Merge master into staging-next

maintainers/maintainer-list.nix

···
   };
   _2hexed = {
     name = "n";
-    email = "[e-mail]";
+    email = "[e-mail]";
     github = "2hexed";
     githubId = 54501296;
   };
···
     github = "c0deaddict";
     githubId = 510553;
     name = "Jos van Bakel";
+  };
+  c31io = {
+    email = "[e-mail]";
+    github = "c31io";
+    githubId = 83821760;
+    name = "Celio Grand";
   };
   c4605 = {
     email = "[e-mail]";
···
     name = "I Al Istannen";
     github = "I-Al-Istannen";
     githubId = 20284688;
+  };
+  iamanaws = {
+    email = "[e-mail]";
+    github = "Iamanaws";
+    githubId = 78835633;
+    name = "Angel J";
   };
   iammrinal0 = {
     email = "[e-mail]";

nixos/modules/services/audio/navidrome.nix

···
             mode = "700";
             inherit (cfg) user group;
           };
+          "${cfg.settings.MusicFolder or (WorkingDirectory + "/music")}"."d" = {
+            mode = ":700";
+            user = ":${cfg.user}";
+            group = ":${cfg.group}";
+          };
         };
         services.navidrome = {
           description = "Navidrome Media Server";

nixos/tests/all-tests.nix

···
   armagetronad = runTest ./armagetronad.nix;
   artalk = runTest ./artalk.nix;
   atd = runTest ./atd.nix;
-  atop = handleTest ./atop.nix { };
+  atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
   atuin = runTest ./atuin.nix;
   audiobookshelf = runTest ./audiobookshelf.nix;

nixos/tests/atop.nix

···
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  ...
 }:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
 
 let
   assertions = rec {
···
   };
 in
 {
-  justThePackage = makeTest {
+  justThePackage = runTest {
     name = "atop-justThePackage";
     nodes.machine = {
       environment.systemPackages = [ pkgs.atop ];
···
       ];
     inherit meta;
   };
-  defaults = makeTest {
+  defaults = runTest {
     name = "atop-defaults";
     nodes.machine = {
       programs.atop = {
···
       ];
     inherit meta;
   };
-  minimal = makeTest {
+  minimal = runTest {
     name = "atop-minimal";
     nodes.machine = {
       programs.atop = {
···
       ];
     inherit meta;
   };
-  netatop = makeTest {
+  netatop = runTest {
     name = "atop-netatop";
     nodes.machine = {
       programs.atop = {
···
       ];
     inherit meta;
   };
-  atopgpu = makeTest {
+  atopgpu = runTest {
     name = "atop-atopgpu";
     nodes.machine = {
       programs.atop = {
···
       ];
     inherit meta;
   };
-  everything = makeTest {
+  everything = runTest {
     name = "atop-everything";
     nodes.machine = {
       programs.atop = {

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

···
     substituteInPlace lua/cord/server/fs/init.lua \
       --replace-fail \
         "or M.get_data_path()" \
-        "'${cord-server}'"
+        "or '${cord-server}'"
   '';
 
   passthru = {

pkgs/by-name/ad/adidnsdump/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "adidnsdump";
-  version = "1.3.1-unstable-2023-12-13";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dirkjanm";
     repo = "adidnsdump";
-    rev = "8bbb4b05b2d1b792f3c77ce0a4a762ab9e08727d";
-    hash = "sha256-dIbnUyV3gdWHHoyzD0ME2fXlMoiQkdrqQ7qQ6Ab6qs0=";
+    tag = "v${version}";
+    hash = "sha256-gKOIZuXYm8ltaajmOZXulPX5dI4fWz4xiZ8W0kPpcRk=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     impacket
     ldap3
   ];
 
