfo_test.rs --replace-fail \
+      'let repo = git2::Repository::init(tmp_dir.path()).unwrap();' \
+      'let repo = git2::Repository::init(tmp_dir.path()).unwrap();
+       let mut config = repo.config().unwrap();
+       config.set_str("user.name", "Test User").unwrap();
+       config.set_str("user.email", "[e-mail]").unwrap();'
+  '';
+
+  cargoHash = "sha256-thLyIxuAACtexqCddKWuUE8Vl0CeUEBP7XxDPYT23lg=";
+
+  # Needed to get openssl-sys to use pkg-config.
+  env.OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+  buildInputs = [
+    openssl
+  ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-line tool to display the status of multiple Git repositories in a clear, tabular format";
+    homepage = "https://github.com/bircni/git-statuses";
+    changelog = "https://github.com/bircni/git-statuses/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nim65s ];
+    mainProgram = "git-statuses";
+  };
+})

pkgs/by-name/go/go-ethereum/package.nix

···
 in
 buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "go-ethereum";
     rev = "v${version}";
-    hash = "sha256-eu6VeG/vMdCOk15HWnKbtKRZbbYhH3y6SJrwEGxJs8w=";
+    hash = "sha256-lsjs/bZhCwfp8OfTES1GDXayjDcg0R8+L0Z3pZ9/Mvs=";
   };
 
   proxyVendor = true;

pkgs/by-name/ic/icloudpd/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "icloudpd";
-  version = "1.28.1";
+  version = "1.28.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "icloud-photos-downloader";
     repo = "icloud_photos_downloader";
     tag = "v${version}";
-    hash = "sha256-e3bv5IVVXKiAnxZAbx8JniGJaPJuT+FYAH1PwhU8q60=";
+    hash = "sha256-5zuV32AOorkRqt3wiUt2ndo+4j1FQ9JBSc8wY+v01OA=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/ja/jaq/package.nix

···
     homepage = "https://github.com/01mf02/jaq";
     changelog = "https://github.com/01mf02/jaq/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
+    teams = [ lib.teams.ngi ];
     maintainers = with lib.maintainers; [
       figsoda
       siraben

pkgs/by-name/lu/lux-cli/package.nix

···
   rustPlatform,
   versionCheckHook,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
   version = "0.7.4";
···
   src = fetchFromGitHub {
     owner = "nvim-neorocks";
     repo = "lux";
-    tag = "v0.7.4";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-m8GSs2gBw+WzDOBciOQHi7n4923XCd7z1TbfTnfJzUA=";
   };
 
···
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
···
       with first-class support for Nix and Neovim.
     '';
     homepage = "https://nvim-neorocks.github.io/";
-    changelog = "https://github.com/nvim-neorocks/lux/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/nvim-neorocks/lux/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
       mrcjkb
···
     platforms = lib.platforms.all;
     mainProgram = "lx";
   };
-}
+})

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py

···
         return cls(Path(file or "default.nix"), attr)
 
 
-def discover_git(location: Path) -> Path | None:
-    """
-    Discover the current git repository in the given location.
-    """
-    current = location.resolve()
-    previous = None
-
-    while current.is_dir() and current != previous:
-        dotgit = current / ".git"
-        if dotgit.is_dir():
-            return current
-        elif dotgit.is_file():  # this is a worktree
-            with dotgit.open() as f:
-                dotgit_content = f.read().strip()
-                if dotgit_content.startswith("gitdir: "):
-                    return Path(dotgit_content.split("gitdir: ")[1])
-        previous = current
-        current = current.parent
-
-    return None
-
-
-def discover_closest_flake(location: Path) -> Path | None:
-    """
-    Discover the closest flake.nix file starting from the given location upwards.
-    """
-    current = location.resolve()
-    previous = None
-
-    while current.is_dir() and current != previous:
-        flake_file = current / "flake.nix"
-        if flake_file.is_file():
-            return current
-        previous = current
-        current = current.parent
-
-    return None
-
-
-def get_hostname(target_host: Remote | None) -> str | None:
+def _get_hostname(target_host: Remote | None) -> str | None:
     if target_host:
         try:
             return run_wrapper(
···
         assert m is not None, f"got no matches for {flake_str}"
         attr = m.group("attr")
         nixos_attr = (
-            f'nixosConfigurations."{attr or get_hostname(target_host) or "default"}"'
+            f'nixosConfigurations."{attr or _get_hostname(target_host) or "default"}"'
         )
-        path_str = m.group("path")
-        if ":" in path_str:
-            return cls(path_str, nixos_attr)
-        else:
-            path = Path(path_str)
-            git_repo = discover_git(path)
-            if git_repo is not None:
-                url = f"git+file://{git_repo}"
-                flake_path = discover_closest_flake(path)
-                if (
-                    flake_path is not None
-                    and flake_path != git_repo
-                    and flake_path.is_relative_to(git_repo)
-                ):
-                    url += f"?dir={flake_path.relative_to(git_repo)}"
-                return cls(url, nixos_attr)
+        path = m.group("path")
+        if ":" in path:
             return cls(path, nixos_attr)
+        else:
+            return cls(Path(path), nixos_attr)
 
