Merge staging-next into staging

nixos/doc/manual/development/writing-nixos-tests.section.md

···
 
 In that case, `numpy` is chosen from the generic `python3Packages`.
 
+## Overriding a test {#sec-override-nixos-test}
+
+The NixOS test framework returns tests with multiple overriding methods.
+
+`overrideTestDerivation` *function*
+:   Like applying `overrideAttrs` on the [test](#test-opt-test) derivation.
+
+    This is a convenience for `extend` with an override on the [`rawTestDerivationArg`](#test-opt-rawTestDerivationArg) option.
+
+    *function*
+    :   An extension function, e.g. `finalAttrs: prevAttrs: { /* … */ }`, the result of which is passed to [`mkDerivation`](https://nixos.org/manual/nixpkgs/stable/#sec-using-stdenv).
+        Just as with `overrideAttrs`, an abbreviated form can be used, e.g. `prevAttrs: { /* … */ }` or even `{ /* … */ }`.
+        See [`lib.extends`](https://nixos.org/manual/nixpkgs/stable/#function-library-lib.fixedPoints.extends).
+
+`extendNixOS { module = ` *module* `; specialArgs = ` *specialArgs* `; }`
+:   Evaluates the test with additional NixOS modules and/or arguments.
+
+    `module`
+    :   A NixOS module to add to all the nodes in the test. Sets test option [`extraBaseModules`](#test-opt-extraBaseModules).
+
+    `specialArgs`
+    :   An attribute set of arguments to pass to all NixOS modules. These override the existing arguments, as well as any `_module.args.<name>` that the modules may define. Sets test option [`node.specialArgs`](#test-opt-node.specialArgs).
+
+    This is a convenience function for `extend` that overrides the aforementioned test options.
+
+    :::{.example #ex-nixos-test-extendNixOS}
+
+    # Using extendNixOS in `passthru.tests` to make `(openssh.tests.overrideAttrs f).tests.nixos` coherent
+
+    ```nix
+    mkDerivation (finalAttrs: {
+      # …
+      passthru = {
+        tests = {
+          nixos = nixosTests.openssh.extendNixOS {
+            module = {
+              services.openssh.package = finalAttrs.finalPackage;
+            };
+          };
+        };
+      };
+    })
+    ```
+    :::
+
+`extend { modules = ` *modules* `; specialArgs = ` *specialArgs* `; }`
+:   Adds new `nixosTest` modules and/or module arguments to the test, which are evaluated together with the existing modules and [built-in options](#sec-test-options-reference).
+
+    If you're only looking to extend the _NixOS_ configurations of the test, and not something else about the test, you may use the `extendNixOS` convenience function instead.
+
+    `modules`
+    :   A list of modules to add to the test. These are added to the existing modules and then [evaluated](https://nixos.org/manual/nixpkgs/stable/index.html#module-system-lib-evalModules) together.
+
+    `specialArgs`
+    :   An attribute of arguments to pass to the test. These override the existing arguments, as well as any `_module.args.<name>` that the modules may define. See [`evalModules`/`specialArgs`](https://nixos.org/manual/nixpkgs/stable/#module-system-lib-evalModules-param-specialArgs).
+
 ## Test Options Reference {#sec-test-options-reference}
 
 The following options can be used when writing tests.

nixos/doc/manual/redirects.json

···
 {
+  "sec-override-nixos-test": [
+    "index.html#sec-override-nixos-test"
+  ],
+  "test-opt-rawTestDerivationArg": [
+    "index.html#test-opt-rawTestDerivationArg"
+  ],
+  "ex-nixos-test-extendNixOS": [
+    "index.html#ex-nixos-test-extendNixOS"
+  ],
   "book-nixos-manual": [
     "index.html#book-nixos-manual"
   ],

nixos/doc/manual/release-notes/rl-2511.section.md

···
 
 - `services.ntpd-rs` now performs configuration validation.
 