-  pythonImportsCheck = [
-    "adidnsdump"
-  ];
+  pythonImportsCheck = [ "adidnsdump" ];
 
   meta = with lib; {
     description = "Active Directory Integrated DNS dumping by any authenticated user";
     homepage = "https://github.com/dirkjanm/adidnsdump";
-    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/v${version}";
+    changelog = "https://github.com/dirkjanm/adidnsdump/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "adidnsdump";

pkgs/by-name/al/altus/package.nix

···
 
 let
   pname = "altus";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchurl {
     name = "altus-${version}.AppImage";
     url = "https://github.com/amanharwara/altus/releases/download/${version}/Altus-${version}.AppImage";
-    hash = "sha512-u4eBTboFJaU5qLFURXFchOmFV7GzlDbUokrBpxx8QeAJO6B0IwX1gJU0C69BKinIdO4Q93SAcjsvUkvSI+blrw==";
+    hash = "sha512-wkH9ZEmEJTP8PAPBG4QeewGrR2Nmd4p2ZWTP/il4+bHREz0N8GttUwkjhYOy1heRSV/S+zlkGjfB8VTaNjGaaA==";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/ch/chatbox/package.nix

···
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:
+let
+  pname = "chatbox";
+  version = "1.11.3";
+
+  src = fetchurl {
+    url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
+    hash = "sha256-YMZsgbCkG/cZd77DOVZj6jVJDzWMcrt92soxyLNr2QI=";
+  };
+
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -m 444 -D ${appimageContents}/xyz.chatboxapp.app.desktop $out/share/applications/chatbox.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/xyz.chatboxapp.app.png $out/share/icons/hicolor/512x512/apps/chatbox.png
+    substituteInPlace $out/share/applications/chatbox.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=chatbox' \
+      --replace-fail 'Icon=xyz.chatboxapp.app' 'Icon=chatbox'
+  '';
+
+  passthru.updateScript = ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl grep common-updater-scripts
+    version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')
+    update-source-version chatbox $version
+  '';
+
+  meta = {
+    description = "AI client application and smart assistant";
+    homepage = "https://chatboxai.app";
+    downloadPage = "https://chatboxai.app/en#download";
+    changelog = "https://chatboxai.app/en/help-center/changelog";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ c31io ];
+    mainProgram = "chatbox";
+
+    # Help porting to other platforms :)
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/by-name/da/databricks-cli/package.nix

···
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.245.0";
+  version = "0.246.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4EWBDfDCiOF9LcON5XT77kNcAXBd57ZjsSGB+hzRgOw=";
+    hash = "sha256-G9+PkmwRYj6Zwc65tscohjv9X4vZmIQXuYK9Lhl0hgQ=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
···
       --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
   '';
 
-  vendorHash = "sha256-XkUkCraKR9AP0lRZa+u1YMWzLZV+xxWZgbAlxkVjsXM=";
+  vendorHash = "sha256-AQsZBNQA3upH4kNuf0Y7CP6IDuIDGPVYeqATAaBKFIk=";
 
   excludedPackages = [
     "bundle/internal"

pkgs/by-name/do/double-entry-generator/package.nix

···
 }:
 buildGoModule rec {
   pname = "double-entry-generator";
-  version = "2.7.1";
+  version = "2.8.0";
   src = fetchFromGitHub {
     owner = "deb-sig";
     repo = "double-entry-generator";
-    hash = "sha256-2Y8Spj1LAVZsUgChDYDCZ63pTH+nqs2ff9xcmC+gr0c=";
+    hash = "sha256-sQiV+sdPTTiydlAbmVfMHijNnfAICMvd5ezAP+1CVWc=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-Xedva9oGteOnv3rP4Wo3sOHIPyuy2TYwkZV2BAuxY4M=";
+  vendorHash = "sha256-/QMt8zPvHM9znUc0+iUC82bOUJoBmH+shJ9D7AHiQ1E=";
 
   excludedPackages = [ "hack" ];
 

pkgs/by-name/gi/github-mcp-server/package.nix

···
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "github-mcp-server";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "github";
+    repo = "github-mcp-server";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LpD4zLAeLFod7sCNvBW8u9Wk0lL75OmlRXZqpQsQMOs=";
+  };
+
+  vendorHash = "sha256-YqjcPP4elzdwEVvYUcFBoPYWlFzeT+q2+pxNzgj1X0Q=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    changelog = "https://github.com/github/github-mcp-server/releases/tag/v${finalAttrs.version}";
+    description = "GitHub's official MCP Server";
+    homepage = "https://github.com/github/github-mcp-server";
+    license = lib.licenses.mit;
+    mainProgram = "github-mcp-server";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+})

