Merge staging-next into staging

nixos/lib/systemd-lib.nix

···
     optional (attr ? ${name} && !isInt attr.${name})
       "Systemd ${group} field `${name}' is not an integer";
 
+  assertRemoved = name: see: group: attr:
+    optional (attr ? ${name})
+      "Systemd ${group} field `${name}' has been removed. See ${see}";
+
   checkUnitConfig = group: checks: attrs: let
     # We're applied at the top-level type (attrsOf unitOption), so the actual
     # unit options might contain attributes from mkOverride and mkIf that we need to

nixos/lib/systemd-types.nix

···
 
   inherit (lib.types)
     attrsOf
+    coercedTo
+    enum
     lines
     listOf
     nullOr
+    oneOf
+    package
     path
+    singleLineStr
     submodule
     ;
+
+  initrdStorePathModule = { config, ... }: {
+    options = {
+      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
+
+      target = mkOption {
+        type = nullOr path;
+        description = ''
+          Path of the symlink.
+        '';
+        default = null;
+      };
+
+      source = mkOption {
+        type = path;
+        description = "Path of the source file.";
+      };
+
+      dlopen = {
+        usePriority = mkOption {
+          type = enum [ "required" "recommended" "suggested" ];
+          default = "recommended";
+          description = ''
+            Priority of dlopen ELF notes to include. "required" is
+            minimal, "recommended" includes "required", and
+            "suggested" includes "recommended".
+
+            See: https://systemd.io/ELF_DLOPEN_METADATA/
+          '';
+        };
+
+        features = mkOption {
+          type = listOf singleLineStr;
+          default = [ ];
+          description = ''
+            Features to enable via dlopen ELF notes. These will be in
+            addition to anything included via 'usePriority',
+            regardless of their priority.
+          '';
+        };
+      };
+    };
+  };
+
 in
 
 {
···
   automounts = listOf (submodule [ stage2AutomountOptions unitConfig automountConfig ]);
   initrdAutomounts = attrsOf (submodule [ stage1AutomountOptions unitConfig automountConfig ]);
 
+  initrdStorePath = listOf (coercedTo
+    (oneOf [ singleLineStr package ])
+    (source: { inherit source; })
+    (submodule initrdStorePathModule));
+
   initrdContents = attrsOf (submodule ({ config, options, name, ... }: {
+    imports = [ initrdStorePathModule ];
     options = {
-      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
-
-      target = mkOption {
-        type = path;
-        description = ''
-          Path of the symlink.
-        '';
-        default = name;
-      };
-
       text = mkOption {
         default = null;
         type = nullOr lines;
         description = "Text of the file.";
       };
-
-      source = mkOption {
-        type = path;
-        description = "Path of the source file.";
-      };
     };
 
     config = {
+      target = mkDefault name;
       source = mkIf (config.text != null) (
         let name' = "initrd-" + baseNameOf name;
         in mkDerivedConfig options.text (pkgs.writeText name')

nixos/modules/system/boot/networkd.nix

···
           "ManageForeignRoutes"
           "RouteTable"
           "IPv6PrivacyExtensions"
+          "IPv4Forwarding"
+          "IPv6Forwarding"
         ])
         (assertValueOneOf "SpeedMeter" boolValues)
         (assertInt "SpeedMeterIntervalSec")
         (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues)
         (assertValueOneOf "ManageForeignRoutes" boolValues)
         (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
+        (assertValueOneOf "IPv4Forwarding" boolValues)
+        (assertValueOneOf "IPv6Forwarding" boolValues)
       ];
 
       sectionDHCPv4 = checkUnitConfig "DHCPv4" [
···
           "DNSDefaultRoute"
           "NTP"
           "IPForward"
+          "IPv4Forwarding"
+          "IPv6Forwarding"
           "IPMasquerade"
           "IPv6PrivacyExtensions"
           "IPv6AcceptRA"
···
         (assertValueOneOf "LLDP" (boolValues ++ ["routers-only"]))
         (assertValueOneOf "EmitLLDP" (boolValues ++ ["nearest-bridge" "non-tpmr-bridge" "customer-bridge"]))
         (assertValueOneOf "DNSDefaultRoute" boolValues)
-        (assertValueOneOf "IPForward" (boolValues ++ ["ipv4" "ipv6"]))
+        (assertRemoved "IPForward" "IPv4Forwarding and IPv6Forwarding in systemd.network(5) and networkd.conf(5)")
+        (assertValueOneOf "IPv4Forwarding" boolValues)
+        (assertValueOneOf "IPv6Forwarding" boolValues)
         (assertValueOneOf "IPMasquerade" (boolValues ++ ["ipv4" "ipv6" "both"]))
         (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
         (assertValueOneOf "IPv6AcceptRA" boolValues)
···
         "systemd-networkd-wait-online.service"
         "systemd-networkd.service"
         "systemd-networkd.socket"
+        "systemd-networkd-persistent-storage.service"
       ];
 
       environment.etc."systemd/networkd.conf" = renderConfig cfg.config;

nixos/modules/system/boot/stage-1.nix

···
 
       # Copy udev.
       copy_bin_and_libs ${udev}/bin/udevadm
+      cp ${lib.getLib udev.kmod}/lib/libkmod.so* $out/lib
       copy_bin_and_libs ${udev}/lib/systemd/systemd-sysctl
       for BIN in ${udev}/lib/udev/*_id; do
         copy_bin_and_libs $BIN

nixos/modules/system/boot/systemd.nix

···
       "cryptsetup.target"
       "cryptsetup-pre.target"
       "remote-cryptsetup.target"
+    ] ++ optionals cfg.package.withTpm2Tss [
+      "tpm2.target"
     ] ++ [
       "sigpwr.target"
       "timers.target"
···
       "sleep.target"
       "hybrid-sleep.target"
       "systemd-hibernate.service"
+      "systemd-hibernate-clear.service"
       "systemd-hybrid-sleep.service"
       "systemd-suspend.service"
       "systemd-suspend-then-hibernate.service"
···
       "systemd-ask-password-wall.path"
       "systemd-ask-password-wall.service"
 
+      # Varlink APIs
+      "systemd-bootctl@.service"
+      "systemd-bootctl.socket"
+      "systemd-creds@.service"
+      "systemd-creds.socket"
+    ] ++ lib.optional cfg.package.withTpm2Tss [
+      "systemd-pcrlock@.service"
+      "systemd-pcrlock.socket"
+    ] ++ [
+
       # Slices / containers.
       "slices.target"
     ] ++ optionals cfg.package.withImportd [
···
     ] ++ optionals cfg.package.withHostnamed [
       "dbus-org.freedesktop.hostname1.service"
       "systemd-hostnamed.service"
+      "systemd-hostnamed.socket"
     ] ++ optionals cfg.package.withPortabled [
       "dbus-org.freedesktop.portable1.service"
       "systemd-portabled.service"

nixos/modules/system/boot/systemd/initrd.nix

···
     "systemd-tmpfiles-setup-dev.service"
     "systemd-tmpfiles-setup.service"
     "timers.target"
+    "tpm2.target"
     "umount.target"
     "systemd-bsod.service"
   ] ++ cfg.additionalUpstreamUnits;
···
     inherit (config.boot.initrd) compressor compressorArgs prepend;
     inherit (cfg) strip;
 
-    contents = map (path: { object = path; symlink = ""; }) (subtractLists cfg.suppressedStorePaths cfg.storePaths)
-      ++ mapAttrsToList (_: v: { object = v.source; symlink = v.target; }) (filterAttrs (_: v: v.enable) cfg.contents);
+    contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
   };
 
 in {
···
       description = ''
         Store paths to copy into the initrd as well.
       '';
-      type = with types; listOf (oneOf [ singleLineStr package ]);
+      type = utils.systemdUtils.types.initrdStorePath;
       default = [];
     };
 
···
     };
 
     enableTpm2 = mkOption {
-      default = true;
+      default = cfg.package.withTpm2Tss;
+      defaultText = "boot.initrd.systemd.package.withTpm2Tss";
       type = types.bool;
       description = ''
         Whether to enable TPM2 support in the initrd.
···
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
         "${cfg.package}/lib/systemd/systemd-bsod"
+        "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
···
         # fido2 support
         "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
         "${pkgs.libfido2}/lib/libfido2.so.1"
-      ] ++ jobScripts;
+      ] ++ jobScripts
+      ++ map (c: builtins.removeAttrs c ["text"]) (builtins.attrValues cfg.contents);
 
       targets.initrd.aliases = ["default.target"];
       units =

nixos/modules/system/boot/systemd/journald.nix

···
       "systemd-journald@.service"
       "systemd-journal-flush.service"
       "systemd-journal-catalog-update.service"
+      "systemd-journald-sync@.service"
       ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
       "systemd-journald-dev-log.socket"
       "syslog.socket"

nixos/modules/system/boot/systemd/shutdown.nix

···
 
   cfg = config.systemd.shutdownRamfs;
 
-  ramfsContents = let
-    storePaths = map (p: "${p}\n") cfg.storePaths;
-    contents = lib.mapAttrsToList (_: v: "${v.source}\n${v.target}") (lib.filterAttrs (_: v: v.enable) cfg.contents);
-  in pkgs.writeText "shutdown-ramfs-contents" (lib.concatStringsSep "\n" (storePaths ++ contents));
+  ramfsContents = pkgs.writeText "shutdown-ramfs-contents.json" (builtins.toJSON cfg.storePaths);
 
 in {
   options.systemd.shutdownRamfs = {
···
       description = ''
         Store paths to copy into the shutdown ramfs as well.
       '';
-      type = lib.types.listOf lib.types.singleLineStr;
+      type = utils.systemdUtils.types.initrdStorePath;
       default = [];
     };
   };
···
       "/etc/initrd-release".source = config.environment.etc.os-release.source;
       "/etc/os-release".source = config.environment.etc.os-release.source;
     };
-    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
+    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"]
+      ++ map (c: builtins.removeAttrs c ["text"]) (builtins.attrValues cfg.contents);
 
     systemd.mounts = [{
       what = "tmpfs";

nixos/modules/virtualisation/proxmox-lxc.nix

···
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 with lib;
 
···
     in
     mkIf cfg.enable {
       system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
-        storeContents = [{
-          object = config.system.build.toplevel;
-          symlink = "none";
-        }];
+        storeContents = [
+          {
+            object = config.system.build.toplevel;
+            symlink = "none";
+          }
+        ];
 
-        contents = [{
-          source = config.system.build.toplevel + "/init";
-          target = "/sbin/init";
-        }];
+        contents = [
+          {
+            source = config.system.build.toplevel + "/init";
+            target = "/sbin/init";
+          }
+        ];
 
         extraCommands = "mkdir -p root etc/systemd/network";
       };
 
+      boot.postBootCommands = ''
+        # After booting, register the contents of the Nix store in the Nix
+        # database.
+        if [ -f /nix-path-registration ]; then
+          ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration &&
+          rm /nix-path-registration
+        fi
+
+        # nixos-rebuild also requires a "system" profile
+        ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+      '';
+
       boot = {
         isContainer = true;
         loader.initScript.enable = true;
···
       };
 
       systemd = {
-        mounts = mkIf (!cfg.privileged) [{
-          enable = false;
-          where = "/sys/kernel/debug";
-        }];
-        services."getty@".unitConfig.ConditionPathExists = [ "" "/dev/%I" ];
+        mounts = mkIf (!cfg.privileged) [
+          {
+            enable = false;
+            where = "/sys/kernel/debug";
+          }
+        ];
+
+        # By default only starts getty on tty0 but first on LXC is tty1
+        services."autovt@".unitConfig.ConditionPathExists = [
+          ""
+          "/dev/%I"
+        ];
+
+        # These are disabled by `console.enable` but console via tty is the default in Proxmox
+        services."getty@tty1".enable = lib.mkForce true;
+        services."autovt@".enable = lib.mkForce true;
       };
 
     };

nixos/tests/rosenpass.nix

···
           enable = true;
           networks."rosenpass" = {
             matchConfig.Name = deviceName;
-            networkConfig.IPForward = true;
+            networkConfig.IPv4Forwarding = true;
+            networkConfig.IPv6Forwarding = true;
             address = [ "${peer.ip}/64" ];
           };
 

nixos/tests/systemd-boot.nix

···
       """
       )
 
-      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot")
+      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
       assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+      assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
+      assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
     '';
   };
 

nixos/tests/systemd-networkd-dhcpserver-static-leases.nix

···
           "01-eth1" = {
             name = "eth1";
             networkConfig = {
-              # IPForward prevents dynamic address configuration
-              IPForward = true;
               DHCPServer = true;
               Address = "10.0.0.1/24";
             };

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

···
             address = [
               "2001:DB8::1/64"
             ];
-            networkConfig.IPForward = true;
+            networkConfig.IPv4Forwarding = true;
+            networkConfig.IPv6Forwarding = true;
           };
         };
       };

nixos/tests/systemd-networkd-vrf.nix

···
         linkConfig.RequiredForOnline = "no";
         networkConfig = {
           Address = "192.168.${toString vlan}.${toString id}/24";
-          IPForward = "yes";
+          IPv4Forwarding = "yes";
+          IPv6Forwarding = "yes";
         };
       };
     };
···
 
         networks."10-vrf1" = {
           matchConfig.Name = "vrf1";
-          networkConfig.IPForward = "yes";
+          networkConfig.IPv4Forwarding = "yes";
+          networkConfig.IPv6Forwarding = "yes";
           routes = [
             { Destination = "192.168.1.2"; Metric = 100; }
           ];
         };
         networks."10-vrf2" = {
           matchConfig.Name = "vrf2";
-          networkConfig.IPForward = "yes";
+          networkConfig.IPv4Forwarding = "yes";
+          networkConfig.IPv6Forwarding = "yes";
           routes = [
             { Destination = "192.168.2.3"; Metric = 100; }
           ];
···
           networkConfig = {
             VRF = "vrf1";
             Address = "192.168.1.1/24";
-            IPForward = "yes";
+            IPv4Forwarding = "yes";
+            IPv6Forwarding = "yes";
           };
         };
         networks."10-eth2" = {
···
           networkConfig = {
             VRF = "vrf2";
             Address = "192.168.2.1/24";
-            IPForward = "yes";
+            IPv4Forwarding = "yes";
+            IPv6Forwarding = "yes";
           };
         };
       };

nixos/tests/systemd.nix

···
         assert "0B read, 0B written" not in output
 
     with subtest("systemd per-unit accounting works"):
-        assert "IP traffic received: 84B" in output_ping
-        assert "IP traffic sent: 84B" in output_ping
+        assert "IP traffic received: 84B sent: 84B" in output_ping
 
     with subtest("systemd environment is properly set"):
         machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ

pkgs/applications/editors/emacs/build-support/generic.nix

···
 , buildInputs ? []
 , packageRequires ? []
 , meta ? {}
+, turnCompilationWarningToError ? false
+, ignoreCompilationError ? true
 , ...
 }@args:
 
···
 
   addEmacsNativeLoadPath = true;
 
+  inherit turnCompilationWarningToError ignoreCompilationError;
+
   postInstall = ''
     # Besides adding the output directory to the native load path, make sure
     # the current package's elisp files are in the load path, otherwise
···
     addEmacsVars "$out"
 
     find $out/share/emacs -type f -name '*.el' -print0 \
-      | xargs -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
-          "emacs --batch --eval '(setq large-file-warning-threshold nil)' -f batch-native-compile {} || true"
+      | xargs --verbose -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
+          "emacs \
+             --batch \
+             --eval '(setq large-file-warning-threshold nil)' \
+             --eval '(setq byte-compile-error-on-warn ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"})' \
+             -f batch-native-compile {} \
+           || exit ${if finalAttrs.ignoreCompilationError then "0" else "\\$?"}"
   '';
 }
 