+- `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 

nixos/lib/testing/call-test.nix

···
-{ config, lib, ... }:
+{
+  config,
+  extendModules,
+  lib,
+  ...
+}:
 let
   inherit (lib) mkOption types;
+
+  unsafeGetAttrPosStringOr =
+    default: name: value:
+    let
+      p = builtins.unsafeGetAttrPos name value;
+    in
+    if p == null then default else p.file + ":" + toString p.line + ":" + toString p.column;
+
 in
 {
   options = {
···
       internal = true;
       default = config;
     };
+  };
+  config = {
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.extend =
+      args@{
+        modules,
+        specialArgs ? { },
+      }:
+      (extendModules {
+        inherit specialArgs;
+        modules = map (lib.setDefaultModuleLocation (
+          unsafeGetAttrPosStringOr "<test.extend module>" "modules" args
+        )) modules;
+      }).config.test;
   };
 }

nixos/lib/testing/nodes.nix

···
   lib,
   hostPkgs,
   nodes,
+  options,
   ...
 }:
 
···
       testModuleArgs.config.extraBaseModules
     ];
   };
+
+  # TODO (lib): Dedup with run.nix, add to lib/options.nix
+  mkOneUp = opt: f: lib.mkOverride (opt.highestPrio - 1) (f opt.value);
 
 in
 
···
         }
       ))
     ];
+
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.extendNixOS =
+      {
+        module,
+        specialArgs ? { },
+      }:
+      config.passthru.extend {
+        modules = [
+          {
+            extraBaseModules = module;
+            node.specialArgs = mkOneUp options.node.specialArgs (_: specialArgs);
+          }
+        ];
+      };
 
   };
 }

nixos/lib/testing/run.nix

···
   config,
   hostPkgs,
   lib,
+  options,
   ...
 }:
 let
   inherit (lib) types mkOption;
+
+  # TODO (lib): Also use lib equivalent in nodes.nix
+  /**
+    Create a module system definition that overrides an existing option from a different module evaluation.
+
+    Type: Option a -> (a -> a) -> Definition a
+  */
+  mkOneUp =
+    /**
+      Option from an existing module evaluation, e.g.
+      - `(lib.evalModules ...).options.x` when invoking `evalModules` again,
+      - or `{ options, ... }:` when invoking `extendModules`.
+    */
+    opt:
+    /**
+      Function from the old value to the new definition, which will be wrapped with `mkOverride`.
+    */
+    f:
+    lib.mkOverride (opt.highestPrio - 1) (f opt.value);
+
 in
 {
   options = {
···
       internal = true;
     };
 
+    rawTestDerivationArg = mkOption {
+      type = types.functionTo types.raw;
+      description = ''
+        Argument passed to `mkDerivation` to create the `rawTestDerivation`.
+      '';
+    };
+
     test = mkOption {
       type = types.package;
       # TODO: can the interactive driver be configured to access the network?
···
   };
 
   config = {
-    rawTestDerivation =
+    rawTestDerivation = hostPkgs.stdenv.mkDerivation config.rawTestDerivationArg;
+    rawTestDerivationArg =
+      finalAttrs:
       assert lib.assertMsg (!config.sshBackdoor.enable)
         "The SSH backdoor is currently not supported for non-interactive testing! Please make sure to only set `interactive.sshBackdoor.enable = true;`!";
-      hostPkgs.stdenv.mkDerivation {
+      {
         name = "vm-test-run-${config.name}";
 
         requiredSystemFeatures =
···
 
     # useful for inspection (debugging / exploration)
     passthru.config = config;
+
+    # Docs: nixos/doc/manual/development/writing-nixos-tests.section.md
+    /**
+      See https://nixos.org/manual/nixos/unstable#sec-override-nixos-test
+    */
+    passthru.overrideTestDerivation =
+      f:
+      config.passthru.extend {
+        modules = [
+          {
+            rawTestDerivationArg = mkOneUp options.rawTestDerivationArg (lib.extends (lib.toExtension f));
+          }
+        ];
+      };
   };
 }

nixos/modules/services/network-filesystems/kubo.nix

···
       autoMount = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description = "Whether Kubo should try to mount /ipfs and /ipns at startup.";
+        description = "Whether Kubo should try to mount /ipfs, /ipns and /mfs at startup.";
       };
 
       autoMigrate = lib.mkOption {
···
               default = "/ipns";
               description = "Where to mount the IPNS namespace to";
             };
+
+            Mounts.MFS = lib.mkOption {
+              type = lib.types.str;
+              default = "/mfs";
+              description = "Where to mount the MFS namespace to";
+            };
           };
         };
         description = ''
···
         ${cfg.dataDir}.d = defaultConfig;
         ${cfg.settings.Mounts.IPFS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
         ${cfg.settings.Mounts.IPNS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
+        ${cfg.settings.Mounts.MFS}.d = lib.mkIf (cfg.autoMount) defaultConfig;
       };
 