pkgs/by-name/in/intelephense/package.nix

···
   fetchurl,
 }:
 let
-  version = "1.14.1";
+  version = "1.14.4";
 in
 buildNpmPackage {
   pname = "intelephense";
···
 
   src = fetchurl {
     url = "https://registry.npmjs.org/intelephense/-/intelephense-${version}.tgz";
-    hash = "sha256-6TT8RYg6l6Vcua0t5Mn+N/t5FehmY9nOxYAgvSFOre8=";
+    hash = "sha256-vFXwkFPmgEbB2RtB0lxT6UaZMxaWXh+3BHCL9+1rRjk=";
   };
 
   postPatch = ''

pkgs/by-name/mo/mongodb-cli/package.nix

···
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  buildGoModule,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "mongodb-cli";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "mongodb";
+    repo = "mongodb-cli";
+    tag = "mongocli/v${version}";
+    sha256 = "sha256-vhx8dxTNngDBy+34e+Er7uqIAGJImJiPmwxZX+EwIG0=";
+  };
+
+  vendorHash = "sha256-825S3jMwgZC3aInuahg6/jg4A9u/bKeie30MB9HexJY=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = [ "cmd/mongocli" ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd mongocli \
+      --bash <($out/bin/mongocli completion bash) \
+      --fish <($out/bin/mongocli completion fish) \
+      --zsh <($out/bin/mongocli completion zsh)
+  '';
+
+  meta = {
+    description = "MongoDB CLI enable you to manage your MongoDB via ops manager and cloud manager";
+    homepage = "https://github.com/mongodb/mongodb-cli";
+    changelog = "https://www.mongodb.com/docs/mongocli/current/release-notes/#mongodb-cli-${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.iamanaws ];
+    mainProgram = "mongocli";
+  };
+}

pkgs/by-name/mo/movim/package.nix

···
 in
 php.buildComposerProject2 (finalAttrs: {
   pname = "movim";
-  version = "0.29.2";
+  version = "0.30";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/u8/9tn0X+IwXKyK3S5uA9X8IRsg5xDdUPpnvxOIaYc=";
+    hash = "sha256-rW751UhDBhakOrAT4BOiRDPpGldf1EwNZY8iavXlpLk=";
   };
 
   php = php.buildEnv (
···
       extensions = (
         { all, enabled }:
         enabled
-        ++ (with all; [
-          curl
-          dom
-          gd
-          imagick
-          mbstring
-          pdo
-          simplexml
-        ])
-        ++ lib.optionals withPostgreSQL (
-          with all;
-          [
-            pdo_pgsql
-            pgsql
-          ]
-        )
-        ++ lib.optionals withMySQL (
-          with all;
-          [
-            mysqli
-            mysqlnd
-            pdo_mysql
-          ]
-        )
+        ++ [
+          all.curl
+          all.dom
+          all.gd
+          all.imagick
+          all.mbstring
+          all.pdo
+          all.simplexml
+        ]
+        ++ lib.optionals withPostgreSQL [
+          all.pdo_pgsql
+          all.pgsql
+        ]
+        ++ lib.optionals withMySQL [
+          all.mysqli
+          all.mysqlnd
+          all.pdo_mysql
+        ]
       );
     }
     // lib.optionalAttrs (phpCfg != null) {
···
     ++ lib.optional minify.style.enable lightningcss
     ++ lib.optional minify.svg.enable scour;
 
-  # no listed license
-  # pinned commonmark
-  composerStrictValidation = false;
-
-  vendorHash = "sha256-ikIAIPq8Yj27vGmJxeViYJ5SWiZtE68CIE526glZPlo=";
+  vendorHash = "sha256-NuX6CX2QXea8BcL0nzFOdxIBs36igD8lvixna+vsviM=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;

pkgs/by-name/pr/prefect/package.nix

···
   python3Packages,
   fetchPypi,
   nixosTests,
+  nix-update-script,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "prefect";
-  version = "3.2.14";
+  version = "3.3.3";
   pyproject = true;
 
