Merge master into staging-next

doc/build-helpers/fetchers.chapter.md

···
 
   _Default value:_ `""`.
 
-`recursiveHash` (Boolean; _optional_)
+`recursiveHash` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash}
 : If set to `true`, will signal to Nix that the hash given to `fetchurl` was calculated using the `"recursive"` mode.
   See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashMode) for more information about the existing modes.
 
···
 
   _Default value_: `false`.
 
-`downloadToTemp` (Boolean; _optional_)
+`downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp}
 : If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location.
   This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output.
 
···
 
 ## `fetchzip` {#sec-pkgs-fetchers-fetchzip}
 
-Downloads content from a given URL (which is assumed to be an archive), and decompresses the archive for you, making files and directories directly accessible.
-`fetchzip` can only be used with archives.
-Despite its name, `fetchzip` is not limited to `.zip` files and can also be used with any tarball.
+Returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads an archive from a given URL and decompresses it.
+
+Despite its name, `fetchzip` is not limited to `.zip` files but can also be used with [various compressed tarball formats](#tar-files) by default.
+This can extended by specifying additional attributes, see [](#ex-fetchers-fetchzip-rar-archive) to understand how to do that.
+
+### Inputs {#sec-pkgs-fetchers-fetchzip-inputs}
+
+`fetchzip` requires an attribute set, and most attributes are passed to the underlying call to [`fetchurl`](#sec-pkgs-fetchers-fetchurl).
+
+The attributes below are treated differently by `fetchzip` when compared to what `fetchurl` expects:
+
+`name` (String; _optional_)
+: Works as defined in `fetchurl`, but has a different default value than `fetchurl`.
+
+  _Default value:_ `"source"`.
+
+`nativeBuildInputs` (List of Attribute Set; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented by `fetchzip` to include packages to deal with additional archives (such as `.zip`).
+
+  _Default value:_ `[]`.
+
+`postFetch` (String; _optional_)
+: Works as defined in `fetchurl`, but it is also augmented with the code needed to make `fetchzip` work.
+
+  :::{.caution}
+  It is only safe to modify files in `$out` in `postFetch`.
+  Consult the implementation of `fetchzip` for anything more involved.
+  :::
 
-It has two required arguments, a URL and a hash.
-The hash is typically `hash`, although many more hash algorithms are supported.
-Nixpkgs contributors are currently recommended to use `hash`.
-This hash will be used by Nix to identify your source.
-A typical usage of `fetchzip` is provided below.
+  _Default value:_ `""`.
+
+`stripRoot` (Boolean; _optional_)
+: If `true`, the decompressed contents are moved one level up the directory tree.
+
+  This is useful for archives that decompress into a single directory which commonly includes some values that change with time, such as version numbers.
+  When this is the case (and `stripRoot` is `true`), `fetchzip` will remove this directory and make the decompressed contents available in the top-level directory.
+
+  [](#ex-fetchers-fetchzip-simple-striproot) shows what this attribute does.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extension` (String or Null; _optional_)
+: If set, the archive downloaded by `fetchzip` will be renamed to a filename with the extension specified in this attribute.
+
+  This is useful when making `fetchzip` support additional types of archives, because the implementation may use the extension of an archive to determine whether they can decompress it.
+  If the URL you're using to download the contents doesn't end with the extension associated with the archive, use this attribute to fix the filename of the archive.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+  _Default value:_ `null`.
+
+`recursiveHash` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`downloadToTemp` (Boolean; _optional_)
+: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp), but its default value is different than for `fetchurl`.
+
+  _Default value:_ `true`.
+
+`extraPostFetch` **DEPRECATED**
+: This attribute is deprecated.
+  Please use `postFetch` instead.
+
+  This attribute is **not** passed through to `fetchurl`.
+
+### Examples {#sec-pkgs-fetchers-fetchzip-examples}
+
+::::{.example #ex-fetchers-fetchzip-simple-striproot}
+# Using `fetchzip` to output contents directly
+
+The following recipe shows how to use `fetchzip` to decompress a `.tar.gz` archive:
 
 ```nix
 { fetchzip }:
···
   hash = "sha256-3ABYlME9R8klcpJ7MQpyFEFwHmxDDEzIYBqu/CpDYmg=";
 }
 ```
+
+This archive has all its contents in a directory named `patchelf-0.18.0`.
+This means that after decompressing, you'd have to enter this directory to see the contents of the archive.
+However, `fetchzip` makes this easier through the attribute `stripRoot` (enabled by default).
+
+After building the recipe, the derivation output will show all the files in the archive at the top level:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+
+$ ls /nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
+aclocal.m4  completions  configure.ac  m4           Makefile.in  patchelf.spec     README.md  tests
+build-aux   configure    COPYING       Makefile.am  patchelf.1   patchelf.spec.in  src        version
+```
+
+If `stripRoot` is set to `false`, the derivation output will be the decompressed archive as-is:
+
+```nix
+{ fetchzip }:
+fetchzip {
+  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
+  hash = "sha256-uv3FuKE4DqpHT3yfE0qcnq0gYjDNQNKZEZt2+PUAneg=";
+  stripRoot = false;
+}
+```
+
+:::{.caution}
+The hash changed!
+Whenever changing attributes of a Nixpkgs fetcher, [remember to invalidate the hash](#chap-pkgs-fetchers-caveats), otherwise you won't get the results you're expecting!
+:::
+
+After building the recipe:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+
+$ ls /nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
+patchelf-0.18.0
+```
+::::
+
+::::{.example #ex-fetchers-fetchzip-rar-archive}
+# Using `fetchzip` to decompress a `.rar` file
+
+The `unrar` package provides a [setup hook](#ssec-setup-hooks) to decompress `.rar` archives during the [unpack phase](#ssec-unpack-phase), which can be used with `fetchzip` to decompress those archives:
+
+```nix
+{ fetchzip, unrar }:
+fetchzip {
+  url = "https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar";
+  hash = "sha256-fC+zsR8BY6vXpUkVd6i1jF0IZZxVKVvNi6VWCKT+pA4=";
+  stripRoot = false;
+  nativeBuildInputs = [ unrar ];
+}
+```
+
+Since this particular `.rar` file doesn't put its contents in a directory inside the archive, `stripRoot` must be set to `false`.
+
+After building the recipe, the derivation output will show the decompressed files:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+
+$ ls /nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
+FONT.DAT      PINBALL.DAT  PINBALL.EXE	PINBALL2.MID  TABLE.BMP    WMCONFIG.EXE
+MSCREATE.DIR  PINBALL.DOC  PINBALL.MID	Sounds	     WAVEMIX.INF
+```
+::::
 
 ## `fetchpatch` {#fetchpatch}
 

maintainers/maintainer-list.nix

···
       fingerprint = "7756 E88F 3C6A 47A5 C5F0  CDFB AB54 6777 F93E 20BF";
     }];
   };
+  phdyellow = {
+    name = "Phil Dyer";
+    email = "[e-mail]";
+    github = "PhDyellow";
+    githubId = 7740661;
+  };
   phfroidmont = {
     name = "Paul-Henri Froidmont";
     email = "[e-mail]";

maintainers/team-list.nix

···
       ryantm
       lassulus
       yayayayaka
+      asymmetric
     ];
     scope = "Maintain Jitsi.";
     shortName = "Jitsi";

nixos/doc/manual/release-notes/rl-2405.section.md

···
 
 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).
 
