Merge master into haskell-updates

doc/hooks/python.section.md

···
 # Python {#setup-hook-python}
 
-Adds the `lib/${python.libPrefix}/site-packages` subdirectory of each build input to the `PYTHONPATH` environment variable.
+Adds the `python.sitePackages` subdirectory (i.e. `lib/pythonX.Y/site-packages`) of each build input to the `PYTHONPATH` environment variable.

doc/languages-frameworks/haskell.section.md

···
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      compiler.${ghcName} = prev.haskell.compiler.${ghcName}.override {
-        # Unfortunately, the GHC setting is named differently for historical reasons
-        enableProfiledLibs = enableProfiling;
+    haskell = prev.haskell // {
+      compiler = prev.haskell.compiler // {
+        ${ghcName} = prev.haskell.compiler.${ghcName}.override {
+          # Unfortunately, the GHC setting is named differently for historical reasons
+          enableProfiledLibs = enableProfiling;
+        };
       };
     };
   })
···
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      packages.${ghcName} = prev.haskell.packages.${ghcName}.override {
-        overrides = hfinal: hprev: {
-          mkDerivation = args: hprev.mkDerivation (args // {
-            # Since we are forcing our ideas upon mkDerivation, this change will
-            # affect every package in the package set.
-            enableLibraryProfiling = enableProfiling;
+    haskell = prev.haskell // {
+      packages = prev.haskell.packages // {
+        ${ghcName} = prev.haskell.packages.${ghcName}.override {
+          overrides = hfinal: hprev: {
+            mkDerivation = args: hprev.mkDerivation (args // {
+              # Since we are forcing our ideas upon mkDerivation, this change will
+              # affect every package in the package set.
+              enableLibraryProfiling = enableProfiling;
 
-            # To actually use profiling on an executable, executable profiling
-            # needs to be enabled for the executable you want to profile. You
-            # can either do this globally or…
-            enableExecutableProfiling = enableProfiling;
-          });
+              # To actually use profiling on an executable, executable profiling
+              # needs to be enabled for the executable you want to profile. You
+              # can either do this globally or…
+              enableExecutableProfiling = enableProfiling;
+            });
 
-          # …only for the package that contains an executable you want to profile.
-          # That saves on unnecessary rebuilds for packages that you only depend
-          # on for their library, but also contain executables (e.g. pandoc).
-          my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
+            # …only for the package that contains an executable you want to profile.
+            # That saves on unnecessary rebuilds for packages that you only depend
+            # on for their library, but also contain executables (e.g. pandoc).
+            my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
 
-          # If you are disabling profiling to save on build time, but want to
-          # retain the ability to substitute from the binary cache. Drop the
-          # override for mkDerivation above and instead have an override like
-          # this for the specific packages you are building locally and want
-          # to make cheaper to build.
-          my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+            # If you are disabling profiling to save on build time, but want to
+            # retain the ability to substitute from the binary cache. Drop the
+            # override for mkDerivation above and instead have an override like
+            # this for the specific packages you are building locally and want
+            # to make cheaper to build.
+            my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+          };
         };
       };
     };

maintainers/maintainer-list.nix

···
     githubId = 264372;
     name = "Jan van den Berg";
   };
+  koppor = {
+    email = "[e-mail]";
+    github = "koppor";
+    githubId = 1366654;
+    name = "Oliver Kopp";
+  };
   koral = {
     email = "[e-mail]";
     github = "k0ral";

nixos/doc/manual/release-notes/rl-2405.section.md

···
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
 
+- [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
 
 - [ollama](https://ollama.ai), server for running large language models locally.

nixos/modules/module-list.nix

···
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/powerdns-admin.nix
+  ./services/web-apps/pretalx.nix
   ./services/web-apps/prosody-filer.nix
   ./services/web-apps/restya-board.nix
   ./services/web-apps/rimgo.nix

nixos/modules/services/hardware/acpid.nix

···
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        PrivateNetwork = true;
         ExecStart = escapeShellArgs
           ([ "${pkgs.acpid}/bin/acpid"
              "--foreground"

nixos/modules/services/monitoring/prometheus/exporters.nix

···
     "node"
     "nut"
     "openldap"
-    "openvpn"
     "pgbouncer"
     "php-fpm"
     "pihole"

nixos/modules/services/monitoring/prometheus/exporters/openvpn.nix

···
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.prometheus.exporters.openvpn;
-in {
-  port = 9176;
-  extraOpts = {
-    statusPaths = mkOption {
-      type = types.listOf types.str;
-      description = lib.mdDoc ''
-        Paths to OpenVPN status files. Please configure the OpenVPN option
-        `status` accordingly.
-      '';
-    };
-    telemetryPath = mkOption {
-      type = types.str;
-      default = "/metrics";
-      description = lib.mdDoc ''
-        Path under which to expose metrics.
-      '';
-    };
-  };
-
-  serviceOpts = {
-    serviceConfig = {
-      PrivateDevices = true;
-      ProtectKernelModules = true;
-      NoNewPrivileges = true;
-      ExecStart = ''
-        ${pkgs.prometheus-openvpn-exporter}/bin/openvpn_exporter \
-          -openvpn.status_paths "${concatStringsSep "," cfg.statusPaths}" \
-          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          -web.telemetry-path ${cfg.telemetryPath}
-      '';
-    };
-  };
-}

nixos/modules/services/monitoring/prometheus/exporters/snmp.nix

···
 with lib;
 
 let
+  logPrefix = "services.prometheus.exporters.snmp";
   cfg = config.services.prometheus.exporters.snmp;
 
   # This ensures that we can deal with string paths, path types and

nixos/modules/services/networking/seafile.nix

···
   dataDir = "${seafRoot}/data";
   seahubDir = "${seafRoot}/seahub";
 
-in {
+in
+{
 
   ###### Interface
 
···
       description = "Seafile components";
     };
 
-    systemd.services = let
-      securityOptions = {
-        ProtectHome = true;
-        PrivateUsers = true;
-        PrivateDevices = true;
-        ProtectClock = true;
-        ProtectHostname = true;
-        ProtectProc = "invisible";
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectKernelLogs = true;
-        ProtectControlGroups = true;
-        RestrictNamespaces = true;
-        LockPersonality = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        MemoryDenyWriteExecute = true;
-        SystemCallArchitectures = "native";
-        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" ];
-      };
-    in {
-      seaf-server = {
-        description = "Seafile server";
-        partOf = [ "seafile.target" ];
-        after = [ "network.target" ];
-        wantedBy = [ "seafile.target" ];
-        restartTriggers = [ ccnetConf seafileConf ];
-        path = [ pkgs.sqlite ];
-        serviceConfig = securityOptions // {
-          User = "seafile";
-          Group = "seafile";
-          DynamicUser = true;
-          StateDirectory = "seafile";
-          RuntimeDirectory = "seafile";
-          LogsDirectory = "seafile";
-          ConfigurationDirectory = "seafile";
-          ExecStart = ''
-            ${cfg.seafilePackage}/bin/seaf-server \
-            --foreground \
-            -F /etc/seafile \
-            -c ${ccnetDir} \
-            -d ${dataDir} \
-            -l /var/log/seafile/server.log \
-            -P /run/seafile/server.pid \
-            -p /run/seafile
-          '';
+    systemd.services =
+      let
+        securityOptions = {
+          ProtectHome = true;
+          PrivateUsers = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectHostname = true;
+          ProtectProc = "invisible";
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" ];
         };
-        preStart = ''
-          if [ ! -f "${seafRoot}/server-setup" ]; then
-              mkdir -p ${dataDir}/library-template
-              mkdir -p ${ccnetDir}/{GroupMgr,misc,OrgMgr,PeerMgr}
-              sqlite3 ${ccnetDir}/GroupMgr/groupmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/groupmgr.sql"
-              sqlite3 ${ccnetDir}/misc/config.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/config.sql"
-              sqlite3 ${ccnetDir}/OrgMgr/orgmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/org.sql"
-              sqlite3 ${ccnetDir}/PeerMgr/usermgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/user.sql"
-              sqlite3 ${dataDir}/seafile.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/seafile.sql"
-              echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
-          fi
-          # checking for upgrades and handling them
-          # WARNING: needs to be extended to actually handle major version migrations
-          installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
-          installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
-          pkgMajor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f1)
-          pkgMinor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f2)
-
-          if [[ $installedMajor == $pkgMajor && $installedMinor == $pkgMinor ]]; then
-             :
-          elif [[ $installedMajor == 8 && $installedMinor == 0 && $pkgMajor == 9 && $pkgMinor == 0 ]]; then
-              # Upgrade from 8.0 to 9.0
-              sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/9.0.0/sqlite3/seafile.sql"
-              echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
-          else
-              echo "Unsupported upgrade" >&2
-              exit 1
-          fi
-        '';
-      };
+      in
+      {
+        seaf-server = {
+          description = "Seafile server";
+          partOf = [ "seafile.target" ];
+          after = [ "network.target" ];
+          wantedBy = [ "seafile.target" ];
+          restartTriggers = [ ccnetConf seafileConf ];
+          path = [ pkgs.sqlite ];
+          serviceConfig = securityOptions // {
+            User = "seafile";
+            Group = "seafile";
+            DynamicUser = true;
+            StateDirectory = "seafile";
+            RuntimeDirectory = "seafile";
+            LogsDirectory = "seafile";
+            ConfigurationDirectory = "seafile";
+            ExecStart = ''
+              ${cfg.seafilePackage}/bin/seaf-server \
+              --foreground \
+              -F /etc/seafile \
+              -c ${ccnetDir} \
+              -d ${dataDir} \
+              -l /var/log/seafile/server.log \
+              -P /run/seafile/server.pid \
+              -p /run/seafile
+            '';
+          };
+          preStart = ''
+            if [ ! -f "${seafRoot}/server-setup" ]; then
+                mkdir -p ${dataDir}/library-template
+                mkdir -p ${ccnetDir}/{GroupMgr,misc,OrgMgr,PeerMgr}
+                sqlite3 ${ccnetDir}/GroupMgr/groupmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/groupmgr.sql"
+                sqlite3 ${ccnetDir}/misc/config.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/config.sql"
+                sqlite3 ${ccnetDir}/OrgMgr/orgmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/org.sql"
+                sqlite3 ${ccnetDir}/PeerMgr/usermgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/user.sql"
+                sqlite3 ${dataDir}/seafile.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            fi
+            # checking for upgrades and handling them
+            installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
+            installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
+            pkgMajor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f1)
+            pkgMinor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f2)
 