pkgs/applications/emulators/retroarch/hashes.json

···
         "src": {
             "owner": "libretro",
             "repo": "beetle-pce-libretro",
-            "rev": "3d91a940b3a48254152a8789b79616ceefe4067f",
-            "hash": "sha256-6zXl49Rns6wCZmcEUWkWqYeSH6W1+qs6Sb998pQ/+Lo="
+            "rev": "372184b402852f9b3a3f1663ea676ffa910f6e48",
+            "hash": "sha256-Q15EKf2dKpmnBRx25KDAeiOOXBNUbNKNBBh16diV6tQ="
         },
-        "version": "unstable-2024-06-14"
+        "version": "unstable-2024-07-19"
     },
     "beetle-pce-fast": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "beetle-pce-fast-libretro",
-            "rev": "9ebf08571e20e79db32be78a025a8b552e9a3795",
-            "hash": "sha256-iE81/8RMkCaJuFOMSfZzCC7BFOFBv/0cNpcJRuQC0ws="
+            "rev": "c68ee949ab5a572c0c6541d25b66e997174a09f6",
+            "hash": "sha256-6hGO1GGFMBJxhuGXeUulilSN5zAqYjls/b4pHnoyc0Y="
         },
-        "version": "unstable-2024-06-28"
+        "version": "unstable-2024-07-19"
     },
     "beetle-pcfx": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "a90ceba8339c73abc2f28ff20ec65fce16904816",
-            "hash": "sha256-8e2Qw34+Y1cRxQWATj4F7+SzZEVlwk0Uoo9GHYOM8l4="
+            "rev": "9c3f4dbe9650c31fa690db230243b4eae9a2f131",
+            "hash": "sha256-9TJzviamGLClhS6Y9OUm1HfEtLEREaOzgaIXX4GSMYs="
         },
-        "version": "unstable-2024-07-05"
+        "version": "unstable-2024-07-19"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "bsnes-libretro",
-            "rev": "83591216128368943c509f028d06bc0277c5752d",
-            "hash": "sha256-7y7ZmEigiOIGFKCNJFLWQFT8Tp4oXe3lbVOrprfLzR8="
+            "rev": "5c0115612ea84fefeebf7219c32006cd32b575ec",
+            "hash": "sha256-veOlN2OV6Xxl+GmH7T/DdTVCmEiSgK72QHgT9TGu89w="
         },
-        "version": "unstable-2024-07-05"
+        "version": "unstable-2024-07-19"
     },
     "bsnes-hd": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "schellingb",
             "repo": "dosbox-pure",
-            "rev": "bcb46c4a8803028d5f64935e80433338464dfc0f",
-            "hash": "sha256-ce3QcKonKsuGolB2RhKlWYtHI2Et54/ITG27UkWgQn8="
+            "rev": "1476308debfad87ce377c6cfe62db1398774cd65",
+            "hash": "sha256-Op+3UQoPSHOSBqOdebp9wjgTt0apTLuwlcbooPqMvLU="
         },
-        "version": "unstable-2024-07-07"
+        "version": "unstable-2024-07-20"
     },
     "easyrpg": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "b63598f8120f280db24c3af5433274c6a2eb6d91",
-            "hash": "sha256-2fD2+VhibQGZM7twN2JHc1K4/502v1ZzmmZrE8ODLYk="
+            "rev": "143452d376faf0090d40241c71cc9b532b0605e0",
+            "hash": "sha256-6IzxMuCX6w5QXR7B3Lz/7GfgIwHQ9MaSakb0bHwG5KU="
         },
-        "version": "unstable-2024-07-08"
+        "version": "unstable-2024-07-12"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "libretro-fceumm",
-            "rev": "d2557ae061d7251bf3fff69ec943077d1711ad16",
-            "hash": "sha256-wGbmdSSRc9lZ+K89q/cS8AvSLpfZbVsXByojdnoVSqo="
+            "rev": "744f5d9c8b976a431dcb5417a520c0c709b17fbe",
+            "hash": "sha256-ENkG4H2PiZFHRBbX5GRN/kCFTCZDzbJAV5CplThqaEE="
         },
-        "version": "unstable-2024-07-05"
+        "version": "unstable-2024-07-20"
     },
     "flycast": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "c6f50fad9d4bb735f02444fddb14f53cfb6bacfc",
-            "hash": "sha256-okcCxM8lyaVAMAVzcuGEWAeQvwh9IqOqFpqQYJ6gReY=",
+            "rev": "0b6b8b3753fb219cb0e3a1d55d2ec7948f2e4842",
+            "hash": "sha256-3U7JTNROxi71NpHERlUzGb8i9oaGdsXDtqgClqcO0kM=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-07-05"
+        "version": "unstable-2024-07-19"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "gambatte-libretro",
-            "rev": "5d47507d3e25354478b216111b30741868d0362b",
-            "hash": "sha256-PkvV3ALtC53v+Te9lGuUWeOfXr8CZSxCdClgS59vpns="
+            "rev": "0cf1a421a2123205559c666853cdf9112382fa46",
+            "hash": "sha256-CjcmRMk+fL1WwiiNcFCv8FGeoPl/Ib9jMvXJRzApPNU="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-19"
     },
     "genesis-plus-gx": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "5355eae2e1c70893a14ec0fda68de4e49cd5a0d5",
-            "hash": "sha256-134J1ifF9EOaPk6qqANdJawVtoa1M91Bc5jqxA0hMOM="
+            "rev": "7f3efe569177702f77d1cdfadba6568f82e30112",
+            "hash": "sha256-ABuWTzN0AvHXiODMSVU0lVYr44WGWpjtEuFfe0y6URw="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-20"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "gpsp",
-            "rev": "bfbdfda215889cad5ae314bd5221d773a343b5bd",
-            "hash": "sha256-l3hr5c7kIgr7Rjfneai6cTpUswMpba51TlZSSreQkyE="
+            "rev": "74c4b82cef7793b11892c791cc2379cb87847fb8",
+            "hash": "sha256-JvQ1zJoJg++yPEeXrxQGsoObht0vE3VXwf6ohLLuvw4="
         },
-        "version": "unstable-2024-06-28"
+        "version": "unstable-2024-07-20"
     },
     "gw": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "mame2003-plus-libretro",
-            "rev": "85edcf558832f0e0e0fcf61ebe0b8d041ef6a0c1",
-            "hash": "sha256-AlscqXw8sV3yrMNPOjtwW8BjBKhXtfNYaLpEMZexq5g="
+            "rev": "eb6295935f5be566fb3aa34dae2856596c37c214",
+            "hash": "sha256-eYHbPi6rWvwrTPhwGGs2OmvKgs1Ks3SF+6/wgPyvUJw="
         },
-        "version": "unstable-2024-07-08"
+        "version": "unstable-2024-07-20"
     },
     "mame2010": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "mupen64plus-libretro-nx",
-            "rev": "147dc7e552b84d5c51d09108fa5ada0268710170",
-            "hash": "sha256-qsjoal3r/4QRJ0B5FcupZBhf9gyeIfok5cxsjeNJhrM="
+            "rev": "c7cd8edcd015ddcbd4a2e984573c9c1d1ddd0b6e",
+            "hash": "sha256-QSGPfl29darzo5p8TiJbSMvezYkfRxon/XiObh5PULY="
         },
-        "version": "unstable-2024-06-28"
+        "version": "unstable-2024-07-19"
     },
     "neocd": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "pcsx_rearmed",
-            "rev": "459f02ad03fa10b5c403fed724d47fe5adfd5fb1",
-            "hash": "sha256-bM2o6ukVXyrH9QnczHUtZCLu6Kwl6Gc9DriLvVHJmXw="
+            "rev": "e87127f85b42b8ca4273f7962cdef8c30c2e2090",
+            "hash": "sha256-X8fcy83wGKuaYI91VTSbbOeURKNPFYbUpMliw8hat3Q="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-16"
     },
     "picodrive": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "a5753e582963e8555985abdfe6b5692bac52d701",
-            "hash": "sha256-OabW7OYitDzMh2bbAokfM+HwMaLo2cY3/FB78/ouvrY=",
+            "rev": "fea21169c4d1fd6aa19f8a5c2ef960af2a3be554",
+            "hash": "sha256-GoLETeWLvtP+DMGkFL/nDhjt85P0pgr1/NTNif1PCCo=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-10"
+        "version": "unstable-2024-07-19"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "hrydgard",
             "repo": "ppsspp",
-            "rev": "0b76d443e2c6992107666111d6c0ab994a39451d",
-            "hash": "sha256-PMt8zqDbGhVUeHIA2uvBvQAfsaCwZzVcnLT8fJ6Fexo=",
+            "rev": "5edd02ef0a81fec0b9f0e6423cbea96123af083f",
+            "hash": "sha256-h+hXuRT/0UizOeJgdG4kqWk3mzl6Y88IdHDK/2XqsPA=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-07-02"
+        "version": "unstable-2024-07-20"
     },
     "prboom": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "smsplus-gx",
-            "rev": "96fa9bc65aa27a5ab2779f9f2ff0439fec7cf513",
-            "hash": "sha256-tlxlI0+5QFgu2IRB4Cpz9XItbhprLNlq1YdCFGXGyIE="
+            "rev": "081d956e07188ba9204595c9f15d34b2b0664796",
+            "hash": "sha256-oVzoVvbqxbyZytXLdnlpeYZDefRRG8mxBFdhgFCPPHM="
         },
-        "version": "unstable-2023-10-31"
+        "version": "unstable-2024-07-20"
     },
     "snes9x": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "921f9f7b83660eb44ad263022a57a4a029057c37",
-            "hash": "sha256-trKxGE1WDG7JM7qbhd4o9nvSW6noYobU7nZ/Nz2NeS8="
+            "rev": "881eeaed9a0d7b6ce9b16b094f25101785f0e39e",
+            "hash": "sha256-ZDp/k9TuaVUp9xH9rvzfpbB0VSJbCFRbkMcnR/oPWLM="
         },
-        "version": "unstable-2024-07-07"
+        "version": "unstable-2024-07-14"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "snes9x2002",
-            "rev": "540baad622d9833bba7e0696193cb06f5f02f564",
-            "hash": "sha256-WJh8Qf1/uFaL9f9d28qXsbpeAZfYGPgjoty3G6XAKSs="
+            "rev": "2790d03b2266c58444429b4f7d76ba298e0bde87",
+            "hash": "sha256-kTZrEeZcaFey7gmLbPEG82T6n3cxxZkKminRP543oZA="
         },
-        "version": "unstable-2022-08-06"
+        "version": "unstable-2024-06-28"
     },
     "snes9x2005": {
         "fetcher": "fetchFromGitHub",
···
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "365e29cf5869a196070d73a9b2a2e2c80ac8f0ad",
-            "hash": "sha256-TiVGzLwK1FJlpHl70lj2Yc4q2i5KQ9WRsbMvGWy5IU0="
+            "rev": "b17b0e4348b3e21f67f84568b12a26a95d0631dc",
+            "hash": "sha256-Q+sDPXclfKnPFmMjgxtlY6/iK6ZnegwQ3uNoqUhDkoo="
         },
-        "version": "unstable-2024-07-08"
+        "version": "unstable-2024-07-15"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",

pkgs/applications/misc/calibre/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.13.0";
+  version = "7.15.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-t0nSLsT3X5MoYHhLjbRpqyKbV6NdAqNurSjbcik/n7Q=";
+    hash = "sha256-03CRYdi5dX3+S+o4wDehsFzI36AGLAF5e/TtfmYmBis=";
   };
 
   patches = [

pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix

···
-{ lib
-, fetchFromGitHub
-, buildGoPackage
-}:
-
-buildGoPackage rec {
-  pname = "ssm-session-manager-plugin";
-  version = "1.2.650.0";
-
-  goPackagePath = "github.com/aws/session-manager-plugin";
-
-  src = fetchFromGitHub {
-    owner = "aws";
-    repo = "session-manager-plugin";
-    rev = version;
-    hash = "sha256-IcDVt/iE/EYV9Blvl7Gj0UFJcdsUCFdaSQkIto0CKRI=";
-  };
-
-  postPatch = ''
-    mv vendor{,-old}
-    mv vendor-old/src vendor
-    rm -r vendor-old
-  '';
-
-  preBuild = ''
-    pushd go/src/${lib.escapeShellArg goPackagePath}
-    echo -n ${lib.escapeShellArg version} > VERSION
-    go run src/version/versiongenerator/version-gen.go
-    popd
-  '';
-
-  doCheck = true;
-  checkFlags = [ "-skip=TestSetSessionHandlers" ];
-
-  preCheck = ''
-    if ! [[ $(go/bin/sessionmanagerplugin-main --version) = ${lib.escapeShellArg version} ]]; then
-      echo 'wrong version'
-      exit 1
-    fi
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm555 go/bin/sessionmanagerplugin-main "$out/bin/session-manager-plugin"
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html";
-    description = "Amazon SSM Session Manager Plugin";
-    mainProgram = "session-manager-plugin";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ amarshall mbaillie ];
-  };
-}

pkgs/applications/version-management/gitlab/data.json

···
 {
-  "version": "17.1.2",
-  "repo_hash": "08nd4194wyb1rs47crcq7vci9b5a6izda23bkjavc0iwdsibf0c3",
-  "yarn_hash": "1xyc3c3hhfp5lgrpacj4gsfbql3wn0brdp16ivnqg4n0csjlizq7",
+  "version": "17.2.0",
+  "repo_hash": "0g3g0nwxwv0h7i49qlv1835n9gh0cw8hikms62jl89nv1ca833yr",
+  "yarn_hash": "119acrb27gpmh4m6vk917y4djfm9319jnys0mrqj183diw8j3zcn",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.1.2-ee",
+  "rev": "v17.2.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.1.2",
-    "GITLAB_PAGES_VERSION": "17.1.2",
-    "GITLAB_SHELL_VERSION": "14.36.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.0.0",
-    "GITLAB_WORKHORSE_VERSION": "17.1.2"
+    "GITALY_SERVER_VERSION": "17.2.0",
+    "GITLAB_PAGES_VERSION": "17.2.0",
+    "GITLAB_SHELL_VERSION": "14.37.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
+    "GITLAB_WORKHORSE_VERSION": "17.2.0"
   }
 }

pkgs/applications/version-management/gitlab/gitaly/default.nix

···
 }:
 
 let
-  version = "17.1.2";
+  version = "17.2.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
···
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-KL6BL5iSOUV0iu0omDGc7upl45p0yet92DiP4DesB+Q=";
+      hash = "sha256-thQ8Gufcygt3QEbIcmkroSuAky9kJ7f7hupim87AJdE=";
     };
 
-    vendorHash = "sha256-yOm0cPC8v6L3gkekUMpf5U86XzpnmeoLTgZSFBb02BA=";
+    vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 

pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.0.0";
+  version = "5.2.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    hash = "sha256-856lRCW4+FIiXjOzMkfoYws6SMIKXWVtvr+867QEjCk=";
+    hash = "sha256-pkZWIsPWUDkjZo48mJ9N8LbMJJAHNI2Wf6X0F5+K23s=";
   };
 
-  vendorHash = "sha256-2XdbTqNGt97jQUJmE06D6M/VxF9+vJAwMM/fF8MP2oo=";
+  vendorHash = "sha256-hFTvNh/N3z99O7dtAEiksonJcTn7Zj7Ijp68vfXEBw8=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/version-management/gitlab/gitlab-pages/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.1.2";
+  version = "17.2.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-QnB5VH8iPWdMCK690REepws6hvX0e++6DNX2vE9t2JM=";
+    hash = "sha256-Rw78xDkOf/LDINsWqNGkMSjUXkbgVlSI6PTiZLHo2Wo=";
   };
 
-  vendorHash = "sha256-uVpkCl5rSAtg6gDnL3d11AaOlGNpS2xaPtJrthUNbfE=";
+  vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.36.0";
+  version = "14.37.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    hash = "sha256-SclRIIUZm1D5fYDrTH1L8opQpxxIoi+SrG2GO7wtScU=";
+    hash = "sha256-to4ZIFKEiM4FCznoLrvHua9/hIqiHcviALzfay+1rb8=";
   };
 
   buildInputs = [ ruby libkrb5 ];
···
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-Ebs9HnHhK4y6+vwLRvVwQnG8I7Gk6leBBezjkc+bhJo=";
+  vendorHash = "sha256-TbjpCCo/ZdFP+yE2h8B8kwS08iUilXNgBT2F5Si7/dc=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

···
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.1.2";
+  version = "17.2.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
···
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-7iit/YJHxvrFYfnppwPox+gEAHea7/eq83vMPojWUWU=";
+  vendorHash = "sha256-ZWpuJTlGCsjjURa8iYTaGMKulx99uyYJ+dr2cL9hiwo=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

···
 gem 'responders', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'sprockets', '~> 3.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sprockets-rails', '~>  3.5.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'view_component', '~> 3.12.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 
 gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'faraday', '~> 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Authorization
···
 gem 'bcrypt', '~> 3.1', '>= 3.1.14' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'doorkeeper-device_authorization_grant', '~> 1.0.0', feature_category: :system_access
 gem 'rexml', '~> 3.2.6' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'ruby-saml', '~> 1.15.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
···
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GraphQL API
-gem 'graphql', '~> 2.3.4', feature_category: :api
-gem 'graphql-docs', '~> 4.0.0', group: [:development, :test], feature_category: :api
-gem 'graphiql-rails', '~> 1.8.0', feature_category: :api
+gem 'graphql', '~> 2.3.5', feature_category: :api
+gem 'graphql-docs', '~> 5.0.0', group: [:development, :test], feature_category: :api
+gem 'graphiql-rails', '~> 1.10', feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
 gem 'graphlient', '~> 0.6.0', feature_category: :importers # Used by BulkImport feature (group::import)
 
···
 gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-core', '~> 3.197.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-core', '~> 3.199.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-s3', '~> 1.151.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.154.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 gem 'asciidoctor', '~> 2.0.18' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'asciidoctor-plantuml', '~> 0.0.16' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'asciidoctor-kroki', '~> 0.8.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'rouge', '~> 4.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'asciidoctor-kroki', '~> 0.10.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rouge', '~> 4.3.0', feature_category: :shared
 gem 'truncato', '~> 0.7.12' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'nokogiri', '~> 1.16' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'gitlab-glfm-markdown', '~> 0.0.17', feature_category: :team_planning
 
 # Calendar rendering
-gem 'icalendar' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'icalendar', '~> 2.10.1', feature_category: :system_access
 
 # Diffs
 gem 'diffy', '~> 3.4' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'diff_match_patch', '~> 0.1.0', path: 'vendor/gems/diff_match_patch', feature_category: :team_planning
 
 # Application server
-gem 'rack', '~> 2.2.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rack', '~> 2.2.9' # rubocop:todo Gemfile/MissingFeatureCategory
 # https://github.com/zombocom/rack-timeout/blob/master/README.md#rails-apps-manually
-gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rack-timeout', '~> 0.7.0', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
 
 group :puma do
   gem 'puma', '= 6.4.0', require: false, feature_category: :shared
···
 gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations
 
 # Slack integration
-gem 'slack-messenger', '~> 2.3.4', feature_category: :integrations
+gem 'slack-messenger', '~> 2.3.5', feature_category: :integrations
 
 # FogBugz integration
 gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers
···
 # Detect and convert string character encoding
 # We forked charlock_holmes at https://gitlab.com/gitlab-org/ruby/gems/charlock_holmes
 # but changed it's name to 'static_holmes' in the gemspec file.
-gem 'static_holmes', '~> 0.7.7', require: 'charlock_holmes' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'static_holmes', '~> 0.7.11', require: 'charlock_holmes', feature_category: :shared
 
 # Detect mime content type from content
 gem 'ruby-magic', '~> 0.6' # rubocop:todo Gemfile/MissingFeatureCategory
···
 gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'gitlab-http', path: 'gems/gitlab-http' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'premailer-rails', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
 gem 'gitlab-labkit', '~> 0.36.0', feature_category: :shared
 gem 'thrift', '>= 0.16.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 
 gem 'batch-loader', '~> 2.0.5' # rubocop:todo Gemfile/MissingFeatureCategory
 
+gem 'tty-prompt', '~> 0.23', require: false, feature_category: :shared
+
 # Perf bar
 gem 'peek', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'prometheus-client-mmap', '~> 1.1', '>= 1.1.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory
 
+# Event-driven reactor for Ruby
+gem 'async', '~> 2.12.1' # rubocop:disable Gemfile/MissingFeatureCategory -- This is general utility gem
+
 # OpenTelemetry
 group :opentelemetry do
   # Core OpenTelemetry gems
···
   gem 'rubocop', feature_category: :tooling
   gem 'solargraph', '~> 0.47.2', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'letter_opener_web', '~> 2.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'letter_opener_web', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'lookbook', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Better errors handler
···
 
   gem 'listen', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'ruby-lsp', "~> 0.16.7", require: false, feature_category: :tooling
+  gem 'ruby-lsp', "~> 0.17.0", require: false, feature_category: :tooling
 
   gem 'ruby-lsp-rails', "~> 0.3.6", feature_category: :tooling
 
···
 group :development, :test do
   gem 'deprecation_toolkit', '~> 1.5.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'bullet', '~> 7.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
-  # Locked on 3.3.0.5 until inspec-core is updated in Omnibus: https://github.com/inspec/inspec/pull/7030
-  gem 'parser', '= 3.3.0.5', feature_category: :shared
+  gem 'parser', '= 3.3.3.0', feature_category: :shared
   gem 'pry-byebug' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'pry-rails', '~> 0.3.9' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'pry-shell', '~> 0.6.4' # rubocop:todo Gemfile/MissingFeatureCategory
···
 end
 
 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 4.7.0', require: false, feature_category: :tooling
+  gem 'gitlab-dangerfiles', '~> 4.8.0', require: false, feature_category: :tooling
 end
 
 group :development, :test, :coverage do
···
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'gitlab_quality-test_tooling', '~> 1.28.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 1.31.0', require: false, feature_category: :tooling
 end
 