     # The hardened systemd unit breaks the fuse-mount function according to documentation in the unit file itself
···
               ipfs --offline config replace -
           '';
         postStop = lib.mkIf cfg.autoMount ''
-          # After an unclean shutdown the fuse mounts at cfg.settings.Mounts.IPFS and cfg.settings.Mounts.IPNS are locked
-          umount --quiet '${cfg.settings.Mounts.IPFS}' '${cfg.settings.Mounts.IPNS}' || true
+          # After an unclean shutdown the fuse mounts at cfg.settings.Mounts.IPFS, cfg.settings.Mounts.IPNS and cfg.settings.Mounts.MFS are locked
+          umount --quiet '${cfg.settings.Mounts.IPFS}' '${cfg.settings.Mounts.IPNS}' '${cfg.settings.Mounts.MFS}' || true
         '';
         serviceConfig = {
           ExecStart = [

nixos/modules/services/networking/monero.nix

···
         '';
       };
 
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/var/lib/monero/monerod.env";
+        description = ''
+          Path to an EnvironmentFile for the monero service as defined in {manpage}`systemd.exec(5)`.
+
+          Secrets may be passed to the service by specifying placeholder variables in the Nix config
+          and setting values in the environment file.
+
+          Example:
+
+          ```
+          # In environment file:
+          MINING_ADDRESS=888tNkZrPN6JsEgekjMnABU4TBzc2Dt29EPAvkRxbANsAnjyPbb3iQ1YBRk1UXcdRsiKc9dhwMVgN5S9cQUiyoogDavup3H
+          ```
+
+          ```
+          # Service config
+          services.monero.mining.address = "$MINING_ADDRESS";
+          ```
+        '';
+      };
+
       extraConfig = lib.mkOption {
         type = lib.types.lines;
         default = "";
···
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      preStart = ''
+        umask 077
+        ${pkgs.envsubst}/bin/envsubst \
+          -i ${configFile} \
+          -o ${cfg.dataDir}/monerod.conf
+      '';
+
       serviceConfig = {
         User = "monero";
         Group = "monero";
-        ExecStart = "${lib.getExe' pkgs.monero-cli "monerod"} --config-file=${configFile} --non-interactive";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStart = "${lib.getExe' pkgs.monero-cli "monerod"} --config-file=${cfg.dataDir}/monerod.conf --non-interactive";
         Restart = "always";
         SuccessExitStatus = [
           0

nixos/tests/kubo/kubo-fuse.nix

···
   testScript = ''
     start_all()
 
-    with subtest("FUSE mountpoint"):
-        machine.fail("echo a | su bob -l -c 'ipfs add --quieter'")
+    with subtest("Create a file for testing"):
+        machine.succeed("echo 'fnord3' > /tmp/test.txt")
+
+
+    with subtest("/ipfs/ FUSE mountpoint"):
+        machine.fail("su bob -l -c 'ipfs add --quieter' < /tmp/test.txt")
         # The FUSE mount functionality is broken as of v0.13.0. This is still the case with v0.29.0.
         # See https://github.com/ipfs/kubo/issues/9044.
         # Workaround: using CID Version 1 avoids that.
···
             "echo fnord3 | su alice -l -c 'ipfs add --quieter --cid-version=1'"
         ).strip()
 
-        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
+
+
+    with subtest("/mfs/ FUSE mountpoint"):
+        with subtest("Write the test file in three different ways"):
+            machine.succeed("cp /tmp/test.txt /mfs/test-1.txt")
+            machine.succeed("su alice -c 'ipfs files write --create /test-2.txt < /tmp/test.txt'")
+            machine.succeed(f"ipfs files cp /ipfs/{ipfs_hash} /test-3.txt")
+
+        with subtest("Show the files (for debugging)"):
+            # Different hashes for the different ways of adding the file to the MFS probably come from different linking structures of the merkle tree. Copying the file to /mfs with `cp` is even non-deterministic.
+            machine.succeed("ipfs files ls --long >&2")
+            machine.succeed("ls -l /mfs >&2")
+
+        with subtest("Check that everyone has permission to read the file (because of Mounts.FuseAllowOther)"):
+            machine.succeed("su alice -c 'cat /mfs/test-1.txt' | grep fnord3")
+            machine.succeed("su bob -c 'cat /mfs/test-1.txt' | grep fnord3")
+
+        with subtest("Check the file contents"):
+            machine.succeed("diff /tmp/test.txt /mfs/test-1.txt")
+            machine.succeed("diff /tmp/test.txt /mfs/test-2.txt")
+            machine.succeed("diff /tmp/test.txt /mfs/test-3.txt")
+
+        with subtest("Check the CID extended attribute"):
+            output = machine.succeed(
+                "getfattr --only-values --name=ipfs_cid /mfs/test-3.txt"
+            ).strip()
+            assert ipfs_hash == output, f"Expected {ipfs_hash} but got {output}"
 
