Merge staging-next into staging

maintainers/maintainer-list.nix

···
     githubId = 1069318;
     name = "Robin Lambertz";
   };
+  robwalt = {
+    email = "[e-mail]";
+    github = "robwalt";
+    githubId = 26892280;
+    name = "Robert Walter";
+  };
   roconnor = {
     email = "[e-mail]";
     github = "roconnor";

nixos/doc/manual/release-notes/rl-2311.section.md

···
 
 - [osquery](https://www.osquery.io/), a SQL powered operating system instrumentation, monitoring, and analytics.
 
+- [ebusd](https://ebusd.eu), a daemon for handling communication with eBUS devices connected to a 2-wire bus system (“energy bus” used by numerous heating systems). Available as [services.ebusd](#opt-services.ebusd.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - The `boot.loader.raspberryPi` options have been marked deprecated, with intent for removal for NixOS 24.11. They had a limited use-case, and do not work like people expect. They required either very old installs ([before mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds out of scope of the standard and generic AArch64 support. That option set never supported the Raspberry Pi 4 family of devices.

nixos/modules/module-list.nix

···
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
   ./services/hardware/keyd.nix
+  ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
   ./services/home-automation/evcc.nix
   ./services/home-automation/home-assistant.nix
···
   ./services/matrix/mjolnir.nix
   ./services/matrix/mx-puppet-discord.nix
   ./services/matrix/pantalaimon.nix
+  ./services/matrix/matrix-sliding-sync.nix
   ./services/matrix/synapse.nix
   ./services/misc/airsonic.nix
   ./services/misc/ananicy.nix

nixos/modules/services/home-automation/ebusd.nix

···
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.ebusd;
+
+  package = pkgs.ebusd;
+
+  arguments = [
+    "${package}/bin/ebusd"
+    "--foreground"
+    "--updatecheck=off"
+    "--device=${cfg.device}"
+    "--port=${toString cfg.port}"
+    "--configpath=${cfg.configpath}"
+    "--scanconfig=${cfg.scanconfig}"
+    "--log=main:${cfg.logs.main}"
+    "--log=network:${cfg.logs.network}"
+    "--log=bus:${cfg.logs.bus}"
+    "--log=update:${cfg.logs.update}"
+    "--log=other:${cfg.logs.other}"
+    "--log=all:${cfg.logs.all}"
+  ] ++ lib.optionals cfg.readonly [
+    "--readonly"
+  ] ++ lib.optionals cfg.mqtt.enable [
+    "--mqtthost=${cfg.mqtt.host}"
+    "--mqttport=${toString cfg.mqtt.port}"
+    "--mqttuser=${cfg.mqtt.user}"
+    "--mqttpass=${cfg.mqtt.password}"
+  ] ++ lib.optionals cfg.mqtt.home-assistant [
+    "--mqttint=${package}/etc/ebusd/mqtt-hassio.cfg"
+    "--mqttjson"
+  ] ++ lib.optionals cfg.mqtt.retain [
+    "--mqttretain"
+  ] ++ cfg.extraArguments;
+
+  usesDev = hasPrefix "/" cfg.device;
+
+  command = concatStringsSep " " arguments;
+
+in
+{
+  meta.maintainers = with maintainers; [ nathan-gs ];
+
+  options.services.ebusd = {
+    enable = mkEnableOption (lib.mdDoc "ebusd service");
+
+    device = mkOption {
+      type = types.str;
+      default = "";
+      example = "IP:PORT";
+      description = lib.mdDoc ''
+        Use DEV as eBUS device [/dev/ttyUSB0].
+        This can be either:
+          enh:DEVICE or enh:IP:PORT for enhanced device (only adapter v3 and newer),
+          ens:DEVICE for enhanced high speed serial device (only adapter v3 and newer with firmware since 20220731),
+          DEVICE for serial device (normal speed, for all other serial adapters like adapter v2 as well as adapter v3 in non-enhanced mode), or
+          [udp:]IP:PORT for network device.
+        https://github.com/john30/ebusd/wiki/2.-Run#device-options
+      '';
+    };
+
+    port = mkOption {
+      default = 8888;
+      type = types.port;
+      description = lib.mdDoc ''
+        The port on which to listen on
+      '';
+    };
+
+    readonly = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+         Only read from device, never write to it
+      '';
+    };
+
+    configpath = mkOption {
+      type = types.str;
+      default = "https://cfg.ebusd.eu/";
+      description = lib.mdDoc ''
+        Read CSV config files from PATH (local folder or HTTPS URL) [https://cfg.ebusd.eu/]
+      '';
+    };
+
+    scanconfig = mkOption {
+      type = types.str;
+      default = "full";
+      description = lib.mdDoc ''
+        Pick CSV config files matching initial scan ("none" or empty for no initial scan message, "full" for full scan, or a single hex address to scan, default is to send a broadcast ident message).
+        If combined with --checkconfig, you can add scan message data as arguments for checking a particular scan configuration, e.g. "FF08070400/0AB5454850303003277201". For further details on this option,
+        see [Automatic configuration](https://github.com/john30/ebusd/wiki/4.7.-Automatic-configuration).
+      '';
+    };
+
+    logs = {
+      main = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+
+      network = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+
+      bus = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+
+      update = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+
+      other = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+
+      all = mkOption {
+        type = types.enum [ "error" "notice" "info" "debug"];
+        default = "info";
+        description = lib.mdDoc ''
+          Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (error|notice|info|debug) [all:notice].
+        '';
+      };
+    };
+
+    mqtt = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Adds support for MQTT
+        '';
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = lib.mdDoc ''
+          Connect to MQTT broker on HOST.
+        '';
+      };
+
+      port = mkOption {
+        default = 1883;
+        type = types.port;
+        description = lib.mdDoc ''
+          The port on which to connect to MQTT
+        '';
+      };
+
+      home-assistant = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Adds the Home Assistant topics to MQTT, read more at [MQTT Integration](https://github.com/john30/ebusd/wiki/MQTT-integration)
+        '';
+      };
+
+      retain = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Set the retain flag on all topics instead of only selected global ones
+        '';
+      };
+
+      user = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The MQTT user to use
+        '';
+      };
+
+      password = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The MQTT password.
+        '';
+      };
+
+    };
+
+    extraArguments = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = lib.mdDoc ''
+        Extra arguments to the ebus daemon
+      '';
+    };
+
+  };
+
+  config = mkIf (cfg.enable) {
+
+    systemd.services.ebusd = {
+      description = "EBUSd Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        ExecStart = command;
+        DynamicUser = true;
+        Restart = "on-failure";
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        DeviceAllow = lib.optionals usesDev [
+          cfg.device
+        ] ;
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = false;
+        NoNewPrivileges = true;
+        PrivateDevices = usesDev;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SupplementaryGroups = [
+          "dialout"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @pkey"
+          "~@privileged @resources"
+        ];
+        UMask = "0077";
+      };
+    };
+
+  };
+}