-gem 'octokit', '~> 8.1', feature_category: :importers
+gem 'octokit', '~> 9.0', feature_category: :importers
 
 gem 'gitlab-mail_room', '~> 0.0.24', require: 'mail_room', feature_category: :shared
 
···
 gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 17.0.1', feature_category: :gitaly
+gem 'gitaly', '~> 17.1.0', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.5.0', feature_category: :deployment_management
···
 
 # JSON
 gem 'jsonb_accessor', '~> 1.3.10' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'json', '~> 2.6.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'json', '~> 2.7.2', feature_category: :shared
 gem 'json_schemer', '~> 0.2.18' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'oj', '~> 3.13.21' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'oj-introspect', '~> 0.7' # rubocop:todo Gemfile/MissingFeatureCategory

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

···
     click_house-client (0.1.0)
       activesupport (< 8)
       addressable (~> 2.8)
-      json (~> 2.6.3)
+      json (~> 2.7.2)
 
 PATH
   remote: gems/csv_builder
···
     asciidoctor (2.0.18)
     asciidoctor-include-ext (0.4.0)
       asciidoctor (>= 1.5.6, < 3.0.0)
-    asciidoctor-kroki (0.8.0)
+    asciidoctor-kroki (0.10.0)
       asciidoctor (~> 2.0)
     asciidoctor-plantuml (0.0.16)
       asciidoctor (>= 2.0.17, < 3.0.0)
     ast (2.4.2)
+    async (2.12.1)
+      console (~> 1.25, >= 1.25.2)
+      fiber-annotation
+      io-event (~> 1.6, >= 1.6.5)
     atlassian-jwt (0.2.1)
       jwt (~> 2.1)
     attr_required (1.0.1)
···
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.197.0)
+    aws-sdk-core (3.199.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
···
     aws-sdk-kms (1.76.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.151.0)
-      aws-sdk-core (~> 3, >= 3.194.0)
+    aws-sdk-s3 (1.154.0)
+      aws-sdk-core (~> 3, >= 3.199.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
     aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.8.0)
+    axe-core-api (4.9.1)
       dumb_delegator
       virtus
-    axe-core-rspec (4.9.0)
-      axe-core-api
+    axe-core-rspec (4.9.1)
+      axe-core-api (= 4.9.1)
       dumb_delegator
       virtus
     axiom-types (0.1.1)
···
     commonmarker (0.23.10)
     concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
+    console (1.25.2)
+      fiber-annotation
+      fiber-local (~> 1.1)
+      json
     cork (0.3.0)
       colored2 (~> 3.1)
     cose (1.3.0)
···
     danger-gitlab (8.0.0)
       danger
       gitlab (~> 4.2, >= 4.2.0)
-    dartsass (1.49.8)
     database_cleaner-active_record (2.1.0)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
···
       unf (>= 0.0.5, < 1.0.0)
     doorkeeper (5.6.6)
       railties (>= 5)
+    doorkeeper-device_authorization_grant (1.0.3)
+      doorkeeper (~> 5.5)
     doorkeeper-openid_connect (1.8.7)
       doorkeeper (>= 5.5, < 5.7)
       jwt (>= 2.5)
···
     factory_bot_rails (6.4.3)
       factory_bot (~> 6.4)
       railties (>= 5.0.0)
-    faraday (1.10.0)
+    faraday (1.10.3)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
···
       rake
     ffi-yajl (2.6.0)
       libyajl2 (>= 1.2)
+    fiber-annotation (0.2.0)
+    fiber-local (1.1.0)
+      fiber-storage
+    fiber-storage (0.1.2)
     find_a_port (1.0.1)
     flipper (0.26.2)
       concurrent-ruby (< 2)
···
     git (1.18.0)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (17.0.2)
+    gitaly (17.1.2)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-dangerfiles (4.7.0)
+    gitlab-dangerfiles (4.8.0)
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
       rake (~> 13.0)
···
       mime-types
     gitlab-glfm-markdown (0.0.17)
       rb_sys (= 0.9.94)
-    gitlab-labkit (0.36.0)
+    gitlab-labkit (0.36.1)
       actionpack (>= 5.0.0, < 8.0.0)
       activesupport (>= 5.0.0, < 8.0.0)
       grpc (>= 1.62)
···
       redis-namespace (>= 1.8.2)
     gitlab-markup (1.9.0)
     gitlab-net-dns (0.9.2)
-    gitlab-sdk (0.3.0)
+    gitlab-sdk (0.3.1)
       activesupport (>= 5.2.0)
       rake (~> 13.0)
       snowplow-tracker (~> 0.8.0)
···
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (1.28.0)
+    gitlab_quality-test_tooling (1.31.0)
       activesupport (>= 7.0, < 7.2)
       amatch (~> 0.4.1)
       gitlab (~> 4.19)
···
     grape-swagger (2.1.0)
       grape (>= 1.7, < 3.0)
       rack-test (~> 2)
-    grape-swagger-entity (0.5.1)
-      grape-entity (>= 0.6.0)
-      grape-swagger (>= 1.2.0)
+    grape-swagger-entity (0.5.4)
+      grape-entity (~> 1)
+      grape-swagger (~> 2)
     grape_logging (1.8.4)
       grape
       rack
-    graphiql-rails (1.8.0)
+    graphiql-rails (1.10.0)
       railties
-      sprockets-rails
     graphlient (0.6.0)
       faraday (>= 1.0)
       faraday_middleware
       graphql-client
     graphlyte (1.0.0)
-    graphql (2.3.4)
+    graphql (2.3.5)
       base64
-    graphql-client (0.19.0)
+    graphql-client (0.23.0)
       activesupport (>= 3.0)
-      graphql
-    graphql-docs (4.0.0)
+      graphql (>= 1.13.0)
+    graphql-docs (5.0.0)
       commonmarker (~> 0.23, >= 0.23.6)
-      dartsass (~> 1.49)
       escape_utils (~> 1.2)
       extended-markdown-filter (~> 0.4)
       gemoji (~> 3.0)
       graphql (~> 2.0)
       html-pipeline (~> 2.14, >= 2.14.3)
+      sass-embedded (~> 1.58)
     grpc (1.63.0)
       google-protobuf (~> 3.25)
       googleapis-common-protos-types (~> 1.0)
···
     i18n (1.14.4)
       concurrent-ruby (~> 1.0)
     i18n_data (0.13.1)
-    icalendar (2.8.0)
+    icalendar (2.10.1)
       ice_cube (~> 0.16)
     ice_cube (0.16.4)
     ice_nine (0.11.2)
···
     influxdb-client (3.1.0)
     invisible_captcha (2.1.0)
       rails (>= 5.2)
+    io-event (1.6.5)
     ipaddr (1.2.5)
     ipaddress (0.8.3)
     jaeger-client (1.1.0)
···
       character_set (~> 1.4)
       regexp_parser (~> 2.5)
       regexp_property_values (~> 1.0)
-    json (2.6.3)
+    json (2.7.2)
     json-jwt (1.15.3)
       activesupport (>= 4.2)
       aes_key_wrap
···
     language_server-protocol (3.17.0.3)
     launchy (2.5.0)
       addressable (~> 2.7)
-    lefthook (1.6.14)
-    letter_opener (1.7.0)
-      launchy (~> 2.2)
-    letter_opener_web (2.0.0)
-      actionmailer (>= 5.2)
-      letter_opener (~> 1.7)
-      railties (>= 5.2)
+    lefthook (1.6.18)
+    letter_opener (1.10.0)
+      launchy (>= 2.2, < 4)
+    letter_opener_web (3.0.0)
+      actionmailer (>= 6.1)
+      letter_opener (~> 1.9)
+      railties (>= 6.1)
       rexml
     libyajl2 (2.1.0)
     license_finder (7.1.0)
···
       tomlrb (>= 1.3, < 2.1)
       with_env (= 1.1.0)
       xml-simple (~> 1.1.9)
-    licensee (9.16.1)
-      dotenv (~> 2.0)
-      octokit (>= 4.20, < 9.0)
+    licensee (9.17.1)
+      dotenv (>= 2, < 4)
+      octokit (>= 4.20, < 10.0)
       reverse_markdown (>= 1, < 3)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
···
       rake (~> 13.0)
     locale (2.1.3)
     lockbox (1.3.0)
+    logger (1.6.0)
     lograge (0.11.2)
       actionpack (>= 4)
       activesupport (>= 4)
···
     loofah (2.22.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    lookbook (2.3.1)
+    lookbook (2.3.2)
       activemodel
       css_parser
       htmlbeautifier (~> 1.3)
···
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0)
       version_gem (~> 1.1)
-    octokit (8.1.0)
-      base64
+    octokit (9.1.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     ohai (18.1.3)
···
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
     parallel (1.24.0)
-    parser (3.3.0.5)
+    parser (3.3.3.0)
       ast (~> 2.4.1)
       racc
     parslet (1.8.2)
···
       google-protobuf (>= 3.22.3)
     plist (3.7.0)
     png_quantizator (0.2.1)
-    premailer (1.16.0)
+    premailer (1.23.0)
       addressable
-      css_parser (>= 1.6.0)
+      css_parser (>= 1.12.0)
       htmlentities (>= 4.0.0)
-    premailer-rails (1.10.3)
+    premailer-rails (1.12.0)
       actionmailer (>= 3)
+      net-smtp
       premailer (~> 1.7, >= 1.7.9)
     prime (0.1.2)
       forwardable
···
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.6.2)
-    rack (2.2.8.1)
+    rack (2.2.9)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.7.0)
       rack (>= 1.0, < 4)
-    rack-cors (2.0.1)
+    rack-cors (2.0.2)
       rack (>= 2.0.0)
     rack-oauth2 (1.21.3)
       activesupport
···
       rack (< 3)
     rack-test (2.1.0)
       rack (>= 1.3)
-    rack-timeout (0.6.3)
+    rack-timeout (0.7.0)
     rails (7.0.8.4)
       actioncable (= 7.0.8.4)
       actionmailbox (= 7.0.8.4)
···
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     rb_sys (0.9.94)
+    rbs (3.5.1)
+      logger
     rbtrace (0.5.1)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
···
     rexml (3.2.6)
     rinku (2.0.0)
     rotp (6.3.0)
-    rouge (4.2.0)
+    rouge (4.3.0)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
···
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
       multipart-post (~> 2.0)
-    ruby-lsp (0.16.7)
+    ruby-lsp (0.17.4)
       language_server-protocol (~> 3.17.0)
-      prism (>= 0.29.0, < 0.30)
+      prism (>= 0.29.0, < 0.31)
+      rbs (>= 3, < 4)
       sorbet-runtime (>= 0.5.10782)
-    ruby-lsp-rails (0.3.6)
-      ruby-lsp (>= 0.16.5, < 0.17.0)
-      sorbet-runtime (>= 0.5.9897)
-    ruby-lsp-rspec (0.1.11)
-      ruby-lsp (~> 0.16.0)
+    ruby-lsp-rails (0.3.7)
+      ruby-lsp (>= 0.17.0, < 0.18.0)
+    ruby-lsp-rspec (0.1.12)
+      ruby-lsp (~> 0.17.0)
     ruby-magic (0.6.0)
       mini_portile2 (~> 2.8)
     ruby-openai (3.7.0)
···
     sanitize (6.0.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
+    sass-embedded (1.77.5)
+      google-protobuf (>= 3.25, < 5.0)
+      rake (>= 13)
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
···
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    semver_dialects (3.0.1)
+    semver_dialects (3.4.0)
       deb_version (~> 1.0.1)
       pastel (~> 0.8.0)
       thor (~> 1.3)
···
     simplecov_json_formatter (0.1.4)
     singleton (0.1.1)
     sixarm_ruby_unaccent (1.2.0)
-    slack-messenger (2.3.5)
-      re2 (= 2.7.0)
+    slack-messenger (2.3.6)
+      re2 (~> 2.7, >= 2.7.0)
     snaky_hash (2.0.0)
       hashie
       version_gem (~> 1.1)
···
     sprockets (3.7.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.4.2)
-      actionpack (>= 5.2)
-      activesupport (>= 5.2)
+    sprockets-rails (3.5.1)
+      actionpack (>= 6.1)
+      activesupport (>= 6.1)
       sprockets (>= 3.0.0)
     ssh_data (1.3.0)
     ssrf_filter (1.0.8)
···
     state_machines-activerecord (0.8.0)
       activerecord (>= 5.1)
       state_machines-activemodel (>= 0.8.0)
-    static_holmes (0.7.7)
+    static_holmes (0.7.11)
     strings (0.2.1)
       strings-ansi (~> 0.2)
       unicode-display_width (>= 1.5, < 3.0)
···
   arr-pm (~> 0.0.12)
   asciidoctor (~> 2.0.18)
   asciidoctor-include-ext (~> 0.4.0)
-  asciidoctor-kroki (~> 0.8.0)
+  asciidoctor-kroki (~> 0.10.0)
   asciidoctor-plantuml (~> 0.0.16)
+  async (~> 2.12.1)
   atlassian-jwt (~> 0.2.1)
   attr_encrypted (~> 3.2.4)!
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.197.0)
-  aws-sdk-s3 (~> 1.151.0)
+  aws-sdk-core (~> 3.199.0)
+  aws-sdk-s3 (~> 1.154.0)
   axe-core-rspec (~> 4.9.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
···
   diffy (~> 3.4)
   discordrb-webhooks (~> 3.5)
   doorkeeper (~> 5.6, >= 5.6.6)
+  doorkeeper-device_authorization_grant (~> 1.0.0)
   doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
   duo_api (~> 1.3)
   ed25519 (~> 1.3.0)
···
   email_spec (~> 2.2.0)
   error_tracking_open_api!
   factory_bot_rails (~> 6.4.3)
-  faraday (~> 1.0)
+  faraday (~> 1.10.3)
   faraday_middleware-aws-sigv4 (~> 0.3.0)
   fast_blank (~> 1.0.1)
   ffaker (~> 2.23)
···
   gdk-toogle (~> 0.9, >= 0.9.5)
   gettext (~> 3.4, >= 3.4.9)
   gettext_i18n_rails (~> 1.12.0)
-  gitaly (~> 17.0.1)
+  gitaly (~> 17.1.0)
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 4.7.0)
+  gitlab-dangerfiles (~> 4.8.0)
   gitlab-experiment (~> 0.9.1)
   gitlab-fog-azure-rm (~> 1.9.1)
   gitlab-glfm-markdown (~> 0.0.17)
···
   gitlab-utils!
   gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 1.28.0)
+  gitlab_quality-test_tooling (~> 1.31.0)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
···
   grape-swagger (~> 2.1.0)
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8, >= 1.8.4)
-  graphiql-rails (~> 1.8.0)
+  graphiql-rails (~> 1.10)
   graphlient (~> 0.6.0)
   graphlyte (~> 1.0.0)
-  graphql (~> 2.3.4)
-  graphql-docs (~> 4.0.0)
+  graphql (~> 2.3.5)
+  graphql-docs (~> 5.0.0)
   grpc (~> 1.63)
   gssapi (~> 1.3.1)
   guard-rspec
···
   html-pipeline (~> 2.14.3)
   html2text
   httparty (~> 0.21.0)
-  icalendar
+  icalendar (~> 2.10.1)
   influxdb-client (~> 3.1)
   invisible_captcha (~> 2.1.0)
   ipaddr (~> 1.2.5)
···
   ipynbdiff!
   jira-ruby (~> 2.3.0)
   js_regex (~> 3.8)
-  json (~> 2.6.3)
+  json (~> 2.7.2)
   json_schemer (~> 0.2.18)
   jsonb_accessor (~> 1.3.10)
   jwt (~> 2.5)
···
   kramdown (~> 2.3.1)
   kubeclient (~> 4.11.0)
   lefthook (~> 1.6.8)
-  letter_opener_web (~> 2.0.0)
+  letter_opener_web (~> 3.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.16)
   listen (~> 3.7)
···
   net-protocol (~> 0.1.3)
   nokogiri (~> 1.16)
   oauth2 (~> 2.0)
-  octokit (~> 8.1)
+  octokit (~> 9.0)
   ohai (~> 18.1)
   oj (~> 3.13.21)
   oj-introspect (~> 0.7)
···
   os (~> 1.1, >= 1.1.4)
   pact (~> 1.64)
   parallel (~> 1.19)
-  parser (= 3.3.0.5)
+  parser (= 3.3.3.0)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.6)
   pg_query (~> 5.1.0)
   png_quantizator (~> 0.2.1)
-  premailer-rails (~> 1.10.3)
+  premailer-rails (~> 1.12.0)
   prometheus-client-mmap (~> 1.1, >= 1.1.1)
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.4)
   puma (= 6.4.0)
-  rack (~> 2.2.8.1)
+  rack (~> 2.2.9)
   rack-attack (~> 6.7.0)
   rack-cors (~> 2.0.1)
   rack-oauth2 (~> 1.21.3)
   rack-proxy (~> 0.7.7)
-  rack-timeout (~> 0.6.3)
+  rack-timeout (~> 0.7.0)
   rails (~> 7.0.8.4)
   rails-controller-testing
   rails-i18n (~> 7.0, >= 7.0.9)
···
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.2.6)
-  rouge (~> 4.2.0)
+  rouge (~> 4.3.0)
   rqrcode (~> 2.2)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0, >= 1.0.2)
···
   rspec_profiling (~> 0.0.9)
   rubocop
   ruby-fogbugz (~> 0.3.0)
-  ruby-lsp (~> 0.16.7)
+  ruby-lsp (~> 0.17.0)
   ruby-lsp-rails (~> 0.3.6)
   ruby-lsp-rspec (~> 0.1.10)
   ruby-magic (~> 0.6)
···
   simplecov (~> 0.22)
   simplecov-cobertura (~> 2.1.0)
   simplecov-lcov (~> 0.8.0)
-  slack-messenger (~> 2.3.4)
+  slack-messenger (~> 2.3.5)
   snowplow-tracker (~> 0.8.0)
   solargraph (~> 0.47.2)
   spamcheck (~> 1.3.0)
···
   spring-commands-rspec (~> 1.0.4)
   sprite-factory (~> 1.7)
   sprockets (~> 3.7.0)
+  sprockets-rails (~> 3.5.1)
   ssh_data (~> 1.3)
   stackprof (~> 0.2.25)
   state_machines-activerecord (~> 0.8.0)
-  static_holmes (~> 0.7.7)
+  static_holmes (~> 0.7.11)
   sys-filesystem (~> 1.4.3)
   tanuki_emoji (~> 0.9)
   telesignenterprise (~> 2.2)
···
   timfel-krb5-auth (~> 0.8)
   toml-rb (~> 2.2.0)
   truncato (~> 0.7.12)
+  tty-prompt (~> 0.23)
   typhoeus (~> 1.4.0)
   undercover (~> 0.4.4)
   unleash (~> 3.2.2)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dhsickf1i4cr1w3l9imbqizv67yx1iqh2dhj3lvvkk7j4s3yfz5";
+      sha256 = "0qih280cjsh3nmywa5ja6kbrd576qmkxnp9zbmxjw3hjizc2ahlf";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.10.0";
   };
   asciidoctor-plantuml = {
     dependencies = ["asciidoctor"];
···
       type = "gem";
     };
     version = "2.4.2";
+  };
+  async = {
+    dependencies = ["console" "fiber-annotation" "io-event"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "199yvq9m9kx3svaxdrqg8ainfh2p7gfmkrlspc5d8nnhysnb6vql";
+      type = "gem";
+    };
+    version = "2.12.1";
   };
   atlassian-jwt = {
     dependencies = ["jwt"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "146v6mhf8gma5vmzhz643sddwzhv3acapv7nhaisv4fcsf1lii1l";
+      sha256 = "1lb21zc9fax6c97dq17h7bllm2cg39ms6hi9ya9z88lsdz8sgnj6";
       type = "gem";
     };
-    version = "3.197.0";
+    version = "3.199.0";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "023h9xx65dd91z1sk9znhfwp4wr48imnnhdhvczv64m17r7ych4y";
+      sha256 = "035d5q3csa1ac51xmxs2cqqibiifhm9sfdh71xjh0yrxnywdwqbh";
       type = "gem";
     };
-    version = "1.151.0";
+    version = "1.154.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bx67lskxslfd2mpim3kqrxa4sx4qhvnpjpr57j1ll2xppyl9kw8";
+      sha256 = "1n7yv7s9mdxa3zz00gj93fsczk58ia3i1lj5adab677fpwbar9wy";
       type = "gem";
     };
-    version = "4.8.0";
+    version = "4.9.1";
   };
   axe-core-rspec = {