-      seahub = {
-        description = "Seafile Server Web Frontend";
-        wantedBy = [ "seafile.target" ];
-        partOf = [ "seafile.target" ];
-        after = [ "network.target" "seaf-server.service" ];
-        requires = [ "seaf-server.service" ];
-        restartTriggers = [ seahubSettings ];
-        environment = {
-          PYTHONPATH = "${pkgs.seahub.pythonPath}:${pkgs.seahub}/thirdpart:${pkgs.seahub}";
-          DJANGO_SETTINGS_MODULE = "seahub.settings";
-          CCNET_CONF_DIR = ccnetDir;
-          SEAFILE_CONF_DIR = dataDir;
-          SEAFILE_CENTRAL_CONF_DIR = "/etc/seafile";
-          SEAFILE_RPC_PIPE_PATH = "/run/seafile";
-          SEAHUB_LOG_DIR = "/var/log/seafile";
+            if [[ $installedMajor == $pkgMajor && $installedMinor == $pkgMinor ]]; then
+               :
+            elif [[ $installedMajor == 8 && $installedMinor == 0 && $pkgMajor == 9 && $pkgMinor == 0 ]]; then
+                # Upgrade from 8.0 to 9.0
+                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/9.0.0/sqlite3/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            elif [[ $installedMajor == 9 && $installedMinor == 0 && $pkgMajor == 10 && $pkgMinor == 0 ]]; then
+                # Upgrade from 9.0 to 10.0
+                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/10.0.0/sqlite3/seafile.sql"
+                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            else
+                echo "Unsupported upgrade" >&2
+                exit 1
+            fi
+          '';
         };
-        serviceConfig = securityOptions // {
-          User = "seafile";
-          Group = "seafile";
-          DynamicUser = true;
-          RuntimeDirectory = "seahub";
-          StateDirectory = "seafile";
-          LogsDirectory = "seafile";
-          ConfigurationDirectory = "seafile";
-          ExecStart = ''
-            ${pkgs.seahub.python.pkgs.gunicorn}/bin/gunicorn seahub.wsgi:application \
-            --name seahub \
-            --workers ${toString cfg.workers} \
-            --log-level=info \
-            --preload \
-            --timeout=1200 \
-            --limit-request-line=8190 \
-            --bind unix:/run/seahub/gunicorn.sock
+
+        seahub = {
+          description = "Seafile Server Web Frontend";
+          wantedBy = [ "seafile.target" ];
+          partOf = [ "seafile.target" ];
+          after = [ "network.target" "seaf-server.service" ];
+          requires = [ "seaf-server.service" ];
+          restartTriggers = [ seahubSettings ];
+          environment = {
+            PYTHONPATH = "${pkgs.seahub.pythonPath}:${pkgs.seahub}/thirdpart:${pkgs.seahub}";
+            DJANGO_SETTINGS_MODULE = "seahub.settings";
+            CCNET_CONF_DIR = ccnetDir;
+            SEAFILE_CONF_DIR = dataDir;
+            SEAFILE_CENTRAL_CONF_DIR = "/etc/seafile";
+            SEAFILE_RPC_PIPE_PATH = "/run/seafile";
+            SEAHUB_LOG_DIR = "/var/log/seafile";
+          };
+          serviceConfig = securityOptions // {
+            User = "seafile";
+            Group = "seafile";
+            DynamicUser = true;
+            RuntimeDirectory = "seahub";
+            StateDirectory = "seafile";
+            LogsDirectory = "seafile";
+            ConfigurationDirectory = "seafile";
+            ExecStart = ''
+              ${pkgs.seahub.python.pkgs.gunicorn}/bin/gunicorn seahub.wsgi:application \
+              --name seahub \
+              --workers ${toString cfg.workers} \
+              --log-level=info \
+              --preload \
+              --timeout=1200 \
+              --limit-request-line=8190 \
+              --bind unix:/run/seahub/gunicorn.sock
+            '';
+          };
+          preStart = ''
+            mkdir -p ${seahubDir}/media
+            # Link all media except avatars
+            for m in `find ${pkgs.seahub}/media/ -maxdepth 1 -not -name "avatars"`; do
+              ln -sf $m ${seahubDir}/media/
+            done
+            if [ ! -e "${seafRoot}/.seahubSecret" ]; then
+                ${pkgs.seahub.python}/bin/python ${pkgs.seahub}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
+                chmod 400 ${seafRoot}/.seahubSecret
+            fi
+            if [ ! -f "${seafRoot}/seahub-setup" ]; then
+                # avatars directory should be writable
+                install -D -t ${seahubDir}/media/avatars/ ${pkgs.seahub}/media/avatars/default.png
+                install -D -t ${seahubDir}/media/avatars/groups ${pkgs.seahub}/media/avatars/groups/default.png
+                # init database
+                ${pkgs.seahub}/manage.py migrate
+                # create admin account
+                ${pkgs.expect}/bin/expect -c 'spawn ${pkgs.seahub}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
+                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+            fi
+            if [ $(cat "${seafRoot}/seahub-setup" | cut -d"-" -f1) != "${pkgs.seahub.version}" ]; then
+                # update database
+                ${pkgs.seahub}/manage.py migrate
+                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+            fi
           '';
         };
-        preStart = ''
-          mkdir -p ${seahubDir}/media
-          # Link all media except avatars
-          for m in `find ${pkgs.seahub}/media/ -maxdepth 1 -not -name "avatars"`; do
-            ln -sf $m ${seahubDir}/media/
-          done
-          if [ ! -e "${seafRoot}/.seahubSecret" ]; then
-              ${pkgs.seahub.python}/bin/python ${pkgs.seahub}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
-              chmod 400 ${seafRoot}/.seahubSecret
-          fi
-          if [ ! -f "${seafRoot}/seahub-setup" ]; then
-              # avatars directory should be writable
-              install -D -t ${seahubDir}/media/avatars/ ${pkgs.seahub}/media/avatars/default.png
-              install -D -t ${seahubDir}/media/avatars/groups ${pkgs.seahub}/media/avatars/groups/default.png
-              # init database
-              ${pkgs.seahub}/manage.py migrate
-              # create admin account
-              ${pkgs.expect}/bin/expect -c 'spawn ${pkgs.seahub}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
-              echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
-          fi
-          if [ $(cat "${seafRoot}/seahub-setup" | cut -d"-" -f1) != "${pkgs.seahub.version}" ]; then
-              # update database
-              ${pkgs.seahub}/manage.py migrate
-              echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
-          fi
-        '';
       };
-    };
   };
 }

nixos/modules/services/web-apps/photoprism.nix

···
     in
     pkgs.writeShellScript "manage" ''
       ${setupEnv}
+      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+      exec ${pkgs.util-linux}/bin/nsenter \
+        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
       exec ${cfg.package}/bin/photoprism "$@"
     '';
 in