nixos/modules/services/matrix/matrix-sliding-sync.nix

···
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.matrix-synapse.sliding-sync;
+in
+{
+  options.services.matrix-synapse.sliding-sync = {
+    enable = lib.mkEnableOption (lib.mdDoc "sliding sync");
+
+    package = lib.mkPackageOption pkgs "matrix-sliding-sync" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = with lib.types; attrsOf str;
+        options = {
+          SYNCV3_SERVER = lib.mkOption {
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              The destination homeserver to talk to not including `/_matrix/` e.g `https://matrix.example.org`.
+            '';
+          };
+
+          SYNCV3_DB = lib.mkOption {
+            type = lib.types.str;
+            default = "postgresql:///matrix-sliding-sync?host=/run/postgresql";
+            description = lib.mdDoc ''
+              The postgres connection string.
+              Refer to <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING>.
+            '';
+          };
+
+          SYNCV3_BINDADDR = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1:8009";
+            example = "[::]:8008";
+            description = lib.mdDoc "The interface and port to listen on.";
+          };
+
+          SYNCV3_LOG_LEVEL = lib.mkOption {
+            type = lib.types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
+            default = "info";
+            description = lib.mdDoc "The level of verbosity for messages logged.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Freeform environment variables passed to the sliding sync proxy.
+        Refer to <https://github.com/matrix-org/sliding-sync#setup> for all supported values.
+      '';
+    };
+
+    createDatabase = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Whether to enable and configure `services.postgres` to ensure that the database user `matrix-sliding-sync`
+        and the database `matrix-sliding-sync` exist.
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      description = lib.mdDoc ''
+        Environment file as defined in {manpage}`systemd.exec(5)`.
+
+        This must contain the {env}`SYNCV3_SECRET` variable which should
+        be generated with {command}`openssl rand -hex 32`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = lib.optionalAttrs cfg.createDatabase {
+      enable = true;
+      ensureDatabases = [ "matrix-sliding-sync" ];
+      ensureUsers = [ rec {
+        name = "matrix-sliding-sync";
+        ensurePermissions."DATABASE \"${name}\"" = "ALL PRIVILEGES";
+      } ];
+    };
+
+    systemd.services.matrix-sliding-sync = {
+      after = lib.optional cfg.createDatabase "postgresql.service";
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.settings;
+      serviceConfig = {
+        DynamicUser = true;
+        EnvironmentFile = cfg.environmentFile;
+        ExecStart = lib.getExe cfg.package;
+        StateDirectory = "matrix-sliding-sync";
+        WorkingDirectory = "%S/matrix-sliding-sync";
+      };
+    };
+  };
+}

nixos/modules/services/misc/gitea.nix

···
       lfs = mkIf cfg.lfs.enable {
         PATH = cfg.lfs.contentDir;
       };
+
+      packages.CHUNKED_UPLOAD_PATH = "${cfg.stateDir}/tmp/package-upload";
     };
 
     services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
···
       '';
 
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;

nixos/modules/services/monitoring/netdata.nix

···
         ExecStart = "${cfg.package}/bin/netdata -P /run/netdata/netdata.pid -D -c /etc/netdata/netdata.conf";
         ExecReload = "${pkgs.util-linux}/bin/kill -s HUP -s USR1 -s USR2 $MAINPID";
         ExecStartPost = pkgs.writeShellScript "wait-for-netdata-up" ''
-          while [ "$(${pkgs.netdata}/bin/netdatacli ping)" != pong ]; do sleep 0.5; done
+          while [ "$(${cfg.package}/bin/netdatacli ping)" != pong ]; do sleep 0.5; done
         '';
 
         TimeoutStopSec = cfg.deadlineBeforeStopSec;

nixos/modules/virtualisation/podman/default.nix

···
 
       systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 
+      systemd.timers.podman-prune.timerConfig = lib.mkIf cfg.autoPrune.enable {
+        Persistent = true;
+        RandomizedDelaySec = 1800;
+      };
+
       systemd.tmpfiles.packages = [
         # The /run/podman rule interferes with our podman group, so we remove
         # it and let the systemd socket logic take care of it.

nixos/tests/gitea.nix

···
       client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git clone {REPO}")
       client2.succeed('test "$(cat repo/testfile | xargs echo -n)" = "hello world"')
 
-      server.succeed(
+      server.wait_until_succeeds(
           'test "$(curl http://localhost:3000/api/v1/repos/test/repo/commits '
           + '-H "Accept: application/json" | jq length)" = "1"'
       )
-
-      client1.shutdown()
-      client2.shutdown()
-      server.shutdown()
     '';
   });
 in

nixos/tests/installer.nix

···
           # The test cannot access the network, so any packages we
           # need must be included in the VM.
           system.extraDependencies = with pkgs; [
+            bintools
             brotli
             brotli.dev
             brotli.lib