     @classmethod
     def from_arg(cls, flake_arg: Any, target_host: Remote | None) -> Self | None:  # noqa: ANN401

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py

···
     )
 
 
-@patch("platform.node", autospec=True, return_value="hostname")
+@patch("platform.node", autospec=True, return_value=None)
 def test_flake_parse(mock_node: Mock, tmpdir: Path, monkeypatch: MonkeyPatch) -> None:
     assert m.Flake.parse("/path/to/flake#attr") == m.Flake(
         Path("/path/to/flake"), 'nixosConfigurations."attr"'
     )
     assert m.Flake.parse("/path/ to /flake") == m.Flake(
-        Path("/path/ to /flake"), 'nixosConfigurations."hostname"'
+        Path("/path/ to /flake"), 'nixosConfigurations."default"'
     )
     with patch(
         get_qualified_name(m.run_wrapper, m),
···
         assert m.Flake.parse("/path/to/flake", target_host) == m.Flake(
             Path("/path/to/flake"), 'nixosConfigurations."remote"'
         )
-    # change directory to tmpdir
-    with monkeypatch.context() as patch_context:
-        patch_context.chdir(tmpdir)
-        assert m.Flake.parse(".#attr") == m.Flake(
-            Path("."), 'nixosConfigurations."attr"'
-        )
-        assert m.Flake.parse("#attr") == m.Flake(
-            Path("."), 'nixosConfigurations."attr"'
-        )
-        assert m.Flake.parse(".") == m.Flake(
-            Path("."), 'nixosConfigurations."hostname"'
-        )
+    assert m.Flake.parse(".#attr") == m.Flake(Path("."), 'nixosConfigurations."attr"')
+    assert m.Flake.parse("#attr") == m.Flake(Path("."), 'nixosConfigurations."attr"')
+    assert m.Flake.parse(".") == m.Flake(Path("."), 'nixosConfigurations."default"')
     assert m.Flake.parse("path:/to/flake#attr") == m.Flake(
         "path:/to/flake", 'nixosConfigurations."attr"'
     )
 
-    # from here on  we should return "default"
-    mock_node.return_value = None
+    # from here on  we should return "hostname"
+    mock_node.return_value = "hostname"
 
     assert m.Flake.parse("github:user/repo/branch") == m.Flake(
-        "github:user/repo/branch", 'nixosConfigurations."default"'
-    )
-    git_root = tmpdir / "git_root"
-    git_root.mkdir()
-    (git_root / ".git").mkdir()
-    assert m.Flake.parse(str(git_root)) == m.Flake(
-        f"git+file://{git_root}", 'nixosConfigurations."default"'
-    )
-
-    work_tree = tmpdir / "work_tree"
-    work_tree.mkdir()
-    (work_tree / ".git").write_text("gitdir: /path/to/git", "utf-8")
-    assert m.Flake.parse(str(work_tree)) == m.Flake(
-        "git+file:///path/to/git", 'nixosConfigurations."default"'
+        "github:user/repo/branch", 'nixosConfigurations."hostname"'
     )
 