+- [ryzen-monitor-ng](https://github.com/mann1x/ryzen_monitor_ng), a desktop AMD CPU power monitor and controller, similar to Ryzen Master but for Linux. Available as [programs.ryzen-monitor-ng](#opt-programs.ryzen-monitor-ng.enable)
+
+- [ryzen-smu](https://gitlab.com/leogx9r/ryzen_smu), Linux kernel driver to expose the SMU (System Management Unit) for certain AMD Ryzen Processors. Includes the userspace program `monitor_cpu`. Available at [hardward.cpu.amd.ryzen-smu](#opt-hardware.cpu.amd.ryzen-smu.enable)
+
 - systemd's gateway, upload, and remote services, which provides ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
···
   non-child processes. This means you will not be able to attach gdb to an
   existing process, but will need to start that process from gdb (so it is a
   child). Or you can set `boot.kernel.sysctl."kernel.yama.ptrace_scope"` to 0.
-
-- The new option `services.getty.autologinOnce` was added to limit the automatic login to once per boot and on the first tty only.
-  When using full disk encryption, this option allows to unlock the system without retyping the passphrase while keeping the other ttys protected.
 
 - The netbird module now allows running multiple tunnels in parallel through [`services.netbird.tunnels`](#opt-services.netbird.tunnels).
 

nixos/modules/hardware/cpu/amd-ryzen-smu.nix

···
+{ config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+  cfg = config.hardware.cpu.amd.ryzen-smu;
+  ryzen-smu = config.boot.kernelPackages.ryzen-smu;
+in
+{
+  options.hardware.cpu.amd.ryzen-smu = {
+    enable = mkEnableOption ''
+        ryzen_smu, a linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors.
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "ryzen-smu" ];
+    boot.extraModulePackages = [ ryzen-smu ];
+    environment.systemPackages = [ ryzen-smu ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}

nixos/modules/module-list.nix

···
   ./hardware/corectrl.nix
   ./hardware/cpu/amd-microcode.nix
   ./hardware/cpu/amd-sev.nix
+  ./hardware/cpu/amd-ryzen-smu.nix
   ./hardware/cpu/intel-microcode.nix
   ./hardware/cpu/intel-sgx.nix
   ./hardware/cpu/x86-msr.nix
···
   ./programs/regreet.nix
   ./programs/rog-control-center.nix
   ./programs/rust-motd.nix
+  ./programs/ryzen-monitor-ng.nix
   ./programs/screen.nix
   ./programs/seahorse.nix
   ./programs/sedutil.nix

nixos/modules/programs/ryzen-monitor-ng.nix

···
+{ pkgs
+, config
+, lib
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkPackageOption mkIf;
+  cfg = config.programs.ryzen-monitor-ng;
+in
+{
+  options = {
+    programs.ryzen-monitor-ng = {
+      enable =  mkEnableOption ''
+        ryzen_monitor_ng, a userspace application for setting and getting Ryzen SMU (System Management Unit) parameters via the ryzen_smu kernel driver.
+
+        Monitor power information of Ryzen processors via the PM table of the SMU.
+
+        SMU Set and Get for many parameters and CO counts.
+
+        https://github.com/mann1x/ryzen_monitor_ng
+
+        WARNING: Damage cause by use of your AMD processor outside of official AMD specifications or outside of factory settings are not covered under any AMD product warranty and may not be covered by your board or system manufacturer's warranty
+      '';
+
+      package = mkPackageOption pkgs "ryzen-monitor-ng" {};
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    hardware.cpu.amd.ryzen-smu.enable = true;
+  };
+
+  meta.maintainers = with lib.maintainers; [ Cryolitia phdyellow ];
+}

nixos/modules/services/networking/cloudflared.nix

···
       default = null;
       example = "30s";
       description = lib.mdDoc ''
-        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout](tlsTimeout).
+        Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by [tlsTimeout](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/local-management/ingress/#tlstimeout).
       '';
     };
 

nixos/modules/services/networking/i2p.nix

···
 let
   cfg = config.services.i2p;
   homeDir = "/var/lib/i2p";
-in {
+in
+{
   ###### interface
   options.services.i2p.enable = mkEnableOption (lib.mdDoc "I2P router");
 
···
         User = "i2p";
         WorkingDirectory = homeDir;
         Restart = "on-abort";
-        ExecStart = "${pkgs.i2p}/bin/i2prouter-plain";
+        ExecStart = "${pkgs.i2p}/bin/i2prouter";
       };
     };
   };

nixos/modules/services/ttys/getty.nix

···
 
   baseArgs = [
     "--login-program" "${cfg.loginProgram}"
-  ] ++ optionals (cfg.autologinUser != null && !cfg.autologinOnce) [
+  ] ++ optionals (cfg.autologinUser != null) [
     "--autologin" cfg.autologinUser
   ] ++ optionals (cfg.loginOptions != null) [
     "--login-options" cfg.loginOptions
   ] ++ cfg.extraArgs;
 
   gettyCmd = args:
-    "${pkgs.util-linux}/sbin/agetty ${escapeShellArgs baseArgs} ${args}";
-
-  autologinScript = ''
-    otherArgs="--noclear --keep-baud $TTY 115200,38400,9600 $TERM";
-    ${lib.optionalString cfg.autologinOnce ''
-      autologged="/run/agetty.autologged"
-      if test "$TTY" = tty1 && ! test -f "$autologged"; then
-        touch "$autologged"
-        exec ${gettyCmd "$otherArgs --autologin ${cfg.autologinUser}"}
-      fi
-    ''}
-    exec ${gettyCmd "$otherArgs"}
-  '';
+    "@${pkgs.util-linux}/sbin/agetty agetty ${escapeShellArgs baseArgs} ${args}";
 
 in
 
···
         description = lib.mdDoc ''
           Username of the account that will be automatically logged in at the console.
           If unspecified, a login prompt is shown as usual.
-        '';
-      };
-
-      autologinOnce = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled the automatic login will only happen in the first tty
-          once per boot. This can be useful to avoid retyping the account
-          password on systems with full disk encrypted.
         '';
       };
 
···
 
     systemd.services."getty@" =
       { serviceConfig.ExecStart = [
-          # override upstream default with an empty ExecStart
-          ""
-          (pkgs.writers.writeDash "getty" autologinScript)
+          "" # override upstream default with an empty ExecStart
+          (gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM")
         ];
-        environment.TTY = "%I";
         restartIfChanged = false;
       };
 

nixos/modules/services/x11/desktop-managers/budgie.nix

···
   budgie-control-center = pkgs.budgie.budgie-control-center.override {
     enableSshSocket = config.services.openssh.startWhenNeeded;
   };
+
+  notExcluded = pkg: (!(lib.elem pkg config.environment.budgie.excludePackages));
 in {
   meta.maintainers = lib.teams.budgie.members;
 