     dependencies = ["axe-core-api" "dumb_delegator" "virtus"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fnzb49lmxs18lc6z6araqy1j7jiqh8naiwq9hjj3i7hbajizy75";
+      sha256 = "1zbf7rd353i6y1rr9ysk18kj3ivazfi3ma2ny6ryzminxrxhdvri";
       type = "gem";
     };
-    version = "4.9.0";
+    version = "4.9.1";
   };
   axiom-types = {
     dependencies = ["descendants_tracker" "ice_nine" "thread_safe"];
···
     };
     version = "2.4.1";
   };
+  console = {
+    dependencies = ["fiber-annotation" "fiber-local" "json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hz9j70qyqsszckmvbdywrrgpsf3j5pvfj2l4wn7nlhf3f6by3s6";
+      type = "gem";
+    };
+    version = "1.25.2";
+  };
   cork = {
     dependencies = ["colored2"];
     groups = ["default" "development"];
···
       type = "gem";
     };
     version = "8.0.0";
-  };
-  dartsass = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0i8kivfa4i1m2msw2h5zigxdnar5fvln7xhym85qyp35lmi74zi6";
-      type = "gem";
-    };
-    version = "1.49.8";
   };
   database_cleaner-active_record = {
     dependencies = ["activerecord" "database_cleaner-core"];
···
     };
     version = "5.6.6";
   };
+  doorkeeper-device_authorization_grant = {
+    dependencies = ["doorkeeper"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0y96jc05c26ld35q121yj1g7lfcb55jfsn6d1s2l42fml09arhwl";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
   doorkeeper-openid_connect = {
     dependencies = ["doorkeeper" "jwt"];
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00palwawk897p5gypw5wjrh93d4p0xz2yl9w93yicb4kq7amh8d4";
+      sha256 = "1c760q0ks4vj4wmaa7nh1dgvgqiwaw0mjr7v8cymy7i3ffgjxx90";
       type = "gem";
     };
-    version = "1.10.0";
+    version = "1.10.3";
   };
   faraday-em_http = {
     groups = ["danger" "default" "development" "test"];
···
     };
     version = "2.6.0";
   };
+  fiber-annotation = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00vcmynyvhny8n4p799rrhcx0m033hivy0s1gn30ix8rs7qsvgvs";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  fiber-local = {
+    dependencies = ["fiber-storage"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01lz929qf3xa90vra1ai1kh059kf2c8xarfy6xbv1f8g457zk1f8";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  fiber-storage = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0b5fr7i4p2gfqv6k2d93124zcv2kbdzvamalbcb1hn1yzm12gxq2";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   find_a_port = {
     groups = ["default" "development" "test"];
     platforms = [];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10ms9zz9j1zvabgdldpsn0s8g7v8q7vn3dkyvzh551iijzqcvlgc";
+      sha256 = "0prcxb5ahqpxdswg2957d24k6w74rlnm0x7qlv5p0dr4qzp51x6y";
       type = "gem";
     };
-    version = "17.0.2";
+    version = "17.1.2";
   };
   gitlab = {
     dependencies = ["httparty" "terminal-table"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jj5w7h457cm2q0ds63kp29ybkq1h02gibn37y2r0wnbimm8fxi5";
+      sha256 = "1nr3llbg4vqs9w3027gmxgv5lhh80fd78kgk7fk79j9famwx09xk";
       type = "gem";
     };
-    version = "4.7.0";
+    version = "4.8.0";
   };
   gitlab-experiment = {
     dependencies = ["activesupport" "request_store"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10gr7886pphgxg8ja1axba022l0b1c5mvqi1hfdhrvbh70f1vwim";
+      sha256 = "0063h3aksh4jp5s7mrir5r2dr94643x736cgxvf1zz75nx0nkyq4";
       type = "gem";
     };
-    version = "0.36.0";
+    version = "0.36.1";
   };
   gitlab-license = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00w9p1h3awari07vh33h65y1l1jh7sgym8fzgcp5q5aihha0y9i2";
+      sha256 = "0457dvz8zsb4fav85ry1v5pdzpyr41q397zgqzvjvfaa9w44kfj8";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.3.1";
   };
   gitlab-secret_detection = {
     dependencies = ["parallel" "re2" "toml-rb"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wsizq4hxcwkd8si14q7hb8rxh9hygpm3s7s0f8cyz2b62ycdcnh";
+      sha256 = "0ljg28wf9vmi6bc639fcf19abx5i4a3h04bjvdwr2ih1pbr3hgf1";
       type = "gem";
     };
-    version = "1.28.0";
+    version = "1.31.0";
   };
   globalid = {
     dependencies = ["activesupport"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08smc3c2li1xa2nmgjkn742sp1xj9qzppy28v68cz5mc00nkf7pm";
+      sha256 = "0wdmkdq907swkf5x8vgj4i166mqh7nnqp612x7768g2jwr6n9h9l";
       type = "gem";
     };
-    version = "0.5.1";
+    version = "0.5.4";
   };
   grape_logging = {
     dependencies = ["grape" "rack"];
···
     version = "1.8.4";
   };
   graphiql-rails = {
-    dependencies = ["railties" "sprockets-rails"];
+    dependencies = ["railties"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lcf0gc88i3wk8cs71qm62ac9lrc1a8v5sd0369c5ip2ic4wbqh2";
+      sha256 = "0h0hi4i49hd7087ba7kh78wykc9gqnz0j9hlhplvkj1ply4zjmxm";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.10.0";
   };
   graphlient = {
     dependencies = ["faraday" "faraday_middleware" "graphql-client"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0df94lkqsis1kqgjch12mkm8fh55d6s1lqp2fvjj6xr310v323q2";
+      sha256 = "1w8ahq2sry3hw2p7lmq4sd9ybkky4qr1dn634h6nchb5z0sphdlw";
       type = "gem";
     };
-    version = "2.3.4";
+    version = "2.3.5";
   };
   graphql-client = {
     dependencies = ["activesupport" "graphql"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1iv9d6l14h05vnhrzmm5fn2cnjb469an28c9z7c6p4bgjy0rssgy";
+      sha256 = "1hdb5fd1vd1zs7kc84ng7lj95081dqwrapyidg8alsv7a7jbhf7j";
       type = "gem";
     };
-    version = "0.19.0";
+    version = "0.23.0";
   };
   graphql-docs = {
-    dependencies = ["commonmarker" "dartsass" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline"];
+    dependencies = ["commonmarker" "escape_utils" "extended-markdown-filter" "gemoji" "graphql" "html-pipeline" "sass-embedded"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mq2zafz0n5yd0i251w1a37l3dk7dn2mhw5snzhjdnv3jaard0pn";
+      sha256 = "011dasgfg93s39p2nnf88v2w9ds2czqxpgxvkxm4nfl0b9pcmfkn";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "5.0.0";
   };
   grpc = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11zfs0l8y2a6gpf0krm91d0ap2mnf04qky89dyzxwaspqxqgj174";
+      sha256 = "03ki7wm2iqr3dv7mgrxv2b8vbh42c7yv55dc33a077n8jnxhhc8z";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.10.1";
   };
   ice_cube = {
     groups = ["default"];
···
       type = "gem";
     };
     version = "2.1.0";
+  };
+  io-event = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qjcgf02p99r46s0sdr95s0dfc4dik946iqsv9iiahazmi2c192x";
+      type = "gem";
+    };
+    version = "1.6.5";
   };
   ipaddr = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nalhin1gda4v8ybk6lq8f407cgfrj6qzn234yra4ipkmlbfmal6";
+      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
       type = "gem";
     };
-    version = "2.6.3";
+    version = "2.7.2";
   };
   json-jwt = {
     dependencies = ["activesupport" "aes_key_wrap" "bindata" "httpclient"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rbw6vr1chabkd0p3sqxcpva77vxgk3a1pzrv7h4m73jx4bixdbq";
+      sha256 = "0wri6j02jkq75qgd4mpdmi2444lzcvyf63nvkfz9p31rvsj44v5n";
       type = "gem";
     };
-    version = "1.6.14";
+    version = "1.6.18";
   };
   letter_opener = {
     dependencies = ["launchy"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09a7kgsmr10a0hrc9bwxglgqvppjxij9w8bxx91mnvh0ivaw0nq9";
+      sha256 = "1cnv3ggnzyagl50vzs1693aacv08bhwlprcvjp8jcg2w7cp3zwrg";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.10.0";
   };
   letter_opener_web = {
     dependencies = ["actionmailer" "letter_opener" "railties" "rexml"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vvvaz2ngaxv0s6sj25gdvp73vd8pfl8q3jharadg18p3va0m1ik";
+      sha256 = "0q4qfi5wnn5bv93zjf10agmzap3sn7gkfmdbryz296wb1vz1wf9z";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "3.0.0";
   };
   libyajl2 = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05g5w9c4jlfhwn0hfz117s1c7hfdm5yn7cywr4mah7xr41yvbh04";
+      sha256 = "16h8yhk4z2wk2lc0l0m7z2pbbk6mfljhy6hp11dx6lw8dp325q0b";
       type = "gem";
     };
-    version = "9.16.1";
+    version = "9.17.1";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify"];
···
     };
     version = "1.3.0";
   };
+  logger = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gpg8gzi0xwymw4aaq2iafcbx31i3xzkg3fb30mdxn1d4qhc3dqa";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
   lograge = {
     dependencies = ["actionpack" "activesupport" "railties" "request_store"];
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ffwg0lnvzfaxp9z7gynll1d4hlxm4ma2c05qcwqrznj7d7jkfnn";
+      sha256 = "02hniq2gjckb0s70w2p90aymrf4x8lpjl0mq1arhl5fr2gmyzkdb";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.3.2";
   };
   lru_redux = {
     groups = ["default"];
···
     version = "2.0.9";
   };
   octokit = {
-    dependencies = ["base64" "faraday" "sawyer"];
+    dependencies = ["faraday" "sawyer"];
     groups = ["danger" "default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kgqga0ycrlrk586gw2s7f8p4w699gjj3zvmmqkhx4afnplrq8l2";
+      sha256 = "0lw2537cdgxx9la7d5jwm3qkk5bwarz1v3glh68n4b3js9cscjbq";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "9.1.0";
   };
   ohai = {
     dependencies = ["chef-config" "chef-utils" "ffi" "ffi-yajl" "ipaddress" "mixlib-cli" "mixlib-config" "mixlib-log" "mixlib-shellout" "plist" "train-core" "wmi-lite"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11r6kp8wam0nkfvnwyc1fmvky102r1vcfr84vi2p1a2wa0z32j3p";
+      sha256 = "1sryynf3iws1b2ffba1gvmlpf8jzhfva5p0qdf37x6wdj683rqm2";
       type = "gem";
     };
-    version = "3.3.0.5";
+    version = "3.3.3.0";
   };
   parslet = {
     groups = ["default" "development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11j7d6abxivj15yax47z3f751wz4pnl02qszzc9swswf8hn41r03";
+      sha256 = "1yvy5lxq287izy7qsz23hry63rc57wkaaalqvxnwjncm56xgdmzh";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.23.0";
   };
   premailer-rails = {
-    dependencies = ["actionmailer" "premailer"];
+    dependencies = ["actionmailer" "net-smtp" "premailer"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bqi7d4f15vy3f1g0xb3bxmncfbzv9dd3ilhqj0plvw64xqbkp3w";
+      sha256 = "0004f73kgrglida336fqkgx906m6n05nnfc17mypzg5rc78iaf61";
       type = "gem";
     };
-    version = "1.10.3";
+    version = "1.12.0";
   };
   prime = {
     dependencies = ["forwardable" "singleton"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10mpk0hl6hnv324fp1pfimi2nw9acj0z4gyhrph36qg84pk1s4m7";
+      sha256 = "0hj0rkw2z9r1lcg2wlrcld2n3phwrcgqcp7qd1g9a7hwgalh2qzx";
       type = "gem";
     };
-    version = "2.2.8.1";
+    version = "2.2.9";
   };
   rack-accept = {
     dependencies = ["rack"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02lvkg1nb4z3zc2nry545dap7a64bb9h2k8waxfz0jkabkgnpimw";
+      sha256 = "06ysmn14pdf2wyr7agm0qvvr9pzcgyf39w4yvk2n05w9k4alwpa1";
       type = "gem";
     };
-    version = "2.0.1";
+    version = "2.0.2";
   };
   rack-oauth2 = {
     dependencies = ["activesupport" "attr_required" "httpclient" "json-jwt" "rack"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cqa9lh2rdqqvhfxbrdys7mj2x4vxhqmf57iww2x8961mhp8jm0p";
+      sha256 = "1nc7kis61n4q7g78gxxsxygam022glmgwq9snydrkjiwg7lkfwvm";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.7.0";
   };
   rails = {
     dependencies = ["actioncable" "actionmailbox" "actionmailer" "actionpack" "actiontext" "actionview" "activejob" "activemodel" "activerecord" "activestorage" "activesupport" "railties"];
···
     };
     version = "0.9.94";
   };
+  rbs = {
+    dependencies = ["logger"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1bnb361ca6gizncs8qybfrm1m9pin2siw548pizfd5l711mrzn4f";
+      type = "gem";
+    };
+    version = "3.5.1";
+  };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fkfa0iq3r9b0zzrxpxha17avmyzci3kidzmfbf6fd1279mndpb0";
+      sha256 = "072qvvrcqj0yfr3b0j932mlhvn41i38bq37z7z07i3ikagndkqwy";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.3.0";
   };
   rqrcode = {
     dependencies = ["chunky_png" "rqrcode_core"];
···
     version = "0.3.0";
   };
   ruby-lsp = {
-    dependencies = ["language_server-protocol" "prism" "sorbet-runtime"];
+    dependencies = ["language_server-protocol" "prism" "rbs" "sorbet-runtime"];
     groups = ["development"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0730631afd1iadx51izm2adygwqd7aii95gdmy405d847x35bmf3";
+      sha256 = "04z280c4mimfwpfgcw2j6b13g1vni0cnrfgwjs9bgkzm95m1vsj9";
       type = "gem";
     };
-    version = "0.16.7";
+    version = "0.17.4";
   };
   ruby-lsp-rails = {
-    dependencies = ["ruby-lsp" "sorbet-runtime"];
+    dependencies = ["ruby-lsp"];
     groups = ["development"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pdr6ir97af633lg0dkdasjflfmrlf50ad4x4jq7a712x4p1fxag";
+      sha256 = "1w4vvhy8nyffj7bp17842kg6szhfz27w8pni0a7haam78hb86b1r";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "0.3.7";
   };
   ruby-lsp-rspec = {
     dependencies = ["ruby-lsp"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11nc5ysf3rq47v7h9v17ivmca62bj7lm6x80fy5fpj45vxh7pz1l";
+      sha256 = "1r8i93fq4ijnxbh9pfh5df0d0pl8xr23s7whvwqjyk6w4xg7gzil";
       type = "gem";
     };
-    version = "0.1.11";
+    version = "0.1.12";
   };
   ruby-magic = {
     dependencies = ["mini_portile2"];
···
     };
     version = "6.0.2";
   };
+  sass-embedded = {
+    dependencies = ["google-protobuf" "rake"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nmy052pm46781s7ca6x3l4yb5p3glh8sf201xwcwpk9rv2av9m2";
+      type = "gem";
+    };
+    version = "1.77.5";
+  };
   sawyer = {
     dependencies = ["addressable" "faraday"];
     groups = ["danger" "default" "development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d9q502kp1az64lk0psblgdi50s5mr8x8g8k19avivkna0v5z6fs";
+      sha256 = "0ndbdsac42sl6ldh6jji7k0agc85v6d28wfd3jb3awyl7hsgs9cn";
       type = "gem";
     };
-    version = "3.0.1";
+    version = "3.4.0";
   };
   sentry-rails = {
     dependencies = ["railties" "sentry-ruby"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kb3dhp38wllw8f54qcik05zw0w4v0a5171cqmgjqp6c63mb0q63";
+      sha256 = "1n367s0wjym1czllgwycgya13r3axgjfpivc6dlvgjzbgmc1wn2q";
       type = "gem";
     };
-    version = "2.3.5";
+    version = "2.3.6";
   };
   snaky_hash = {
     dependencies = ["hashie" "version_gem"];
···
   };
   sprockets-rails = {
     dependencies = ["actionpack" "activesupport" "sprockets"];
-    groups = ["default" "test"];
+    groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b9i14qb27zs56hlcc2hf139l0ghbqnjpmfi0054dxycaxvk5min";
+      sha256 = "0j7gwm749b3ff6544wxa878fpd1kvf2qc9fafassi8c7735jcin4";
       type = "gem";
     };
-    version = "3.4.2";
+    version = "3.5.1";
   };
   ssh_data = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01w2vjm0sssiw3j38jhgkqsqn1wdqnm2ld24hi8ib2bj47c2di47";
+      sha256 = "1frj0w4bmqpih40sxxig3055rm2ijnw6jkdvnbh5crlq6pnv6p63";
       type = "gem";
     };
-    version = "0.7.7";
+    version = "0.7.11";
   };
   strings = {
     dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];

pkgs/applications/version-management/gomp/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "gomp";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "11nq40igqbyfiygdzb1zyxx1n6d9xkv8vlmprbbi75mq54gfihhb";
+    sha256 = "sha256-Ixq9jtV56FKbh68jqmRd3lwpbMG00GcOUIpjzJhnSp0=";
   };
 
   doCheck = false; # tests require interactive terminal

pkgs/applications/video/mpv/scripts/mpv-webm.nix

···
 
 buildLua {
   pname = "mpv-webm";
-  version = "0-unstable-2024-05-13";
+  version = "0-unstable-2024-07-20";
 
   src = fetchFromGitHub {
     owner = "ekisu";
     repo = "mpv-webm";
-    rev = "8d4902b2aec92f40e4595ec9a411ab90488dcf4e";
-    hash = "sha256-aPPVAZu9reDdyovSpDklYZYLaapKBclAx3lCYUMJt+w=";
+    rev = "64844ec52b7a17d621ddceacf77e1e933f856b3c";
+    hash = "sha256-Unz8DQtm4sc/u0ciWoOdLcAEDZL+AjD+2T4q61Gzdns=";
   };
   passthru.updateScript = unstableGitUpdater {
     # only "latest" tag pointing at HEAD

pkgs/build-support/kernel/make-initrd-ng.nix

···
   ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
   passAsFile = ["contents"];
-  contents = lib.concatMapStringsSep "\n" ({ object, symlink, ... }: "${object}\n${lib.optionalString (symlink != null) symlink}") contents + "\n";
+  contents = builtins.toJSON contents;
 
   nativeBuildInputs = [makeInitrdNGTool libarchive] ++ lib.optional makeUInitrd ubootTools ++ lib.optional strip binutils;
 

pkgs/build-support/kernel/make-initrd-ng/Cargo.lock

···
 checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
 
 [[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "make-initrd-ng"
···
 dependencies = [
  "eyre",
  "goblin",
+ "serde",
+ "serde_json",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "scroll"
···
 ]
 