 
···
             autospec=True,
             return_value=False,
         ),
-        patch(
-            get_qualified_name(m.discover_git),
-            autospec=True,
-            return_value="/etc/nixos",
-        ),
     ):
         assert m.Flake.from_arg(None, None) == m.Flake(
-            "git+file:///etc/nixos", 'nixosConfigurations."hostname"'
+            Path("/etc/nixos"), 'nixosConfigurations."hostname"'
         )
 
     with (

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

···
 
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
-def test_editd_flake(mock_run: Mock, monkeypatch: MonkeyPatch, tmpdir: Path) -> None:
-    flake = m.Flake.parse(f"{tmpdir}#attr")
+def test_edit_flake(mock_run: Mock) -> None:
+    flake = m.Flake.parse(".#attr")
     n.edit_flake(flake, {"commit_lock_file": True})
     mock_run.assert_called_with(
         [
···
             "edit",
             "--commit-lock-file",
             "--",
-            f'{tmpdir}#nixosConfigurations."attr"',
+            '.#nixosConfigurations."attr"',
         ],
         check=False,
     )

pkgs/by-name/oc/oci2git/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oci2git";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "Virviil";
     repo = "oci2git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-axUNZWV9hKdnHfPqgIx1O2onHvBb4n5Wdv2laNV83Ik=";
+    hash = "sha256-+y2sWYoEuGGOYBk3E1b+2G9eF0mGSABHi92cCm+v590=";
   };
 
-  cargoHash = "sha256-1U/kvuXAPYFU1YekY6xKeEsTJ03ol1uN2DDp7j/Sync=";
+  cargoHash = "sha256-khl56908go19CV2XlwzH5xE4BNzQW8U7D6ce9OZgovA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ss/ssh-mitm/package.nix

···
   python3,
 }:
 
-let
-  py = python3.override {
-    self = py;
-    packageOverrides = self: super: {
-      paramiko = super.paramiko.overridePythonAttrs (oldAttrs: rec {
-        version = "3.4.1";
-        src = oldAttrs.src.override {
-          inherit version;
-          hash = "sha256-ixUwKHCvf2ZS8uA4l1wdKXPwYEbLXX1lNVZos+y+zgw=";
-        };
-        dependencies = oldAttrs.dependencies ++ [ python3.pkgs.icecream ];
-      });
-    };
-  };
-in
-with py.pkgs;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "ssh-mitm";
   version = "5.0.1";
   pyproject = true;
···
     hash = "sha256-FmxVhYkPRZwS+zFwuId9nRGN832LRkgCNgDYb8Pg01U=";
   };
 
-  build-system = [
+  pythonRelaxDeps = [ "paramiko" ];
+
+  build-system = with python3.pkgs; [
     hatchling
     hatch-requirements-txt
   ];
 
-  dependencies = [
-    appimage
-    argcomplete
-    colored
-    packaging
-    paramiko
-    pytz
-    pyyaml
-    python-json-logger
-    rich
-    tkinter
-    setuptools
-    sshpubkeys
-    wrapt
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ setuptools ];
+  nativeBuildInputs = [ installShellFiles ];
+
+  dependencies =
+    with python3.pkgs;
+    [
+      appimage
+      argcomplete
+      colored
+      packaging
+      paramiko
+      pytz
+      pyyaml
+      python-json-logger
+      rich
+      tkinter
+      setuptools
+      sshpubkeys
+      wrapt
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ setuptools ];
   # fix for darwin users
 
-  nativeBuildInputs = [ installShellFiles ];
-
   # Module has no tests
   doCheck = false;
+
   # Install man page
   postInstall = ''
     installManPage man1/*

pkgs/by-name/sw/sway-overfocus/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "sway-overfocus";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "korreman";
     repo = "sway-overfocus";
     rev = "v${version}";
-    hash = "sha256-trpjKA0TV8InSfViIXKnMDeZeFXZfavpiU7/R3JDQkQ=";
+    hash = "sha256-Ik1YkEtmnMdm5bQb5PtqzZZdJxCnGu4Bzt000iV7tc4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RtiXcUvId+bf8t74Ld2JXQGx+o094Qo3O5kt+ldm1Ag=";
+  cargoHash = "sha256-sMciCYeuvgY6K7u9HHxIL9EaCUAWGqtbcSjhfcbjdXI=";
 