···
       ++ cfg.sessionPath;
 
     # Both budgie-desktop-view and nemo defaults to this emulator.
-    programs.gnome-terminal.enable = mkDefault true;
+    programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);
 
     # Fonts.
     fonts.packages = [

nixos/modules/services/x11/desktop-managers/cinnamon.nix

···
       '';
 
       # Default services
-      services.blueman.enable = mkDefault true;
+      services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       hardware.bluetooth.enable = mkDefault true;
       hardware.pulseaudio.enable = mkDefault true;
       security.polkit.enable = true;
···
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.geary.enable = mkDefault true;
-      programs.gnome-disks.enable = mkDefault true;
-      programs.gnome-terminal.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.geary.enable = mkDefault (notExcluded pkgs.gnome.geary);
+      programs.gnome-disks.enable = mkDefault (notExcluded pkgs.gnome.gnome-disk-utility);
+      programs.gnome-terminal.enable = mkDefault (notExcluded pkgs.gnome.gnome-terminal);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);
 
       environment.systemPackages = with pkgs // pkgs.gnome // pkgs.cinnamon; utils.removePackagesByName [
         # cinnamon team apps

nixos/modules/services/x11/desktop-managers/pantheon.nix

···
     extraGSettingsOverrides = cfg.extraGSettingsOverrides;
   };
 
+  notExcluded = pkg: (!(lib.elem pkg config.environment.pantheon.excludePackages));
 in
 
 {
···
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault true;
-      programs.file-roller.enable = mkDefault true;
+      programs.evince.enable = mkDefault (notExcluded pkgs.gnome.evince);
+      programs.file-roller.enable = mkDefault (notExcluded pkgs.gnome.file-roller);
 
       environment.systemPackages = utils.removePackagesByName ([
         pkgs.gnome.gnome-font-viewer

nixos/tests/budgie.nix

···
       };
     };
 
+    # We don't ship gnome-text-editor in Budgie module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.budgie.excludePackages = [ pkgs.gnome-text-editor ];
+
     services.xserver.desktopManager.budgie = {
       enable = true;
       extraPlugins = [

nixos/tests/cinnamon.nix

···
     services.xserver.enable = true;
     services.xserver.desktopManager.cinnamon.enable = true;
 
+    # We don't ship gnome-text-editor in Cinnamon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.cinnamon.excludePackages = [ pkgs.gnome-text-editor ];
+
     # For the sessionPath subtest.
     services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gnome.gpaste ];
   };

nixos/tests/pantheon.nix

···
     services.xserver.enable = true;
     services.xserver.desktopManager.pantheon.enable = true;
 
+    # We ship pantheon.appcenter by default when this is enabled.
+    services.flatpak.enable = true;
+
+    # We don't ship gnome-text-editor in Pantheon module, we add this line mainly
+    # to catch eval issues related to this option.
+    environment.pantheon.excludePackages = [ pkgs.gnome-text-editor ];
+
     environment.systemPackages = [ pkgs.xdotool ];
   };
 

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "0.1.18";
-          sha256 = "soNGZuyvG5+haWRcwYmYB+0OcyDAm4UQ419UnEd8waA=";
+          version = "0.1.36";
+          hash = "sha256-N1X8wB2n6JYoFHCP5iHBXHnEaRa9S1zooQZsR5mUeh8=";
         };
         meta = {
           description = "An extension for Visual Studio Code to open any Coder workspace in VS Code with a single click.";

pkgs/applications/networking/cluster/helm/default.nix

···
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.14.3";
+  version = "3.14.4";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-GC9rkB35m+a/9pEvD7aNjE4z3qrv33NES842crrzD3I=";
+    sha256 = "sha256-Wt5ovKa2CHrD0VSxvReYAwoC4SsuZHAhi/P6Kn1H7So=";
   };
-  vendorHash = "sha256-f5tLyq9tP5tdE73Mlee9vAUSHqkUAtAJkwjZP/K6wPM=";
+  vendorHash = "sha256-b25LUyr4B4fF/WF4Q+zzrDo78kuSTEPBklKkA4o+DBo=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/terragrunt/default.nix

···
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.56.2";
+  version = "0.56.5";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FbuXdng2pGd1Wi4GdFzQjk4quP5yz3APNXm6dcfGO7U=";
+    hash = "sha256-aKgcXLxFZBoomrKJFmUr/XfxHmNrkvK2IlfTR2dJNY0=";
   };
 
-  vendorHash = "sha256-ijAg0Y/dfNxDS/Jov7QYjlTZ4N4/jDMH/zCV0jdVXRc=";
+  vendorHash = "sha256-joEmkFtoVxqlVrgl2mtJN9Cyr3YdnT6tBjaSXj9z2WU=";
 
   doCheck = false;
 

pkgs/applications/science/math/eigenmath/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2024-03-20";
+  version = "unstable-2024-04-08";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "262a6525225be7bcef52c3072b1061db3c238055";
-    hash = "sha256-QH8mLlcCOuq77vLer8RsSnD9VeJu9kAVv2qWAH3ky6I=";
+    rev = "c0be6c47309aa40d44784a3a4c4c07bc4e8fb6fa";
+    hash = "sha256-UVCazX0P03+e1exnpXrGNc/1vHxLH04Xtvgsy00UAoI=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/applications/version-management/git-cliff/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    hash = "sha256-pOmSVySn8QUpFLTXFXBVm1KTX9ny221t1xSxBRHkljQ=";
+    hash = "sha256-FRcreSnSO65m9h9+SUg4qdFELvpVX1+HkWH3dI2RR/M=";
   };
 
-  cargoHash = "sha256-y0XTvSV8JE6nmSJfJKLw2Gt/D/yX12kbx2+RHqVCVWI=";
+  cargoHash = "sha256-RlcZvyFi7fc8eJYB5X64axAnNp8Z1h0WOV4hM1SLoRk=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;

pkgs/applications/version-management/git-mit/default.nix

···
 }:
 
 let
-  version = "5.12.191";
+  version = "5.12.194";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
···
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-aSEoAs0s7zyALf3s77eVlrjkCrn7ihW/4OW5hN8YL8k=";
+    hash = "sha256-9ITy2VPLIunSLSNx4EXbvxZ7V/Kr+DwmjzDVj/QVGHs=";
   };
 
-  cargoHash = "sha256-pm+XreLGxZJKRcrmU1ooMjN7MTRJqgKOy2J1OqdodxE=";
+  cargoHash = "sha256-6R+T0BSgT6IivugkXXsX5xJ2c3/J3FnLY3ZvcfYW53E=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/gi/gitu/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.13.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-1wfc3n3uSkox2wa5i+Qiv7PZ0d2dXXbwjWw8NMXJXj8=";
+    hash = "sha256-/yPP8GzeaVMauhcYLDAgXzOafUpOhJF2tyHOyD6KWS8=";
   };
 