 [[package]]
+name = "serde"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.203"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d947f6b3163d8857ea16c4fa0dd4840d52f3041039a85decd46867eb1abef2e4"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
 name = "syn"
-version = "2.0.48"
+version = "2.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
 dependencies = [
  "proc-macro2",
  "quote",

pkgs/build-support/kernel/make-initrd-ng/Cargo.toml

···
 [dependencies]
 eyre = "0.6.8"
 goblin = "0.5.0"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"

pkgs/build-support/kernel/make-initrd-ng/src/main.rs

···
-use std::collections::{HashSet, VecDeque};
+use std::collections::{BTreeSet, HashSet, VecDeque};
 use std::env;
 use std::ffi::{OsStr, OsString};
 use std::fs;
 use std::hash::Hash;
-use std::io::{BufRead, BufReader};
 use std::iter::FromIterator;
 use std::os::unix;
 use std::path::{Component, Path, PathBuf};
···
 
 use eyre::Context;
 use goblin::{elf::Elf, Object};
+use serde::Deserialize;
+
+#[derive(PartialEq, Eq, PartialOrd, Ord, Clone, Copy, Debug, Deserialize, Hash)]
+#[serde(rename_all = "lowercase")]
+enum DLOpenPriority {
+    Required,
+    Recommended,
+    Suggested,
+}
+
+#[derive(PartialEq, Eq, Debug, Deserialize, Clone, Hash)]
+#[serde(rename_all = "camelCase")]
+struct DLOpenConfig {
+    use_priority: DLOpenPriority,
+    features: BTreeSet<String>,
+}
+
+#[derive(Deserialize, Debug)]
+struct DLOpenNote {
+    soname: Vec<String>,
+    feature: Option<String>,
+    // description is in the spec, but we don't need it here.
+    // description: Option<String>,
+    priority: Option<DLOpenPriority>,
+}
+
+#[derive(Deserialize, Debug, PartialEq, Eq, Hash, Clone)]
+struct StoreInput {
+    source: String,
+    target: Option<String>,
+    dlopen: Option<DLOpenConfig>,
+}
+
+#[derive(PartialEq, Eq, Hash, Clone)]
+struct StorePath {
+    path: Box<Path>,
+    dlopen: Option<DLOpenConfig>,
+}
 
 struct NonRepeatingQueue<T> {
     queue: VecDeque<T>,
···
     }
 }
 
-fn add_dependencies<P: AsRef<Path> + AsRef<OsStr>>(
+fn add_dependencies<P: AsRef<Path> + AsRef<OsStr> + std::fmt::Debug>(
     source: P,
     elf: Elf,
-    queue: &mut NonRepeatingQueue<Box<Path>>,
-) {
+    contents: &[u8],
+    dlopen: &Option<DLOpenConfig>,
+    queue: &mut NonRepeatingQueue<StorePath>,
+) -> eyre::Result<()> {
     if let Some(interp) = elf.interpreter {
-        queue.push_back(Box::from(Path::new(interp)));
+        queue.push_back(StorePath {
+            path: Box::from(Path::new(interp)),
+            dlopen: dlopen.clone(),
+        });
+    }
+
+    let mut dlopen_libraries = vec![];
+    if let Some(dlopen) = dlopen {
+        for n in elf
+            .iter_note_sections(&contents, Some(".note.dlopen"))
+            .into_iter()
+            .flatten()
+        {
+            let note = n.wrap_err_with(|| format!("bad note in {:?}", source))?;
+            // Payload is padded and zero terminated
+            let payload = &note.desc[..note
+                .desc
+                .iter()
+                .position(|x| *x == 0)
+                .unwrap_or(note.desc.len())];
+            let parsed = serde_json::from_slice::<Vec<DLOpenNote>>(payload)?;
+            for mut parsed_note in parsed {
+                if dlopen.use_priority
+                    >= parsed_note.priority.unwrap_or(DLOpenPriority::Recommended)
+                    || parsed_note
+                        .feature
+                        .map(|f| dlopen.features.contains(&f))
+                        .unwrap_or(false)
+                {
+                    dlopen_libraries.append(&mut parsed_note.soname);
+                }
+            }
+        }
     }
 
     let rpaths = if elf.runpaths.len() > 0 {
···
         .map(|p| Box::<Path>::from(Path::new(p)))
         .collect::<Vec<_>>();
 
-    for line in elf.libraries {
+    for line in elf
+        .libraries
+        .into_iter()
+        .map(|s| s.to_string())
+        .chain(dlopen_libraries)
+    {
         let mut found = false;
         for path in &rpaths_as_path {
-            let lib = path.join(line);
+            let lib = path.join(&line);
             if lib.exists() {
                 // No need to recurse. The queue will bring it back round.
-                queue.push_back(Box::from(lib.as_path()));
+                queue.push_back(StorePath {
+                    path: Box::from(lib.as_path()),
+                    dlopen: dlopen.clone(),
+                });
                 found = true;
                 break;
             }
···
             );
         }
     }
+
+    Ok(())
 }
 
 fn copy_file<
···
 >(
     source: P,
     target: S,
-    queue: &mut NonRepeatingQueue<Box<Path>>,
+    dlopen: &Option<DLOpenConfig>,
+    queue: &mut NonRepeatingQueue<StorePath>,
 ) -> eyre::Result<()> {
     fs::copy(&source, &target)
         .wrap_err_with(|| format!("failed to copy {:?} to {:?}", source, target))?;
···
         fs::read(&source).wrap_err_with(|| format!("failed to read from {:?}", source))?;
 
     if let Ok(Object::Elf(e)) = Object::parse(&contents) {
-        add_dependencies(source, e, queue);
+        add_dependencies(source, e, &contents, &dlopen, queue)?;
 
         // Make file writable to strip it
         let mut permissions = fs::metadata(&target)
···
 
 fn queue_dir<P: AsRef<Path> + std::fmt::Debug>(
     source: P,
-    queue: &mut NonRepeatingQueue<Box<Path>>,
+    dlopen: &Option<DLOpenConfig>,
+    queue: &mut NonRepeatingQueue<StorePath>,
 ) -> eyre::Result<()> {
     for entry in
         fs::read_dir(&source).wrap_err_with(|| format!("failed to read dir {:?}", source))?
     {
         let entry = entry?;
         // No need to recurse. The queue will bring us back round here on its own.
-        queue.push_back(Box::from(entry.path().as_path()));
+        queue.push_back(StorePath {
+            path: Box::from(entry.path().as_path()),
+            dlopen: dlopen.clone(),
+        });
     }
 
     Ok(())
···
 
 fn handle_path(
     root: &Path,
-    p: &Path,
-    queue: &mut NonRepeatingQueue<Box<Path>>,
+    p: StorePath,
+    queue: &mut NonRepeatingQueue<StorePath>,
 ) -> eyre::Result<()> {
     let mut source = PathBuf::new();
     let mut target = Path::new(root).to_path_buf();
-    let mut iter = p.components().peekable();
+    let mut iter = p.path.components().peekable();
     while let Some(comp) = iter.next() {
         match comp {
             Component::Prefix(_) => panic!("This tool is not meant for Windows"),
···
                     .wrap_err_with(|| format!("failed to get symlink metadata for {:?}", source))?
                     .file_type();
                 if typ.is_file() && !target.exists() {
-                    copy_file(&source, &target, queue)?;
+                    copy_file(&source, &target, &p.dlopen, queue)?;
 
                     if let Some(filename) = source.file_name() {
                         source.set_file_name(OsString::from_iter([
···
 
                         let wrapped_path = source.as_path();
                         if wrapped_path.exists() {
-                            queue.push_back(Box::from(wrapped_path));
+                            queue.push_back(StorePath {
+                                path: Box::from(wrapped_path),
+                                dlopen: p.dlopen.clone(),
+                            });
                         }
                     }
                 } else if typ.is_symlink() {
···
                     }
                     let link_target_path = source.as_path();
                     if link_target_path.exists() {
-                        queue.push_back(Box::from(link_target_path));
+                        queue.push_back(StorePath {
+                            path: Box::from(link_target_path),
+                            dlopen: p.dlopen.clone(),
+                        });
                     }
                     break;
                 } else if typ.is_dir() {
···
 
                     // Only recursively copy if the directory is the target object
                     if iter.peek().is_none() {
-                        queue_dir(&source, queue)
+                        queue_dir(&source, &p.dlopen, queue)
                             .wrap_err_with(|| format!("failed to queue dir {:?}", source))?;
                     }
                 }
···
 
 fn main() -> eyre::Result<()> {
     let args: Vec<String> = env::args().collect();
-    let input =
-        fs::File::open(&args[1]).wrap_err_with(|| format!("failed to open file {:?}", &args[1]))?;
+    let contents =
+        fs::read(&args[1]).wrap_err_with(|| format!("failed to open file {:?}", &args[1]))?;
+    let input = serde_json::from_slice::<Vec<StoreInput>>(&contents)
+        .wrap_err_with(|| format!("failed to parse JSON in {:?}", &args[1]))?;
     let output = &args[2];
     let out_path = Path::new(output);
 
-    let mut queue = NonRepeatingQueue::<Box<Path>>::new();
-
-    let mut lines = BufReader::new(input).lines();
-    while let Some(obj) = lines.next() {
-        // Lines should always come in pairs
-        let obj = obj?;
-        let sym = lines.next().unwrap()?;
+    let mut queue = NonRepeatingQueue::<StorePath>::new();
 
-        let obj_path = Path::new(&obj);
-        queue.push_back(Box::from(obj_path));
-        if !sym.is_empty() {
-            println!("{} -> {}", &sym, &obj);
+    for sp in input {
+        let obj_path = Path::new(&sp.source);
+        queue.push_back(StorePath {
+            path: Box::from(obj_path),
+            dlopen: sp.dlopen,
+        });
+        if let Some(target) = sp.target {
+            println!("{} -> {}", &target, &sp.source);
             // We don't care about preserving symlink structure here
             // nearly as much as for the actual objects.
-            let link_string = format!("{}/{}", output, sym);
+            let link_string = format!("{}/{}", output, target);
             let link_path = Path::new(&link_string);
             let mut link_parent = link_path.to_path_buf();
             link_parent.pop();
···
         }
     }
     while let Some(obj) = queue.pop_front() {
-        handle_path(out_path, &*obj, &mut queue)?;
+        handle_path(out_path, obj, &mut queue)?;
     }
 
     Ok(())

pkgs/build-support/setup-hooks/auto-patchelf.py

···
 import pprint
 import subprocess
 import sys
+import json
 from fnmatch import fnmatch
 from collections import defaultdict
 from contextlib import contextmanager
 from dataclasses import dataclass
 from itertools import chain
 from pathlib import Path, PurePath
-from typing import DefaultDict, Iterator, List, Optional, Set, Tuple
+from typing import DefaultDict, Generator, Iterator, Optional
 
 from elftools.common.exceptions import ELFError  # type: ignore
 from elftools.elf.dynamic import DynamicSection  # type: ignore
+from elftools.elf.sections import NoteSection  # type: ignore
 from elftools.elf.elffile import ELFFile  # type: ignore
 from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI  # type: ignore
 
···
     return bool(elf.get_section_by_name(".interp"))
 
 
-def get_dependencies(elf: ELFFile) -> List[str]:
+def get_dependencies(elf: ELFFile) -> list[list[Path]]:
     dependencies = []
     # This convoluted code is here on purpose. For some reason, using
     # elf.get_section_by_name(".dynamic") does not always return an
···
     for section in elf.iter_sections():
         if isinstance(section, DynamicSection):
             for tag in section.iter_tags('DT_NEEDED'):
-                dependencies.append(tag.needed)
+                dependencies.append([Path(tag.needed)])
             break # There is only one dynamic section
 
     return dependencies
 
 
-def get_rpath(elf: ELFFile) -> List[str]:
+def get_dlopen_dependencies(elf: ELFFile) -> list[list[Path]]:
+    """
+    Extracts dependencies from the `.note.dlopen` section.
+    This is a FreeDesktop standard to annotate binaries with libraries that it may `dlopen`.
+    See https://systemd.io/ELF_DLOPEN_METADATA/
+    """
+    dependencies = []
+    for section in elf.iter_sections():
+        if not isinstance(section, NoteSection) or section.name != ".note.dlopen":
+            continue
+        for note in section.iter_notes():
+            if note["n_type"] != 0x407C0C0A or note["n_name"] != "FDO":
+                continue
+            note_desc = note["n_desc"]
+            text = note_desc.decode("utf-8").rstrip("\0")
+            j = json.loads(text)
+            for d in j:
+                dependencies.append([Path(soname) for soname in d["soname"]])
+    return dependencies
+
+
+def get_rpath(elf: ELFFile) -> list[str]:
     # This convoluted code is here on purpose. For some reason, using
     # elf.get_section_by_name(".dynamic") does not always return an
     # instance of DynamicSection, but that is required to call iter_tags
···
         return [path] if path.match(pattern) else []
 
 
-cached_paths: Set[Path] = set()
-soname_cache: DefaultDict[Tuple[str, str], List[Tuple[Path, str]]] = defaultdict(list)
+cached_paths: set[Path] = set()
+soname_cache: DefaultDict[tuple[str, str], list[tuple[Path, str]]] = defaultdict(list)
 
 
-def populate_cache(initial: List[Path], recursive: bool =False) -> None:
+def populate_cache(initial: list[Path], recursive: bool =False) -> None:
     lib_dirs = list(initial)
 
     while lib_dirs:
···
     found: bool = False     # Whether it was found somewhere
 
 
-def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List[Path] = [], extra_args: List[str] = []) -> list[Dependency]:
+def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], extra_args: list[str] = []) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
···
 
             file_is_dynamic_executable = is_dynamic_executable(elf)
 
-            file_dependencies = map(Path, get_dependencies(elf))
+            file_dependencies = get_dependencies(elf) + get_dlopen_dependencies(elf)
 
     except ELFError:
         return []
···
     # failing at the first one, because it's more useful when working
     # on a new package where you don't yet know the dependencies.
     for dep in file_dependencies:
-        if dep.is_absolute() and dep.is_file():
-            # This is an absolute path. If it exists, just use it.
-            # Otherwise, we probably want this to produce an error when
-            # checked (because just updating the rpath won't satisfy
-            # it).
-            continue
-        elif (libc_lib / dep).is_file():
-            # This library exists in libc, and will be correctly
-            # resolved by the linker.
-            continue
+        was_found = False
+        for candidate in dep:
+
+            # This loop determines which candidate for a given
+            # dependency can be found, and how. There may be multiple
+            # candidates for a dep because of '.note.dlopen'
+            # dependencies.
+            #
+            # 1. If a candidate is an absolute path, it is already a
+            #    valid dependency if that path exists, and nothing needs
+            #    to be done. It should be an error if that path does not exist.
+            # 2. If a candidate is found in our library dependencies, that
+            #    dependency should be added to rpath.
+            # 3. If a candidate is found in libc, it will be correctly
+            #    resolved by the dynamic linker automatically.
+            #
+            # These conditions are checked in this order, because #2
+            # and #3 may both be true. In that case, we still want to
+            # add the dependency to rpath, as the original binary
+            # presumably had it and this should be preserved.
+
+            if candidate.is_absolute() and candidate.is_file():
+                was_found = True
+                break
+            elif found_dependency := find_dependency(candidate.name, file_arch, file_osabi):
+                rpath.append(found_dependency)
+                dependencies.append(Dependency(path, candidate, found=True))
+                print(f"    {candidate} -> found: {found_dependency}")
+                was_found = True
+                break
+            elif (libc_lib / candidate).is_file():
+                was_found = True
+                break
 
-        if found_dependency := find_dependency(dep.name, file_arch, file_osabi):
-            rpath.append(found_dependency)
-            dependencies.append(Dependency(path, dep, True))
-            print(f"    {dep} -> found: {found_dependency}")
-        else:
-            dependencies.append(Dependency(path, dep, False))
-            print(f"    {dep} -> not found!")
+        if not was_found:
+            dep_name = dep[0] if len(dep) == 1 else f"any({', '.join(map(str, dep))})"
+            dependencies.append(Dependency(path, dep_name, found=False))
+            print(f"    {dep_name} -> not found!")
 
     rpath.extend(append_rpaths)
 
···
 
 
 def auto_patchelf(
-        paths_to_patch: List[Path],
-        lib_dirs: List[Path],
-        runtime_deps: List[Path],
+        paths_to_patch: list[Path],
+        lib_dirs: list[Path],
+        runtime_deps: list[Path],
         recursive: bool = True,
-        ignore_missing: List[str] = [],
-        append_rpaths: List[Path] = [],
-        extra_args: List[str] = []) -> None:
+        ignore_missing: list[str] = [],
+        append_rpaths: list[Path] = [],
+        extra_args: list[str] = []) -> None:
 
     if not paths_to_patch:
         sys.exit("No paths to patch, stopping.")