   # Crate without tests.
   doCheck = false;

pkgs/by-name/te/teleport/package.nix

···
 
   withRdpClient ? true,
 
-  version ? "17.5.3",
-  hash ? "sha256-VyuzSk388Dumm65+Gadu/SddVN7uUS3du5RGPm4xI6g=",
+  version ? "17.5.4",
+  hash ? "sha256-ojRIyPTrSG3/xuqdaUNrN4s5HP3E8pvzjG8h+qFEYrc=",
   vendorHash ? "sha256-IHXwCp1MdcEKJhIs9DNf77Vd93Ai2as7ROlh6AJT9+Q=",
   extPatches ? [ ],
   cargoHash ? "sha256-qz8gkooQTuBlPWC4lHtvBQpKkd+nEZ0Hl7AVg9JkPqs=",

pkgs/by-name/te/teleport_16/package.nix

···
   teleport,
 }:
 teleport.override {
-  version = "16.5.11";
-  hash = "sha256-uLis1oRTr5J2bKaJtnVAIQ0ixYT8BYLo4jQPcdFp82s=";
-  vendorHash = "sha256-OcVHckqxpTVz6Gaemt3+9WxBQc5D5QBxb3IMGOMq4LI=";
-  pnpmHash = "sha256-JQca2eFxcKJDHIaheJBg93ivZU95UWMRgbcK7QE4R10=";
+  version = "16.5.13";
+  hash = "sha256-X9Ujgvp+2dFCoku0tjGW4W05X8QrnExFE+H1kMhf91A=";
+  vendorHash = "sha256-0+7xbIONnZs7dPpfpHPmep+k4XxQE8TS/eKz4F5a3V0=";
+  pnpmHash = "sha256-waBzmNs20wbuoBDObVFnJjEYs3NJ/bzQksVz7ltMD7M=";
   cargoHash = "sha256-04zykCcVTptEPGy35MIWG+tROKFzEepLBmn04mSbt7I=";
 }

pkgs/by-name/um/umu-launcher-unwrapped/package.nix

···
 }:
 python3Packages.buildPythonPackage rec {
   pname = "umu-launcher-unwrapped";
-  version = "1.2.6";
+  version = "1.2.7";
 
   src = fetchFromGitHub {
     owner = "Open-Wine-Components";
     repo = "umu-launcher";
     tag = version;
-    hash = "sha256-DkfB78XhK9CXgN/OpJZTjwHB7IcLC4h2HM/1JW42ZO0=";
+    hash = "sha256-G8UZvQ/pidh93FSsYq1dY0FTESWbksKAd9OU5Sxvv4I=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-JhNErFDJsM20BhgIgJSUBeNzAst8f+s1NzpLfl2m2es=";
+    hash = "sha256-qGkEc4VPShMMNgSB4JmSf7Mq4jEOxEK+BqlR680ZO9k=";
   };
 
   nativeCheckInputs = [

pkgs/development/ocaml-modules/bytesrw/default.nix

···
+{
+  lib,
+  fetchzip,
+  libblake3,
+  libmd,
+  xxHash,
+  zlib,
+  zstd,
+  buildTopkgPackage,
+}:
+
+buildTopkgPackage rec {
+  pname = "bytesrw";
+  version = "0.1.0";
+
+  minimalOCamlVersion = "4.14.0";
+
+  src = fetchzip {
+    url = "https://erratique.ch/software/bytesrw/releases/bytesrw-${version}.tbz";
+    hash = "sha256-leH3uo5Q8ba22A/Mbl9pio0tW/IxCTGp77Cra7l4D80=";
+  };
+
+  # docs say these are optional, but buildTopkgPackage doesn’t handle missing
+  # dependencies
+
+  buildInputs = [
+    libblake3
+    libmd
+    xxHash
+    zlib
+    zstd
+  ];
+
+  meta = {
+    description = "composable, memory efficient, byte stream readers and writers compatible with effect-based concurrency";
+    longDescription = ''
+      Bytesrw extends the OCaml Bytes module with composable, memory efficient,
+      byte stream readers and writers compatible with effect-based concurrency.
+
+      Except for byte slice life-times, these abstractions intentionnaly
+      separate away ressource management and the specifics of reading and
+      writing bytes.
+    '';
+    homepage = "https://erratique.ch/software/bytesrw";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}