nixos/modules/services/web-apps/pretalx.nix

···
+{ config
+, lib
+, pkgs
+, utils
+, ...
+}:
+
+let
+  cfg = config.services.pretalx;
+  format = pkgs.formats.ini { };
+
+  configFile = format.generate "pretalx.cfg" cfg.settings;
+
+  extras = cfg.package.optional-dependencies.redis
+    ++ lib.optionals (cfg.settings.database.backend == "mysql") cfg.package.optional-dependencies.mysql
+    ++ lib.optionals (cfg.settings.database.backend == "postgresql") cfg.package.optional-dependencies.postgres;
+
+  pythonEnv = cfg.package.python.buildEnv.override {
+    extraLibs = [ (cfg.package.python.pkgs.toPythonModule cfg.package) ]
+      ++ (with cfg.package.python.pkgs; [ gunicorn ]
+      ++ lib.optional cfg.celery.enable celery) ++ extras;
+  };
+in
+
+{
+  meta = with lib; {
+    maintainers = teams.c3d2.members;
+  };
+
+  options.services.pretalx = {
+    enable = lib.mkEnableOption (lib.mdDoc "pretalx");
+
+    package = lib.mkPackageOptionMD pkgs "pretalx" {};
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "pretalx";
+      description = "Group under which pretalx should run.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "pretalx";
+      description = "User under which pretalx should run.";
+    };
+
+    gunicorn.extraArgs = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [
+        "--name=pretalx"
+      ];
+      example = [
+        "--name=pretalx"
+        "--workers=4"
+        "--max-requests=1200"
+        "--max-requests-jitter=50"
+        "--log-level=info"
+      ];
+      description = lib.mdDoc ''
+        Extra arguments to pass to gunicorn.
+        See <https://docs.pretalx.org/administrator/installation.html#step-6-starting-pretalx-as-a-service> for details.
+      '';
+      apply = lib.escapeShellArgs;
+    };
+
+    celery = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = lib.mdDoc ''
+          Whether to set up celery as an asynchronous task runner.
+        '';
+      };
+
+      extraArgs = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ ];
+        description = lib.mdDoc ''
+          Extra arguments to pass to celery.
+
+          See <https://docs.celeryq.dev/en/stable/reference/cli.html#celery-worker> for more info.
+        '';
+        apply = utils.escapeSystemdExecArgs;
+      };
+    };
+
+    nginx = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = lib.mdDoc ''
+          Whether to set up an nginx virtual host.
+        '';
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "talks.example.com";
+        description = lib.mdDoc ''
+          The domain name under which to set up the virtual host.
+        '';
+      };
+    };
+
+    database.createLocally = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      example = false;
+      description = lib.mdDoc ''
+        Whether to automatically set up the database on the local DBMS instance.
+
+        Currently only supported for PostgreSQL. Not required for sqlite.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          database = {
+            backend = lib.mkOption {
+              type = lib.types.enum [
+                "postgresql"
+              ];
+              default = "postgresql";
+              description = lib.mdDoc ''
+                Database backend to use.
+
+                Currently only PostgreSQL gets tested, and as such we don't support any other DBMS.
+              '';
+              readOnly = true; # only postgres supported right now
+            };
+
+            host = lib.mkOption {
+              type = with lib.types; nullOr types.path;
+              default = if cfg.settings.database.backend == "postgresql" then "/run/postgresql"
+                else if cfg.settings.database.backend == "mysql" then "/run/mysqld/mysqld.sock"
+                else null;
+              defaultText = lib.literalExpression ''
+                if config.services.pretalx.settings..database.backend == "postgresql" then "/run/postgresql"
+                else if config.services.pretalx.settings.database.backend == "mysql" then "/run/mysqld/mysqld.sock"
+                else null
+              '';
+              description = lib.mdDoc ''
+                Database host or socket path.
+              '';
+            };
+
+            name = lib.mkOption {
+              type = lib.types.str;
+              default = "pretalx";
+              description = lib.mdDoc ''
+                Database name.
+              '';
+            };
+
+            user = lib.mkOption {
+              type = lib.types.str;
+              default = "pretalx";
+              description = lib.mdDoc ''
+                Database username.
+              '';
+            };
+          };
+
+          filesystem = {
+            data = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/pretalx";
+              description = lib.mdDoc ''
+                Base path for all other storage paths.
+              '';
+            };
+            logs = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/log/pretalx";
+              description = lib.mdDoc ''
+                Path to the log directory, that pretalx logs message to.
+              '';
+            };
+            static = lib.mkOption {
+              type = lib.types.path;
+              default = "${cfg.package.static}/";
+              defaultText = lib.literalExpression "\${config.services.pretalx.package}.static}/";
+              readOnly = true;
+              description = lib.mdDoc ''
+                Path to the directory that contains static files.
+              '';
+            };
+          };
+
+          celery = {
+            backend = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = lib.optionalString cfg.celery.enable "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1";
+              defaultText = lib.literalExpression ''
+                optionalString config.services.pretalx.celery.enable "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=1"
+              '';
+              description = lib.mdDoc ''
+                URI to the celery backend used for the asynchronous job queue.
+              '';
+            };
+
+            broker = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = lib.optionalString cfg.celery.enable "redis+socket://${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2";
+              defaultText = lib.literalExpression ''
+                optionalString config.services.pretalx.celery.enable "redis+socket://''${config.services.redis.servers.pretalx.unixSocket}?virtual_host=2"
+              '';
+              description = lib.mdDoc ''
+                URI to the celery broker used for the asynchronous job queue.
+              '';
+            };
+          };
+
+          redis = {
+            location = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = "unix://${config.services.redis.servers.pretalx.unixSocket}?db=0";
+              defaultText = lib.literalExpression ''
+                "unix://''${config.services.redis.servers.pretalx.unixSocket}?db=0"
+              '';
+              description = lib.mdDoc ''
+                URI to the redis server, used to speed up locking, caching and session storage.
+              '';
+            };
+
+            session = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              example = false;
+              description = lib.mdDoc ''
+                Whether to use redis as the session storage.
+              '';
+            };
+          };
+
+          site = {
+            url = lib.mkOption {
+              type = lib.types.str;
+              default = "https://${cfg.nginx.domain}";
+              defaultText = lib.literalExpression "https://\${config.services.pretalx.nginx.domain}";
+              example = "https://talks.example.com";
+              description = lib.mdDoc ''
+                The base URI below which your pretalx instance will be reachable.
+              '';
+            };
+          };
+        };
+      };
+      default = { };
+      description = lib.mdDoc ''
+        pretalx configuration as a Nix attribute set. All settings can also be passed
+        from the environment.
+
+        See <https://docs.pretalx.org/administrator/configure.html> for possible options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # https://docs.pretalx.org/administrator/installation.html
+
+    environment.systemPackages = [
+      (pkgs.writeScriptBin "pretalx-manage" ''
+        cd ${cfg.settings.filesystem.data}
+        sudo=exec
+        if [[ "$USER" != ${cfg.user} ]]; then
+          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
+        fi
+        export PRETALX_CONFIG_FILE=${configFile}
+        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+      '')
+    ];
+
+    services = {
+      nginx = lib.mkIf cfg.nginx.enable {
+        enable = true;
+        recommendedGzipSettings = lib.mkDefault true;
+        recommendedOptimisation = lib.mkDefault true;
+        recommendedProxySettings = lib.mkDefault true;
+        recommendedTlsSettings = lib.mkDefault true;
+        upstreams.pretalx.servers."unix:/run/pretalx/pretalx.sock" = { };
+        virtualHosts.${cfg.nginx.domain} = {
+          # https://docs.pretalx.org/administrator/installation.html#step-7-ssl
+          extraConfig = ''
+            more_set_headers Referrer-Policy same-origin;
+            more_set_headers X-Content-Type-Options nosniff;
+          '';
+          locations = {
+            "/".proxyPass = "http://pretalx";
+            "/media/" = {
+              alias = "${cfg.settings.filesystem.data}/data/media/";
+              extraConfig = ''
+                access_log off;
+                more_set_headers Content-Disposition 'attachment; filename="$1"';
+                expires 7d;
+              '';
+            };
+            "/static/" = {
+              alias = cfg.settings.filesystem.static;
+              extraConfig = ''
+                access_log off;
+                more_set_headers Cache-Control "public";
+                expires 365d;
+              '';
+            };
+          };
+        };
+      };
+
+      postgresql = lib.mkIf (cfg.database.createLocally && cfg.settings.database.backend == "postgresql") {
+        enable = true;
+        ensureUsers = [ {
+          name = cfg.settings.database.user;
+          ensureDBOwnership = true;
+        } ];
+        ensureDatabases = [ cfg.settings.database.name ];
+      };
+
+      redis.servers.pretalx.enable = true;
+    };
+
+    systemd.services = let
+      commonUnitConfig = {
+        environment.PRETALX_CONFIG_FILE = configFile;
+        serviceConfig = {
+          User = "pretalx";
+          Group = "pretalx";
+          StateDirectory = [ "pretalx" "pretalx/media" ];
+          LogsDirectory = "pretalx";
+          WorkingDirectory = cfg.settings.filesystem.data;
+          SupplementaryGroups = [ "redis-pretalx" ];
+        };
+      };
+    in {
+      pretalx-web = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx web service";
+        after = [
+          "network.target"
+          "redis-pretalx.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
+          "postgresql.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "mysql") [
+          "mysql.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          versionFile="${cfg.settings.filesystem.data}/.version"
+          version=$(cat "$versionFile" 2>/dev/null || echo 0)
+
+          if [[ $version != ${cfg.package.version} ]]; then
+            ${lib.getExe' pythonEnv "pretalx-manage"} migrate
+
+            echo "${cfg.package.version}" > "$versionFile"
+          fi
+        '';
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pythonEnv "gunicorn"} --bind unix:/run/pretalx/pretalx.sock ${cfg.gunicorn.extraArgs} pretalx.wsgi";
+          RuntimeDirectory = "pretalx";
+        };
+      };
+
+      pretalx-periodic = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx periodic task runner";
+        # every 15 minutes
+        startAt = [ "*:3,18,33,48" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe' pythonEnv "pretalx-manage"} runperiodic";
+        };
+      };
+
+      pretalx-clear-sessions = lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx session pruning";
+        startAt = [ "monthly" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe' pythonEnv "pretalx-manage"} clearsessions";
+        };
+      };
+
+      pretalx-worker = lib.mkIf cfg.celery.enable (lib.recursiveUpdate commonUnitConfig {
+        description = "pretalx asynchronous job runner";
+        after = [
+          "network.target"
+          "redis-pretalx.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
+          "postgresql.service"
+        ] ++ lib.optionals (cfg.settings.database.backend == "mysql") [
+          "mysql.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.ExecStart = "${lib.getExe' pythonEnv "celery"} -A pretalx.celery_app worker ${cfg.celery.extraArgs}";
+      });
+    };
+
+    systemd.sockets.pretalx-web.socketConfig = {
+      ListenStream = "/run/pretalx/pretalx.sock";
+      SocketUser = "nginx";
+    };
+
+    users = {
+      groups."${cfg.group}" = {};
+      users."${cfg.user}" = {
+        isSystemUser = true;
+        createHome = true;
+        home = cfg.settings.filesystem.data;
+        inherit (cfg) group;
+      };
+    };
+  };
+}

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

···
 # These values will be replaced with actual values during the package build
 EFI_SYS_MOUNT_POINT = "@efiSysMountPoint@"
 TIMEOUT = "@timeout@"
-EDITOR = bool("@editor@")
+EDITOR = "@editor@" == "1"
 CONSOLE_MODE = "@consoleMode@"
 BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

···
 
     timeout = optionalString (config.boot.loader.timeout != null) config.boot.loader.timeout;
 
-    editor = if cfg.editor then "True" else "False";
-
     configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;
 
-    inherit (cfg) consoleMode graceful;
+    inherit (cfg) consoleMode graceful editor;
 
     inherit (efi) efiSysMountPoint canTouchEfiVariables;
 

nixos/tests/all-tests.nix

···
   power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};
   pppd = handleTest ./pppd.nix {};
   predictable-interface-names = handleTest ./predictable-interface-names.nix {};
+  pretalx = runTest ./web-apps/pretalx.nix;
   printing-socket = handleTest ./printing.nix { socket = true; };
   printing-service = handleTest ./printing.nix { socket = false; };
   privoxy = handleTest ./privoxy.nix {};

nixos/tests/prometheus-exporters.nix

···
       '';
     };
 
-    openvpn = {
-      exporterConfig = {
-        enable = true;
-        group = "openvpn";
-        statusPaths = [ "/run/openvpn-test" ];
-      };
-      metricProvider = {
-        users.groups.openvpn = { };
-        services.openvpn.servers.test = {
-          config = ''
-            dev tun
-            status /run/openvpn-test
-            status-version 3
-          '';
-          up = "chmod g+r /run/openvpn-test";
-        };
-        systemd.services."openvpn-test".serviceConfig.Group = "openvpn";
-      };
-      exporterTest = ''
-        wait_for_unit("openvpn-test.service")
-        wait_for_unit("prometheus-openvpn-exporter.service")
-        succeed("curl -sSf http://localhost:9176/metrics | grep 'openvpn_up{.*} 1'")
-      '';
-    };
-
     pgbouncer = {
       exporterConfig = {
         enable = true;

nixos/tests/web-apps/pretalx.nix

···
+{ lib, ... }:
+
+{
+  name = "pretalx";
+  meta.maintainers = lib.teams.c3d2.members;
+
+  nodes = {
+    pretalx = {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
+
+      services.pretalx = {
+        enable = true;
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    pretalx.wait_for_unit("pretalx-web.service")
+    pretalx.wait_for_unit("pretalx-worker.service")
+
+    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+  '';
+}

pkgs/applications/audio/ledfx/default.nix

···
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.89";
+  version = "2.0.90";
   pyproject= true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PBOj6u0TukT6wRKMQML4+XNQQZvsGyRzXBk9YsISst4=";
+    hash = "sha256-ZlZtC0bi9ZUf/1D9hUxxhdix6F8l7Lg5IUOOg+JHGYU=";
   };
 
   pythonRelaxDeps = true;

pkgs/applications/audio/mympd/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "13.0.6";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7yqpm2qMDHWVM5m5FueYlkEFY+VIW8Cx+aRa1iY2vZ4=";
+    sha256 = "sha256-srwLnoQSPex7/PtgF6RWpJM39fpOqN3wze5ABSRTIRA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/netease-music-tui/default.nix