pkgs/by-name/eu/eudic/package.nix

···
+{ fetchurl
+, stdenv
+, autoPatchelfHook
+, makeWrapper
+, lib
+, copyDesktopItems
+, libnotify
+, libX11
+, libXScrnSaver
+, libXext
+, libXtst
+, libuuid
+, libsecret
+, xdg-utils
+, xdg-utils-cxx
+, at-spi2-atk
+# additional dependencies autoPatchelfHook discovered
+, gtk3
+, alsa-lib
+, e2fsprogs
+, nss
+, libgpg-error
+, libjack2
+, mesa
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "eudic";
+  version = "13.5.2";
+
+  src = fetchurl {
+    url = "https://www.eudic.net/download/eudic.deb?v=${finalAttrs.version}";
+    hash = "sha256-UPkDRaqWF/oydH6AMo3t3PUT5VU961EPLcFb5XwOXVs=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libnotify
+    libX11
+    libXScrnSaver
+    libXext
+    libXtst
+    libuuid
+    libsecret
+    xdg-utils
+    xdg-utils-cxx
+    at-spi2-atk
+    # additional dependencies autoPatchelfHook discovered
+    gtk3
+    alsa-lib
+    e2fsprogs
+    nss
+    libgpg-error
+    libjack2
+    mesa
+  ];
+
+  unpackPhase = ''
+    ar x $src
+    tar xf data.tar.xz
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r usr/* $out/
+
+    makeWrapper $out/share/eusoft-eudic/eudic $out/bin/eudic
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Authoritative English Dictionary Software Essential Tools for English Learners";
+    homepage = "https://www.eudic.net/v4/en/app/eudic";
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ onedragon ];
+    mainProgram = "eudic";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/op/openfga/package.nix

···
 
 let
   pname = "openfga";
-  version = "1.5.5";
+  version = "1.5.6";
 in
 
 buildGoModule {
···
     owner = "openfga";
     repo = "openfga";
     rev = "v${version}";
-    hash = "sha256-g6cAN+OhpcBkaVVvHes7ETgKuY7aEhlyvdH7bxiTANA=";
+    hash = "sha256-R5BqaKiW2jhglJ6zPPQF2Ld97YCttocjhfbo0dDGvCI=";
   };
 
-  vendorHash = "sha256-NwEGElYT6dmx5+U166E3XJoP1z3oUjp+jb5WHhVtNrs=";
+  vendorHash = "sha256-zrhLG5msji6t4VPKG85jD8c2XQCRdQkF9UfRMqnzSFM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ss/ssm-session-manager-plugin/0001-module-support.patch

···
+From e246c4f87c1af78be5f5a76f79bd66c27d63918f Mon Sep 17 00:00:00 2001
+From: Paul Meyer <[e-mail]>
+Date: Wed, 3 Jul 2024 21:38:15 +0200
+Subject: [PATCH] module support
+
+Signed-off-by: Paul Meyer <[e-mail]>
+---
+ go.mod | 26 ++++++++++++++++++++++++++
+ go.sum | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 68 insertions(+)
+ create mode 100644 go.mod
+ create mode 100644 go.sum
+
+diff --git a/go.mod b/go.mod
+new file mode 100644
+index 00000000..51c79d4c
+--- /dev/null
++++ b/go.mod
+@@ -0,0 +1,26 @@
++module github.com/aws/session-manager-plugin
++
++go 1.22.3
++
++require (
++	github.com/aws/aws-sdk-go v1.54.14
++	github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575
++	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203
++	github.com/fsnotify/fsnotify v1.7.0
++	github.com/gorilla/websocket v1.5.3
++	github.com/stretchr/testify v1.9.0
++	github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19
++	github.com/xtaci/smux v1.5.24
++	golang.org/x/crypto v0.24.0
++	golang.org/x/sync v0.7.0
++	golang.org/x/sys v0.21.0
++)
++
++require (
++	github.com/davecgh/go-spew v1.1.1 // indirect
++	github.com/jmespath/go-jmespath v0.4.0 // indirect
++	github.com/pmezard/go-difflib v1.0.0 // indirect
++	github.com/stretchr/objx v0.5.2 // indirect
++	golang.org/x/term v0.21.0 // indirect
++	gopkg.in/yaml.v3 v3.0.1 // indirect
++)
+diff --git a/go.sum b/go.sum
+new file mode 100644
+index 00000000..ca623749
+--- /dev/null
++++ b/go.sum
+@@ -0,0 +1,42 @@
++github.com/aws/aws-sdk-go v1.54.14 h1:llJ60MzLzovyDE/rEDbUjS1cICh7krk1PwQwNlKRoeQ=
++github.com/aws/aws-sdk-go v1.54.14/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
++github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 h1:kHaBemcxl8o/pQ5VM1c8PVE1PubbNx3mjUr09OqWGCs=
++github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575/go.mod h1:9d6lWj8KzO/fd/NrVaLscBKmPigpZpn5YawRPw+e3Yo=
++github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
++github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
++github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
++github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
++github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
++github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
++github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
++github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
++github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
++github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
++github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
++github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
++github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
++github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
++github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
++github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
++github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
++github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
++github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
++github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19 h1:HlxV0XiEKMMyjS3gGtJmmFZsxQ22GsLvA7F980il+1w=
++github.com/twinj/uuid v0.0.0-20151029044442-89173bcdda19/go.mod h1:mMgcE1RHFUFqe5AfiwlINXisXfDGro23fWdPUfOMjRY=
++github.com/xtaci/smux v1.5.24 h1:77emW9dtnOxxOQ5ltR+8BbsX1kzcOxQ5gB+aaV9hXOY=
++github.com/xtaci/smux v1.5.24/go.mod h1:OMlQbT5vcgl2gb49mFkYo6SMf+zP3rcjcwQz7ZU7IGY=
++golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
++golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
++golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
++golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
++golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
++golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
++golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
++golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
++gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
++gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
++gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
++gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+-- 
+2.45.1
+

pkgs/by-name/ss/ssm-session-manager-plugin/package.nix

···
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, fetchpatch
+}:
+buildGoModule rec {
+  pname = "ssm-session-manager-plugin";
+  version = "1.2.650.0";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "session-manager-plugin";
+    rev = version;
+    hash = "sha256-IcDVt/iE/EYV9Blvl7Gj0UFJcdsUCFdaSQkIto0CKRI=";
+  };
+
+  patches = [
+    # Add support for Go modules.
+    #
+    # This patch doesn't belong to any upstream PR, it is specially crafted for
+    # nixpkgs. Deleting the vendor dir is left out from the patch and done in
+    # postPatch instead, as otherwise the patch would be to big and GitHub returns
+    # an error.
+    #
+    # With https://github.com/aws/session-manager-plugin/pull/74 there is an
+    # upstream PR with the same goal. It isn't pulled here as patch for the same
+    # reason.
+    #
+    # Notice that the dependencies are pinned with the patch, and upstream dependency
+    # updates won't take effect. Patch should be recreated from time to time.
+    # - `rm -rf vendor`
+    # - `go mod init github.com/aws/session-manager-plugin`
+    # - `go mod tidy`
+    # - `go get github.com/twinj/uuid@v0.0.0-20151029044442-89173bcdda19`
+    # - `go mod tidy`
+    # - `git checkout HEAD vendor`
+    ./0001-module-support.patch
+  ];
+
+  postPatch = ''
+    rm -rf vendor
+  '';
+
+  vendorHash = "sha256-wK+aWRC5yrPtdihXAj6RlYC9ZTTPuGUg9wLY33skzeE=";
+
+  subPackages = [ "src/sessionmanagerplugin-main" ];
+
+  preBuild = ''
+    echo -n ${lib.escapeShellArg version} > VERSION
+    go run src/version/versiongenerator/version-gen.go
+  '';
+
+  doCheck = true;
+  checkFlags = [ "-skip=TestSetSessionHandlers" ];
+
+  preCheck = ''
+    if ! [[ $($GOPATH/bin/sessionmanagerplugin-main --version) = ${lib.escapeShellArg version} ]]; then
+      echo 'wrong version'
+      exit 1
+    fi
+  '';
+
+  meta = {
+    homepage = "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html";
+    description = "Amazon SSM Session Manager Plugin";
+    mainProgram = "session-manager-plugin";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ amarshall mbaillie ];
+  };
+}

pkgs/by-name/ti/tio/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
+  inih,
+  lua,
+  bash-completion,
+  darwin,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tio";
+  version = "3.5";
+
+  src = fetchFromGitHub {
+    owner = "tio";
+    repo = "tio";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-3d3TYHSERIQdw+Iw6qCydGpWRpWrhZwb4SnwV1nVtIk=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [
+    inih
+    lua
+    glib
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.IOKit ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    bash-completion
+  ];
+
+  meta = with lib; {
+    description = "Serial console TTY";
+    homepage = "https://tio.github.io/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ yana ];
+    mainProgram = "tio";
+    platforms = platforms.unix;
+  };
+})

pkgs/by-name/uv/uv/Cargo.lock

···
 
 [[package]]
 name = "uv"
-version = "0.2.26"
+version = "0.2.27"
 dependencies = [
  "anstream",
  "anyhow",
···
  "nanoid",
  "once_cell",
  "path-absolutize",
+ "path-slash",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
···
  "install-wheel-rs",
  "itertools 0.13.0",
  "once_cell",
+ "owo-colors",
  "pep440_rs",
  "pep508_rs",
  "platform-tags",
···
  "reqwest",
  "reqwest-middleware",
  "rmp-serde",
+ "rustix",
  "same-file",
  "schemars",
  "serde",
···
  "uv-warnings",
  "which",
  "winapi",
+ "winsafe",
 ]
 
 [[package]]
···
  "uv-python",
  "uv-state",
  "uv-virtualenv",
- "uv-warnings",
 ]
 
 [[package]]
···
 
 [[package]]
 name = "uv-version"
-version = "0.2.26"
+version = "0.2.27"
 
 [[package]]
 name = "uv-virtualenv"
···
 dependencies = [
  "either",
  "home",
+ "regex",
  "rustix",
  "winsafe",
 ]

pkgs/by-name/uv/uv/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "uv";
-  version = "0.2.26";
+  version = "0.2.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = "refs/tags/${version}";
-    hash = "sha256-JjRXcbRwZyrS0QFfDjlJrMUxXJrkv9uORibwZ11zZ50=";
+    hash = "sha256-KYBHg0E06zeUpyIdPcMQijUorwX4QiiPwacR+UcDFJs=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {

pkgs/development/embedded/edl/default.nix

···
 { lib, stdenv, fetchFromGitHub, python3Packages }:
 
-python3Packages.buildPythonPackage rec {
+python3Packages.buildPythonPackage {
   pname = "edl";
   version = "unstable-2022-09-07";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "bkerler";
     repo = "edl";
     rev = "f6b94da5faa003b48d24a5f4a8f0b8495626fd5b";
     fetchSubmodules = true;
     hash = "sha256-bxnRy+inWNArE2gUA/qDPy7NKvqBm43sbxdIaTc9N28=";
   };
-  # edl has a spurious dependency on "usb" which has nothing to do with the
-  # project and was probably added by accident trying to add pyusb
-  postPatch = ''
-    sed -i '/'usb'/d' setup.py
-  '';
-  # No tests set up
-  doCheck = false;
-  # EDL loaders are ELFs but shouldn't be touched, rest is Python anyways
-  dontStrip = true;
+
   propagatedBuildInputs = with python3Packages; [
     pyusb
     pyserial
···
     pycryptodome
     lxml
     colorama
-    # usb
     capstone
     keystone-engine
   ];
+
+  # No tests set up
+  doCheck = false;
+  # EDL loaders are ELFs but shouldn't be touched, rest is Python anyways
+  dontStrip = true;
+
+  # edl has a spurious dependency on "usb" which has nothing to do with the
+  # project and was probably added by accident trying to add pyusb
+  postPatch = ''
+    sed -i '/'usb'/d' setup.py
+  '';
+
+  postInstall = ''
+    mkdir -p $out/etc/udev/rules.d
+    cp $src/Drivers/51-edl.rules $out/etc/udev/rules.d/51-edl.rules
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/bkerler/edl";

pkgs/development/interpreters/python/cpython/3.13/0001-Fix-build-with-_PY_SHORT_FLOAT_REPR-0.patch

···
-From 94d8a9efe6ec86a6e5b4806dbfb82ac926286456 Mon Sep 17 00:00:00 2001
-From: Yureka <[e-mail]>
-Date: Sun, 30 Jun 2024 09:45:58 +0200
-Subject: [PATCH] Fix build with _PY_SHORT_FLOAT_REPR == 0
-
----
- Include/internal/pycore_dtoa.h | 10 +++-------
- 1 file changed, 3 insertions(+), 7 deletions(-)
-
-diff --git a/Include/internal/pycore_dtoa.h b/Include/internal/pycore_dtoa.h
-index c5cfdf4ce8..e4222c5267 100644
---- a/Include/internal/pycore_dtoa.h
-+++ b/Include/internal/pycore_dtoa.h
-@@ -11,8 +11,6 @@ extern "C" {
- #include "pycore_pymath.h"        // _PY_SHORT_FLOAT_REPR
- 
- 
--#if _PY_SHORT_FLOAT_REPR == 1
--
- typedef uint32_t ULong;
- 
- struct
-@@ -22,15 +20,15 @@ Bigint {
-     ULong x[1];
- };
- 
--#ifdef Py_USING_MEMORY_DEBUGGER
-+#if defined(Py_USING_MEMORY_DEBUGGER) || _PY_SHORT_FLOAT_REPR == 0
- 
- struct _dtoa_state {
-     int _not_used;
- };
--#define _dtoa_interp_state_INIT(INTERP) \
-+#define _dtoa_state_INIT(INTERP) \
-     {0}
- 
--#else  // !Py_USING_MEMORY_DEBUGGER
-+#else  // !Py_USING_MEMORY_DEBUGGER && _PY_SHORT_FLOAT_REPR != 0
- 
- /* The size of the Bigint freelist */
- #define Bigint_Kmax 7
-@@ -66,8 +64,6 @@ extern char* _Py_dg_dtoa(double d, int mode, int ndigits,
-                          int *decpt, int *sign, char **rve);
- extern void _Py_dg_freedtoa(char *s);
- 
--#endif // _PY_SHORT_FLOAT_REPR == 1
--
- 
- extern PyStatus _PyDtoa_Init(PyInterpreterState *interp);
- extern void _PyDtoa_Fini(PyInterpreterState *interp);
--- 
-2.45.1
-

pkgs/development/interpreters/python/cpython/default.nix

···
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.stdenv.cc
     pythonOnBuildForHost
-  ] ++ optionals (stdenv.cc.isClang && !stdenv.isDarwin && (!stdenv.hostPlatform.useAndroidPrebuilt or false) && (enableLTO || enableOptimizations)) [
+  ] ++ optionals (stdenv.cc.isClang && (!stdenv.hostPlatform.useAndroidPrebuilt or false) && (enableLTO || enableOptimizations)) [
     stdenv.cc.cc.libllvm.out
   ];
 
···
     };
   in [
     "${mingw-patch}/*.patch"
-  ]) ++ optionals (pythonAtLeast "3.12") [
+  ]) ++ optionals isPy312 [
     # backport fix for various platforms; armv7l, riscv64, s390
     # https://github.com/python/cpython/pull/121178
-    (
-      if (pythonAtLeast "3.13") then
-        ./3.13/0001-Fix-build-with-_PY_SHORT_FLOAT_REPR-0.patch
-      else
-        ./3.12/0001-Fix-build-with-_PY_SHORT_FLOAT_REPR-0.patch
-    )
+    ./3.12/0001-Fix-build-with-_PY_SHORT_FLOAT_REPR-0.patch
   ];
 
   postPatch = optionalString (!stdenv.hostPlatform.isWindows) ''

pkgs/development/python-modules/asyncua/default.nix

···
 
 buildPythonPackage rec {
   pname = "asyncua";
-  version = "1.1.0";
+  version = "1.1.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "FreeOpcUa";
     repo = "opcua-asyncio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tHlo5oNsb8E6r0vmSi0eVbk4RCMg0xe97LITzW9FQWA=";
+    hash = "sha256-XXjzYDOEBdA4uk0VCzscHrPCY2Lgin0JBAVDdxmSOio=";
     fetchSubmodules = true;
   };
 
   postPatch = ''
-    # https://github.com/FreeOpcUa/opcua-asyncio/issues/1263
-    substituteInPlace setup.py \
-      --replace ", 'asynctest'" ""
-
     # Workaround hardcoded paths in test
     # "test_cli_tools_which_require_sigint"
     substituteInPlace tests/test_tools.py \
-      --replace "tools/" "$out/bin/"
+      --replace-fail "tools/" "$out/bin/"
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiofiles
     aiosqlite
     cryptography
···
 
   pythonImportsCheck = [ "asyncua" ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
+  disabledTests = [
     # Failed: DID NOT RAISE <class 'asyncio.exceptions.TimeoutError'>
     "test_publish"
+  ] ++ lib.optionals stdenv.isDarwin [
     # OSError: [Errno 48] error while attempting to bind on address ('127.0.0.1',...
     "test_anonymous_rejection"
     "test_certificate_handling_success"

pkgs/development/python-modules/django-health-check/default.nix

···
 
 buildPythonPackage rec {
   pname = "django-health-check";
-  version = "3.18.2";
+  version = "3.18.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "KristianOellegaard";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-c0JOfbuVIiTqZo/alJWPN7AB8a3nNdG7euS3scwGHaY=";
+    hash = "sha256-+6+YxB/x4JdKUCwxxe+YIc+r1YAzngFUHiS6atupWM8=";
   };
 
   buildInputs = [

pkgs/development/python-modules/folium/default.nix

···
   branca,
   buildPythonPackage,
   fetchFromGitHub,
+  geodatasets,
   geopandas,
   jinja2,
   nbconvert,
···
   ];
 
   nativeCheckInputs = [
+    geodatasets
     geopandas
     nbconvert
     pandas
···
     "test_notebook"
     "test_valid_png_size"
     "test_valid_png"
+    # pooch tries to write somewhere it can, and geodatasets does not give us an env var to customize this.
+    "test_timedynamic_geo_json"
   ];
 
   pythonImportsCheck = [ "folium" ];
···
     homepage = "https://github.com/python-visualization/folium";
     changelog = "https://github.com/python-visualization/folium/blob/v${version}/CHANGES.txt";
     license = with lib.licenses; [ mit ];
+    maintainers = lib.teams.geospatial.members;
   };
 }

pkgs/development/python-modules/geopandas/default.nix

···
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   pytestCheckHook,
   pythonOlder,
   setuptools,
 