-    with subtest("Unmounting of /ipns and /ipfs"):
+
+    with subtest("Unmounting of /ipns, /ipfs and /mfs"):
         # Force Kubo to crash and wait for it to restart
         machine.systemctl("kill --signal=SIGKILL ipfs.service")
         machine.wait_for_unit("ipfs.service", timeout = 30)
 
-        machine.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+        machine.succeed(f"diff /tmp/test.txt /ipfs/{ipfs_hash}")
+        machine.succeed("diff /tmp/test.txt /mfs/test-3.txt")
   '';
 }

pkgs/build-support/testers/test/default.nix

···
         __structuredAttrs = enable;
       });
     });
+  runNixOSTest-example = pkgs-with-overlay.testers.runNixOSTest (
+    { lib, ... }:
+    {
+      name = "runNixOSTest-test";
+      nodes.machine =
+        { pkgs, ... }:
+        {
+          system.nixos = dummyVersioning;
+          environment.systemPackages = [
+            pkgs.proof-of-overlay-hello
+            pkgs.figlet
+          ];
+        };
+      testScript = ''
+        machine.succeed("hello | figlet >/dev/console")
+      '';
+    }
+  );
 
 in
 lib.recurseIntoAttrs {
···
     };
   };
 
-  runNixOSTest-example = pkgs-with-overlay.testers.runNixOSTest (
-    { lib, ... }:
-    {
-      name = "runNixOSTest-test";
-      nodes.machine =
-        { pkgs, ... }:
-        {
-          system.nixos = dummyVersioning;
-          environment.systemPackages = [
-            pkgs.proof-of-overlay-hello
-            pkgs.figlet
-          ];
-        };
-      testScript = ''
-        machine.succeed("hello | figlet >/dev/console")
-      '';
-    }
-  );
+  inherit runNixOSTest-example;
+
+  runNixOSTest-extendNixOS =
+    let
+      t = runNixOSTest-example.extendNixOS {
+        module =
+          { hi, lib, ... }:
+          {
+            config = {
+              assertions = [ { assertion = hi; } ];
+            };
+            options = {
+              itsProofYay = lib.mkOption { };
+            };
+          };
+        specialArgs.hi = true;
+      };
+    in
+    assert lib.isDerivation t;
+    assert t.nodes.machine ? itsProofYay;
+    t;
 
   # Check that the wiring of nixosTest is correct.
   # Correct operation of the NixOS test driver should be asserted elsewhere.

pkgs/by-name/fr/freecad/package.nix

···
   pkg-config,
   python3Packages,
   spaceNavSupport ? stdenv.hostPlatform.isLinux,
-  ifcSupport ? false,
   stdenv,
   swig,
   vtk,
···
   nix-update-script,
 }:
 let
-  pythonDeps =
-    with python3Packages;
-    [
-      boost
-      gitpython # for addon manager
-      matplotlib
-      opencamlib
-      pivy
-      ply # for openSCAD file support
-      py-slvs
-      pybind11
-      pycollada
-      pyside6
-      python
-      pyyaml # (at least for) PyrateWorkbench
-      scipy
-      shiboken6
-    ]
-    ++ lib.optionals ifcSupport [
-      ifcopenshell
-    ];
+  pythonDeps = with python3Packages; [
+    boost
+    gitpython # for addon manager
+    ifcopenshell
+    matplotlib
+    opencamlib
+    pivy
+    ply # for openSCAD file support
+    py-slvs
+    pybind11
+    pycollada
+    pyside6
+    python
+    pyyaml # (at least for) PyrateWorkbench
+    scipy
+    shiboken6
+  ];
 
   freecad-utils = callPackage ./freecad-utils.nix { };
 in

pkgs/by-name/fr/freecad/tests/default.nix

···
 {
   callPackage,
-  freecad,
 }:
 {
   python-path = callPackage ./python-path.nix { };
   modules = callPackage ./modules.nix { };
-  withIfcSupport = freecad.override { ifcSupport = true; };
 }

pkgs/by-name/ku/kubo/package.nix

···
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.34.1"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.35.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "16"; # Also update kubo-migrator when changing the repo version
···
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-wrAnmPfls7LFO3gQBISSmn4ucuUVmzvYEoz+eVc/A5M=";
+    hash = "sha256-OubXaa2JWbEaakDV6pExm5PkiZ5XPd9uG+S4KwWb0xQ=";
   };
 