pkgs/applications/audio/faust/faust1.nix

···
-{ lib, stdenv
-, coreutils
-, fetchurl
-, makeWrapper
-, pkg-config
-}:
-
-with lib.strings;
-
-let
-
-  version = "0.9.90";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/faudiostream/faust-${version}.tgz";
-    sha256 = "0d1fqwymyfb73zkmpwv4zk4gsg4ji7qs20mfsr20skmnqx30xvna";
-  };
-
-  meta = with lib; {
-    homepage = "https://faust.grame.fr/";
-    downloadPage = "https://sourceforge.net/projects/faudiostream/files/";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ magnetophon pmahoney ];
-  };
-
-  faust = stdenv.mkDerivation {
-    pname = "faust";
-    inherit version;
-
-    inherit src;
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    passthru = {
-      inherit wrap wrapWithBuildEnv;
-    };
-
-    preConfigure = ''
-      makeFlags="$makeFlags prefix=$out"
-
-      # The faust makefiles use 'system ?= $(shell uname -s)' but nix
-      # defines 'system' env var, so undefine that so faust detects the
-      # correct system.
-      unset system
-    '';
-
-    # Remove most faust2appl scripts since they won't run properly
-    # without additional paths setup. See faust.wrap,
-    # faust.wrapWithBuildEnv.
-    postInstall = ''
-      # syntax error when eval'd directly
-      pattern="faust2!(*@(atomsnippets|graph|graphviewer|md|plot|sig|sigviewer|svg))"
-      (shopt -s extglob; rm "$out"/bin/$pattern)
-    '';
-
-    postFixup = ''
-      # Set faustpath explicitly.
-      substituteInPlace "$out"/bin/faustpath \
-        --replace "/usr/local /usr /opt /opt/local" "$out"
-
-      # The 'faustoptflags' is 'source'd into other faust scripts and
-      # not used as an executable, so patch 'uname' usage directly
-      # rather than use makeWrapper.
-      substituteInPlace "$out"/bin/faustoptflags \
-        --replace uname "${coreutils}/bin/uname"
-
-      # wrapper for scripts that don't need faust.wrap*
-      for script in "$out"/bin/faust2*; do
-        wrapProgram "$script" \
-          --prefix PATH : "$out"/bin
-      done
-    '';
-
-    meta = meta // {
-      description = "A functional programming language for realtime audio signal processing";
-      longDescription = ''
-        FAUST (Functional Audio Stream) is a functional programming
-        language specifically designed for real-time signal processing
-        and synthesis. FAUST targets high-performance signal processing
-        applications and audio plug-ins for a variety of platforms and
-        standards.
-        The Faust compiler translates DSP specifications into very
-        efficient C++ code. Thanks to the notion of architecture,
-        FAUST programs can be easily deployed on a large variety of
-        audio platforms and plugin formats (jack, alsa, ladspa, maxmsp,
-        puredata, csound, supercollider, pure, vst, coreaudio) without
-        any change to the FAUST code.
-
-        This package has just the compiler, libraries, and headers.
-        Install faust2* for specific faust2appl scripts.
-      '';
-    };
-
-  };
-
-  # Default values for faust2appl.
-  faust2ApplBase =
-    { baseName
-    , dir ? "tools/faust2appls"
-    , scripts ? [ baseName ]
-    , ...
-    }@args:
-
-    args // {
-      name = "${baseName}-${version}";
-
-      inherit src;
-
-      dontBuild = true;
-
-      installPhase = ''
-        runHook preInstall
-
-        mkdir -p "$out/bin"
-        for script in ${concatStringsSep " " scripts}; do
-          cp "${dir}/$script" "$out/bin/"
-        done
-
-        runHook postInstall
-      '';
-
-      postInstall = ''
-        # For the faust2appl script, change 'faustpath' and
-        # 'faustoptflags' to absolute paths.
-        for script in "$out"/bin/*; do
-          substituteInPlace "$script" \
-            --replace ". faustpath" ". '${faust}/bin/faustpath'" \
-            --replace ". faustoptflags" ". '${faust}/bin/faustoptflags'"
-        done
-      '';
-
-      meta = meta // {
-        description = "The ${baseName} script, part of faust functional programming language for realtime audio signal processing";
-      };
-    };
-
-  # Some 'faust2appl' scripts, such as faust2alsa, run faust to
-  # generate cpp code, then invoke the c++ compiler to build the code.
-  # This builder wraps these scripts in parts of the stdenv such that
-  # when the scripts are called outside any nix build, they behave as
-  # if they were running inside a nix build in terms of compilers and
-  # paths being configured (e.g. rpath is set so that compiled
-  # binaries link to the libs inside the nix store)
-  #
-  # The function takes two main args: the appl name (e.g.
-  # 'faust2alsa') and an optional list of propagatedBuildInputs. It
-  # returns a derivation that contains only the bin/${appl} script,
-  # wrapped up so that it will run as if it was inside a nix build
-  # with those build inputs.
-  #
-  # The build input 'faust' is automatically added to the
-  # propagatedBuildInputs.
-  wrapWithBuildEnv =
-    { baseName
-    , propagatedBuildInputs ? [ ]
-    , ...
-    }@args:
-
-    stdenv.mkDerivation ((faust2ApplBase args) // {
-
-      nativeBuildInputs = [ pkg-config makeWrapper ];
-
-      propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
-
-      postFixup = ''
-
-        # export parts of the build environment
-        for script in "$out"/bin/*; do
-          wrapProgram "$script" \
-            --set FAUSTLIB "${faust}/lib/faust" \
-            --set FAUSTINC "${faust}/include/faust" \
-            --prefix PATH : "$PATH" \
-            --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
-            --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
-            --set NIX_LDFLAGS "$NIX_LDFLAGS"
-        done
-      '';
-    });
-
-  # Builder for 'faust2appl' scripts, such as faust2firefox that
-  # simply need to be wrapped with some dependencies on PATH.
-  #
-  # The build input 'faust' is automatically added to the PATH.
-  wrap =
-    { baseName
-    , runtimeInputs ? [ ]
-    , ...
-    }@args:
-
-    let
-
-      runtimePath = concatStringsSep ":" (map (p: "${p}/bin") ([ faust ] ++ runtimeInputs));
-
-    in stdenv.mkDerivation ((faust2ApplBase args) // {
-
-      nativeBuildInputs = [ makeWrapper ];
-
-      postFixup = ''
-        for script in "$out"/bin/*; do
-          wrapProgram "$script" --prefix PATH : "${runtimePath}"
-        done
-      '';
-
-    });
-
-in faust

pkgs/applications/editors/jetbrains/default.nix

···
       };
     });
 
-    buildDataSpell = { pname, version, src, license, description, wmClass, buildNumber, ... }:
-      (mkJetBrainsProduct {
-        inherit pname version src wmClass jdk buildNumber;
-        product = "DataSpell";
-        meta = with lib; {
-          homepage = "https://www.jetbrains.com/dataspell/";
-          inherit description license platforms;
-          longDescription = ''
-            DataSpell is a new IDE from JetBrains built for Data Scientists.
-            Mainly it integrates Jupyter notebooks in the IntelliJ platform.
-          '';
-          maintainers = with maintainers; [ leona ];
-        };
-      });
+  buildDataSpell = { pname, version, src, license, description, wmClass, buildNumber, ... }:
+    (mkJetBrainsProduct {
+      inherit pname version src wmClass jdk buildNumber;
+      product = "DataSpell";
+      meta = with lib; {
+        homepage = "https://www.jetbrains.com/dataspell/";
+        inherit description license platforms;
+        longDescription = ''
+          DataSpell is a new IDE from JetBrains built for Data Scientists.
+          Mainly it integrates Jupyter notebooks in the IntelliJ platform.
+        '';
+        maintainers = with maintainers; [ leona ];
+      };
+    });
 
   buildGateway = { pname, version, src, license, description, wmClass, buildNumber, product, ... }:
     (mkJetBrainsProduct {
···
     (mkJetBrainsProduct {
       inherit pname version src wmClass jdk buildNumber;
       product = "Goland";
+      extraWrapperArgs = [
+        # fortify source breaks build since delve compiles with -O0
+        ''--prefix CGO_CPPFLAGS " " "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0"''
+      ];
       meta = with lib; {
         homepage = "https://www.jetbrains.com/go/";
         inherit description license platforms;
···
         interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
         patchelf --set-interpreter $interp $out/goland/plugins/go-plugin/lib/dlv/linux/dlv
         chmod +x $out/goland/plugins/go-plugin/lib/dlv/linux/dlv
-        # fortify source breaks build since delve compiles with -O0
-        wrapProgram $out/bin/goland \
-          --prefix CGO_CPPFLAGS " " "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0"
       '';
     });
 

pkgs/applications/editors/jetbrains/plugins/default.nix

···
   # Only use if you know what youre doing
   raw = { inherit files byId byName; };
 
+  tests = callPackage ./tests.nix {};
+
   addPlugins = ide: unprocessedPlugins:
     let
 