-  fiona,
   packaging,
   pandas,
+  pyogrio,
   pyproj,
   rtree,
   shapely,
···
 
 buildPythonPackage rec {
   pname = "geopandas";
-  version = "0.14.4";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "geopandas";
     repo = "geopandas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FBhPcae8bnNnsfr14I1p22VhoOf9USF9DAcrAqx+zso=";
+    hash = "sha256-SZizjwkx8dsnaobDYpeQm9jeXZ4PlzYyjIScnQrH63Q=";
   };
 
-  patches = [
-    # GDAL 3.9 compat for boolean array in shp
-    (fetchpatch {
-      url = "https://github.com/geopandas/geopandas/commit/f1be60532bed31cb410ce4db2da6b733bc8713c9.patch";
-      sha256 = "sha256-DZhC7sSOki0XTcojSRvVVSlsnYnxCw/Ee7vHBmDCsbA=";
-    })
-
-    # GDAL 3.9 compat for boolean array in shp for fiona
-    (fetchpatch {
-      url = "https://github.com/geopandas/geopandas/commit/1e08422d8aee4877752047a8a08f41e3a67188f2.patch";
-      sha256 = "sha256-SpNqe7jL1rA79YhhSUfEzt30plt56Tux5v1h7IHp31I=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   propagatedBuildInputs = [
-    fiona
     packaging
     pandas
+    pyogrio
     pyproj
     shapely
   ];

pkgs/development/python-modules/objexplore/default.nix

···
 {
-  blessed,
-  buildPythonPackage,
-  fetchFromGitHub,
   lib,
-  pandas,
-  pytestCheckHook,
+  buildPythonPackage,
   pythonOlder,
-  rich,
+  fetchFromGitHub,
   setuptools,
+  blessed,
+  rich,
+  pytestCheckHook,
+  pandas
 }:
 
 buildPythonPackage rec {
···
   src = fetchFromGitHub {
     owner = "kylepollina";
     repo = "objexplore";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-FFQIiip7pk9fQhjGLxMSMakwoXbzaUjXcbQgDX52dnI=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail '==' '>='
-  '';
+  pythonRelaxDeps = [ "blessed" "rich" ];
 
   build-system = [ setuptools ];
 
···
     "objexplore.utils"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Terminal UI to interactively inspect and explore Python objects";
     homepage = "https://github.com/kylepollina/objexplore";
-    license = licenses.mit;
-    maintainers = with maintainers; [ pbsds ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pbsds sigmanificient ];
   };
 }

pkgs/development/python-modules/psd-tools/default.nix

···
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.9.33";
+  version = "1.9.34";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "psd-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4Y4VLfGwopfeIppxwvGKSuelUDAXg67rM/ES9BrTP24=";
+    hash = "sha256-UFdprXoHFsbH3Tbui44n8FTdbkynnYVL1LHtFzFInio=";
   };
 
   postPatch = ''

pkgs/development/python-modules/qdrant-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "qdrant-client";
-  version = "1.9.2";
+  version = "1.10.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "qdrant";
     repo = "qdrant-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F7H06SGKq6jSasY0TQVBmn1TYONVEZn6ArJXlRR4lCc=";
+    hash = "sha256-moBu/VA/bRcpzgDH+CILiy+Xt7kb0e9ASlo+xOLrgTU=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/xknx/default.nix

···
     hash = "sha256-gajxXIR3lmHsW7258v4z20RilzGfm5KGVrXZwRm74Mk=";
   };
 
-  patches = [ ./pytest-asyncio-0.22-compat.patch ];
-
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cryptography
     ifaddr
   ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];

pkgs/development/python-modules/xknx/pytest-asyncio-0.22-compat.patch

···
-diff --git a/test/devices_tests/datetime_test.py b/test/devices_tests/datetime_test.py
-index af06abc6..2145fcc1 100644
---- a/test/devices_tests/datetime_test.py
-+++ b/test/devices_tests/datetime_test.py
-@@ -12,11 +12,6 @@ from xknx.telegram.apci import GroupValueRead, GroupValueResponse, GroupValueWri
- class TestDateTime:
-     """Test class for DateTime object."""
- 
--    # pylint: disable=attribute-defined-outside-init
--    def teardown_method(self):
--        """Cancel broadcast_task."""
--        self.datetime.__del__()
--
-     #
-     # SET Time
-     #
-diff --git a/test/io_tests/secure_session_test.py b/test/io_tests/secure_session_test.py
-index cd2dc1d0..ca90e2d9 100644
---- a/test/io_tests/secure_session_test.py
-+++ b/test/io_tests/secure_session_test.py
-@@ -65,7 +65,6 @@ class TestSecureSession:
- 
-     def teardown_method(self):
-         """Cancel keepalive task."""
--        self.session.stop()
-         self.patch_serial_number.stop()
-         self.patch_message_tag.stop()
- 

pkgs/development/tools/dep2nix/default.nix

···
-{ lib, fetchFromGitHub, buildGoPackage
-, makeWrapper, nix-prefetch-scripts }:
-
-buildGoPackage rec {
-  pname = "dep2nix";
-  version = "unstable-2019-04-02";
-
-  goPackagePath = "github.com/nixcloud/dep2nix";
-
-  src = fetchFromGitHub {
-    owner = "nixcloud";
-    repo = pname;
-    rev = "830684f920333b8ff0946d6b807e8be642eec3ef";
-    sha256 = "17sjxhzhmz4893x3x054anp4xvqd1px15nv3fj2m7i6r0vbgpm0j";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  postFixup = ''
-    wrapProgram $out/bin/dep2nix \
-      --prefix PATH : ${nix-prefetch-scripts}/bin
-  '';
-
-  goDeps = ./deps.nix;
-
-  meta = with lib; {
-    description = "Convert `Gopkg.lock` files from golang dep into `deps.nix`";
-    mainProgram = "dep2nix";
-    license = licenses.bsd3;
-    homepage = "https://github.com/nixcloud/dep2nix";
-    maintainers = [ maintainers.mic92 ];
-  };
-}

pkgs/development/tools/dep2nix/deps.nix

···
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/Masterminds/semver";
-    fetch = {
-      type = "git";
-      url = "https://github.com/carolynvs/semver.git";
-      rev =  "a93e51b5a57ef416dac8bb02d11407b6f55d8929";
-      sha256 = "1rd3p135r7iw0lvaa6vk7afxna87chq61a7a0wqnxd3xgpnpa9ik";
-    };
-  }
-  {
-    goPackagePath  = "github.com/Masterminds/vcs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Masterminds/vcs";
-      rev =  "6f1c6d150500e452704e9863f68c2559f58616bf";
-      sha256 = "02bpyzccazw9lwqchcz349al4vlxnz4m5gzwigk02zg2qpa1j53j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/armon/go-radix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/go-radix";
-      rev =  "1fca145dffbcaa8fe914309b1ec0cfc67500fe61";
-      sha256 = "19jws9ngncpbhghzcy7biyb4r8jh14mzknyk67cvq6ln7kh1qyic";
-    };
-  }
-  {
-    goPackagePath  = "github.com/boltdb/bolt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/boltdb/bolt";
-      rev =  "2f1ce7a837dcb8da3ec595b1dac9d0632f0f99e8";
-      sha256 = "0z7j06lijfi4y30ggf2znak2zf2srv2m6c68ar712wd2ys44qb3r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/dep";
-    fetch = {
-      type = "git";
-      url = "https://github.com/CrushedPixel/dep";
-      rev =  "fa9f32339c8855ebe7e7bc66e549036a7e06d37a";
-      sha256 = "1knaxs1ji1b0b68393f24r8qzvahxz9x7rqwc8jsjlshvpz0hlm6";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "bbd03ef6da3a115852eaf24c8a1c46aeb39aa175";
-      sha256 = "1pyli3dcagi7jzpiazph4fhkz7a3z4bhd25nwbb7g0iy69b8z1g4";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jmank88/nuts";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmank88/nuts";
-      rev =  "8b28145dffc87104e66d074f62ea8080edfad7c8";
-      sha256 = "1d0xj1dj1lfalq3pg15h0c645n84lf122xx3zkm7hawq9zri6n5k";
-    };
-  }
-  {
-    goPackagePath  = "github.com/nightlyone/lockfile";
-    fetch = {
-      type = "git";
-      url = "https://github.com/nightlyone/lockfile";
-      rev =  "6a197d5ea61168f2ac821de2b7f011b250904900";
-      sha256 = "03znnf6rzyyi4h4qj81py1xpfs3pnfm39j4bfc9qzakz5j9y1gdl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pelletier/go-toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-toml";
-      rev =  "acdc4509485b587f5e675510c4f2c63e90ff68a8";
-      sha256 = "1y5m9pngxhsfzcnxh8ma5nsllx74wn0jr47p2n6i3inrjqxr12xh";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sdboyer/constext";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sdboyer/constext";
-      rev =  "836a144573533ea4da4e6929c235fd348aed1c80";
-      sha256 = "0055yw73di4spa1wwpa2pyb708wmh9r3xd8dcv8pn81dba94if1w";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "dc948dff8834a7fe1ca525f8d04e261c2b56e70d";
-      sha256 = "0gkw1am63agb1rgpxr2qhns9npr99mzwrxg7px88qq8h93zzd4kg";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev =  "fd80eb99c8f653c847d294a001bdf2a3a6f768f5";
-      sha256 = "12lzldlj1cqc1babp1hkkn76fglzn5abkqvmbpr4f2j95mf9x836";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "37707fdb30a5b38865cfb95e5aab41707daec7fd";
-      sha256 = "1abrr2507a737hdqv4q7pw7hv6ls9pdiq9crhdi52r3gcz6hvizg";
-    };
-  }
-]

pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch

···
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 0d68f31d36..6b52f7ed4b 100644
+index ad0c7e2fb5..79f3086e78 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -22,10 +22,6 @@ SUBSYSTEM=="block", TAG+="systemd"
- SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
- SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
+@@ -26,10 +26,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
+ # Import previous SYSTEMD_READY state.
+ SUBSYSTEM=="block", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}=="", IMPORT{db}="SYSTEMD_READY"
  
 -# Ignore encrypted devices with no identified superblock on it, since
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # Explicitly set SYSTEMD_READY=1 for DM devices that don't have it set yet, so that we always have something to import above
- SUBSYSTEM=="block", ENV{DM_UUID}=="?*", ENV{SYSTEMD_READY}=="", ENV{SYSTEMD_READY}="1"
- 
+ # add symlink to GPT root disk
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"

pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch

···
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 55e76b6e16..015a608035 100644
+index eac5bb8d3b..d8187bfa99 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
 @@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
···
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 1a9b99d761..04ef9af1ea 100644
+index ca6d36e054..0a9227c9a8 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
 @@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {

pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch

···
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 38196ef3d6..57d1750b00 100644
+index 4fee8a693c..756ce11b1f 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5602,6 +5602,7 @@ static int run(int argc, char *argv[]) {
+@@ -6028,6 +6028,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
···
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5618,6 +5619,7 @@ static int run(int argc, char *argv[]) {
+@@ -6044,6 +6045,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }

pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch

···
  2 files changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 4e3d59fc56..0d18b9a2d0 100644
+index 540256b73b..a115ec09a3 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
-@@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
+@@ -123,11 +123,7 @@ int runtime_directory(char **ret, RuntimeScope scope, const char *suffix) {
  }
  
  static const char* const user_data_unit_paths[] = {
···
          NULL
  };
  
-@@ -613,16 +609,13 @@ int lookup_paths_init(
+@@ -634,16 +630,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
···
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -638,14 +631,11 @@ int lookup_paths_init(
+@@ -659,14 +652,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
···
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -805,7 +795,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -825,7 +815,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
···
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -813,7 +802,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -833,7 +822,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
···
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -852,14 +840,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+@@ -872,14 +860,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",

pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch

···
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index e61ebee253..22cc5cc843 100644
+index 04103e0fe9..e26c6c5cfd 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1562,7 +1562,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1611,7 +1611,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  

pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch

···
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index e1d53f2395..a224e6dadc 100644
+index 82d08803fa..8e40b77eba 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1116,6 +1116,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
···
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1116,6 +1119,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1178,6 +1181,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
···
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 5d96237fae..9af35cd29c 100644
+index c0d104578d..51a714ee23 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -226,6 +226,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
···
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -347,6 +350,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -343,6 +346,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
···
          vc_context_empty_to_null(&in);
  
          r = vc_context_verify_and_warn(&in, LOG_ERR, error);
-@@ -465,6 +471,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -460,6 +466,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
···
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c7be30f563..50f8aa8675 100644
+index e3b4367ec0..448aa7e94d 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -659,6 +659,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -673,6 +673,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
···
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -737,6 +741,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -750,6 +754,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
···
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -928,6 +935,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  

pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch

···
  5 files changed, 13 insertions(+), 13 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
-index e486474c44..5f373d0723 100644
+index 3a13e04a27..4fd58068a1 100644
 --- a/man/localtime.xml
 +++ b/man/localtime.xml
 @@ -20,7 +20,7 @@
···
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index f9014dc560..3ee0363369 100644
+index b94f37c31c..48f5a2526b 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
 @@ -1412,7 +1412,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
···
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1625,7 +1625,7 @@ int get_timezone(char **ret) {
+@@ -1617,7 +1617,7 @@ int get_timezone(char **ret) {
          if (r < 0)
-                 return r; /* returns EINVAL if not a symlink */
+                 return r; /* Return EINVAL if not a symlink */
  
--        e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
-+        e = PATH_STARTSWITH_SET(t, "/etc/zoneinfo/", "../etc/zoneinfo/");
+-        const char *e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
++        const char *e = PATH_STARTSWITH_SET(t, "/etc/zoneinfo/", "../etc/zoneinfo/");
          if (!e)
                  return -EINVAL;
- 
+         if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index f77a5f6266..63bac85b29 100644
+index 6afabef430..c1e3af77e1 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -632,7 +632,7 @@ static int process_timezone(int rfd) {
+@@ -648,7 +648,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
···
          r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
          if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index e48ebe8342..41796f3358 100644
+index 756ce11b1f..436804b3bd 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1845,8 +1845,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1862,8 +1862,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
···
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 50f8aa8675..aff156ab42 100644
+index 448aa7e94d..2161e09579 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -276,7 +276,7 @@ static int context_read_data(Context *c) {
+@@ -280,7 +280,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
···
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -300,7 +300,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -304,7 +304,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
···
  
                          if (unlink("/etc/localtime") < 0 && errno != ENOENT)
                                  return -errno;
-@@ -308,9 +308,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -312,9 +312,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  

pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch

···
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 6bb5f3c281..678d13737d 100644
+index e70817c51f..859e673a67 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -65,13 +65,15 @@
+@@ -62,13 +62,15 @@
          "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
···
 +        "/usr/lib/" n "\0"                      \
 +        PREFIX "/lib/" n "\0"
  
- #define CONF_PATHS_USR(n)                       \
+ #define CONF_PATHS(n)                           \
          "/etc/" n,                              \
          "/run/" n,                              \
          "/usr/local/lib/" n,                    \
···
 +        "/usr/lib/" n,                          \
 +        PREFIX "/lib/" n
  
- #define CONF_PATHS(n)                           \
-         CONF_PATHS_USR(n)
+ #define CONF_PATHS_STRV(n)                      \
+         STRV_MAKE(CONF_PATHS(n))

pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch

···
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index b976b7d8cf..b1c02df6fd 100644
+index 67f44e16e9..dda6614561 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -336,6 +336,7 @@ static void init_watchdog(void) {
+@@ -358,6 +358,7 @@ static void notify_supervisor(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,

pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch

···
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 21af3e9e52..6d096e3c78 100644
+index c96207428d..1e95eec7f1 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -215,6 +215,7 @@ static int execute(
+@@ -217,6 +217,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,

pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch

···
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 6d943e967f..d4380aa7e3 100644
+index fcb3aa9399..b9e69cbf91 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -25,9 +25,9 @@
- #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
- #endif
+@@ -17,10 +17,10 @@
+ #define PATH_MERGED_BIN(x) x "bin"
+ #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
+ 
+-#define DEFAULT_PATH_WITH_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/")
+-#define DEFAULT_PATH_WITHOUT_SBIN PATH_MERGED_BIN("/usr/local/") ":" PATH_MERGED_BIN("/usr/")
++#define DEFAULT_PATH_WITH_SBIN "@defaultPathNormal@"
++#define DEFAULT_PATH_WITHOUT_SBIN DEFAULT_PATH_WITH_SBIN
+ 
+-#define DEFAULT_PATH_COMPAT PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/") ":" PATH_SPLIT_BIN("/")
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_SBIN
  
--#define DEFAULT_PATH PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
--#define DEFAULT_PATH_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
--#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
-+#define DEFAULT_PATH "@defaultPathNormal@"
-+#define DEFAULT_PATH_NULSTR "@defaultPathNormal@\0"
-+#define DEFAULT_PATH_COMPAT DEFAULT_PATH
+ const char* default_PATH(void);
  
- #ifndef DEFAULT_USER_PATH
- #  define DEFAULT_USER_PATH DEFAULT_PATH

pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch

···
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 22cc5cc843..5dc7d4504f 100644
+index e26c6c5cfd..6cc1642684 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3914,9 +3914,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -4035,9 +4035,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  

pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch

···
 
 See also: https://github.com/systemd/systemd/issues/24191
 ---
- src/core/manager.c | 3 ---
- 1 file changed, 3 deletions(-)
+ src/core/taint.c | 8 --------
+ 1 file changed, 8 deletions(-)
 
-diff --git a/src/core/manager.c b/src/core/manager.c
-index 5dc7d4504f..6208c9aa31 100644
---- a/src/core/manager.c
-+++ b/src/core/manager.c
-@@ -4800,9 +4800,6 @@ char* manager_taint_string(const Manager *m) {
-         const char* stage[12] = {};
-         size_t n = 0;
+diff --git a/src/core/taint.c b/src/core/taint.c
+index 969b37f209..de64e8f1f9 100644
+--- a/src/core/taint.c
++++ b/src/core/taint.c
+@@ -41,14 +41,6 @@ char* taint_string(void) {
+ 
+         _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
  
--        _cleanup_free_ char *usrbin = NULL;
--        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
+-        if (readlink_malloc("/bin", &bin) < 0 || !PATH_IN_SET(bin, "usr/bin", "/usr/bin"))
 -                stage[n++] = "unmerged-usr";
+-
+-        /* Note that the check is different from default_PATH(), as we want to taint on uncanonical symlinks
+-         * too. */
+-        if (readlink_malloc("/usr/sbin", &usr_sbin) < 0 || !PATH_IN_SET(usr_sbin, "bin", "/usr/bin"))
+-                stage[n++] = "unmerged-bin";
+-
+         if (readlink_malloc("/var/run", &var_run) < 0 || !PATH_IN_SET(var_run, "../run", "/run"))
+                 stage[n++] = "var-run-bad";
  