···
     description = "netease cloud music terminal client by rust";
     maintainers = with maintainers; [ vonfry ];
     license = licenses.mit;
+    mainProgram = "ncmt";
   };
 }

pkgs/applications/audio/polyphone/default.nix

···
   '';
 
   installPhase = ''
+    runHook preInstall
     install -d $out/bin
     install -m755 bin/polyphone $out/bin/
+
+    install -Dm444 ./contrib/com.polyphone_soundfonts.polyphone.desktop -t $out/share/applications/
+    install -Dm444 ./contrib/polyphone.svg -t $out/share/icons/hicolor/scalable/apps/
+    runHook postInstall
   '';
 
   qmakeFlags = [

pkgs/applications/editors/vscode/extensions/default.nix

···
         mktplcRef = {
           name = "vscode-eslint";
           publisher = "dbaeumer";
-          version = "2.4.2";
-          sha256 = "sha256-eIjaiVQ7PNJUtOiZlM+lw6VmW07FbMWPtY7UoedWtbw=";
+          version = "2.4.4";
+          sha256 = "sha256-NJGsMme/+4bvED/93SGojYTH03EZbtKe5LyvocywILA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/dbaeumer.vscode-eslint/changelog";
···
         mktplcRef = {
           name = "crates";
           publisher = "serayuzgur";
-          version = "0.6.5";
-          sha256 = "sha256-HgqM4PKGk3R5MLY4cVjKxv79p5KlOkVDeDbv7/6FmpM=";
+          version = "0.6.6";
+          sha256 = "sha256-HXoH1IgMLniq0kxHs2snym4rerScu9qCqUaqwEC+O/E=";
         };
         meta = {
           license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.wackbyte ];
         };
       };
 

pkgs/applications/emulators/yuzu/compat-list.nix

···
 { stdenv, fetchFromGitHub, unstableGitUpdater }:
 stdenv.mkDerivation {
   pname = "yuzu-compatibility-list";
-  version = "unstable-2024-01-27";
+  version = "unstable-2024-01-30";
 
   src = fetchFromGitHub {
     owner = "flathub";
     repo = "org.yuzu_emu.yuzu";
-    rev = "c01bdbbfda3e2558930fcced63b6d02b646f881b";
-    hash = "sha256-TDmzBxeJq4gJvU88hJaXN7U3PYOqI1OrkenlH1GJo8g=";
+    rev = "82194fa23ec35545ade47cc3dc2035b2b07badcb";
+    hash = "sha256-LsQZml8I43fZDFACtVZpc76/62Pv11Z6bm8w/9hTHdI=";
   };
 
   buildCommand = ''

pkgs/applications/gis/qgis/unwrapped.nix

···
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.2";
+  version = "3.34.3";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-RKxIJpp0lmRqyMYJuX2U4/GJh0FTnklFOcUft6LsuHc=";
+    hash = "sha256-uf4qUalY6LxPykgUt/atHBTu+A6ITrcnfez/jwVMLvA=";
   };
 
   passthru = {

pkgs/applications/misc/diffuse/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "diffuse";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "MightyCreak";
     repo = "diffuse";
     rev = "v${version}";
-    sha256 = "aGg5uh9KitVP2bBUizgGIZWvzTxfJGid0WUGVNyHdlk=";
+    sha256 = "6GdUtdVhhIQL1cD9/e7Byv37PVKXmzVWhJC6GROK7OA=";
   };
 
   format = "other";

pkgs/applications/misc/gramps/default.nix

···
-{ lib, fetchFromGitHub, gtk3, pythonPackages, intltool, gexiv2,
-  pango, gobject-introspection, wrapGAppsHook, gettext,
-# Optional packages:
- enableOSM ? true, osm-gps-map, glib-networking,
- enableGraphviz ? true, graphviz,
- enableGhostscript ? true, ghostscript
- }:
+{ lib
+, fetchpatch
+, fetchFromGitHub
+, gtk3
+, pythonPackages
+, glibcLocales
+, intltool
+, gexiv2
+, pango
+, gobject-introspection
+, wrapGAppsHook
+, gettext
+, # Optional packages:
+  enableOSM ? true
+, osm-gps-map
+, glib-networking
+, enableGraphviz ? true
+, graphviz
+, enableGhostscript ? true
+, ghostscript
+}:
 
 let
   inherit (pythonPackages) python buildPythonApplication;
-in buildPythonApplication rec {
-  version = "5.1.4";
+in
+buildPythonApplication rec {
+  version = "5.1.6";
   pname = "gramps";
+  pyproject = true;
 
-  nativeBuildInputs = [ wrapGAppsHook intltool gettext gobject-introspection ];
+  nativeBuildInputs = [
+    wrapGAppsHook
+    intltool
+    gettext
+    gobject-introspection
+    pythonPackages.setuptools
+  ];
+
+  nativeCheckInputs = [
+    glibcLocales
+    pythonPackages.jsonschema
+    pythonPackages.mock
+    pythonPackages.lxml
+  ];
+
   buildInputs = [ gtk3 pango gexiv2 ]
     # Map support
     ++ lib.optionals enableOSM [ osm-gps-map glib-networking ]
···
     owner = "gramps-project";
     repo = "gramps";
     rev = "v${version}";
-    sha256 = "00358nzyw686ypqv45imc5k9frcqnhla0hpx9ynna3iy6iz5006x";
+    hash = "sha256-BerkDXdFYfZ3rV5AeMo/uk53IN2U5z4GFs757Ar26v0=";
   };
 
-  pythonPath = with pythonPackages; [ bsddb3 pyicu pygobject3 pycairo ];
+  pythonPath = with pythonPackages; [
+    bsddb3
+    pyicu
+    pygobject3
+    pycairo
+  ];
+
+  patches = [
+    # fix for running tests with a temporary home - remove next release
+    # https://gramps-project.org/bugs/view.php?id=12577
+    (fetchpatch {
+      url = "https://github.com/gramps-project/gramps/commit/1e95d8a6b5193d655d8caec1e6ab13628ad123db.patch";
+      hash = "sha256-2riWB13Yl+tk9+Tuo0YDLoxY2Rc0xrJKfb+ZU7Puzxk=";
+    })
+  ];
 
   # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
   # install flag.
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
+    mkdir -p "$out/${python.sitePackages}"
 
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --install-lib=$out/${python.sitePackages} \
       --prefix="$out"
 
-    eapth="$out/lib/${python.libPrefix}"/site-packages/easy-install.pth
+    eapth="$out/${python.sitePackages}/easy-install.pth"
     if [ -e "$eapth" ]; then
         # move colliding easy_install.pth to specifically named one
         mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
     fi
 
-    rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+    rm -f "$out/${python.sitePackages}"/site.py*
 
     runHook postInstall
+  '';
+
+  preCheck = ''
+    export HOME=$TMPDIR
   '';
 
   # https://github.com/NixOS/nixpkgs/issues/149812
···
   meta = with lib; {
     description = "Genealogy software";
     homepage = "https://gramps-project.org";
-    license = licenses.gpl2;
+    maintainers = with maintainers; [ jk pinpox ];
+    changelog = "https://github.com/gramps-project/gramps/blob/v${version}/ChangeLog";
+    longDescription = ''
+      Every person has their own story but they are also part of a collective
+      family history. Gramps gives you the ability to record the many details of
+      an individual's life as well as the complex relationships between various
+      people, places and events. All of your research is kept organized,
+      searchable and as precise as you need it to be.
+    '';
+    license = licenses.gpl2Plus;
   };
 }

pkgs/applications/misc/loxodo/default.nix

···
     [Desktop Entry]
     Type=Application
     Exec=$out/bin/loxodo
-    Icon=$out/lib/${python3.libPrefix}/site-packages/resources/loxodo-icon.png
+    Icon=$out/${python3.sitePackages}/resources/loxodo-icon.png
     Name=Loxodo
     GenericName=Password Vault
     Categories=Application;Other;

pkgs/applications/misc/prusa-slicer/default.nix

···
 , cereal
 , cgal
 , curl
+, darwin
 , dbus
 , eigen
 , expat
···
     catch2
   ] ++ lib.optionals withSystemd [
     systemd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreWLAN
   ];
 
   separateDebugInfo = true;
···
     homepage = "https://github.com/prusa3d/PrusaSlicer";
     license = licenses.agpl3;
     maintainers = with maintainers; [ moredread tweber tmarkus ];
+    platforms = platforms.unix;
   } // lib.optionalAttrs (stdenv.isDarwin) {
     mainProgram = "PrusaSlicer";
   };

pkgs/applications/misc/wmenu/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.4";
+  version = "0.1.6";
 
   strictDeps = true;
 
···
     owner = "~adnano";
     repo = "wmenu";
     rev = version;
-    hash = "sha256-aB23wi8kLBKAvQv2UPsfqVMCjakdsM6AzH8LgGv3HPs=";
+    hash = "sha256-Xsnf7T39up6E5kzV37sM9j3PpA2eqxItbGt+tOfjsjE=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja ];

pkgs/applications/networking/browsers/firefox/common.nix

···
     # Runs autoconf through ./mach configure in configurePhase
     configureScript="$(realpath ./mach) configure"
 
+    # Set reproducible build date; https://bugzilla.mozilla.org/show_bug.cgi?id=885777#c21
+    export MOZ_BUILD_DATE=$(head -n1 sourcestamp.txt)
+
     # Set predictable directories for build and state
     export MOZ_OBJDIR=$(pwd)/mozobj
     export MOZBUILD_STATE_PATH=$(pwd)/mozbuild

pkgs/applications/networking/browsers/microsoft-edge/default.nix

···
 {
   stable = import ./browser.nix {
     channel = "stable";
-    version = "120.0.2210.144";
+    version = "121.0.2277.83";
     revision = "1";
-    hash = "sha256-O/7LdopcMfSYx8cg9BNDU6KxbPfnF9rYXD7Q6jugBLU=";
+    hash = "sha256-WuDu44elNlkYZEtol+TZNpcRAkAq8HHATYCc9Or/bvU=";
   };
   beta = import ./browser.nix {
     channel = "beta";
-    version = "121.0.2277.71";
+    version = "121.0.2277.83";
     revision = "1";
-    hash = "sha256-PsfUZJ5ftHxSFGaXjzFMEff7Czfq88yL31mqNkFilNM=";
+    hash = "sha256-eW8Bpcjw1aY5lMqsGCJ3hORVLhzW8Fmaio+kpSOzPeU=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "122.0.2348.0";
+    version = "122.0.2353.0";
     revision = "1";
-    hash = "sha256-Vsnrc43d70fLDncMeQeYhZJhnYex2LsIV1U2KPlkP9U=";
+    hash = "sha256-llLaq13SU4ZpqhOYK0hy6ZD6amAqijStk8TIHX3gydQ=";
   };
 }

pkgs/applications/networking/cluster/kubecm/default.nix

···
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.27.1";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-Fg+jlnYkdv9Vfj94lxfmhoc6pyM0EAqwIBepFXYoO5M=";
+    hash = "sha256-v2frNvJUvDjPhV1RCR3DHk04kYEqP6hMXeA4j3cWlss=";
   };
 
-  vendorHash = "sha256-wj/IHNN8r6pwkKk0ZmpRjxr5nE2c+iypjCsZb+i5vwo=";
+  vendorHash = "sha256-uM9/rqu5WOXK6bqxhtmje+Zd9dtdv3qwt+Xr0SJHjPs=";
   ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];
 
   doCheck = false;

pkgs/applications/networking/cluster/terraform/default.nix

···
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.7.1";
-    hash = "sha256-e+YXOqXgiUXtm6P8PulZowRK0OLA8ekmS+MZRQP/srg=";
-    vendorHash = "sha256-77W0x6DENB+U3yB4LI3PwJU9bTuH7Eqz2a9FNoERuJg=";
+    version = "1.7.2";
+    hash = "sha256-jTzZWmYeKF87Er2i7XHquM8oQyF4q/qoBf4DdMqv7L8=";
+    vendorHash = "sha256-DI4YTjdFFvfby8ExEY3KoK4J9YKK5LPpMbelzFMDVVs=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/cluster/tilt/assets.nix