   # tarball contains multiple files/directories

pkgs/by-name/re/renovate/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "41.16.0";
+  version = "41.21.3";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-hMcGK89YIqYCA201f+fxorHA3sseDL3nZTjH/90/JGQ=";
+    hash = "sha256-np21ghEbfaM7Z4ETmrAWUjrauQOf5FW+krl156UB2Ek=";
   };
 
   postPatch = ''
···
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-VF2fq6o4O5Ua+98PJ1d+vj5W8TMYL4ks3ekf27eQmIY=";
+    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;

pkgs/by-name/ti/tideways-daemon/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.9.40";
+  version = "1.9.44";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
···
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-6U6Vq908tJmR4JzZlbK/qjlfCl/iWrCIOJNvUh0Xvag=";
+        hash = "sha256-JzsSyUqKuH4msdSqN+rFdfrnNvlkFFFmspfpYLsiRZc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-2Yq2HvQoBPPDvEyZPjwyTjjc/bb4+zOrwknqHUnZsjc=";
+        hash = "sha256-1nE61XHqnycMgjvjKIZnbgVSak0HYOIUHgF67RjcJi8=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-ab7ZAUYH4Em6KuE/VlVLItf3N0yMvIRuJnf7vOGDGsY=";
+        hash = "sha256-4KwUsFK3G73hGiVGqF1sAOv7gEjqJXSAj99wLyHE+qM=";
       };
     };
     updateScript = "${

pkgs/development/python-modules/app-model/default.nix

···
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.3.1";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "pyapp-kit";
     repo = "app-model";
     tag = "v${version}";
-    hash = "sha256-bIqcbKjAj5TMZD9mZ+7G4q+sR0aRqn6E4hf99srgRIE=";
+    hash = "sha256-T7aUwdne1rUzhVRotlxDvEBm3mi/frUQziZdLo53Lsg=";
   };
 
   build-system = [

pkgs/development/python-modules/limits/default.nix

···
 
 buildPythonPackage rec {
   pname = "limits";
-  version = "5.2.0";
+  version = "5.4.0";
   pyproject = true;
-
-  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "alisaifee";
···
     # Upstream uses versioneer, which relies on git attributes substitution.
     # This leads to non-reproducible archives on github. Remove the substituted
     # file here, and recreate it later based on our version info.
+    hash = "sha256-EHLqkd5Muazr52/oYaLklFVvF+AzJWGbFaaIG+T0ulE=";
     postFetch = ''
       rm "$out/limits/_version.py"
     '';
-    hash = "sha256-0D44XaSZtebMnn9mqXbaE7FB7usdu/eZ/4UE3Ye0oyA=";
   };
 
   patches = [
···
 
   pytestFlagsArray = [ "--benchmark-disable" ];
 
-  disabledTests = [ "test_moving_window_memcached" ];
+  disabledTests = [
+    "test_moving_window_memcached"
+    # Flaky: compares time to magic value
+    "test_sliding_window_counter_previous_window"
+  ];
 
   pythonImportsCheck = [ "limits" ];
 
-  meta = with lib; {
+  meta = {
     description = "Rate limiting using various strategies and storage backends such as redis & memcached";
     homepage = "https://github.com/alisaifee/limits";
     changelog = "https://github.com/alisaifee/limits/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sarahec ];
   };
 }

pkgs/development/python-modules/napari/default.nix

···
 
 mkDerivationWith buildPythonPackage rec {
   pname = "napari";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "napari";
     repo = "napari";
     tag = "v${version}";
-    hash = "sha256-qgyhoxXROlm+DASJV2QOA1IqpHxPhsIEv+TGU2mhiuc=";
+    hash = "sha256-p6deNHnlvgZXV3Ym3OADC44j5bOkMDjlmM2N3yE5GxE=";
   };
 
   postPatch = ''

pkgs/development/python-modules/valkey/default.nix

···
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildPythonPackage,
   pythonOlder,
···
   pname = "valkey";
   version = "6.1.0";
   pyproject = true;
-
-  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
···
 
   pytestFlagsArray = [ "-m 'not onlycluster and not ssl'" ];
 