-  cargoHash = "sha256-JwNyzA6D8mIzp/+egjD2C7T9mGbcCKKtwFRXBuXMQ+U=";
+  cargoHash = "sha256-eKRFPnH9MvSykrnPo4dc5DtEfb79s0hBtmYfERGQbWg=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/i2/i2p/package.nix

···
+{ lib
+, stdenv
+, fetchzip
+, jdk
+, ant
+, gettext
+, which
+, dbip-country-lite
+, java-service-wrapper
+, makeWrapper
+, gmp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "i2p";
+  version = "2.4.0";
+
+  src = fetchzip {
+    urls = map (mirror: "${mirror}${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
+      "https://github.com/i2p/i2p.i2p/releases/download/i2p-"
+      "https://download.i2p2.de/releases/"
+      "https://files.i2p-projekt.de/"
+      "https://download.i2p2.no/releases/"
+    ];
+    hash = "sha256-RESN1qA/SD9MajUSJyXssNZnph2XZge7xr2kTgOp5V4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    ant
+    gettext
+    jdk
+    which
+  ];
+
+  buildInputs = [ gmp ];
+
+  postConfigure = ''
+    rm -r installer/lib
+    mkdir -p installer/lib/wrapper/all/
+    # The java-service-wrapper is needed for build but not really used in runtime
+    ln -s ${java-service-wrapper}/lib/wrapper.jar installer/lib/wrapper/all/wrapper.jar
+    # Don't use the bundled geoip data
+    echo "with-geoip-database=true" >> override.properties
+  '';
+
+  buildPhase = ''
+    # When this variable exists we can build the .so files only.
+    export DEBIANVERSION=1
+    pushd core/c/jcpuid
+    ./build.sh
+    popd
+    pushd core/c/jbigi
+    ./build_jbigi.sh dynamic
+    popd
+    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
+    SOURCE_DATE_EPOCH=0 ant preppkg-unix
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,share,geoip}
+    mv pkg-temp/* $out
+    mv core/c/jbigi/*.so $out/lib
+    mv $out/man $out/share/
+    rm $out/{osid,postinstall.sh,INSTALL-headless.txt}
+
+    for jar in $out/lib/*.jar; do
+      if [ ! -z $CP ]; then
+        CP=$CP:$jar;
+      else
+        CP=$jar
+      fi
+    done
+
+    makeWrapper ${jdk}/bin/java $out/bin/i2prouter \
+      --add-flags "-cp $CP -Djava.library.path=$out/lib/ -Di2p.dir.base=$out -DloggerFilenameOverride=logs/log-router-@.txt" \
+      --add-flags "net.i2p.router.RouterLaunch"
+
+    ln -s ${dbip-country-lite.mmdb} $out/geoip/GeoLite2-Country.mmdb
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check if jbigi is used
+    java -cp $out/lib/i2p.jar -Djava.library.path=$out/lib/ net.i2p.util.NativeBigInteger \
+      | tee /dev/stderr | grep -Fw "Found native library" || exit 1
+
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    description = "Applications and router for I2P, anonymity over the Internet";
+    homepage = "https://geti2p.net";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = with licenses; [
+      asl20
+      boost
+      bsd2
+      bsd3
+      cc-by-30
+      cc0
+      epl10
+      gpl2
+      gpl3
+      lgpl21Only
+      lgpl3Only
+      mit
+      publicDomain
+    ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ linsui ];
+    mainProgram = "i2prouter-plain";
+  };
+})

pkgs/by-name/na/namespace-cli/package.nix

···
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.354";
+  version = "0.0.355";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-wO1ygoaqgCkvtVJ+ATxNGSiJpAZAqe2LXyPg8r4osQk=";
+    hash = "sha256-St/zZqfoate9TwYo7q9Za+T6q4kRw9vSzcBfMW7AXkw=";
   };
 
   vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";

pkgs/by-name/ry/ryzen-monitor-ng/package.nix

···
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "ryzen-monitor-ng";
+  version = "2.0.5-unstable-2023-11-05";
+
+  # Upstream has not updated ryzen_smu header version
+  # This fork corrects ryzen_smu header version and
+  # adds support for Matisse AMD CPUs.
+  src = fetchFromGitHub {
+    owner = "plasmin";
+    repo = "ryzen_monitor_ng";
+    rev = "8b7854791d78de731a45ce7d30dd17983228b7b1";
+    hash = "sha256-fcW2fEsCFliRnMFnboR0jchzVIlCYbr2AE6AS06cb6o=";
+  };
+
+  ## Remove binaries committed into upstream repo
+  preBuild = ''
+    rm src/ryzen_monitor
+  '';
+
+  makeTargets = [ "clean" "install" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mv ./src/ryzen_monitor $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Access Ryzen SMU information exposed by the ryzen_smu driver";
+    homepage = "https://github.com/mann1x/ryzen_monitor_ng";
+    license = licenses.agpl3Only;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ phdyellow ];
+    mainProgram = "ryzen_monitor";
+  };
+}

pkgs/by-name/sc/scrutiny/package.nix

···
 }:
 let
   pname = "scrutiny";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "AnalogJ";
     repo = "scrutiny";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ysjE2nn1WwhEiFIvJ5cRCJQf9mECTgiGUyenwf3mKTA=";
+    hash = "sha256-WoU5rdsIEhZQ+kPoXcestrGXC76rFPvhxa0msXjFsNg=";
   };
 
   frontend = buildNpmPackage {
···
   meta = {
     description = "Hard Drive S.M.A.R.T Monitoring, Historical Trends & Real World Failure Thresholds.";
     homepage = "https://github.com/AnalogJ/scrutiny";
+    changelog = "https://github.com/AnalogJ/scrutiny/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jnsgruk ];
     mainProgram = "scrutiny";

pkgs/by-name/to/tootik/package.nix

···
+{ lib, stdenv, buildGoModule, fetchFromGitHub, openssl }:
+
+buildGoModule rec {
+  pname = "tootik";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "dimkr";
+    repo = "tootik";
+    rev = version;
+    hash = "sha256-RcuioFb0+mvZupwgaCN6qbcOy7gHp9KjJxRwaPI55yo=";
+  };
+
+  vendorHash = "sha256-/52VjfoecXaML1cDRIEe1EQPYU8xeP9lu4lY3cMV3VE=";
+
+  nativeBuildInputs = [ openssl ];
+
+  preBuild = ''
+    go generate ./migrations
+  '';
+
+  ldflags = [ "-X github.com/dimkr/tootik/buildinfo.Version=${version}" ];
+
+  tags = [ "fts5" ];
+
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = {
+    description = "A federated nanoblogging service with a Gemini frontend";
+    homepage = "https://github.com/dimkr/tootik";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sikmir ];
+    mainProgram = "tootik";
+  };
+}

pkgs/by-name/ws/wslu/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wslu";
-  version = "4.1.2";
+  version = "4.1.3";
 