···
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/web/yarn.lock";
-    hash = "sha256-UTxglGn3eIgahZg4kxolg2f2MTReCL4r/GyWNg4105E=";
+    hash = "sha256-0JpoAQKRmU7P1bzYNR/vqtPjOOSw8wSlNjXl2f6uBrw=";
   };
 
   configurePhase = ''

pkgs/applications/networking/cluster/tilt/default.nix

···
       /* Do not use "dev" as a version. If you do, Tilt will consider itself
         running in development environment and try to serve assets from the
         source tree, which is not there once build completes.  */
-      version = "0.33.6";
+      version = "0.33.10";
 
       src = fetchFromGitHub {
         owner = "tilt-dev";
         repo = "tilt";
         rev = "v${version}";
-        hash = "sha256-WtE8ExUKFRtdYeg0+My/DB+L/qT+J1EaKHKChNjC5oI=";
+        hash = "sha256-LPb2tC3xIGhjiLYkTU+NBIUoqiicO2ORM6Nt1eTnwQs=";
       };
     };
 

pkgs/applications/networking/deck/default.nix

···
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.32.0";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     rev = "v${version}";
-    hash = "sha256-h0dZXIrQm8RlfNnIHU4P0iFelWmkXVqkBmyyrA3/EgY=";
+    hash = "sha256-7lE/Wnrlv3L6V1ex+357q6XXpdx0810m1rKkqITowXY=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
···
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-0KEQ03lls8ZEbhMEcKiZ1jFIbBtXnlCE/mkYHrZdWv8=";
+  vendorHash = "sha256-D260T3E0aufOAqlN918SChv3aNDCFHfe2e0It1pcPiU=";
 
   postInstall = ''
     installShellCompletion --cmd deck \

pkgs/applications/networking/instant-messengers/beeper/default.nix

···
 }:
 let
   pname = "beeper";
-  version = "3.92.23";
+  version = "3.93.36";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.92.23-build-240111az2vz7kii-x86_64.AppImage";
-    hash = "sha256-M+3mJ+X/yr6yONOpdnCRECbswYlSuhlqqbg2d6Px/7s=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.93.36-build-2401269p8vcb695-x86_64.AppImage";
+    hash = "sha256-3pOOAI4/BWdbWfPweRx5I2KRi9VOgJ5vcQ89FTJhPak=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/instant-messengers/rambox/default.nix

···
 
 let
   pname = "rambox";
-  version = "2.2.3";
+  version = "2.3.0";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    sha256 = "sha256-V1Sxfgn3fcqW7t7oa1pfnrPYAqHdCLrWUbplE/I789A=";
+    sha256 = "sha256-PmTiXQp+AkTwCKisH1tR6B1+cHPx25P8FAAlLvKEb3w=";
   };
 
   desktopItem = (makeDesktopItem {

pkgs/applications/networking/mkchromecast/default.nix

···
   ];
 
   postInstall = ''
-    substituteInPlace $out/lib/${python3Packages.python.libPrefix}/site-packages/mkchromecast/video.py \
+    substituteInPlace $out/${python3Packages.python.sitePackages}/mkchromecast/video.py \
       --replace '/usr/share/mkchromecast/nodejs/' '${placeholder "out"}/share/mkchromecast/nodejs/'
   '' + lib.optionalString stdenv.isDarwin ''
     install -Dm 755 -t $out/bin bin/audiodevice
-    substituteInPlace $out/lib/${python3Packages.python.libPrefix}/site-packages/mkchromecast/audio_devices.py \
+    substituteInPlace $out/${python3Packages.python.sitePackages}/mkchromecast/audio_devices.py \
       --replace './bin/audiodevice' '${placeholder "out"}/bin/audiodevice'
   '';
 

pkgs/applications/networking/p2p/deluge/default.nix

···
         install -Dm444 -t $out/share/applications deluge/ui/data/share/applications/deluge.desktop
       '' else ''
         rm -r $out/bin/deluge-gtk
-        rm -r $out/lib/${python3Packages.python.libPrefix}/site-packages/deluge/ui/gtk3
+        rm -r $out/${python3Packages.python.sitePackages}/deluge/ui/gtk3
         rm -r $out/share/{icons,man/man1/deluge-gtk*,pixmaps}
       '');
 

pkgs/applications/networking/seahub/default.nix

···
 , nixosTests
 }:
 let
-  # Seahub 8.x.x does not support django-webpack-loader >=1.x.x
   python = python3.override {
     packageOverrides = self: super: {
-      django-webpack-loader = super.django-webpack-loader.overridePythonAttrs (old: rec {
-        version = "0.7.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-ejyIIBqlRIH5OZRlYVy+e5rs6AgUlqbQKHt8uOIy9Ec=";
-        };
-      });
+      django = super.django_3;
     };
   };
 in
 python.pkgs.buildPythonApplication rec {
   pname = "seahub";
-  version = "9.0.10";
+  version = "10.0.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seahub";
-    rev = "5971bf25fe67d94ec4d9f53b785c15a098113620"; # using a fixed revision because upstream may re-tag releases :/
-    sha256 = "sha256-7Exvm3EShb/1EqwA4wzWB9zCdv0P/ISmjKSoqtOMnqk=";
+    rev = "e8c02236c0eaca6dde009872745f089da4b77e6e"; # using a fixed revision because upstream may re-tag releases :/
+    sha256 = "sha256-7JXWKEFqCsC+ZByhvyP8AmDpajT3hpgyYDNUqc3wXyg=";
   };
 
   patches = [

pkgs/applications/office/libreoffice/darwin/default.nix

···
     homepage = "https://libreoffice.org/";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ tricktron ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-darwin" "aarch64-darwin" ];
   };
 }

pkgs/applications/office/paperwork/paperwork-gtk.nix

···
     # fixes [WARNING] [openpaperwork_core.resources.setuptools] Failed to find
     # resource file paperwork_gtk.icon.out/paperwork_128.png, tried at path
     # /nix/store/3n5lz6y8k9yks76f0nar3smc8djan3xr-paperwork-2.0.2/lib/python3.8/site-packages/paperwork_gtk/icon/out/paperwork_128.png.
-    site=$out/lib/${python3Packages.python.libPrefix}/site-packages/paperwork_gtk
+    site=$out/${python3Packages.python.sitePackages}/paperwork_gtk
     for i in $site/data/paperwork_*.png; do
       ln -s $i $site/icon/out;
     done

pkgs/applications/office/qownnotes/default.nix

···
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.1.4";
+  version = "24.1.5";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-RWAg89rbmoOSzOu9YjAkDluyPiYjT6f8gmri5AAHyww=";
+    hash = "sha256-iw3MdsS1i7B8RXZk2GXwiOReSUC1IX5z0MTEk9B4nMM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/radio/gnuradio/3.8.nix

···
     rm gr-fec/python/fec/qa_polar_encoder.py
     rm gr-fec/python/fec/qa_polar_encoder_systematic.py
     rm gr-filter/python/filter/qa_freq_xlating_fft_filter.py
+    # Failed with libstdc++ from GCC 13
+    rm gr-filter/python/filter/qa_filterbank.py
   '';
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227

pkgs/applications/radio/gnuradio/3.9.nix

···
 { lib, stdenv
+, fetchpatch
 , fetchFromGitHub
 , cmake
 # Remove gcc and python references
···
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.3_9.patch
+    # Fix compilation with GCC 13
+    (fetchpatch {
+      url = "https://github.com/gnuradio/gnuradio/commit/fe1b3592776c26e349e9985d47d3178568dfe6ec.patch";
+      hash = "sha256-bu6fJuUo/i4kM+cZqSw8moB0ymoSVooLfwUIW+WDpWI=";
+    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must

pkgs/applications/science/biology/obitools/obitools3.nix

···
   '';
 
   preBuild = ''
-    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/lib/${python3.libPrefix}/site-packages";
-    export NIX_CFLAGS_COMPILE="-L $out/lib/${python3.libPrefix}/site-packages $NIX_CFLAGS_COMPILE"
+    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/${python3.sitePackages}";
+    export NIX_CFLAGS_COMPILE="-L $out/${python3.sitePackages} $NIX_CFLAGS_COMPILE"
   '';
 
   dontConfigure = true;

pkgs/applications/science/misc/root/default.nix

···
 , lib
 , callPackage
 , fetchurl
-, fetchpatch
 , makeWrapper
 , cmake
 , coreutils
···
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.30.02";
+  version = "6.30.04";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
···
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-eWWkVtGtHuDV/kdpv1qP7Cka9oTtk9sPMICpw2JDUYM=";
+    hash = "sha256-K0GAtpjznMZdkQhNgzqIRRWzJbxfZzyOOavoGLAl2Mw=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
···
 
   patches = [
     ./sw_vers.patch
-
-    # Fix for builtin_llvm=OFF
-    # https://github.com/root-project/root/pull/14238
-    (fetchpatch {
-      url = "https://github.com/root-project/root/commit/1477d3adebf27a19f3a8b85f21c27a0a5649c7ff.diff";
-      hash = "sha256-g+FqXBTWXA7t7F/rMarnmOK2014oCNnNJbHhjH+Tvjw=";
-    })
   ];
 
   preConfigure = ''

pkgs/applications/version-management/gitlab/data.json

···
 {
-  "version": "16.7.4",
-  "repo_hash": "sha256-rUEr9G/5T4yWnNY69I+IpjsVOSmfdL0j0u6et4jkIt8=",
-  "yarn_hash": "1qxz2p969qg7kzyvhwxws5zwdw986gdq9gxllzi58c5c56jz49zf",
+  "version": "16.8.1",
+  "repo_hash": "sha256-95YdEAUYoFDFX4COI6NnI6tDB+NLnihlJdUDM8NixXA=",
+  "yarn_hash": "1yhl4l2dln9ck4nbjjrlyjx17nxk4h12gb5hqjh4dq3rz3az3jvx",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v16.7.4-ee",
+  "rev": "v16.8.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "16.7.4",
-    "GITLAB_PAGES_VERSION": "16.7.4",
-    "GITLAB_SHELL_VERSION": "14.32.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.5.0",
-    "GITLAB_WORKHORSE_VERSION": "16.7.4"
+    "GITALY_SERVER_VERSION": "16.8.1",
+    "GITLAB_PAGES_VERSION": "16.8.1",
+    "GITLAB_SHELL_VERSION": "14.33.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.6.0",
+    "GITLAB_WORKHORSE_VERSION": "16.8.1"
   }
 }