   # Trying to install from source is challenging
···
   # Source will be missing sdist, uv.lock, ui artefacts ...
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DmPpiilxKp8uakcRJGaP1AD4AuOre1okk5h7bb5T2tE=";
+    hash = "sha256-4cJoOD7wdmwL+56VMh01JqzyC6817FnLrbIf0Ydaz/g=";
   };
 
   pythonRelaxDeps = [
···
 
   passthru.tests = {
     inherit (nixosTests) prefect;
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        # avoid pre‐releases
+        "--version-regex"
+        ''^\d+\.\d+\.\d+$''
+      ];
+    };
   };
 
   # Tests are not included in the pypi source

pkgs/by-name/pu/puncia/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "puncia";
-  version = "0.29";
+  version = "0.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ARPSyndicate";
     repo = "puncia";
     tag = "v${version}";
-    hash = "sha256-46qJ5sUQs8A8wiNj1Oj/1s4roAR+gtwmcGqHhkkUvd0=";
+    hash = "sha256-woy8JL+yFOYUsAhYWxyskUj/hT3JmwrhKHg3JHyWzNY=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/qo/qownnotes/package.nix

···
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.3.3";
+  version = "25.4.1";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-waWFOPXxKgCb1h1dVSzXDVQwcKyFBKXuAwYXu63ofPo=";
+    hash = "sha256-1Als8iv9L9fOL9JNXRsM5ilfSXwd/l4kE6wnWkz1BBE=";
   };
 
   nativeBuildInputs =

pkgs/by-name/qu/quark-engine/package.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
-  version = "25.3.1";
+  version = "25.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quark-engine";
     repo = "quark-engine";
     tag = "v${version}";
-    hash = "sha256-k4jWmLoTT92ikyiVXv7iXyNoVfyGGo12ekmfthO9M3U=";
+    hash = "sha256-Z005rFKdwuS2t5mTZKv+HSO5GvEe2YqsRVaN556cM/Y=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/ti/tiny-cuda-nn/package.nix

···
 {
+  config,
   cmake,
   cudaPackages,
   fetchFromGitHub,
···
     license = licenses.bsd3;
     maintainers = with maintainers; [ connorbaker ];
     platforms = platforms.linux;
-    # g++: error: unrecognized command-line option '-mf16c'
-    broken = stdenv.hostPlatform.isAarch64;
+    badPlatforms = [
+      # g++: error: unrecognized command-line option '-mf16c'
+      lib.systems.inspect.patterns.isAarch64
+    ];
+    # Requires torch.cuda._is_compiled() == True to build
+    broken = !config.cudaSupport;
   };
 })

pkgs/development/python-modules/aider-chat/default.nix

···
       gitMinimal
     ];
 
+    postPatch = ''
+      substituteInPlace aider/linter.py --replace-fail "\"flake8\"" "\"${flake8}\""
+    '';
+
     disabledTestPaths = [
       # Tests require network access
       "tests/scrape/test_scrape.py"
···
             propagatedBuildInputs ? [ ],
             ...
           }:
-          let
-            playwrightDeps =
-              if withPlaywright || withAll then aider-chat.optional-dependencies.playwright else [ ];
-            browserDeps = if withBrowser || withAll then aider-chat.optional-dependencies.browser else [ ];
-            helpDeps = if withHelp || withAll then aider-chat.optional-dependencies.help else [ ];
-            bedrockDeps = if withBedrock || withAll then aider-chat.optional-dependencies.bedrock else [ ];
 