   src = fetchFromGitHub {
     owner = "wslutilities";
     repo = "wslu";
     rev = "v${version}";
-    hash = "sha256-rmNGKayg8Y872yICilveMpDFBLkDZ6Ox8rqtWrK2om8=";
+    hash = "sha256-lyJk8nOADq+s7GkZXsd1T4ilrDzMRsoALOesG8NxYK8=";
   };
 
   nativeBuildInputs = [ copyDesktopItems ];

pkgs/by-name/xe/xevd/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  stdenv,
+  gitUpdater,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xevd";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xevd";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+qC/BnP8o/kfl5ax+g1PohvXIJBL2gin/QZ9Gkvi0WU=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      name = "fix dangling pointer error";
+      url = "https://github.com/mpeg5/xevd/commit/13b86a74e26df979dd1cc3a1cb19bf1ac828e197.patch";
+      sha256 = "sha256-CeSfhN78ldooyZ9H4F2ex9wTBFXuNZdBcnLdk7GqDXI=";
+    })
+    (fetchpatch2 {
+      name = "fix invalid comparison of c_buf in write_y4m_header ";
+      url = "https://github.com/mpeg5/xevd/commit/e4ae0c567a6ec5e10c9f5ed44c61e4e3b6816c16.patch";
+      sha256 = "sha256-9bG6hyIV/AZ0mRbd3Fc/c137Xm1i6NJ1IfuGadG0vUU=";
+    })
+  ];
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xevd/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xevd";
+    description = "eXtra-fast Essential Video Decoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xevd_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})

pkgs/by-name/xe/xeve/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  gitUpdater,
+  stdenv,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeve";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "mpeg5";
+    repo = "xeve";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-8YueEx2oIh24jV38bzpDlCVHNZB7HDOXeP5MANM8zBc=";
+  };
+
+  postPatch = ''
+    echo v$version > version.txt
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  postInstall = ''
+    ln $dev/include/xeve/* $dev/include/
+  '';
+
+  env.NIX_CFLAGS_COMPILE = toString [ "-lm" ];
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    homepage = "https://github.com/mpeg5/xeve";
+    description = "eXtra-fast Essential Video Encoder, MPEG-5 EVC";
+    license = lib.licenses.bsd3;
+    mainProgram = "xeve_app";
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+    platforms = lib.platforms.all;
+    broken = !stdenv.hostPlatform.isx86;
+  };
+})

pkgs/desktops/mate/mate-themes/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mate-themes";
-  version = "3.22.24";
+  version = "3.22.26";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/themes/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "PYs6KihTMd4kxM9djJ3YRtqhFpXyBnZdjxaT68rPbko=";
+    sha256 = "Ik6J02TrO3Pxz3VtBUlKmEIak8v1Q0miyF/GB+t1Xtc=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/orc/default.nix

···
     sha256 = "sha256-g7B0y2cxfVi+8ejQzIYveuinekW7/wVqH5h8ZIiy9f0=";
   };
 
-  postPatch = lib.optionalString stdenv.isAarch32 ''
-    # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/20
-    sed -i '/exec_opcodes_sys/d' testsuite/meson.build
-  '' + lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
     # This benchmark times out on Hydra.nixos.org
     sed -i '/memcpy_speed/d' testsuite/meson.build
   '';

pkgs/development/libraries/ffmpeg/generic.nix

···
 , withOpus ? withHeadlessDeps # Opus de/encoder
 , withPlacebo ? withFullDeps && !stdenv.isDarwin # libplacebo video processing library
 , withPulse ? withSmallDeps && stdenv.isLinux # Pulseaudio input support
+, withQrencode ? withFullDeps && lib.versionAtLeast version "7" # QR encode generation
+, withQuirc ? withFullDeps && lib.versionAtLeast version "7" # QR decoding
 , withRav1e ? withFullDeps # AV1 encoder (focused on speed and safety)
 , withRtmp ? false # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin && withGPLv3 # Samba protocol
···
 , withXcbShape ? withFullDeps # X11 grabbing shape rendering
 , withXcbShm ? withFullDeps # X11 grabbing shm communication
 , withXcbxfixes ? withFullDeps # X11 grabbing mouse rendering
+, withXevd ? withFullDeps && lib.versionAtLeast version "7" && stdenv.hostPlatform.isx86 # MPEG-5 EVC decoding
+, withXeve ? withFullDeps && lib.versionAtLeast version "7" && stdenv.hostPlatform.isx86 # MPEG-5 EVC encoding
 , withXlib ? withFullDeps # Xlib support
 , withXml2 ? withFullDeps # libxml2 support, for IMF and DASH demuxers
 , withXvid ? withHeadlessDeps && withGPL # Xvid encoder, native encoder exists
···
 , opencore-amr
 , openh264
 , openjpeg
+, qrencode
+, quirc
 , rav1e
 , rtmpdump
 , samba
···
 , x264
 , x265
 , xavs
+, xevd
+, xeve
 , xvidcore
 , xz
 , zeromq4
···
     (enableFeature withPlacebo "libplacebo")
   ] ++ [
     (enableFeature withPulse "libpulse")
+  ] ++ optionals (versionAtLeast version "7") [
+    (enableFeature withQrencode "libqrencode")
+    (enableFeature withQuirc "libquirc")
+  ] ++ [
     (enableFeature withRav1e "librav1e")
     (enableFeature withRtmp "librtmp")
     (enableFeature withSamba "libsmbclient")
···
     (enableFeature withXcbShape "libxcb-shape")
     (enableFeature withXcbShm "libxcb-shm")
     (enableFeature withXcbxfixes "libxcb-xfixes")
+  ] ++ optionals (versionAtLeast version "7")  [
+    (enableFeature withXevd "libxevd")
+    (enableFeature withXeve "libxeve")
+  ] ++ [
     (enableFeature withXlib "xlib")
     (enableFeature withXml2 "libxml2")
     (enableFeature withXvid "libxvid")
···
   ++ optionals withOpus [ libopus ]
   ++ optionals withPlacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withPulse [ libpulseaudio ]
+  ++ optionals withQrencode [ qrencode ]
+  ++ optionals withQuirc [ quirc ]
   ++ optionals withRav1e [ rav1e ]
   ++ optionals withRtmp [ rtmpdump ]
   ++ optionals withSamba [ samba ]
···
   ++ optionals withX265 [ x265 ]
   ++ optionals withXavs [ xavs ]
   ++ optionals withXcb [ libxcb ]
+  ++ optionals withXevd [ xevd ]
+  ++ optionals withXeve [ xeve ]
   ++ optionals withXlib [ libX11 libXv libXext ]
   ++ optionals withXml2 [ libxml2 ]
   ++ optionals withXvid [ xvidcore ]

pkgs/development/python-modules/graphene-django/default.nix

···
 
 buildPythonPackage rec {
   pname = "graphene-django";
-  version = "3.2.0";
+  version = "3.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "graphql-python";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SOLY3NogovwQ5gr2gnvOcROWpbk9p134wI2f9FKr+5M=";
+    hash = "sha256-wzU9U4mYvBf43qBQi20ewKtmw1eFskQk+nnsdaM7HQM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/mypy-boto3/default.nix