-         if (access("/proc/cgroups", F_OK) < 0)
-                 stage[n++] = "cgroups-missing";

pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch

···
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 5e07b88a89..8dd7315009 100644
+index 10a78adfaf..6493d5d270 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -654,7 +654,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -670,7 +670,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */

pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch

···
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index 367afa20f7..5777154d01 100644
+index 15398f8364..8d440cee59 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
 @@ -322,6 +322,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
···
 +        if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM)
 +                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead.");
 +
-         if (!on_tty())
+         if (!on_tty() && !arg_stdin)
                  return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units if not on a tty.");
  

pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch

···
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 7419e2b0b0..c82a527976 100644
+index cecdbc3aa7..bd7f8ec580 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2497,7 +2497,6 @@ install_data('LICENSE.GPL2',
+@@ -2652,7 +2652,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
 -install_emptydir(systemdstatedir)
  
- ############################################################
+ #####################################################################
  

pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

···
-From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Yuri Nesterov <[e-mail]>
 Date: Wed, 21 Jun 2023 17:17:38 +0300
 Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled
···
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index 1d8ebecc91..2b0ae361ff 100644
+index 5c308a04bc..81aa3d3334 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
 @@ -21,6 +21,11 @@
···
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
-+        r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE");
++        r = secure_getenv_bool("SYSTEMD_NSS_RESOLVE_VALIDATE");
 +        if (r == 0) {
 +                log_info("Disabling NSCD because DNSSEC validation is turned off");
 +                __nss_disable_nscd(register_traced_file);
···
          log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached());
  
          notify_message = notify_start("READY=1\n"
--- 
-2.34.1
-

pkgs/os-specific/linux/systemd/default.nix

···
 , pkgsCross
 , fetchFromGitHub
 , fetchzip
+, fetchpatch
 , buildPackages
 , makeBinaryWrapper
 , ninja
···
 , gperf
 , getent
 , glibcLocales
+, autoPatchelfHook
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
 , glib
···
 , p11-kit
 , libpwquality
 , qrencode
+, libarchive
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to
   # be available during build time.
···
   # building disk images for non-NixOS systems. To save users from trying to use it
   # on their live NixOS system, we disable it by default.
 , withKernelInstall ? false
+, withLibarchive ? true
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
···
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "255.9";
+  version = "256.2";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1701895110";
+  releaseTimestamp = "1720202583";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
···
   # This has proven to be less error-prone than the previous systemd fork.
   src = fetchFromGitHub {
     owner = "systemd";
-    repo = "systemd-stable";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-fnMvBYyMRQrP2x//8ntGTSwoHOtFk2TQ4S5fwcsSLDU=";
+    repo = "systemd";
+    rev = "v${version}";
+    hash = "sha256-fyHzL+oe192YYuwyoTrov10IlrB0NSfY/XKVWzJrQEI=";
   };
 
   # On major changes, or when otherwise required, you *must* :
···
     ./0015-tpm2_context_init-fix-driver-name-checking.patch
     ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
     ./0017-meson.build-do-not-create-systemdstatedir.patch
+
+    # https://github.com/systemd/systemd/pull/33258
+    # Remove after 256.3
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/compare/b268a71069786a45460807967e669d505ba3c5a2..f26b2ec46118a4493608618da2253bb9dfc6b517.patch";
+      hash = "sha256-OmuPDm3NykrDeNTA3NcYt9iTXEUFwKJ5apPP4KqtABg=";
+    })
+
+    # https://github.com/systemd/systemd/pull/33400
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/compare/051d462b42fe6c27824046c15cd3c84fa5afe05b..5e2d802c018f0b6d5dd58745f64d6958fa261096.patch";
+      hash = "sha256-drGAnx+ECixOjIP0DUSbCG/emUgoVips9WQL5ny3NKQ=";
+    })
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
···
       --replace \
       "/usr/lib/systemd/boot/efi" \
       "$out/lib/systemd/boot/efi"
-  '' + (
-    let
-      # The following patches references to dynamic libraries to ensure that all
-      # the features that are implemented via dlopen(3) are available (or
-      # explicitly deactivated) by pointing dlopen to the absolute store path
-      # instead of relying on the linkers runtime lookup code.
-      #
-      # All of the shared library references have to be handled. When new ones
-      # are introduced by upstream (or one of our patches) they must be
-      # explicitly declared, otherwise the build will fail.
-      #
-      # As of systemd version 247 we've seen a few errors like `libpcre2.… not
-      # found` when using e.g. --grep with journalctl. Those errors should
-      # become less unexpected now.
-      #
-      # There are generally two classes of dlopen(3) calls. Those that we want
-      # to support and those that should be deactivated / unsupported. This
-      # change enforces that we handle all dlopen calls explicitly. Meaning:
-      # There is not a single dlopen call in the source code tree that we did
-      # not explicitly handle.
-      #
-      # In order to do this we introduced a list of attributes that maps from
-      # shared object name to the package that contains them. The package can be
-      # null meaning the reference should be nuked and the shared object will
-      # never be loadable during runtime (because it points at an invalid store
-      # path location).
-      #
-      # To get a list of dynamically loaded libraries issue something like
-      #   `grep -ri '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"'' $src`
-      # and update the list below.
-      dlopenLibs =
-        let
-          opt = condition: pkg: if condition then pkg else null;
-        in
-        [
-          # bpf compilation support. We use libbpf 1 now.
-          { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
-          { name = "libbpf.so.0"; pkg = null; }
-
-          # We did never provide support for libxkbcommon
-          { name = "libxkbcommon.so.0"; pkg = null; }
-
-          # qrencode
-          { name = "libqrencode.so.4"; pkg = opt withQrencode qrencode; }
-          { name = "libqrencode.so.3"; pkg = null; }
-
-          # Password quality
-          # We currently do not package passwdqc, only libpwquality.
-          { name = "libpwquality.so.1"; pkg = opt withPasswordQuality libpwquality; }
-          { name = "libpasswdqc.so.1"; pkg = null; }
-
-          # Only include cryptsetup if it is enabled. We might not be able to
-          # provide it during "bootstrap" in e.g. the minimal systemd build as
-          # cryptsetup has udev (aka systemd) in it's dependencies.
-          { name = "libcryptsetup.so.12"; pkg = opt withCryptsetup cryptsetup; }
-
-          # We are using libidn2 so we only provide that and ignore the others.
-          # Systemd does this decision during configure time and uses ifdef's to
-          # enable specific branches. We can safely ignore (nuke) the libidn "v1"
-          # libraries.
-          { name = "libidn2.so.0"; pkg = opt withLibidn2 libidn2; }
-          { name = "libidn.so.12"; pkg = null; }
-          { name = "libidn.so.11"; pkg = null; }
-
-          # journalctl --grep requires libpcre so let's provide it
-          { name = "libpcre2-8.so.0"; pkg = pcre2; }
-
-          # Support for TPM2 in systemd-cryptsetup, systemd-repart and systemd-cryptenroll
-          { name = "libtss2-esys.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
-          { name = "libtss2-rc.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
-          { name = "libtss2-mu.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
-          { name = "libtss2-tcti-"; pkg = opt withTpm2Tss tpm2-tss; }
-          { name = "libfido2.so.1"; pkg = opt withFido2 libfido2; }
-
-          # inspect-elf support
-          { name = "libelf.so.1"; pkg = opt withCoredump elfutils; }
-          { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
-
-          # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
-          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
-
-          { name = "libip4tc.so.2"; pkg = opt withIptables iptables; }
-        ];
-
-      patchDlOpen = dl:
-        let
-          library = "${lib.makeLibraryPath [ dl.pkg ]}/${dl.name}";
-        in
-        if dl.pkg == null then ''
-          # remove the dependency on the library by replacing it with an invalid path
-          for file in $(grep -lr '"${dl.name}"' src); do
-            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
-            substituteInPlace "$file" --replace '"${dl.name}"' '"${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
-          done
-        '' else ''
-          # ensure that the library we provide actually exists
-          if ! [ -e ${library} ]; then
-            # exceptional case, details:
-            # https://github.com/systemd/systemd-stable/blob/v249-stable/src/shared/tpm2-util.c#L157
-            if ! [[ "${library}" =~ .*libtss2-tcti-$ ]]; then
-              echo 'The shared library `${library}` does not exist but was given as substitute for `${dl.name}`'
-              exit 1
-            fi
-          fi
-          # make the path to the dependency explicit
-          for file in $(grep -lr '"${dl.name}"' src); do
-            echo "patching dlopen(\"${dl.name}\", …) in $file to ${library}…"
-            substituteInPlace "$file" --replace '"${dl.name}"' '"${library}"'
-          done
-
-        '';
-    in
-    # patch all the dlopen calls to contain absolute paths to the libraries
-    lib.concatMapStringsSep "\n" patchDlOpen dlopenLibs
-  )
-  # finally ensure that there are no left-over dlopen calls (or rather strings
-  # pointing to shared libraries) that we didn't handle
-  + ''
-    if grep -qr '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"' src; then
-      echo "Found unhandled dynamic library calls: "
-      grep -r '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"' src
-      exit 1
-    fi
   ''
   # Finally, patch shebangs in scripts used at build time. This must not patch
   # scripts that will end up in the output, to avoid build platform references
···
       glibcLocales
       getent
       m4
+      autoPatchelfHook
 
       intltool
       gettext
···
     ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
     ++ lib.optionals withPasswordQuality [ libpwquality ]
     ++ lib.optionals withQrencode [ qrencode ]
+    ++ lib.optionals withLibarchive [ libarchive ]
   ;
 
   mesonBuildType = "release";
···
     #   https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
     (lib.mesonOption "time-epoch" releaseTimestamp)
 
-    (lib.mesonOption "version-tag" finalAttrs.version)
+    (lib.mesonOption "version-tag" version)
     (lib.mesonOption "mode" "release")
     (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
     (lib.mesonOption "debug-shell" "${bashInteractive}/bin/bash")
     (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d")
-    # Use cgroupsv2. This is already the upstream default, but better be explicit.
-    (lib.mesonOption "default-hierarchy" "unified")
     (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
 
     # Attempts to check /usr/sbin and that fails in macOS sandbox because
···
     (lib.mesonOption "sbat-distro" "nixos")
     (lib.mesonOption "sbat-distro-summary" "NixOS")
     (lib.mesonOption "sbat-distro-url" "https://nixos.org/")
-    (lib.mesonOption "sbat-distro-pkgname" finalAttrs.pname)
-    (lib.mesonOption "sbat-distro-version" finalAttrs.version)
+    (lib.mesonOption "sbat-distro-pkgname" pname)
+    (lib.mesonOption "sbat-distro-version" version)
 
     # Users
     (lib.mesonOption "system-uid-max" "999")
···
     # Mount
     (lib.mesonOption "mount-path" "${lib.getOutput "mount" util-linux}/bin/mount")
     (lib.mesonOption "umount-path" "${lib.getOutput "mount" util-linux}/bin/umount")
+
+    # SSH
+    # Disabled for now until someone makes this work.
+    (lib.mesonOption "sshconfdir" "no")
+    (lib.mesonOption "sshdconfdir" "no")
 
 
     # Features
···
     (lib.mesonEnable "kmod" withKmod)
     (lib.mesonEnable "qrencode" withQrencode)
     (lib.mesonEnable "vmspawn" withVmspawn)
+    (lib.mesonEnable "libarchive" withLibarchive)
     (lib.mesonEnable "xenctrl" false)
     (lib.mesonEnable "gnutls" false)
     (lib.mesonEnable "xkbcommon" false)
···
     interfaceVersion = 2;
 
     inherit withBootloader withCryptsetup withEfi withHostnamed withImportd withKmod
-      withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+      withLocaled withMachined withPortabled withTimedated withTpm2Tss withUtmp
+      util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests)

pkgs/servers/http/router/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "router";
-  version = "1.50.0";
+  version = "1.51.0";
 
   src = fetchFromGitHub {
     owner = "apollographql";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Inah2IcmWSyizsavXr2N5j2S2eAfocpxzjrAdhQlfjg=";
+    hash = "sha256-U2CL+RwCtDcRdK2DMpcqXEDJvOfYiYWT7IEqTO5ykNk=";
   };
 
-  cargoHash = "sha256-G4HjvVGRbgOteZvC1tt75HP+EJDGEkndVhADBm8B1C8=";
+  cargoHash = "sha256-TwVA17/fKmhV3/xmQUopqel5pQ6aF2ew9q90a/aky/o=";
 
   nativeBuildInputs = [
     cmake

pkgs/servers/sql/postgresql/generic.nix

···
 
   generic =
       # dependencies
-      { stdenv, lib, fetchurl, makeWrapper
+      { stdenv, lib, fetchurl, fetchpatch, makeWrapper
       , glibc, zlib, readline, openssl, icu, lz4, zstd, systemd, libossp_uuid
       , pkg-config, libxml2, tzdata, libkrb5, substituteAll, darwin
       , linux-pam
···
         locale = "${if stdenv.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc}/bin/locale";
       })
 
+      (
+        if atLeast "16" then
+          fetchpatch {
+            name = "libxml2-2.13-compat.patch";
+            # This one is for 16 branch upstream.
+            url = "https://github.com/postgres/postgres/commit/f85c91a1867b45742bb28e4578ca2b4a0976383f.diff";
+            hash = "sha256-4YcXfo98uVuCu+ybVw3bM4x8Y0I1xfjdjBZOlhyF21w=";
+          }
+        else
+          fetchpatch {
+            name = "libxml2-2.13-compat.patch";
+            # This one is for 15 branch upstream, but it also applies well to all our older branches.
+            url = "https://github.com/postgres/postgres/commit/f68d6aabb7e2c803818185b49a3d356bdb2b2974.diff";
+            hash = "sha256-Nelb0mbjx0Xq9UJuVv7cs3ifCtUPP7UZraPMPGb2wyQ=";
+          }
+      )
     ] ++ lib.optionals stdenv'.hostPlatform.isMusl (
       # Using fetchurl instead of fetchpatch on purpose: https://github.com/NixOS/nixpkgs/issues/240141
       map fetchurl (lib.attrValues muslPatches)

pkgs/stdenv/darwin/default.nix

···
         buildInputs = old.buildInputs or [ ] ++ [ self.darwin.CF ];
       });
 
+      scons = super.scons.override { python3Packages = self.python3Minimal.pkgs; };
+
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         apple_sdk = superDarwin.apple_sdk // {
           inherit (prevStage.darwin.apple_sdk) sdkRoot;

pkgs/tools/filesystems/genimage/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "genimage";
-  version = "17";
+  version = "18";
 
   src = fetchurl {
     url = "https://public.pengutronix.de/software/genimage/genimage-${version}.tar.xz";
-    sha256 = "sha256-qHVuNWeg1NgsNrCMzB4IglC5AG1WcMaysBQYXm7GBnE=";
+    sha256 = "sha256-68P4hsTYAGTdbG1ePC6Y5aZwB4JkEIzi+Jraii4T/t0=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

pkgs/tools/graphics/netpbm/default.nix

···
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.6.1";
+  version = "11.7.0";
 
   outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "4907";
-    sha256 = "eMLADYFf/Us8eiBTacf+wvQSGyrV+fslpvlTT+rIiYM=";
+    rev = "4925";
+    sha256 = "Y6o/9nq9ICqlKCDh59eiT38CZ+cfB1ezb8arF0uBYsk=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/fd/default.nix

···
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles, rust-jemalloc-sys, testers, fd }:
+{ stdenv, lib, rustPlatform, fetchFromGitHub, installShellFiles, rust-jemalloc-sys, testers, fd }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
···
 
   postInstall = ''
     installManPage doc/fd.1
-
+  '' + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd fd \
       --bash <($out/bin/fd --gen-completions bash) \
       --fish <($out/bin/fd --gen-completions fish)

pkgs/tools/misc/fdupes/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fdupes";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "adrianlopezroche";
     repo = "fdupes";
     rev = "v${version}";
-    hash = "sha256-yOUgPa13DHDcuEqJMpBQVMOKFH/rlH44rWiIPRwnztM=";
+    hash = "sha256-VPaNDKUgaJRF75cxksK0nZNFarqhat7n8ztIdBoxHI8=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/tio/default.nix

···
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, inih, lua, bash-completion, darwin }:
-
-stdenv.mkDerivation rec {
-  pname = "tio";
-  version = "2.8";
-
-  src = fetchFromGitHub {
-    owner = "tio";
-    repo = "tio";
-    rev = "v${version}";
-    hash = "sha256-BBfLmRhbDeymXXlYp71XTwbAab7h7gJ842fzZJNb6kU=";
-  };
-
-  strictDeps = true;
-
-  buildInputs = [ inih lua ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.IOKit ];
-
-  nativeBuildInputs = [ meson ninja pkg-config bash-completion ];
-
-  meta = with lib; {
-    description = "Serial console TTY";
-    homepage = "https://tio.github.io/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ yana ];
-    platforms = platforms.unix;
-    mainProgram = "tio";
-  };
-}

pkgs/tools/networking/magic-wormhole-rs/default.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "magic-wormhole-rs";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole.rs";
     rev = version;
-    sha256 = "sha256-6dRnOAclHcPayY0e5guhWR5CLaKzp5TlEU5esLvYQg8=";
+    sha256 = "sha256-YFbBOjJK3+Zyy6pKQwGzYlva63PLhBhgMPEdQljNerE=";
   };
 
-  cargoHash = "sha256-SPhTvj2DYNzuAtWamDhsgtCTUpQXtnhoRRSE745tB/k=";
+  cargoHash = "sha256-qwrNj8M6ZDCqu7529DnhgiCaxYwsOlABTEEDBmkSL2U=";
 
   buildInputs = [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ Security AppKit ];

pkgs/top-level/all-packages.nix

···
 
   timer = callPackage ../tools/misc/timer { };
 
-  tio = callPackage ../tools/misc/tio { };
-
   tiv = callPackage ../applications/misc/tiv { };
 
   tkman = callPackage ../tools/misc/tkman { };
···
   spidermonkey_115 = callPackage ../development/interpreters/spidermonkey/115.nix {
     inherit (darwin) libobjc;
   };
-
-  ssm-session-manager-plugin = callPackage ../applications/networking/cluster/ssm-session-manager-plugin { };
 
   starlark-rust = callPackage ../development/interpreters/starlark-rust { };
 
···
 
   delve = callPackage ../development/tools/delve { };
 
-  dep2nix = callPackage ../development/tools/dep2nix { };
-
   easyjson = callPackage ../development/tools/easyjson { };
 
   iferr = callPackage ../development/tools/iferr { };
···
     withPasswordQuality = false;
     withVmspawn = false;
     withQrencode = false;
+    withLibarchive = false;
   };
   systemdLibs = systemdMinimal.override {
     pname = "systemd-minimal-libs";