···
         let
           pluginCmdsLines = map (plugin: "ln -s ${plugin} \"$out\"/${meta.mainProgram}/plugins/${baseNameOf plugin}") plugins;
           pluginCmds = builtins.concatStringsSep "\n" pluginCmdsLines;
-          extraBuildPhase = rec {
-            clion = ''
-              sed "s|${ide}|$out|" -i $out/bin/.clion-wrapped
-            '';
-            goland = ''
-              sed "s|${ide}|$out|" -i $out/bin/.goland-wrapped
-            '';
-          };
         in
         ''
           cp -r ${ide} $out
···
           do
             ln -s "$plugin" -t $out/${meta.mainProgram}/plugins/
           done
-          sed "s|${ide.outPath}|$out|" -i $out/bin/${meta.mainProgram}
+          sed "s|${ide.outPath}|$out|" \
+            -i $(realpath $out/bin/${meta.mainProgram}) \
+            -i $(realpath $out/bin/${meta.mainProgram}-remote-dev-server)
           autoPatchelf $out/${meta.mainProgram}/bin
-        '' + (extraBuildPhase."${ide.meta.mainProgram}" or "");
+        '';
     };
 }

pkgs/applications/editors/jetbrains/plugins/plugins.json

···
       },
       "name": "csv-editor"
     },
+    "12062": {
+      "compatible": [
+        "clion",
+        "datagrip",
+        "goland",
+        "idea-community",
+        "idea-ultimate",
+        "mps",
+        "phpstorm",
+        "pycharm-community",
+        "pycharm-professional",
+        "rider",
+        "ruby-mine",
+        "webstorm"
+      ],
+      "builds": {
+        "223.8836.1185": "https://plugins.jetbrains.com/files/12062/256327/keymap-vscode-223.7571.113.zip",
+        "231.9011.35": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.12": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.15": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.16": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.18": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.21": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip",
+        "231.9225.23": "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip"
+      },
+      "name": "vscode-keymap"
+    },
     "12559": {
       "compatible": [
         "clion",
···
   "files": {
     "https://plugins.jetbrains.com/files/10037/358810/CSVEditor-3.2.1-231.zip": "sha256-JC/NOICLHf1gc4wTarDPw7lYfGHOkCOlG194yt18xOA=",
     "https://plugins.jetbrains.com/files/10037/358812/CSVEditor-3.2.1-223.zip": "sha256-l8xq7XXQheZYcP+kdnLXAO7FhfPJYwIh+ZffbttBI9s=",
+    "https://plugins.jetbrains.com/files/12062/256327/keymap-vscode-223.7571.113.zip": "sha256-MlWTPLA6517inAtiOdJDUeUMyHczXzeUIe4dfASLzsM=",
+    "https://plugins.jetbrains.com/files/12062/307834/keymap-vscode-231.8109.91.zip": "sha256-OqK3HmcksgNlrADv7Ld91VCW+uzTOVWtcXcRC60IKfw=",
     "https://plugins.jetbrains.com/files/12559/257029/keymap-eclipse-223.7571.125.zip": "sha256-0hMn8Qt+xJjB9HnYz7OMw8xmI0FxDFy+lYfXHURhTKY=",
     "https://plugins.jetbrains.com/files/12559/307825/keymap-eclipse-231.8109.91.zip": "sha256-8jUsRK4evNMzjuWQIjIMrvQ0sIXPoY1C/buu1nod5X8=",
     "https://plugins.jetbrains.com/files/13017/257030/keymap-visualStudio-223.7571.125.zip": "sha256-YiJALivO1a+I4bCtZEv68PZ21Vydk5UW6gAgErj28DQ=",

pkgs/applications/editors/jetbrains/plugins/tests.nix

···
+{ jetbrains, writeText }:
+
+{
+  # Check to see if the process for adding plugins is breaking anything, instead of the plugins themselves
+  default =
+    let
+      modify-ide = ide: jetbrains.plugins.addPlugins ide [ ];
+      ides = with jetbrains; map modify-ide [
+        clion
+        datagrip
+        dataspell
+        goland
+        idea-community
+        idea-ultimate
+        mps
+        phpstorm
+        pycharm-community
+        pycharm-professional
+        rider
+        ruby-mine
+        webstorm
+      ];
+      paths = builtins.concatStringsSep " " ides;
+    in
+    writeText "jb-ides" paths;
+}

pkgs/applications/networking/cluster/terraform-providers/providers.json

···
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-VDet4IGyd0RXCzlQ+s08QwX9eby5oYfwq2eVRfSS9ME=",
+    "hash": "sha256-6/KnfV4Gti79nh9Cpic1swfOjDkxRK1Zx57DLqTj/nE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.8.0",
+    "rev": "v5.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-oNPWz/0jcSL0FYuIW9wnj8Jp94vm9dJdiC9gfhtbQiU="
+    "vendorHash": "sha256-uBfZLiKLv60WoN+DXf6U62XnHxYt/jx2DRcWP58B6GA="
   },
   "azuread": {
     "hash": "sha256-6LSvqMi79HW1GdEG0lSVwLF2nWft/JnKyj9EQO4pMW4=",
···
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-4cJal4GrL8OwoFNMjN0AKlicq2mC0ba3N8bYISMaY3A=",
+    "hash": "sha256-7irC2P8Sev0lqUbJrHi6MjZGQ1ag0BDiQ84iEBVoDss=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.65.0",
+    "rev": "v3.66.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
···
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-2ahiJ4YL0BmrDwc9f9fp/ppStb51bZlzpwEfuTAlgko=",
+    "hash": "sha256-sytQJgrfgtJ761mGo0KUTxAukqvmPYyLM8+vsYGtoZc=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.27.0",
+    "rev": "v3.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-yAOWcs+rFjjp21Xq1Ch/sE/6N0BSpOC167mxIOmR9nk="
+    "vendorHash": "sha256-foS7GyRUdhF/M8uTPf2I4WQo7qEg4Z/3FXjagoeSRkU="
   },
   "dhall": {
     "hash": "sha256-K0j90YAzYqdyJD4aofyxAJF9QBYNMbhSVm/s1GvWuJ4=",
···
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-W1s4SCxpPsZH31KOExoGX1h5y8twaJQ6qKPiRXUkTZk=",
+    "hash": "sha256-NFBDqRVlSzEHTptAWg3OnK5zYm6JnvuzZnfh8mTtl2Q=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.25.0",
+    "rev": "v2.25.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wwm0edsOwsuCiURFI2Y2Jue0FD+4pAzyDxqSVJYkQYE="
+    "vendorHash": "sha256-rgM+TkygUIUXbw+QNsZOr003A/42iC52Zybw2zBJ15U="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
···
     "vendorHash": "sha256-xd2tsJ5k/8PCSegHqeyJ1ePFBS0ho8SD+4m4QyFMTL0="
   },
   "vcd": {
-    "hash": "sha256-AiVmxqktBgvXbMl6jA5sMa86sEAvxD1LjVuxdwdBJvU=",
+    "hash": "sha256-ltdkB9PqmuCs5daRjcThVhy1wIoDW21yBiwtRo/pMss=",
     "homepage": "https://registry.terraform.io/providers/vmware/vcd",
     "owner": "vmware",
     "repo": "terraform-provider-vcd",
-    "rev": "v3.9.0",
+    "rev": "v3.10.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-dYFLohH/gU+cAiaLLNluxAjfj7giqnk+zQKGVSR1Kws="
+    "vendorHash": "sha256-p/wTnEr/+qe8S83x6EtfsnIMVUF1VWZVHOq0vLDbh60="
   },
   "venafi": {
     "hash": "sha256-/5X/+BilaYwi1Vce7mIvVeHjTpVX/OuYquZ+2BGfxrs=",