···
 
   mypy-boto3-chime-sdk-voice = buildMypyBoto3Package "chime-sdk-voice" "1.34.0" "sha256-9fQQgWFKeabSblJIhP6mN0CEnSixkz1r3mf/k6IL/BE=";
 
-  mypy-boto3-cleanrooms = buildMypyBoto3Package "cleanrooms" "1.34.78" "sha256-76zy6rTsSqmKdwrZwBsf7m6qPZXSdi6GpQEXMvN82Tw=";
+  mypy-boto3-cleanrooms = buildMypyBoto3Package "cleanrooms" "1.34.82" "sha256-KaCs/P3NM3IeZ9V9khIwysyBXBG/8RuGFBAlrbMYn4Y=";
 
   mypy-boto3-cloud9 = buildMypyBoto3Package "cloud9" "1.34.24" "sha256-fryD7UfO5cdFS7vMxmZaT9LW4nNSGTQCd3NyD60f9wA=";
 
···
 
   mypy-boto3-config = buildMypyBoto3Package "config" "1.34.45" "sha256-LN1CcIOj9cgzSNCvnUVwLRNPXlitHAlt+5jj6wu6i8E=";
 
-  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.67" "sha256-kWjC/FacCsC0xevx2dOs67UxaKG1WM3xMahcO3CqZL8=";
+  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.82" "sha256-QyZteRrk1d+Qwqj87uUb4f2ZK5SjPdMJV4NGv6kwrl4=";
 
   mypy-boto3-connect-contact-lens = buildMypyBoto3Package "connect-contact-lens" "1.34.0" "sha256-Wx9vcjlgXdWZ2qP3Y/hTY2LAeTd+hyyV5JSIuKQ5I5k=";
 
···
 
   mypy-boto3-redshift-serverless = buildMypyBoto3Package "redshift-serverless" "1.34.16" "sha256-ag5tKb1+4cHiG99OszDNGdnX9RPRPraaqM8p3IqgLBg=";
 
-  mypy-boto3-rekognition = buildMypyBoto3Package "rekognition" "1.34.20" "sha256-zKJX/AlDoDKUbrI1LZq2kk5fr+SNqES6gniM0FQGeaM=";
+  mypy-boto3-rekognition = buildMypyBoto3Package "rekognition" "1.34.82" "sha256-qy7yacSuG6cARR2L/YjBGWYM1BU5/qtMr/H08x3XFIM=";
 
   mypy-boto3-resiliencehub = buildMypyBoto3Package "resiliencehub" "1.34.0" "sha256-F/ZRCp/M/6kBI4Apb3mISzqe1Zi4Y7gq/vu0dvyyTvM=";
 

pkgs/development/python-modules/pytorch-pfn-extras/default.nix

···
 { buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , lib
-, setuptools
 , numpy
 , onnx
 , packaging
 , pytestCheckHook
+, pythonAtLeast
+, setuptools
+, stdenv
 , torch
 , torchvision
 , typing-extensions
-, pythonAtLeast
 }:
 
 buildPythonPackage rec {
···
     hash = "sha256-vSon/0GxQfaRtSPsQbYAvE3s/F0HEN59VpzE3w1PnVE=";
   };
 
-  nativeBuildInputs = [
+  patches = [
+    (fetchpatch {
+      name = "relax-setuptools.patch";
+      url = "https://github.com/pfnet/pytorch-pfn-extras/commit/96abe38c4baa6a144d604bdd4744c55627e55440.patch";
+      hash = "sha256-85UDGcgJyQS5gINbgpNM58b3XJGvf+ArtGhwJ5EXdhk=";
+    })
+  ];
+
+  build-system = [
     setuptools
   ];
 
-  propagatedBuildInputs = [ numpy packaging torch typing-extensions ];
+  dependencies = [ numpy packaging torch typing-extensions ];
 
   nativeCheckInputs = [ onnx pytestCheckHook torchvision ];
 
-  # ignore all pytest warnings
-  preCheck = ''
-    rm pytest.ini
-  '';
+  pytestFlagsArray = [
+    # Requires CUDA access which is not possible in the nix environment.
+    "-m 'not gpu and not mpi'"
+    "-Wignore::DeprecationWarning"
+  ];
 
   pythonImportsCheck = [ "pytorch_pfn_extras" ];
 
···
 
     # requires onnxruntime which was removed because of poor maintainability
     # See https://github.com/NixOS/nixpkgs/pull/105951 https://github.com/NixOS/nixpkgs/pull/155058
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_annotate.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_as_output.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_export.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_export_testcase.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_lax.py"
+    "tests/pytorch_pfn_extras_tests/onnx_tests/test_load_model.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_torchvision.py"
     "tests/pytorch_pfn_extras_tests/onnx_tests/utils.py"
-    "tests/pytorch_pfn_extras_tests/onnx_tests/test_lax.py"
 
     # RuntimeError: No Op registered for Gradient with domain_version of 9
     "tests/pytorch_pfn_extras_tests/onnx_tests/test_grad.py"
-
-    # Requires CUDA access which is not possible in the nix environment.
-    "tests/pytorch_pfn_extras_tests/cuda_tests/test_allocator.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_batchnorm.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_conv.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_linear.py"
-    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy.py"
-    "tests/pytorch_pfn_extras_tests/profiler_tests/test_record.py"
-    "tests/pytorch_pfn_extras_tests/runtime_tests/test_to.py"
-    "tests/pytorch_pfn_extras_tests/handler_tests/test_handler.py"
-    "tests/pytorch_pfn_extras_tests/test_reporter.py"
-    "tests/pytorch_pfn_extras_tests/training_tests/test_trainer.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_checkpoint.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_comparer.py"
-    "tests/pytorch_pfn_extras_tests/utils_tests/test_new_comparer.py"
-  ] ++ lib.optionals (pythonAtLeast "3.11") [
-    # Remove this when https://github.com/NixOS/nixpkgs/pull/259068 is merged
+  ] ++ lib.optionals (pythonAtLeast "3.12") [
+    # RuntimeError: Dynamo is not supported on Python 3.12+
     "tests/pytorch_pfn_extras_tests/dynamo_tests/test_compile.py"
+    "tests/pytorch_pfn_extras_tests/test_ops/test_register.py"
+  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # torch.distributed is not available on darwin
+    "tests/pytorch_pfn_extras_tests/training_tests/extensions_tests/test_sharded_snapshot.py"
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # RuntimeError: internal error
+    # convolution (e.g. F.conv3d) causes runtime error
+    "tests/pytorch_pfn_extras_tests/nn_tests/modules_tests/test_lazy_conv.py"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/sphinxcontrib-confluencebuilder/default.nix

···
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-confluencebuilder";
-  version = "2.5.0";
+  version = "2.5.1";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "sphinxcontrib_confluencebuilder";
     inherit version;
-    hash = "sha256-rE9tWUie9ZaeWnKR+ojwS9A6BHEtsgVpwzXAuWoxknQ=";
+    hash = "sha256-PQpkwQ95UVJwDGTAq1xdcSvd07FZpZfA/4jq3ywlMas=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/faas-cli/default.nix