pkgs/development/ocaml-modules/jsont/default.nix

···
+{
+  lib,
+  fetchzip,
+  buildTopkgPackage,
+  brr,
+  bytesrw,
+  cmdliner,
+}:
+
+buildTopkgPackage rec {
+  pname = "jsont";
+  version = "0.1.1";
+
+  minimalOCamlVersion = "4.14.0";
+
+  src = fetchzip {
+    url = "https://erratique.ch/software/jsont/releases/jsont-${version}.tbz";
+    hash = "sha256-bLbTfRVz/Jzuy2LnQeTEHQGojfA34M+Xj7LODpBAVK4=";
+  };
+
+  # docs say these dependendencies are optional, but buildTopkgPackage doesn’t
+  # handle missing dependencies
+
+  buildInputs = [
+    cmdliner
+  ];
+
+  propagatedBuildInputs = [
+    brr
+    bytesrw
+  ];
+
+  meta = {
+    description = "declarative JSON data manipulation";
+    longDescription = ''
+      Jsont is an OCaml library for declarative JSON data manipulation. it
+      provides:
+
+      • Combinators for describing JSON data using the OCaml values of your
+        choice. The descriptions can be used by generic functions to decode,
+        encode, query and update JSON data without having to construct a
+        generic JSON representation
+      • A JSON codec with optional text location tracking and best-effort
+        layout preservation. The codec is compatible with effect-based
+        concurrency.
+
+      The descriptions are independent from the codec and can be used by
+      third-party processors or codecs.
+    '';
+    homepage = "https://erratique.ch/software/jsont";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}

pkgs/development/python-modules/mmengine/default.nix

···
     + ''
       substituteInPlace tests/test_config/test_lazy.py \
         --replace-fail "import numpy.compat" ""
+
+      substituteInPlace mmengine/utils/dl_utils/collect_env.py \
+        --replace-fail \
+          "from distutils" \
+          "from setuptools._distutils"
     '';
 
   build-system = [ setuptools ];

pkgs/development/python-modules/nicegui/default.nix

···
 {
   lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  poetry-core,
-  setuptools,
-
-  # dependencies
   aiofiles,
   aiohttp,
+  buildPythonPackage,
   certifi,
   docutils,
   fastapi,
+  fetchFromGitHub,
   httpx,
   ifaddr,
   itsdangerous,
   jinja2,
+  libsass,
   markdown2,
+  matplotlib,
   orjson,
+  pandas,
+  pkgs,
+  plotly,
+  poetry-core,
+  polars,
+  pyecharts,
   pygments,
+  pytest-asyncio,
+  pytest-selenium,
+  pytestCheckHook,
   python-multipart,
   python-socketio,
+  pywebview,
+  redis,
   requests,
+  setuptools,
   typing-extensions,
   urllib3,
   uvicorn,
   vbuild,
   watchfiles,
-
-  # optional-dependencies
-  matplotlib,
-  pywebview,
-  plotly,
-  libsass,
-  redis,
-
-  # tests
-  pandas,
-  pkgs,
-  polars,
-  pyecharts,
-  pytest-asyncio,
-  pytest-selenium,
-  pytestCheckHook,
   webdriver-manager,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "nicegui";
-  version = "2.15.0";
+  version = "2.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zauberzeug";
     repo = "nicegui";
     tag = "v${version}";
-    hash = "sha256-pwR+9QBCIMZXFK9n8GRESl9UFsh7zcgOxTngdgdyMuc=";
+    hash = "sha256-XCOFRfG+EkgSKz5Z7Ds9F2Vwl1+7GH7ojxuE6ruvO3Y=";
   };
+
+  pythonRelaxDeps = [ "requests" ];
 