pkgs/applications/version-management/gitlab/default.nix

···
 { stdenv, lib, fetchurl, fetchpatch, fetchFromGitLab, bundlerEnv
 , ruby_3_1, tzdata, git, nettools, nixosTests, nodejs, openssl
+, defaultGemConfig, buildRubyGem
 , gitlabEnterprise ? false, callPackage, yarn
 , prefetch-yarn-deps, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
+, cargo, rustc, rustPlatform
 }:
 
 let
···
     name = "gitlab-env-${version}";
     ruby = ruby_3_1;
     gemdir = ./rubyEnv;
-    gemset =
-      let x = import (gemdir + "/gemset.nix") src;
-      in x // {
-        gpgme = x.gpgme // {
+    gemset = import (gemdir + "/gemset.nix") src;
+    gemConfig = defaultGemConfig // {
+        gpgme = attrs: {
           nativeBuildInputs = [ pkg-config ];
         };
         # the openssl needs the openssl include files
-        openssl = x.openssl // {
+        openssl = attrs: {
           buildInputs = [ openssl ];
         };
-        ruby-magic = x.ruby-magic // {
+        ruby-magic = attrs: {
           buildInputs = [ file ];
           buildFlags = [ "--enable-system-libraries" ];
+        };
+        gitlab-glfm-markdown = attrs: {
+          cargoDeps = rustPlatform.fetchCargoTarball {
+            src = stdenv.mkDerivation {
+              inherit (buildRubyGem { inherit (attrs) gemName version source; })
+                name
+                src
+                unpackPhase
+                nativeBuildInputs
+              ;
+              dontBuilt = true;
+              installPhase = ''
+                cp -R ext/glfm_markdown $out
+                cp Cargo.lock $out
+              '';
+            };
+            hash = "sha256-I5w/roDgnRe5eyXo0wiRcoWPpXEtpL3kOl9eDg99t/w=";
+          };
+
+          dontBuild = false;
+
+          nativeBuildInputs = [
+            cargo
+            rustc
+            rustPlatform.cargoSetupHook
+            rustPlatform.bindgenHook
+          ];
+
+          preInstall = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+          '';
+
+          postInstall = ''
+            mv -v $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib/{glfm_markdown/glfm_markdown.so,}
+          '';
         };
       };
     groups = [

pkgs/applications/version-management/gitlab/gitaly/default.nix

···
 }:
 
 let
-  version = "16.7.4";
+  version = "16.8.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
···
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-4wdMwLsJiQzaZ8PhQz7gYj+dzA+92NFPm0twMdr65qA=";
+      hash = "sha256-yR8O9F6THymKKHbnfh67NhEcNNBz7XHja/fpeTmVoe0=";
     };
 
-    vendorHash = "sha256-btWHZMy1aBSsUVs30IqrdBCO79XQvTMXxkxYURF2Nqs=";
+    vendorHash = "sha256-AkL/BbCrqgXyvfiMxzMIXeZwh5aFL2a2+myk/4YXMNc=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 

pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "4.5.0";
+  version = "4.6.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    sha256 = "sha256-6Y2ARnFjbz6nFhWGRhzgAY8s0aX24oLMY1016oRD9oo=";
+    sha256 = "sha256-HlT3Uj/DWbyK4xGq7SjKjZ90sww6oMiMDo05mtv6rTA=";
   };
 
-  vendorHash = "sha256-jpjfQl2z5yPnlGEYW6KKBfd4quchT+bU/RU6vwaB4gQ=";
+  vendorHash = "sha256-YUH/agSy/shHmHRXlfDtgumbka6BjX5NTxgvlNJS4hQ=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/version-management/gitlab/gitlab-pages/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "16.7.4";
+  version = "16.8.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-6OPpfn+nylTUp7rNI8NqipbHmLmaV0ezE1qrQqHcuqw=";
+    hash = "sha256-Wj15GHm+5Xd5wq4C3dH+i94jh7pecHM6KCDugLm5YAA=";
   };
 
-  vendorHash = "sha256-NMky8v0YmN2pSeKJ7G0+DWAZvUx2JlwFbqPHvciYroM=";
+  vendorHash = "sha256-9yogTSdEij/YwWGm3gz7jMn2AZcI+o7aEnjBvJ8E3vA=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.32.0";
+  version = "14.33.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "sha256-fZttdcIdPeiy2ncDyseR1BnR6GBoSRsFkn7Mxc+mTA8=";
+    sha256 = "sha256-0C3ODs2NElJQ+A6x9lZxSParTZc3q4YqWsw7DxwhODo=";
   };
 
   buildInputs = [ ruby libkrb5 ];
 
   patches = [ ./remove-hardcoded-locations.patch ];
 
-  vendorHash = "sha256-tdYBEV/dKnIJ+OWTF3/5bIbWVdE/ulMrMD/LMzj1QZE=";
+  vendorHash = "sha256-sTAd/AbPx5WzBCzTDLvo/bDZcmz/xVhIhz9nFGBEYx4=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

···
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "16.7.4";
+  version = "16.8.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
···
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-1oeToeqGXSj5CdL5dgWsnN/VpwALlus93P0Ed7G8TIw=";
+  vendorHash = "sha256-OcdfanSlH1ZUmKlhzMOD3oNySx1o92Is7EDf1Z3953A=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

···
 
 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'bootsnap', '~> 1.17.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'bootsnap', '~> 1.17.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'openssl', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'ipaddr', '~> 1.2.5' # rubocop:todo Gemfile/MissingFeatureCategory
···
 gem 'net-ldap', '~> 0.17.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # API
-gem 'grape', '~> 1.7.1', feature_category: :api
+gem 'grape', '~> 2.0.0', feature_category: :api
 gem 'grape-entity', '~> 0.10.0', feature_category: :api
-gem 'grape-swagger', '~> 1.6.1', group: [:development, :test], feature_category: :api
+gem 'grape-swagger', '~> 2.0.1', group: [:development, :test], feature_category: :api
 gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test], feature_category: :api
-gem 'grape-path-helpers', '~> 1.7.1', feature_category: :api
+gem 'grape-path-helpers', '~> 2.0.0', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # GraphQL API
···
 gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-core', '~> 3.190.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-core', '~> 3.190.2' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-s3', '~> 1.141.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.142.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Markdown and HTML processing
-gem 'html-pipeline', '~> 2.14.3' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'deckar01-task_list', '2.3.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'html-pipeline', '~> 2.14.3', feature_category: :team_planning
+gem 'deckar01-task_list', '2.3.3', feature_category: :team_planning
 gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'commonmarker', '~> 0.23.10' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'commonmarker', '~> 0.23.10', feature_category: :team_planning
 gem 'kramdown', '~> 2.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'RedCloth', '~> 4.3.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'org-ruby', '~> 0.9.12' # rubocop:todo Gemfile/MissingFeatureCategory
···
 gem 'asciidoctor-kroki', '~> 0.8.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'rouge', '~> 4.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'truncato', '~> 0.7.12' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'nokogiri', '~> 1.15', '>= 1.15.5' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'nokogiri', '~> 1.16' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-glfm-markdown', '~> 0.0.11', feature_category: :team_planning
 
 # Calendar rendering
 gem 'icalendar' # rubocop:todo Gemfile/MissingFeatureCategory
···
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base' # rubocop:todo Gemfile/MissingFeatureCategory
 
 group :puma do
-  gem 'puma', '~> 6.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'puma', '= 6.4.0', require: false, feature_category: :shared
   gem 'sd_notify', '~> 0.1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 end
 
···
 gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Background jobs
-gem 'sidekiq', '~> 6.5.10' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sidekiq', '~> 7.1.6' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'sidekiq-cron', '~> 1.12.0', feature_category: :shared
 gem 'gitlab-sidekiq-fetcher', path: 'vendor/gems/sidekiq-reliable-fetch', require: 'sidekiq-reliable-fetch' # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 gem 'ruby-progressbar', '~> 1.10' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Linear-time regex library for untrusted regular expressions
-gem 're2', '2.5.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 're2', '2.6.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Misc
 
···
 gem 'connection_pool', '~> 2.4' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Redis session store
-gem 'redis-actionpack', '~> 5.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'redis-actionpack', '~> 5.4.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Discord integration
 gem 'discordrb-webhooks', '~> 3.4', require: false, feature_category: :integrations
···
 
 gem 'premailer-rails', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'gitlab-labkit', '~> 0.34.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-labkit', '~> 0.35.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'thrift', '>= 0.16.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # I18n
···
 
 # Metrics
 gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'prometheus-client-mmap', '~> 1.0', '>= 1.0.2', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'prometheus-client-mmap', '~> 1.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
···
 
   gem 'listen', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'ruby-lsp', "~> 0.13.1", require: false, feature_category: :tooling
+  gem 'ruby-lsp', "~> 0.13.2", require: false, feature_category: :tooling
 
   gem 'ruby-lsp-rails', "~> 0.2.8", feature_category: :tooling
 
···
 group :development, :test do
   gem 'deprecation_toolkit', '~> 1.5.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'bullet', '~> 7.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'parser', '~> 3.2', '>= 3.2.2.4' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'parser', '~> 3.3', '>= 3.3.0.2' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'pry-byebug' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'pry-rails', '~> 0.3.9' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'pry-shell', '~> 0.6.4' # rubocop:todo Gemfile/MissingFeatureCategory
···
   gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
   gem 'database_cleaner-active_record', '~> 2.1.0', feature_category: :database
-  gem 'factory_bot_rails', '~> 6.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'factory_bot_rails', '~> 6.4.3' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'rspec-rails', '~> 6.1.0', feature_category: :shared
 
   # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
···
 
   gem 'gitlab-styles', '~> 11.0.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'haml_lint', '~> 0.52', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'haml_lint', '~> 0.53', require: false # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'bundler-audit', '~> 0.9.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
   # Benchmarking & profiling
···
 
   gem 'sigdump', '~> 0.2.4', require: 'sigdump/setup' # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'pact', '~> 1.63' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'pact', '~> 1.64' # rubocop:todo Gemfile/MissingFeatureCategory
 
   # For now we only use vite in development / test, and not for production builds
   # See: https://gitlab.com/gitlab-org/frontend/rfcs/-/issues/106
···
 end
 
 group :development, :test, :coverage do
-  gem 'simplecov', '~> 0.21', require: false, feature_category: :tooling
+  gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
   gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
   gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
   gem 'undercover', '~> 0.4.4', require: false, feature_category: :tooling
···
   gem 'test-prof', '~> 1.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'rspec_junit_formatter' # rubocop:todo Gemfile/MissingFeatureCategory
   gem 'guard-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'axe-core-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'axe-core-rspec', '~> 4.8.0', feature_category: :tooling
 
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'gitlab_quality-test_tooling', '~> 1.9.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 1.11.0', require: false, feature_category: :tooling
 end
 
 gem 'octokit', '~> 6.0' # rubocop:todo Gemfile/MissingFeatureCategory
···
 
 gem 'grpc', '~> 1.58.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'google-protobuf', '~> 3.25', '>= 3.25.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'google-protobuf', '~> 3.25', '>= 3.25.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'toml-rb', '~> 2.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