···
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.23";
+  version = "0.16.25";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-QbMwokFHaISvsNuHy/Do90bvXtwaJmie/hDLybuy2qk=";
+    sha256 = "sha256-6HX+n3OXSA2gJ0LW5zlH3FboM5RNaOI72EmnEI9wbFE=";
   };
 
   vendorHash = null;

pkgs/development/tools/micronaut/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.3.7";
+  version = "4.3.8";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-TP7Ccv/Krc5l35AxyrkRmeRMSgQP9Q3BpNiHxlqLD4I=";
+    sha256 = "sha256-8sUXJExg1CApMbF95Lx3B/mnOJ5Y6HAck8+0UgF0bdc=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];

pkgs/development/tools/templ/default.nix

···
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.2.648";
+  version = "0.2.663";
 
   subPackages = [ "cmd/templ" ];
 
···
     owner = "a-h";
     repo = "templ";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9Co3yvfy8X69PIffPg2lDjVCVTjDhiFnSsJd4MQ6cf4=";
+    hash = "sha256-TU8QG6OmUzSNDAX9W0Ntmz5cucLqVQeTskfnJbm/YM0=";
   };
 
   vendorHash = "sha256-Upd5Wq4ajsyOMDiAWS2g2iNO1sm1XJc43AFQLIo5eDM=";

pkgs/os-specific/linux/ndiswrapper/default.nix

···
-{ lib, stdenv, fetchurl, kernel, perl, kmod, libelf }:
+{ lib, stdenv, fetchurl, kernel, perl, kmod, elfutils }:
 let
   version = "1.63";
 in
···
     sha256 = "1v6b66jhisl110jfl00hm43lmnrav32vs39d85gcbxrjqnmcx08g";
   };
 
-  buildInputs = [ perl libelf ];
+  buildInputs = [ perl elfutils ];
 
   meta = {
     description = "Ndis driver wrapper for the Linux kernel";

pkgs/os-specific/linux/ryzen-smu/default.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+let
+  version = "0.1.5-unstable-2024-01-03";
+
+  ## Upstream has not been merging PRs.
+  ## Nixpkgs maintainers are providing a
+  ## repo with PRs merged until upstream is
+  ## updated.
+  src = fetchFromGitHub {
+    owner = "Cryolitia";
+    repo = "ryzen_smu";
+    rev = "ce1aa918efa33ca79998f0f7d467c04d4b07016c";
+    hash = "sha256-s9SSmbL6ixWqZUKEhrZdxN4xoWgk+8ClZPoKq2FDAAE=";
+  };
+
+  monitor-cpu = stdenv.mkDerivation {
+    pname = "monitor-cpu";
+    inherit version src;
+
+    makeFlags = [
+      "-C userspace"
+    ];
+
+    installPhase = ''
+    runHook preInstall
+
+    install userspace/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+  };
+
+in
+stdenv.mkDerivation {
+  pname = "ryzen-smu-${kernel.version}";
+  inherit version src;
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "TARGET=${kernel.modDirVersion}"
+    "KERNEL_BUILD=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install ryzen_smu.ko -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/ryzen_smu
+    install ${monitor-cpu}/bin/monitor_cpu -Dm755 -t $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Linux kernel driver that exposes access to the SMU (System Management Unit) for certain AMD Ryzen Processors";
+    homepage = "https://gitlab.com/leogx9r/ryzen_smu";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ Cryolitia phdyellow ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "monitor_cpu";
+  };
+}

pkgs/servers/search/weaviate/default.nix

···
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.24.7";
+  version = "1.24.8";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-KLKzHB+MzaLifMNdMCziFNawFBMUWJ75Xozu53yvJFU=";
+    hash = "sha256-OydGohfsS2/Wb9uuFP+6IogmfiWMFLBIEdooFJwS3TU=";
   };
 
   vendorHash = "sha256-DMzwIxtF267C2OLyVdZ6CrCz44sy6ZeKL2qh8AkhS2I=";

pkgs/servers/spicedb/default.nix

···
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.30.0";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-enMUGLOoVy56PCAqfW6jTOgEr/Me6kbuUvq3YmlxMPs=";
+    hash = "sha256-4hxIDdmPXU+wnD6O7S/H30YIAroOWAQobAPimwwxxv0=";
   };
 
   vendorHash = "sha256-lMhfCkuLuA8aj3Q+I/v/Ohof/htBJjPRmQ3c9QXsioc=";

pkgs/tools/inputmethods/ibus-engines/ibus-m17n/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ibus-m17n";
-  version = "1.4.28";
+  version = "1.4.29";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus-m17n";
     rev = version;
-    sha256 = "sha256-3/AnytPIIi1Q2i/25rkqOZWgUCtouO+cS+TByp9neOI=";
+    sha256 = "sha256-KHAdGTlRdTNpSuYbT6rocbT9rSNhxCdt4Z6QSLlbBsg=";
   };
 
   nativeBuildInputs = [

pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.25.4";
+  version = "2.25.6";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-uTq+/g2DtiftfQvNVYIKtARyxA9Y8LE6VCeGFcWs5SQ=";
+    hash = "sha256-HFC6VhlA3Kt1oZd1R5bOHRMQrNiNu4J0Op1uCKOXj9w=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];

pkgs/tools/networking/grpcui/default.nix

···
 
 buildGoModule rec {
   pname = "grpcui";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G4lVYwx8fYxuyHI2CzAfBQHQV/G4lf7zBwL8JTpnscA=";
+    sha256 = "sha256-OIwfLuWY7Y0t85v+P/0F55vEe0hNohlqMl16Omr8AF0=";
   };
 
-  vendorHash = "sha256-lw8HildV1RFTGLOf6FaitbXPxr4FtVGg7GxdzBVFiTM=";
+  vendorHash = "sha256-dEek7q8OjFgCn+f/qyiQL/5qu8RJp38vZk3OrBREHx4=";
 
   doCheck = false;
 

pkgs/tools/networking/grpcurl/default.nix

···
 
 buildGoModule rec {
   pname = "grpcurl";
-  version = "1.8.9";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fullstorydev";
     repo = "grpcurl";
     rev = "v${version}";
-    sha256 = "sha256-zN/vleCph919HXZZ9wsXoJBXRT6y7gjyuQxnjRMzq00=";
+    sha256 = "sha256-OVlFOZD4+ZXRKl0Q0Dh5Etij/zeB1jTGoY8n13AyLa4=";
   };
 
   subPackages = [ "cmd/grpcurl" ];
 