pkgs/applications/networking/irc/thelounge/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "thelounge";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "thelounge";
     repo = "thelounge";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2MHq71lKkFe1uHEENgUiYsO99bPyLmEZZIdcdgsZfSM=";
+    hash = "sha256-4FdNYP9VLgv/rfvT7KHCF+ABFsZvPbJjfz6IvvDkRNA=";
   };
 
   # Allow setting package path for the NixOS module.
···
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-OKLsNGl94EDyLgP2X2tiwihgRQFXGvf5XgXwgX+JEpk=";
+    hash = "sha256-MM6SgVT7Pjdu96A4eWRucEzT7uNPxBqUDgHKl8mH2C0=";
   };
 
   nativeBuildInputs = [ nodejs yarn fixup_yarn_lock python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;

pkgs/applications/networking/mkchromecast/default.nix

···
 , opusTools
 , gst_all_1
 , enableSonos ? true
+, qtwayland
 }:
 let packages = [
   vorbis-tools
···
 ] ++ lib.optionals stdenv.isLinux [ pulseaudio ];
 
 in
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "mkchromecast-unstable";
   version = "2022-10-31";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "muammar";
     repo = "mkchromecast";
     rev = "0de9fd78c4122dec4f184aeae2564790b45fe6dc";
     sha256 = "sha256-dxsIcBPrZaXlsfzOEXhYj2qoK5LRducJG2ggMrMMl9Y=";
   };
 
+  buildInputs = lib.optional stdenv.isLinux qtwayland;
   propagatedBuildInputs = with python3Packages; ([
     pychromecast
     psutil

pkgs/applications/version-management/codeberg-cli/default.nix

···
+{ lib
+, CoreServices
+, Security
+, fetchFromGitea
+, installShellFiles
+, openssl
+, pkg-config
+, rustPlatform
+, stdenv
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "codeberg-cli";
+  version = "0.3.5";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "RobWalt";
+    repo = "codeberg-cli";
+    rev = "v${version}";
+    hash = "sha256-KjH78yqfZoN24TBYyFZuxf7z9poRov0uFYQ8+eq9p/o=";
+  };
+
+  cargoHash = "sha256-RE4Zwa5vUWPc42w5GaaYkS6fLIbges1fAsOUuwqR2ag=";
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+
+  buildInputs = [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
+
+  postInstall = ''
+    installShellCompletion --cmd berg \
+      --bash <($out/bin/berg completion bash) \
+      --fish <($out/bin/berg completion fish) \
+      --zsh <($out/bin/berg completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "CLI Tool for Codeberg similar to gh and glab";
+    homepage = "https://codeberg.org/RobWalt/codeberg-cli";
+    license = with licenses; [ agpl3Plus ];
+    maintainers = with maintainers; [ robwalt ];
+  };
+}

pkgs/applications/version-management/gitea/default.nix

···
 
 buildGoModule rec {
   pname = "gitea";
-  version = "1.19.4";
+  version = "1.20.0";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.com/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-vNMNEKMpUoVLUGwPPVhLKfElFmjCWgZHY5i1liNs+xk=";
+    hash = "sha256-ME2ZYSeaHru/7wBFBmXLpf9dKpl0WrtrmAqmzw37tq4=";
   };
 
   vendorHash = null;

pkgs/development/compilers/gleam/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.30.1";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-x/Wb65UIVzuIBwbJmTNVpCzNBu/0bIDL5UD98Bo8n4Q=";
+    hash = "sha256-XrXN+HZlCPzywFo10/vLHbz/zjglSZnNQKfYvLvx35I=";
   };
 
   nativeBuildInputs = [ git pkg-config ];
···
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  cargoHash = "sha256-IKCrIATDALS4Bvl26dzVlHtj90U+XR3n7+Lu772sy1I=";
+  cargoHash = "sha256-K7MrrnupH1BS8KEIgVdlnGF91J5ND5umgdeLVCg7DbQ=";
 
   meta = with lib; {
     description = "A statically typed language for the Erlang VM";

pkgs/development/ocaml-modules/ocamlformat/ocamlformat-rpc-lib.nix

···
 let source =
   if lib.versionAtLeast ocaml.version "4.13"
   then {
-    version = "0.21.0";
-    sha256 = "sha256-KhgX9rxYH/DM6fCqloe4l7AnJuKrdXSe6Y1XY3BXMy0=";
+    version = "0.26.0";
+    sha256 = "sha256-AxSUq3cM7xCo9qocvrVmDkbDqmwM1FexEP7IWadeh30=";
   } else {
     version = "0.20.0";
     sha256 = "sha256-JtmNCgwjbCyUE4bWqdH5Nc2YSit+rekwS43DcviIfgk=";

pkgs/development/python-modules/bleak-retry-connector/default.nix

···
 
 buildPythonPackage rec {
   pname = "bleak-retry-connector";
-  version = "3.0.2";
+  version = "3.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mJQ3Y6o6HAqnktsPVuD9ebGgJo0BjSnlDTyqTpNPb1M=";
+    hash = "sha256-hFtk25ia3ZupqAWp9ODLYGMClKLPU9UrSfYFXRX4rJE=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bluetooth-adapters/default.nix

···
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.15.4";
+  version = "0.16.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-H8QkOs+QPN9jB/g4f3OaGlX/F2SO2hIDptoPB47ogqA=";
+    hash = "sha256-gbnsTRiT/4YumyaJ1h4VRzDAf8/oSkD3yL9mdACvWWk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/bluetooth-data-tools/default.nix

···
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.3.0";
+  version = "1.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-uN3N8/RzZyMp+ljgGYqBLUperNYOnbOPTWjlDlos5QE=";
+    hash = "sha256-Doz8T7XuX/8JFu1yutTUxrtvasDLWD3Fp/+JMLEUIQM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bravado-core/default.nix

···
 { lib
-, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
···
 
 buildPythonPackage rec {
   pname = "bravado-core";
-  version = "5.17.1";
+  version = "6.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "Yelp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7LnKNR1/YIzw2iIPYXAuoC6G7fdm4D3frkSl/wJhYG4=";
+    hash = "sha256-/ePs3znbwamMHHzb/PD4UHq+7v0j1r1X3J3Bnb4S2VU=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/crytic-compile/default.nix