   build-system = [
     poetry-core

pkgs/development/python-modules/optuna-dashboard/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  alembic,
+  boto3,
+  botorch,
+  bottle,
+  cmaes,
+  colorlog,
+  moto,
+  numpy,
+  optuna,
+  packaging,
+  plotly,
+  pytestCheckHook,
+  setuptools,
+  scikit-learn,
+  scipy,
+  streamlit,
+  tqdm,
+}:
+
+buildPythonPackage rec {
+  pname = "optuna-dashboard";
+  version = "0.18.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "optuna";
+    repo = "optuna-dashboard";
+    tag = "v${version}";
+    hash = "sha256-0L1QTw9srZsHWDVP4J0WMIvndn5pn51Hs/Xz/tusv0I=";
+  };
+
+  dependencies = [
+    alembic
+    bottle
+    cmaes
+    colorlog
+    numpy
+    optuna
+    packaging
+    scikit-learn
+    scipy
+    tqdm
+  ];
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    boto3
+    botorch
+    moto
+    plotly
+    streamlit
+  ];
+
+  # Disable tests that use playwright (needs network)
+  disabledTestPaths = [
+    "e2e_tests/test_dashboard/test_usecases/test_preferential_optimization.py"
+    "e2e_tests/test_dashboard/test_usecases/test_study_history.py"
+    "e2e_tests/test_dashboard/visual_regression_test.py"
+    "e2e_tests/test_standalone/test_study_list.py"
+  ];
+
+  pythonImportsCheck = [ "optuna_dashboard" ];
+
+  meta = {
+    description = "Real-time Web Dashboard for Optuna";
+    homepage = "https://github.com/optuna/optuna-dashboard";
+    changelog = "https://github.com/optuna/optuna-dashboard/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "optuna-dashboard";
+  };
+}

pkgs/development/python-modules/tweepy/default.nix

···
   async-lru,
   buildPythonPackage,
   fetchFromGitHub,
+  flit-core,
   oauthlib,
   pytestCheckHook,
-  pythonOlder,
-  requests,
   requests-oauthlib,
-  setuptools,
+  requests,
   vcrpy,
 }:
 
 buildPythonPackage rec {
   pname = "tweepy";
-  version = "4.15.0";
+  version = "4.16.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "tweepy";
     repo = "tweepy";
     tag = "v${version}";
-    hash = "sha256-vbiMwaJh4cN7OY7eYu2s8azs3A0KXvW/kRPVCx50ZVA=";
+    hash = "sha256-9rJrZb9X3twVtfnQTFjWLH/TttfUNm4KA3/6AIHDKc0=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ flit-core ];
 
   dependencies = [
     oauthlib

pkgs/tools/networking/mtr/default.nix

···
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   pkg-config,
   libcap,
···
 
 stdenv.mkDerivation rec {
   pname = "mtr${lib.optionalString withGtk "-gui"}";
-  version = "0.95";
+  version = "0.96";
 
   src = fetchFromGitHub {
     owner = "traviscross";
     repo = "mtr";
     rev = "v${version}";
-    sha256 = "sha256-f5bL3IdXibIc1xXCuZHwcEV5vhypRE2mLsS3A8HW2QM=";
+    sha256 = "sha256-Oit0jEm1g+jYCIoTak/mcdlF14GDkDOAWKmX2mYw30M=";
   };
-
-  patches = [
-    (fetchpatch {
-      # https://github.com/traviscross/mtr/pull/468
-      url = "https://github.com/traviscross/mtr/commit/5908af4c19188cb17b62f23368b6ef462831a0cb.patch";
-      hash = "sha256-rTydtU8+Wc4nGEKh1GOkhcpgME4hwsACy82gKPaIe64=";
-    })
-  ];
 
   # we need this before autoreconfHook does its thing
   postPatch = ''

pkgs/top-level/ocaml-packages.nix

···
 
         bwd = callPackage ../development/ocaml-modules/bwd { };
 
+        bytesrw = callPackage ../development/ocaml-modules/bytesrw { };
+
         bytestring = callPackage ../development/ocaml-modules/bytestring { };
 
         bz2 = callPackage ../development/ocaml-modules/bz2 { };
···
         json-data-encoding-bson = callPackage ../development/ocaml-modules/json-data-encoding/bson.nix { };
 
         jsonm = callPackage ../development/ocaml-modules/jsonm { };
+
+        jsont = callPackage ../development/ocaml-modules/jsont { };
 
         jsonrpc = callPackage ../development/ocaml-modules/ocaml-lsp/jsonrpc.nix { };
 

pkgs/top-level/python-packages.nix

···
 
   optuna = callPackage ../development/python-modules/optuna { };
 
+  optuna-dashboard = callPackage ../development/python-modules/optuna-dashboard { };
+
   optype = callPackage ../development/python-modules/optype { };
 
   opuslib = callPackage ../development/python-modules/opuslib { };