-  disabledTests = [
-    # valkey.sentinel.MasterNotFoundError: No master found for 'valkey-py-test'
-    "test_get_from_cache"
-    "test_cache_decode_response"
-    # Expects another valkey instance on port 6380 *shrug*
-    "test_psync"
+  disabledTests =
+    [
+      # valkey.sentinel.MasterNotFoundError: No master found for 'valkey-py-test'
+      "test_get_from_cache"
+      "test_cache_decode_response"
+      # Expects another valkey instance on port 6380 *shrug*
+      "test_psync"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      #  OSError: AF_UNIX path too long
+      "test_uds_connect"
+      "test_network_connection_failure"
+    ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # AttributeError: Can't get local object 'TestMultiprocessing.test_valkey_client.<locals>.target'
+    "tests/test_multiprocessing.py"
   ];
 
-  meta = with lib; {
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/valkey-io/valkey-py";
     changelog = "https://github.com/valkey-io/valkey-py/releases/tag/${src.tag}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ hexa ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
   };
 }

pkgs/os-specific/linux/kernel/common-config.nix

···
       ATH10K_DFS_CERTIFIED = option yes;
       B43_PHY_HT = option yes;
       BCMA_HOST_PCI = option yes;
+
+      # Enable "untested" hardware support for RTL8xxxU.
+      # There's a bunch of those still floating around,
+      # and given how old the hardware is, we're unlikely
+      # to kill any, so let's enable all known device IDs.
+      RTL8XXXU_UNTESTED = option yes;
+
       RTW88 = module;
       RTW88_8822BE = lib.mkMerge [
         (whenOlder "5.8" yes)

pkgs/os-specific/linux/kernel/kernels-org.json

···
 {
     "testing": {
-        "version": "6.16-rc3",
-        "hash": "sha256:04inkd3aqpikjarxy3lxzw2v2f45mnfzlq82r8mdsm23lkn68glr"
+        "version": "6.16-rc4",
+        "hash": "sha256:1h66i51d8m4zwbrxh7xayvqsnkrzj5wipf7rm8szyqmf86isjkpi"
     },
     "6.1": {
-        "version": "6.1.142",
-        "hash": "sha256:1am31xw70sbxzdnvj70fx9l946nadcbrc7qk2yxxssy96nhnxlnw"
+        "version": "6.1.143",
+        "hash": "sha256:02ivq22hv42bcnssfpkkbqlhz1by9jrfrqlrz1wi0svysz2dlnz2"
     },
     "5.15": {
         "version": "5.15.186",
···
         "hash": "sha256:1adn0pbk8y1zp1yrz83ch6h4wypm2qvbnx4xig3sls2nfgvmi0f4"
     },
     "6.6": {
-        "version": "6.6.95",
-        "hash": "sha256:11gaczm68mqm72f3mfg656nkiqd9y66kf943hvwghln9lblhlr0q"
+        "version": "6.6.96",
+        "hash": "sha256:1p8v49w7z8w3wc68mbw46cz9xqrllc8cpa7nqlm2xnrssi1mir4y"
     },
     "6.12": {
-        "version": "6.12.35",
-        "hash": "sha256:0j577lqmzbzx45gxvxirx627pv6cbhq9slzb50rqqmyy3nqf1x05"
+        "version": "6.12.36",
+        "hash": "sha256:135s057ya63zw4v1jr9lzjdxk60ahr9v38hbv6nima755pnql5ja"
     },
     "6.15": {
-        "version": "6.15.4",
-        "hash": "sha256:05psir6p8x5a89d9kxkxlv5iifln67yf803xj5rqvx82nqkxdbqf"
+        "version": "6.15.5",
+        "hash": "sha256:1dc8qrwvvy34s5lgm43j295ipwaqm8wd8x4qchr14hqlkj9hg9rc"
     }
 }

pkgs/os-specific/linux/kernel/manual-config.nix

···
   stdenv,
   buildPackages,
   runCommand,
-  net-tools,
   bc,
   bison,
   flex,
···
             flex
             perl
             bc
-            net-tools
             openssl
             rsync
             gmp

pkgs/tools/security/tor/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.16";
+  version = "0.4.8.17";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ZUDdN3oSD7jn0nUwqjt/9yoPpbT2cP4dZMmHwc/TkMs=";
+    sha256 = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
   };
 
   outputs = [