-  vendorHash = "sha256-g5G966CuaVILGAgWunHAPrrkLjSv8pBj9R4bcLzyI+A=";
+  vendorHash = "sha256-KsPrJC4hGrGEny8wVWE1EG00qn+b1Rrvh4qK27VzgLU=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 

pkgs/tools/networking/i2p/default.nix

···
-{ lib
-, stdenv
-, ps
-, coreutils
-, fetchurl
-, jdk
-, jre
-, ant
-, gettext
-, which
-, java-service-wrapper
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "i2p";
-  version = "2.4.0";
-
-  src = fetchurl {
-    urls = map (mirror: "${mirror}/${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
-      "https://download.i2p2.de/releases"
-      "https://files.i2p-projekt.de"
-      "https://download.i2p2.no/releases"
-    ];
-    sha256 = "sha256-MO+K/K0P/6/ZTTCsMH+GtaazGOLB9EoCMAWEGh/NB3w=";
-  };
-
-  buildInputs = [ jdk ant gettext which ];
-  patches = [ ./i2p.patch ];
-
-  buildPhase = ''
-    export JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF8"
-    ant preppkg-linux-only
-  '';
-
-  installPhase = ''
-    set -B
-    mkdir -p $out/{bin,share}
-    cp -r pkg-temp/* $out
-
-    cp ${java-service-wrapper}/bin/wrapper $out/i2psvc
-    cp ${java-service-wrapper}/lib/wrapper.jar $out/lib
-    cp ${java-service-wrapper}/lib/libwrapper.so $out/lib
-
-    sed -i $out/i2prouter -i $out/runplain.sh \
-      -e "s#uname#${coreutils}/bin/uname#" \
-      -e "s#which#${which}/bin/which#" \
-      -e "s#%gettext%#${gettext}/bin/gettext#" \
-      -e "s#/usr/ucb/ps#${ps}/bin/ps#" \
-      -e "s#/usr/bin/tr#${coreutils}/bin/tr#" \
-      -e "s#%INSTALL_PATH#$out#" \
-      -e 's#%USER_HOME#$HOME#' \
-      -e "s#%SYSTEM_java_io_tmpdir#/tmp#" \
-      -e "s#%JAVA%#${jre}/bin/java#"
-    mv $out/runplain.sh $out/bin/i2prouter-plain
-    mv $out/man $out/share/
-    chmod +x $out/bin/* $out/i2psvc
-    rm $out/{osid,postinstall.sh,INSTALL-headless.txt}
-  '';
-
-  meta = with lib; {
-    description = "Applications and router for I2P, anonymity over the Internet";
-    homepage = "https://geti2p.net";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode # source bundles dependencies as jars
-    ];
-    license = with licenses; [
-      asl20
-      boost
-      bsd2
-      bsd3
-      cc-by-30
-      cc0
-      epl10
-      gpl2
-      gpl3
-      lgpl21Only
-      lgpl3Only
-      mit
-      publicDomain
-    ];
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ joelmo ];
-    mainProgram = "i2prouter-plain";
-  };
-})

pkgs/tools/networking/i2p/i2p.patch

···
-diff --git a/installer/resources/i2prouter b/installer/resources/i2prouter
-index 365737d89..2ea14db3e 100644
---- a/installer/resources/i2prouter
-+++ b/installer/resources/i2prouter
-@@ -49,7 +49,7 @@ APP_LONG_NAME="I2P Service"
- 
- # gettext - we look for it in the path
- # fallback to echo is below, we can't set it to echo here.
--GETTEXT=$(which gettext > /dev/null 2>&1)
-+GETTEXT=%gettext%
- 
- # Where to install the systemd service
- SYSTEMD_SERVICE="/etc/systemd/system/${APP_NAME}.service"
-diff --git a/installer/resources/runplain.sh b/installer/resources/runplain.sh
-index eb4995dfe..0186cede3 100644
---- a/installer/resources/runplain.sh
-+++ b/installer/resources/runplain.sh
-@@ -25,7 +25,7 @@ CP=
- 
- # Try using the Java binary that I2P was installed with.
- # If it's not found, try looking in the system PATH.
--JAVA=$(which "%JAVA_HOME"/bin/java || which java)
-+JAVA=%JAVA%
- 
- if [ -z $JAVA ] || [ ! -x $JAVA ]; then
-     echo "Error: Cannot find java." >&2
-@@ -44,15 +44,4 @@ if [ $(uname -s) = "Darwin" ]; then
-     export JAVA_TOOL_OPTIONS="-Djava.awt.headless=true"
- fi
- JAVAOPTS="${MAXMEMOPT} -Djava.net.preferIPv4Stack=${PREFERv4} -Djava.library.path=${I2P}:${I2P}/lib -Di2p.dir.base=${I2P} -DloggerFilenameOverride=logs/log-router-@.txt"
--(
--    nohup ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch > /dev/null 2>&1
--) &
--PID=$!
--
--if [ ! -z $PID ] && kill -0 $PID > /dev/null 2>&1 ; then
--    echo "I2P started [$PID]" >&2
--    echo $PID > "${I2PTEMP}/router.pid"
--else
--    echo "I2P failed to start." >&2
--    exit 1
--fi
-+exec ${JAVA} -cp \"${CP}\" ${JAVAOPTS} net.i2p.router.RouterLaunch

pkgs/tools/security/chipsec/default.nix

···
 , stdenv
 , fetchFromGitHub
 , kernel ? null
-, libelf
+, elfutils
 , nasm
 , python3
 , withDriver ? false
···
   KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = [
-    libelf
     nasm
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.buildPlatform elfutils) [
+    elfutils
   ] ++ lib.optionals withDriver kernel.moduleBuildDependencies;
 
   nativeCheckInputs = with python3.pkgs; [

pkgs/tools/security/tor/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "tor";
-  version = "0.4.8.10";
+  version = "0.4.8.11";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-5ii0+rcO20cncVsjzykxN1qfdoWsCPLFnqSYoXhGOoY=";
+    sha256 = "sha256-jyvfkOYzgHgSNap9YE4VlXDyg+zuZ0Zwhz2LtwUsjgc=";
   };
 
   outputs = [ "out" "geoip" ];

pkgs/tools/security/trufflehog/default.nix

···
     hash = "sha256-2xgvXHeltoODr5Rok7yaUqdVcO2crtdPvvRrN+DDGr4=";
   };
 
-  vendorHash = "sha256-dQ/oKVy5RZ5R8cbNom1msSbuzrQ7VbtK7m+8aS33u7Y=";
+  vendorHash = "sha256-zpHrwQ1egD2juWkQicHl2HVzXGr3DCmAyRdUgm5jdGg=";
+  proxyVendor = true;
 
   ldflags = [
     "-s"

pkgs/top-level/all-packages.nix

···
 
   i2c-tools = callPackage ../os-specific/linux/i2c-tools { };
 
-  i2p = callPackage ../tools/networking/i2p { };
-
   i2pd = callPackage ../tools/networking/i2pd { };
 
   iannix = libsForQt5.callPackage ../applications/audio/iannix { };

pkgs/top-level/linux-kernels.nix

···
 
     ithc = callPackage ../os-specific/linux/ithc { };
 
+    ryzen-smu = callPackage ../os-specific/linux/ryzen-smu { };
+
     zenpower = callPackage ../os-specific/linux/zenpower { };
 
     zfs_2_1 = callPackage ../os-specific/linux/zfs/2_1.nix {