···
   remote: gems/gitlab-housekeeper
   specs:
     gitlab-housekeeper (0.1.0)
+      activesupport
       httparty
       rubocop
 
···
       concurrent-ruby (~> 1.2)
       httparty (~> 0.21.0)
       ipaddress (~> 0.8.3)
-      nokogiri (~> 1.15.4)
       railties (~> 7)
 
 PATH
···
   remote: gems/gitlab-safe_request_store
   specs:
     gitlab-safe_request_store (0.1.0)
+      rack (~> 2.2.8)
       request_store
 
 PATH
···
   remote: gems/gitlab-secret_detection
   specs:
     gitlab-secret_detection (0.1.0)
+      parallel (~> 1.22)
       re2 (~> 2.4)
       toml-rb (~> 2.2)
 
···
       actionview (>= 6.1.7.2)
       activesupport (>= 6.1.7.2)
       addressable (~> 2.8)
-      nokogiri (~> 1.15.2)
       rake (~> 13.0)
 
 PATH
···
 PATH
   remote: vendor/gems/sidekiq-reliable-fetch
   specs:
-    gitlab-sidekiq-fetcher (0.10.0)
+    gitlab-sidekiq-fetcher (0.11.0)
       json (>= 2.5)
-      sidekiq (~> 6.1)
+      sidekiq (~> 7.0)
 
 GEM
   remote: https://rubygems.org/
···
     awesome_print (1.9.2)
     awrence (1.2.1)
     aws-eventstream (1.3.0)
-    aws-partitions (1.761.0)
+    aws-partitions (1.877.0)
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.190.0)
+    aws-sdk-core (3.190.2)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.64.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
+    aws-sdk-kms (1.76.0)
+      aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.141.0)
+    aws-sdk-s3 (1.142.0)
       aws-sdk-core (~> 3, >= 3.189.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
     aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    axe-core-api (4.6.0)
+    axe-core-api (4.8.0)
       dumb_delegator
       virtus
-    axe-core-rspec (4.6.0)
+    axe-core-rspec (4.8.0)
       axe-core-api
       dumb_delegator
       virtus
···
     bindata (2.4.11)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.17.0)
+    bootsnap (1.17.1)
       msgpack (~> 1.2)
     browser (5.3.1)
     builder (3.2.4)
···
       jwt (>= 2.5)
     dotenv (2.7.6)
     dry-cli (1.0.0)
-    dry-core (1.0.0)
+    dry-core (1.0.1)
       concurrent-ruby (~> 1.0)
       zeitwerk (~> 2.6)
     dry-inflector (1.0.0)
···
     expression_parser (0.9.0)
     extended-markdown-filter (0.7.0)
       html-pipeline (~> 2.9)
-    factory_bot (6.2.0)
+    factory_bot (6.4.5)
       activesupport (>= 5.0.0)
-    factory_bot_rails (6.2.0)
-      factory_bot (~> 6.2.0)
+    factory_bot_rails (6.4.3)
+      factory_bot (~> 6.4)
       railties (>= 5.0.0)
     faraday (1.10.0)
       faraday-em_http (~> 1.0)
···
       rake
     ffi-yajl (2.6.0)
       libyajl2 (>= 1.2)
-    filelock (1.1.1)
     find_a_port (1.0.1)
     flipper (0.26.2)
       concurrent-ruby (< 2)
···
       fog-core (= 2.1.0)
       fog-json (~> 1.2.0)
       mime-types
-    gitlab-labkit (0.34.0)
+    gitlab-glfm-markdown (0.0.11)
+      rb_sys (~> 0.9.86)
+    gitlab-labkit (0.35.0)
       actionpack (>= 5.0.0, < 8.0.0)
       activesupport (>= 5.0.0, < 8.0.0)
       grpc (>= 1.37)
       jaeger-client (~> 1.1.0)
       opentracing (~> 0.4)
-      pg_query (~> 4.2.3)
+      pg_query (>= 4.2.3, < 6.0)
       redis (> 3.0.0, < 6.0.0)
     gitlab-license (2.3.0)
     gitlab-mail_room (0.0.24)
···
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (1.9.0)
+    gitlab_quality-test_tooling (1.11.0)
       activesupport (>= 6.1, < 7.2)
       amatch (~> 0.4.1)
       gitlab (~> 4.19)
···
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    google-protobuf (3.25.1)
+    google-protobuf (3.25.2)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
···
       signet (>= 0.16, < 2.a)
     gpgme (2.0.23)
       mini_portile2 (~> 2.7)
-    grape (1.7.1)
-      activesupport
+    grape (2.0.0)
+      activesupport (>= 5)
       builder
       dry-types (>= 1.1)
       mustermann-grape (~> 1.0.0)
-      rack (>= 1.3.0, < 3)
+      rack (>= 1.3.0)
       rack-accept
     grape-entity (0.10.0)
       activesupport (>= 3.0.0)
       multi_json (>= 1.3.2)
-    grape-path-helpers (1.7.1)
+    grape-path-helpers (2.0.1)
       activesupport
-      grape (~> 1.3)
+      grape (~> 2.0)
       rake (> 12)
       ruby2_keywords (~> 0.0.2)
-    grape-swagger (1.6.1)
-      grape (~> 1.3)
+    grape-swagger (2.0.1)
+      grape (>= 1.7, < 3.0)
+      rack-test (~> 2)
     grape-swagger-entity (0.5.1)
       grape-entity (>= 0.6.0)
       grape-swagger (>= 1.2.0)
···
     haml (5.2.2)
       temple (>= 0.8.0)
       tilt
-    haml_lint (0.52.0)
-      haml (>= 4.0)
+    haml_lint (0.53.0)
+      haml (>= 5.0)
       parallel (~> 1.10)
       rainbow
       rubocop (>= 1.0)
···
       net-protocol
     net-ssh (7.2.0)
     netrc (0.11.0)
-    nio4r (2.5.8)
+    nio4r (2.7.0)
     no_proxy_fix (0.1.2)
-    nokogiri (1.15.5)
+    nokogiri (1.16.0)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
···
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (1.1.4)
-    pact (1.63.0)
+    pact (1.64.0)
       pact-mock_service (~> 3.0, >= 3.3.1)
       pact-support (~> 1.16, >= 1.16.9)
       rack-test (>= 0.6.3, < 3.0.0)
       rspec (~> 3.0)
-      term-ansicolor (~> 1.0)
+      term-ansicolor (~> 1.7)
       thor (>= 0.20, < 2.0)
-      webrick (~> 1.3)
-    pact-mock_service (3.10.0)
-      filelock (~> 1.1)
+      webrick (~> 1.8)
+    pact-mock_service (3.11.2)
       find_a_port (~> 1.0.1)
       json
       pact-support (~> 1.16, >= 1.16.4)
       rack (~> 2.0)
       rspec (>= 2.14)
-      term-ansicolor (~> 1.0)
       thor (>= 0.19, < 2.0)
-      webrick (~> 1.3)
-    pact-support (1.18.1)
+      webrick (~> 1.8)
+    pact-support (1.20.0)
       awesome_print (~> 1.9)
-      diff-lcs (~> 1.4)
+      diff-lcs (~> 1.5)
       expgen (~> 0.1)
       rainbow (~> 3.1.1)
     parallel (1.22.1)
-    parser (3.2.2.4)
+    parser (3.3.0.2)
       ast (~> 2.4.1)
       racc
     parslet (1.8.2)
···
     prime (0.1.2)
       forwardable
       singleton
-    prism (0.18.0)
+    prism (0.19.0)
     proc_to_ast (0.1.0)
       coderay
       parser
       unparser
-    prometheus-client-mmap (1.0.2)
-      rb_sys (~> 0.9)
+    prometheus-client-mmap (1.1.0)
+      rb_sys (~> 0.9.86)
     protocol (2.0.0)
       ruby_parser (~> 3.0)
     pry (0.14.2)
···
       rack
     rack-proxy (0.7.7)
       rack
+    rack-session (1.0.2)
+      rack (< 3)
     rack-test (2.1.0)
       rack (>= 1.3)
     rack-timeout (0.6.3)
···
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.5.0)
-      loofah (~> 2.19, >= 2.19.1)
+    rails-html-sanitizer (1.6.0)
+      loofah (~> 2.21)
+      nokogiri (~> 1.14)
     rails-i18n (7.0.3)
       i18n (>= 0.7, < 2)
       railties (>= 6.0.0, < 8)
···
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rb_sys (0.9.83)
+    rb_sys (0.9.86)
     rbtrace (0.4.14)
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
       optimist (>= 3.0.0)
     rbtree (0.4.6)
     rchardet (1.8.0)
-    re2 (2.5.0)
+    re2 (2.6.0)
       mini_portile2 (~> 2.8.5)
     recaptcha (5.12.3)
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.6.0)
     redis (4.8.0)
-    redis-actionpack (5.3.0)
+    redis-actionpack (5.4.0)
       actionpack (>= 5, < 8)
-      redis-rack (>= 2.1.0, < 3)
+      redis-rack (>= 2.1.0, < 4)
       redis-store (>= 1.1.0, < 2)
+    redis-client (0.19.0)
+      connection_pool
     redis-namespace (1.10.0)
       redis (>= 4)
-    redis-rack (2.1.4)
-      rack (>= 2.0.8, < 3)
+    redis-rack (3.0.0)
+      rack-session (>= 0.2.0)
       redis-store (>= 1.2, < 2)
-    redis-store (1.9.1)
-      redis (>= 4, < 5)
+    redis-store (1.10.0)
+      redis (>= 4, < 6)
     regexp_parser (2.6.0)
     regexp_property_values (1.0.0)
     representable (3.2.0)
···
     ruby-fogbugz (0.3.0)
       crack (~> 0.4)
       multipart-post (~> 2.0)
-    ruby-lsp (0.13.1)
+    ruby-lsp (0.13.2)
       language_server-protocol (~> 3.17.0)
-      prism (>= 0.18.0, < 0.19)
+      prism (>= 0.19.0, < 0.20)
       sorbet-runtime (>= 0.5.5685)
     ruby-lsp-rails (0.2.8)
       actionpack (>= 6.0)
···
     shellany (0.0.1)
     shoulda-matchers (5.1.0)
       activesupport (>= 5.2.0)
-    sidekiq (6.5.12)
-      connection_pool (>= 2.2.5, < 3)
-      rack (~> 2.0)
-      redis (>= 4.5.0, < 5)
+    sidekiq (7.1.6)
+      concurrent-ruby (< 2)
+      connection_pool (>= 2.3.0)
+      rack (>= 2.2.4)
+      redis-client (>= 0.14.0)
     sidekiq-cron (1.12.0)
       fugit (~> 1.8)
       globalid (>= 1.0.1)
···
     unparser (0.6.7)
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
-    uri (0.12.2)
+    uri (0.13.0)
     uri_template (0.7.0)
     valid_email (0.1.3)
       activemodel
···
   autoprefixer-rails (= 10.2.5.1)
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.190.0)
-  aws-sdk-s3 (~> 1.141.0)
-  axe-core-rspec
+  aws-sdk-core (~> 3.190.2)
+  aws-sdk-s3 (~> 1.142.0)
+  axe-core-rspec (~> 4.8.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
   batch-loader (~> 2.0.1)
···
   benchmark-ips (~> 2.11.0)
   benchmark-memory (~> 0.1)
   better_errors (~> 2.10.1)
-  bootsnap (~> 1.17.0)
+  bootsnap (~> 1.17.1)
   browser (~> 5.3.1)
   bullet (~> 7.1.2)
   bundler-audit (~> 0.9.1)
···
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   error_tracking_open_api!
-  factory_bot_rails (~> 6.2.0)
+  factory_bot_rails (~> 6.4.3)
   faraday (~> 1.0)
   faraday_middleware-aws-sigv4 (~> 0.3.0)
   fast_blank (~> 1.0.1)
···
   gitlab-dangerfiles (~> 4.6.0)
   gitlab-experiment (~> 0.9.1)
   gitlab-fog-azure-rm (~> 1.8.0)
+  gitlab-glfm-markdown (~> 0.0.11)
   gitlab-housekeeper!
   gitlab-http!
-  gitlab-labkit (~> 0.34.0)
+  gitlab-labkit (~> 0.35.0)
   gitlab-license (~> 2.3)
   gitlab-mail_room (~> 0.0.24)
   gitlab-markup (~> 1.9.0)
···
   gitlab-utils!
   gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 1.9.0)
+  gitlab_quality-test_tooling (~> 1.11.0)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
···
   google-apis-sqladmin_v1beta4 (~> 0.41.0)
   google-apis-storage_v1 (~> 0.29)
   google-cloud-storage (~> 1.45.0)
-  google-protobuf (~> 3.25, >= 3.25.1)
+  google-protobuf (~> 3.25, >= 3.25.2)
   gpgme (~> 2.0.23)
-  grape (~> 1.7.1)
+  grape (~> 2.0.0)
   grape-entity (~> 0.10.0)
-  grape-path-helpers (~> 1.7.1)
-  grape-swagger (~> 1.6.1)
+  grape-path-helpers (~> 2.0.0)
+  grape-swagger (~> 2.0.1)
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8)
   graphiql-rails (~> 1.8.0)
···
   grpc (~> 1.58.0)
   gssapi (~> 1.3.1)
   guard-rspec
-  haml_lint (~> 0.52)
+  haml_lint (~> 0.53)
   hamlit (~> 2.15.0)
   hashie (~> 5.0.0)
   health_check (~> 3.0)
···
   net-ldap (~> 0.17.1)
   net-ntp
   net-protocol (~> 0.1.3)
-  nokogiri (~> 1.15, >= 1.15.5)
+  nokogiri (~> 1.16)
   oauth2 (~> 2.0)
   octokit (~> 6.0)
   ohai (~> 18.1)
···
   openssl (~> 3.0)
   org-ruby (~> 0.9.12)
   os (~> 1.1)
-  pact (~> 1.63)
+  pact (~> 1.64)
   parallel (~> 1.19)
-  parser (~> 3.2, >= 3.2.2.4)
+  parser (~> 3.3, >= 3.3.0.2)
   parslet (~> 1.8)
   peek (~> 1.1)
   pg (~> 1.5.4)
   pg_query (~> 4.2.3)
   png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 1.0, >= 1.0.2)
+  prometheus-client-mmap (~> 1.1)
   pry-byebug
   pry-rails (~> 0.3.9)
   pry-shell (~> 0.6.4)
-  puma (~> 6.4)
+  puma (= 6.4.0)
   rack (~> 2.2.8)
   rack-attack (~> 6.7.0)
   rack-cors (~> 2.0.1)
···
   rails-i18n (~> 7.0)
   rainbow (~> 3.0)
   rbtrace (~> 0.4)
-  re2 (= 2.5.0)
+  re2 (= 2.6.0)
   recaptcha (~> 5.12)
   redis (~> 4.8.0)
-  redis-actionpack (~> 5.3.0)
+  redis-actionpack (~> 5.4.0)
   redis-namespace (~> 1.10.0)
   request_store (~> 1.5.1)
   responders (~> 3.0)
···
   rspec_profiling (~> 0.0.6)
   rubocop
   ruby-fogbugz (~> 0.3.0)
-  ruby-lsp (~> 0.13.1)
+  ruby-lsp (~> 0.13.2)
   ruby-lsp-rails (~> 0.2.8)
   ruby-lsp-rspec (~> 0.1.8)
   ruby-magic (~> 0.6)
···
   sentry-ruby (~> 5.10.0)
   sentry-sidekiq (~> 5.10.0)
   shoulda-matchers (~> 5.1.0)
-  sidekiq (~> 6.5.10)
+  sidekiq (~> 7.1.6)
   sidekiq-cron (~> 1.12.0)
   sigdump (~> 0.2.4)
   simple_po_parser (~> 1.1.6)
-  simplecov (~> 0.21)
+  simplecov (~> 0.22)
   simplecov-cobertura (~> 2.1.0)
   simplecov-lcov (~> 0.8.0)
   slack-messenger (~> 2.3.4)
···
   yajl-ruby (~> 1.4.3)
 