···
 , pycryptodome
 , pythonOlder
 , setuptools
+, solc-select
 }:
 
 buildPythonPackage rec {
   pname = "crytic-compile";
-  version = "0.3.0";
+  version = "0.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "crytic";
     repo = "crytic-compile";
     rev = "refs/tags/${version}";
-    hash = "sha256-4iTvtu2TmxvLTyWm4PV0+yV1fRLYpJHZNBgjy1MFLjM=";
+    hash = "sha256-Nx3eKy/0BLg82o3qDHjxcHXtpX3KDdnBKYwCuTLWRUE=";
   };
 
   propagatedBuildInputs = [
     cbor2
     pycryptodome
     setuptools
+    solc-select
   ];
 
   # Test require network access
   doCheck = false;
 
+  # required for import check to work
+  # PermissionError: [Errno 13] Permission denied: '/homeless-shelter'
+  env.HOME = "/tmp";
   pythonImportsCheck = [
     "crytic_compile"
   ];
···
     homepage = "https://github.com/crytic/crytic-compile";
     changelog = "https://github.com/crytic/crytic-compile/releases/tag/${version}";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ SuperSandro2000 arturcygan ];
+    maintainers = with maintainers; [ arturcygan hellwolf ];
   };
 }

pkgs/development/python-modules/dissect-cobaltstrike/default.nix

···
     ];
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [
     pytest-httpserver
     pytestCheckHook

pkgs/development/python-modules/google-cloud-bigquery/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.11.3";
+  version = "3.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1Fhb6edsmE7IPvKQ6+/xdWLSyfL0+E0wFdm3sntJmp0=";
+    hash = "sha256-aX3xFyQaIoO8u5OyHhC63BTlHJqQgA0qfho+HH2EKXQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-container/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.26.0";
+  version = "2.27.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fUqX5n/tQ7BgtIo3/1jyOGvkIUiVltbfLpzwIZ0YJ0M=";
+    hash = "sha256-d5XR09tdeJ/x5SRtExplDUWsbFXBtzcTQ4pbWhmjkvk=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/identify/default.nix

···
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "2.5.24";
+  version = "2.5.25";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "pre-commit";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-L73M+lWonuT7sSk+piBkZZJtxxeBvZ1XUXUypvS65G0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kqeqo0qWE9O9Q57Ef/0zTSGR04ubYibFFs6FzP9UQys=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/msoffcrypto-tool/default.nix

···
 
 buildPythonPackage rec {
   pname = "msoffcrypto-tool";
-  version = "5.0.1";
+  version = "5.1.1";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "nolze";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-OrGgY+CEhAHGOOIPYK8OijRdoh0PRelnsKB++ksUIXY=";
+    hash = "sha256-A1TeTE4TMHAb+KtFxTi+b4yTfuEFya8iyzy92dzQ0Z4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pynisher/default.nix

···
 
 buildPythonPackage rec {
   pname = "pynisher";
-  version = "1.0.5";
+  version = "1.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-usSowgCwGTATiX1dbPpScO9/FI+E567dvGZxAC+zS14=";
+    hash = "sha256-cqgRoV3AJn96zAJDGbRJ5e3xOTuujmBu8HwZi2RQ6GY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/slither-analyzer/default.nix

···
 , pythonOlder
 , setuptools
 , solc
+, web3
 , withSolc ? false
 }:
 
 buildPythonPackage rec {
   pname = "slither-analyzer";
-  version = "0.9.2";
+  version = "0.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
···
     owner = "crytic";
     repo = "slither";
     rev = "refs/tags/${version}";
-    hash = "sha256-Co3BFdLmSIMqlZVEPJHYH/Cf7oKYSZ+Ktbnd5RZGmfE=";
+    hash = "sha256-c6H7t+aPPWn1i/30G9DLOmwHhdHHHbcP3FRVVjk1XR4=";
   };
 
   nativeBuildInputs = [
···
     packaging
     prettytable
     setuptools
+    web3
   ];
 
   postFixup = lib.optionalString withSolc ''
···
     homepage = "https://github.com/trailofbits/slither";
     changelog = "https://github.com/crytic/slither/releases/tag/${version}";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ arturcygan fab ];
+    maintainers = with maintainers; [ arturcygan fab hellwolf ];
   };
 }

pkgs/development/python-modules/types-urllib3/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.25.13";
+  version = "1.26.25.14";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MwBTjJ3BHa0y6uSCesMT9dmGuLIUlIAfG/l6GsbAOuU=";
+    hash = "sha256-Ipt/V3yVG4wbksG8Ky/bC0mEe9KvbRzCouPdNA872o8=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/unstructured-inference/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+# runtime dependencies
+, layoutparser
+, python-multipart
+, huggingface-hub
+, opencv
+, onnxruntime
+, transformers
+, detectron2
+# check inputs
+, pytestCheckHook
+, coverage
+, click
+, httpx
+, mypy
+, pytest-cov
+, pdf2image
+}:
+
+buildPythonPackage rec {
+  pname = "unstructured-inference";
+  version = "0.5.5";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "Unstructured-IO";
+    repo = "unstructured-inference";
+    rev = version;
+    hash = "sha256-Oma6vPoiA+5czauYFgsU1W6UECDRurYmBTaCSiEILNs=";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements/base.in \
+      --replace "opencv-python" "opencv"
+  '';
+
+  propagatedBuildInputs = [
+    layoutparser
+    python-multipart
+    huggingface-hub
+    opencv
+    onnxruntime
+    transformers
+    detectron2
+    # paddleocr
+    # yolox
+  ]
+    ++ layoutparser.optional-dependencies.layoutmodels
+    ++ layoutparser.optional-dependencies.tesseract;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    coverage
+    click
+    httpx
+    mypy
+    pytest-cov
+    pdf2image
+    huggingface-hub
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # not sure why this fails
+    "test_get_path_oob_move_deeply_nested"
+    "test_get_path_oob_move_nested[False]"
+    # requires yolox
+    "test_yolox"
+    # requires paddleocr
+    "test_table_prediction"
+  ];
+
+  disabledTestPaths = [
+    # network access
+    "test_unstructured_inference/inference/test_layout.py"
+    "test_unstructured_inference/models/test_chippermodel.py"
+    "test_unstructured_inference/models/test_detectron2.py"
+    "test_unstructured_inference/models/test_detectron2onnx.py"
+    # unclear failure
+    "test_unstructured_inference/models/test_donut.py"
+    "test_unstructured_inference/models/test_model.py"
+    "test_unstructured_inference/models/test_tables.py"
+  ];
+
+  pythonImportsCheck = [ "unstructured_inference" ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/Unstructured-IO/unstructured-inference";
+    changelog = "https://github.com/Unstructured-IO/unstructured-inference/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}

pkgs/development/python-modules/weconnect/default.nix

···
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.55.0";
+  version = "0.56.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
···
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+ISWPrpY/urpZZZrn6+Ii8gbrwkQMLL6gXhydXd8HqI=";
+    hash = "sha256-Z6QIEFITMjmB3JbbcfGC5JMJtAz5/3F21TRgao5lBs0=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/qtcreator/qt6.nix