-            playwrightInputs = if withPlaywright || withAll then [ playwright-driver.browsers ] else [ ];
-            playwrightArgs =
-              if withPlaywright || withAll then
-                [
-                  "--set"
-                  "PLAYWRIGHT_BROWSERS_PATH"
-                  "${playwright-driver.browsers}"
-                  "--set"
-                  "PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS"
-                  "true"
-                ]
-              else
-                [ ];
-            helpArgs =
-              if withHelp || withAll then
-                [
-                  "--set"
-                  "NLTK_DATA"
-                  "${aider-nltk-data}"
-                ]
-              else
-                [ ];
-          in
           {
-            dependencies = dependencies ++ playwrightDeps ++ browserDeps ++ helpDeps ++ bedrockDeps;
-            propagatedBuildInputs = propagatedBuildInputs ++ playwrightInputs;
-            makeWrapperArgs = makeWrapperArgs ++ playwrightArgs ++ helpArgs;
+            dependencies =
+              dependencies
+              ++ lib.optionals (withAll || withPlaywright) aider-chat.optional-dependencies.playwright
+              ++ lib.optionals (withAll || withBrowser) aider-chat.optional-dependencies.browser
+              ++ lib.optionals (withAll || withHelp) aider-chat.optional-dependencies.help
+              ++ lib.optionals (withAll || withBedrock) aider-chat.optional-dependencies.bedrock;
+
+            propagatedBuildInputs =
+              propagatedBuildInputs
+              ++ lib.optionals (withAll || withPlaywright) [ playwright-driver.browsers ];
+
+            makeWrapperArgs =
+              makeWrapperArgs
+              ++ lib.optionals (withAll || withPlaywright) [
+                "--set"
+                "PLAYWRIGHT_BROWSERS_PATH"
+                "${playwright-driver.browsers}"
+                "--set"
+                "PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS"
+                "true"
+              ]
+              ++ lib.optionals (withAll || withHelp) [
+                "--set"
+                "NLTK_DATA"
+                "${aider-nltk-data}"
+              ];
           }
         );
 
-      updateScript = nix-update-script { };
+      updateScript = nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          "^v([0-9.]+)$"
+        ];
+      };
     };
 
     meta = {

pkgs/development/python-modules/cohere/default.nix

···
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "5.14.0";
+  version = "5.14.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cohere-ai";
     repo = "cohere-python";
     tag = version;
-    hash = "sha256-/C2P8+fnDQv389DoY98vRh7IDIlvZgxCr8Xc2ML/Zpo=";
+    hash = "sha256-58l6yBJsKDpFktZITbHemLm/PdK9BZOhoxsCJNvyCmQ=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/dash/default.nix

···
   dash-core-components,
   dash-table,
   importlib-metadata,
-  stringcase,
   typing-extensions,
   requests,
   retrying,
···
 
 buildPythonPackage rec {
   pname = "dash";
-  version = "3.0.0";
+  version = "3.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "dash";
     tag = "v${version}";
-    hash = "sha256-plGYBMwVQLBar48nv2BIH7ttfXM8Dnb3E0sPOZ2Et2M=";
+    hash = "sha256-cBFSqp4GWnWJQtaCWdfbLj+C7fT8XSA0SpxK8MU5LT0=";
   };
 
   nativeBuildInputs = [
···
     dash-core-components
     dash-table
     importlib-metadata
-    stringcase
     typing-extensions
     requests
     retrying

pkgs/development/python-modules/donut-shellcode/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "donut-shellcode";
+  version = "1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "TheWover";
+    repo = "donut";
+    rev = "v${version}";
+    hash = "sha256-gKa7ngq2+r4EYRdwH9AWnJodJjCdppzKch4Ve/4ZPhk=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "donut" ];
+
+  meta = {
+    description = "Module to generate x86, x64, or AMD64+x86 position-independent shellcode";
+    homepage = "https://github.com/TheWover/donut";
+    changelog = "https://github.com/TheWover/donut/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/pysecretsocks/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pyasyncore,
+}:
+
+buildPythonPackage rec {
+  pname = "pysecretsocks";
+  version = "0.9.1-unstable-2023-11-04";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "BC-SECURITY";
+    repo = "PySecretSOCKS";
+    rev = "da5be0e48f82097044894247343cef2111f13c7a";
+    hash = "sha256-3jvMVsoKgBN4eRc6hyj7X/uu7NoJvofsbljVcgGfcPc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pyasyncore ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "secretsocks" ];
+
+  meta = {
+    description = "Socks server for tunneling a connection over another channel";
+    homepage = "https://github.com/BC-SECURITY/PySecretSOCKS";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/python-obfuscator/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  regex,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "python-obfuscator";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "davidteather";
+    repo = "python-obfuscator";
+    tag = "V${version}";
+    hash = "sha256-LUD+9vNd1sdigbKG2tm5hE3zLtmor/2LqsIarUWS2Ek=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ regex ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "python_obfuscator" ];
+
+  meta = {
+    description = "Module to obfuscate code";
+    homepage = "https://github.com/davidteather/python-obfuscator";
+    changelog = "https://github.com/davidteather/python-obfuscator/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/sqlalchemy-utc/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+  sqlalchemy,
+}:
+
+buildPythonPackage rec {
+  pname = "sqlalchemy-utc";
+  version = "0.14.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "spoqa";
+    repo = "sqlalchemy-utc";
+    tag = version;
+    hash = "sha256-ZtUuwUDgd/ngOQoWu8IgOldTbTGoFbv5Y0Hyha1KTrE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ sqlalchemy ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "sqlalchemy_utc" ];
+
+  disabledTests = [
+    # ArgumentError
+    "test_utcnow_timezone"
+  ];
+
+  meta = {
+    description = "SQLAlchemy type to store aware datetime values";
+    homepage = "https://github.com/spoqa/sqlalchemy-utc";
+    changelog = "https://github.com/spoqa/sqlalchemy-utc/blob/${src.tag}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/zlib-wrapper/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "zlib-wrapper";
+  version = "0.1.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "zlib_wrapper";
+    inherit version;
+    hash = "sha256-Yxqc7fSDdnAPlGLzTbgcEQxiTKJDSJmPgm0eV62JiGQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "zlib_wrapper" ];
+
+  meta = {
+    description = "Wrapper around zlib with custom header crc32";
+    homepage = "https://pypi.org/project/zlib_wrapper/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/tools/networking/openvpn/default.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvpn";
-  version = "2.6.13";
+  version = "2.6.14";
 
   src = fetchurl {
     url = "https://swupdate.openvpn.net/community/releases/openvpn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-GvELhpIr18mYJ8wPFR3+loQze45evbOXU5FyhBrCSmo=";
+    hash = "sha256-nramYYNS+ee3canTiuFjG17f7tbUAjPiQ+YC3fIZXno=";
   };
 
   nativeBuildInputs =

pkgs/top-level/python-packages.nix

···
 
   donfig = callPackage ../development/python-modules/donfig { };
 
+  donut-shellcode = callPackage ../development/python-modules/donut-shellcode { };
+
   doorbirdpy = callPackage ../development/python-modules/doorbirdpy { };
 
   dopy = callPackage ../development/python-modules/dopy { };
···
 
   pysearpc = toPythonModule (pkgs.libsearpc.override { python3 = self.python; });
 
+  pysecretsocks = callPackage ../development/python-modules/pysecretsocks { };
+
   pysecuritas = callPackage ../development/python-modules/pysecuritas { };
 
   pysendfile = callPackage ../development/python-modules/pysendfile { };
···
   python-nvd3 = callPackage ../development/python-modules/python-nvd3 { };
 
   python-oauth2 = callPackage ../development/python-modules/python-oauth2 { };
+
+  python-obfuscator = callPackage ../development/python-modules/python-obfuscator { };
 
   python-octaviaclient = callPackage ../development/python-modules/python-octaviaclient { };
 
···
   sqlalchemy-jsonfield = callPackage ../development/python-modules/sqlalchemy-jsonfield { };
 
   sqlalchemy-mixins = callPackage ../development/python-modules/sqlalchemy-mixins { };
+
+  sqlalchemy-utc = callPackage ../development/python-modules/sqlalchemy-utc { };
 
   sqlalchemy-utils = callPackage ../development/python-modules/sqlalchemy-utils { };