···
 , qtsvg
 , qttools
 , qtwebengine
+, qtwayland
 , qtshadertools
 , wrapQtAppsHook
 , yaml-cpp
···
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "10.0.2";
+  version = "11.0.0";
 
   src = fetchurl {
     url = "https://download.qt.io/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-2n/F59wagMccCeJFt9JxHrAbpXXi+ZEQ0Ep855mSbU4=";
+    hash = "sha256-2/RPVfsDg00nC+3v9pWsT8Aq862oRfW575graxWaFDA=";
   };
 
   nativeBuildInputs = [
···
     qtsvg
     qtquick3d
     qtwebengine
+    qtwayland
     qtserialport
     qtshadertools
     qt5compat

pkgs/os-specific/linux/kernel/hardened/patches.json

···
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.38-hardened1.patch",
-            "sha256": "0sv8i26xwgw3a36yga79n36a5xbrs3ajn8wdkqn40ydbzp24i0qc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.38-hardened1/linux-hardened-6.1.38-hardened1.patch"
+            "name": "linux-hardened-6.1.39-hardened1.patch",
+            "sha256": "0j4sgcs6m2mq9dn1v525bymhdhha3x8ivrpfrhqm553q4vdnmbg7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.39-hardened1/linux-hardened-6.1.39-hardened1.patch"
         },
-        "sha256": "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r",
-        "version": "6.1.38"
+        "sha256": "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac",
+        "version": "6.1.39"
     },
     "6.3": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.3.12-hardened1.patch",
-            "sha256": "12dqdn2prr0mczwcy48907wpp235n87pl22gwyfilsxcj94x2wrx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.12-hardened1/linux-hardened-6.3.12-hardened1.patch"
+            "name": "linux-hardened-6.3.13-hardened1.patch",
+            "sha256": "1iy95awbkrdk5529w9s07axb21l2snab4kifbzjghhz9vwzx22rp",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.13-hardened1/linux-hardened-6.3.13-hardened1.patch"
         },
-        "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb",
-        "version": "6.3.12"
+        "sha256": "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa",
+        "version": "6.3.13"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.3-hardened1.patch",
-            "sha256": "1xwy9088f8qy7algv1gad90gd6sv03diz16jvfnk2yb01k4f87wv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.3-hardened1/linux-hardened-6.4.3-hardened1.patch"
+            "name": "linux-hardened-6.4.4-hardened1.patch",
+            "sha256": "0yy02hn190wvl24z1j9kjmnyxrlp6s9fhkyvqgcm8i56d7d69zhb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.4-hardened1/linux-hardened-6.4.4-hardened1.patch"
         },
-        "sha256": "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i",
-        "version": "6.4.3"
+        "sha256": "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w",
+        "version": "6.4.4"
     }
 }

pkgs/os-specific/linux/kernel/linux-6.1.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.38";
+  version = "6.1.39";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r";
+    sha256 = "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.3.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3.12";
+  version = "6.3.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb";
+    sha256 = "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.4.nix

···
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.3";
+  version = "6.4.4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
···
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i";
+    sha256 = "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w";
   };
 } // (args.argsOverride or { }))

pkgs/servers/ebusd/default.nix

···
+{ lib, stdenv, pkgs, fetchFromGitHub, argparse, mosquitto, cmake, autoconf, automake, libtool, pkg-config, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "ebusd";
+  version = "23.2";
+
+  src = fetchFromGitHub {
+    owner = "john30";
+    repo = "ebusd";
+    rev = version;
+    sha256 = "2CkcTTxEzVrEPtUVVDxXPPkYqZT6+gsCcfTrt83sFv8=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    autoconf
+    automake
+    libtool
+    pkg-config
+  ];
+
+  buildInputs = [
+    argparse
+    mosquitto
+    openssl
+  ];
+
+  patches = [
+    ./patches/ebusd-cmake.patch
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_SYSCONFDIR=${placeholder "out"}/etc"
+    "-DCMAKE_INSTALL_BINDIR=${placeholder "out"}/bin"
+    "-DCMAKE_INSTALL_LOCALSTATEDIR=${placeholder "TMPDIR"}"
+  ];
+
+  postInstall = ''
+    mv $out/usr/bin $out
+    rmdir $out/usr
+  '';
+
+  meta = with lib; {
+    description = "ebusd";
+    homepage = "https://github.com/john30/ebusd";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nathan-gs ];
+    platforms = platforms.linux;
+ };
+}

pkgs/servers/ebusd/patches/ebusd-cmake.patch

···
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -184,16 +184,11 @@
+ add_subdirectory(src/lib/knx)
+ add_subdirectory(src/tools)
+
+-if(EXISTS "${ROOT}/etc/debian_version")
+-  install(FILES ${CMAKE_SOURCE_DIR}/contrib/debian/default/ebusd DESTINATION /etc/default/)
+-  install(FILES ${CMAKE_SOURCE_DIR}/contrib/debian/init.d/ebusd DESTINATION /etc/init.d/)
+-  install(FILES ${CMAKE_SOURCE_DIR}/contrib/debian/systemd/ebusd.service DESTINATION /lib/systemd/system/)
+-endif()
+ if(HAVE_MQTT)
+   FILE(GLOB MQTT_CFG_FILES "${CMAKE_SOURCE_DIR}/contrib/etc/ebusd/mqtt-*.cfg")
+-  install(FILES ${MQTT_CFG_FILES} DESTINATION /etc/ebusd/)
++  install(FILES ${MQTT_CFG_FILES} DESTINATION ${CMAKE_INSTALL_SYSCONFDIR}/ebusd/)
+ endif(HAVE_MQTT)
+ if(HAVE_KNX)
+   FILE(GLOB KNX_CFG_FILES "${CMAKE_SOURCE_DIR}/contrib/etc/ebusd/knx*.cfg")
+-  install(FILES ${KNX_CFG_FILES} DESTINATION /etc/ebusd/)
++  install(FILES ${KNX_CFG_FILES} DESTINATION ${CMAKE_INSTALL_SYSCONFDIR}/ebusd/)
+ endif(HAVE_KNX)

pkgs/tools/filesystems/ceph/default.nix

···
           inherit version;
           hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
         };
-        nativeCheckInputs = oldAttrs.nativeCheckInputs ++ (with super; [
-          pytest-xdist
-        ]);
-        disabledTestPaths = (oldAttrs.disabledTestPaths or []) ++ [
+        disabledTestPaths = [
           "test/aaa_profiling"
           "test/ext/mypy"
         ];

pkgs/tools/graphics/maskromtool/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "maskromtool";
-  version = "2023-06-17";
+  version = "2023-07-20";
 
   src = fetchFromGitHub {
     owner = "travisgoodspeed";
     repo = "maskromtool";
     rev = "v${version}";
-    hash = "sha256-NumMO9whM5ZdEtxI3gjp2Ky2b8/rjPSiD9G/95xJk1o=";
+    hash = "sha256-AUZh1GAGN5RUXyK+YvQfhAp124bSI0LvCSaTRutLuE4=";
   };
 
   buildInputs = [

pkgs/tools/networking/amass/default.nix

···
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.23.3";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    hash = "sha256-aOir4ezLBNWoTaDeQDWoDdV/A+Qzbq09601297o6uDE=";
+    hash = "sha256-FdOfTZG2zzO8Lp3/CbSw8ouDmveXDzbIBB34EuKiyXg=";
   };
 
-  vendorHash = "sha256-zUl1q6rRjX958VXKnVB2YmLUpKMUtFvdh+hkIrTomes=";
+  vendorHash = "sha256-ZA9XKloUk46pdJK0Lutk1upPfT9irwR0NtmntCkzmlA=";
 
   outputs = [
     "out"

pkgs/tools/security/echidna/default.nix

···
 { lib
+, mkDerivation
 , fetchFromGitHub
-# Haskell deps
-, mkDerivation, aeson, base, base16-bytestring, binary, brick, bytestring
-, containers, data-dword, data-has, directory, exceptions, extra, filepath
-, hashable, hevm, hpack, html-entities, lens, ListLike, MonadRandom, mtl
-, optparse-applicative, process, random, semver, tasty, tasty-hunit
-, tasty-quickcheck, text, transformers, unix, unliftio, unordered-containers
-, vector, vector-instances, vty, yaml
+, haskellPackages
+, haskell
+, slither-analyzer
 }:
-mkDerivation rec {
+
+let haskellPackagesOverride = haskellPackages.override {
+      overrides = self: super: {
+        # following the revision specified in echidna/stack.yaml
+        # TODO: 0.51.3 is not in haskellPackages yet
+        hevm = haskell.lib.overrideCabal super.hevm (oa: {
+          version = "0.51.3";
+          src = fetchFromGitHub {
+            owner = "ethereum";
+            repo = "hevm";
+            rev = "release/0.51.3";
+            hash = "sha256-H6oURBGoQWSOuPhBB+UKg2UarVzXgv1tmfDBLnOtdhU=";
+          };
+          libraryHaskellDepends = oa.libraryHaskellDepends
+                                  ++ (with haskellPackages;[githash witch]);
+        });
+      };
+    };
+in mkDerivation rec {
   pname = "echidna";
-  version = "2.0.5";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "crytic";
     repo = "echidna";
     rev = "v${version}";
-    sha256 = "sha256-8bChe+qA4DowfuwsR5wLckb56fXi102g8vL2gAH/kYE=";
+    sha256 = "sha256-5d9ttPR3rRHywBeLM85EGCEZLNZNZzOAhIN6AJToJyI=";
   };
 
   isLibrary = true;
   isExecutable = true;
-  libraryHaskellDepends = [
-    aeson base base16-bytestring binary brick bytestring containers data-dword
-    data-has directory exceptions extra filepath hashable hevm html-entities
-    lens ListLike MonadRandom mtl optparse-applicative process random semver
-    text transformers unix unliftio unordered-containers vector vector-instances
-    vty yaml
+
+  libraryToolDepends = with haskellPackagesOverride; [
+    haskellPackages.hpack
   ];
-  libraryToolDepends = [ hpack ];
-  executableHaskellDepends = libraryHaskellDepends;
-  testHaskellDepends = [
+
+  # Note: This can be extracted from package.yaml of echidna, the list is shorter because some are transitive.
+  executableHaskellDepends = with haskellPackagesOverride;
+    [aeson base base16-bytestring binary brick bytestring code-page containers data-dword data-has directory exceptions extra
+     filepath hashable hevm html-conduit html-entities http-conduit lens ListLike MonadRandom mtl optics optparse-applicative
+     process random semver text transformers unix unliftio unordered-containers vector vector-instances vty with-utf8
+     xml-conduit yaml];
+
+  # Note: there is also a runtime dependency of slither-analyzer, let's include it also.
+  executableSystemDepends = [ slither-analyzer ];
+
+  testHaskellDepends = with haskellPackagesOverride; [
     tasty tasty-hunit tasty-quickcheck
   ];
+
   preConfigure = ''
     hpack
     # re-enable dynamic build for Linux
···
   description = "Ethereum smart contract fuzzer";
   homepage = "https://github.com/crytic/echidna";
   license = lib.licenses.agpl3Plus;
-  maintainers = with lib.maintainers; [ arturcygan ];
+  maintainers = with lib.maintainers; [ arturcygan hellwolf ];
   platforms = lib.platforms.unix;
   mainProgram = "echidna-test";
 }

pkgs/tools/security/exploitdb/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-07-18";
+  version = "2023-07-21";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fna7N9TCrq2Fz+/S0vNQRCx35EFTRr+OiYk6aXzWfyc=";
+    hash = "sha256-HJKvIyWJSLsoVq2jpLDN7H1dsLE9+zv5bSZIh3l4W/4=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/aliases.nix

···
 
   facette = throw "facette has been removed"; # Added 2020-01-06
   faustStk = faustPhysicalModeling; # Added 2023-05-16
+  faust1 = throw "faust1 has been removed, use faust2 instead"; # Added 2022-12-03
   fast-neural-doodle = throw "fast-neural-doodle has been removed, as the upstream project has been abandoned"; # Added 2020-03-28
   fastnlo = fastnlo_toolkit; # Added 2021-04-24
   fbreader = throw "fbreader has been removed, as the upstream project has been archived"; # Added 2022-05-26

pkgs/top-level/all-packages.nix

···
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  codeberg-cli = callPackage ../applications/version-management/codeberg-cli {
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
+  };
+
   conftest = callPackage ../development/tools/conftest { };
 
   coldsnap = callPackage ../tools/admin/coldsnap {
···
   ea = callPackage ../tools/misc/ea { };
 
   each = callPackage ../tools/text/each { };
+
+  ebusd = callPackage ../servers/ebusd { };
 
   eclipse-mat = callPackage ../development/tools/eclipse-mat { };
 
···
   glee = callPackage ../tools/graphics/glee { };
 
   faust = res.faust2;
-
-  faust1 = callPackage ../applications/audio/faust/faust1.nix { };
 
   faust2 = callPackage ../applications/audio/faust/faust2.nix { };
 

pkgs/top-level/python-packages.nix

···
 
   unrpa = callPackage ../development/python-modules/unrpa { };
 
+  unstructured-inference = callPackage ../development/python-modules/unstructured-inference { };
+
   untangle = callPackage ../development/python-modules/untangle { };
 
   untokenize = callPackage ../development/python-modules/untokenize { };