 BUNDLED WITH
-   2.4.22
+   2.5.4

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1whf6ppvdibfpsr660ajncig3hyc6q9dvnx645ajrjfz3r7487i9";
+      sha256 = "1zcwrlg4in3gzvsiynpzp9fzlr5grrhc2881xcgfs01ppmxysllm";
       type = "gem";
     };
-    version = "1.761.0";
+    version = "1.877.0";
   };
   aws-sdk-cloudformation = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19nglxz49nlzgsvnivb3bdm17vxjn1ng2br8659xv48nzjrmyid3";
+      sha256 = "0z9f8ypvpwj3sfqh3nlnhrq7ryhrv7isqzg370fba27zpy7bv5sx";
       type = "gem";
     };
-    version = "3.190.0";
+    version = "3.190.2";
   };
   aws-sdk-kms = {
     dependencies = ["aws-sdk-core" "aws-sigv4"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bcm0c9f7xy5qj5f0z3gddqslhb2vzrj9smc39pgqyq4jmn5kpj0";
+      sha256 = "0jfgw9a9c8xyjhkmgpd9rpi95h9i0rhbqszn8iqkbfm9rc9m1xz7";
       type = "gem";
     };
-    version = "1.64.0";
+    version = "1.76.0";
   };
   aws-sdk-s3 = {
     dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bnhpmi0iiaj88rqc5lhhnp2gyrk4fs8xz51lj36wwzng94qinya";
+      sha256 = "1sfpipfdmixpc0madfx1yvpwpv52fdhxfx4bmvrjxzb6ra78ikbr";
       type = "gem";
     };
-    version = "1.141.0";
+    version = "1.142.0";
   };
   aws-sigv4 = {
     dependencies = ["aws-eventstream"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qkcia7yg50j0ycmzqnl2dzzz9a35wlg5fk30g0qs41z6p1xw38v";
+      sha256 = "0bx67lskxslfd2mpim3kqrxa4sx4qhvnpjpr57j1ll2xppyl9kw8";
       type = "gem";
     };
-    version = "4.6.0";
+    version = "4.8.0";
   };
   axe-core-rspec = {
     dependencies = ["axe-core-api" "dumb_delegator" "virtus"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zvlrnxcyam2574gzn44r0ibz4h0s9j3vrp5lixi731qvp4mphhi";
+      sha256 = "07niarqd2lrbgnw00biyigc48lbdv4vy68p57myliz7k82nizidj";
       type = "gem";
     };
-    version = "4.6.0";
+    version = "4.8.0";
   };
   axiom-types = {
     dependencies = ["descendants_tracker" "ice_nine" "thread_safe"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iqkzby0fdgi786m873nm0ckmc847wy9a4ydinb29m7hd3fs83kb";
+      sha256 = "028qif22isxa5sg5gf1322d0qjhir5rr0jpkaiwcic4lspacdcnv";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.17.1";
   };
   browser = {
     groups = ["default"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01gks2hrp7nl3pzb487azvd25dlbrc40d5cpk4n0szwnf2c0k4ks";
+      sha256 = "03a5qn74c4lk2rpy6wlhv66synjlyzc4wn086xzphkpmw12l4bzk";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   dry-inflector = {
     groups = ["default" "development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04vxmjr200akcil9fqxc9ghbb9q0lyrh2q03xxncycd5vln910fi";
+      sha256 = "1glq677vmd3xrdilcx6ar8sdaysm9ldrppg34yzw43jzr6dx47fp";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.4.5";
   };
   factory_bot_rails = {
     dependencies = ["factory_bot" "railties"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18fhcihkc074gk62iwqgbdgc3ymim4fm0b4p3ipffy5hcsb9d2r7";
+      sha256 = "1j6w4rr2cb5wng9yrn2ya9k40q52m0pbz47kzw8xrwqg3jncwwza";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.4.3";
   };
   faraday = {
     dependencies = ["faraday-em_http" "faraday-em_synchrony" "faraday-excon" "faraday-httpclient" "faraday-multipart" "faraday-net_http" "faraday-net_http_persistent" "faraday-patron" "faraday-rack" "faraday-retry" "ruby2_keywords"];
···
       type = "gem";
     };
     version = "2.6.0";
-  };
-  filelock = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "085vrb6wf243iqqnrrccwhjd4chphfdsybkvjbapa2ipfj1ja1sj";
-      type = "gem";
-    };
-    version = "1.1.1";
   };
   find_a_port = {
     groups = ["default" "development" "test"];
···
     };
     version = "1.8.0";
   };
+  gitlab-glfm-markdown = {
+    dependencies = ["rb_sys"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z0h4bvfvlwyfx8ia03lr9dlpy38n75v2wxh424v6fhy4z08ycab";
+      type = "gem";
+    };
+    version = "0.0.11";
+  };
   gitlab-housekeeper = {
-    dependencies = ["httparty" "rubocop"];
+    dependencies = ["activesupport" "httparty" "rubocop"];
     groups = ["development" "test"];
     platforms = [];
     source = {
···
     version = "0.1.0";
   };
   gitlab-http = {
-    dependencies = ["activesupport" "concurrent-ruby" "httparty" "ipaddress" "nokogiri" "railties"];
+    dependencies = ["activesupport" "concurrent-ruby" "httparty" "ipaddress" "railties"];
     groups = ["default"];
     platforms = [];
     source = {
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1k9yd8b1xbq3l6l1n4pb0mh2wklz0ninr7h2l5xx031r05150p6a";
+      sha256 = "0ya6r3ij0fzz6p50h157bn224n7405nwak6lx80ppvil9sm0dzr6";
       type = "gem";
     };
-    version = "0.34.0";
+    version = "0.35.0";
   };
   gitlab-license = {
     groups = ["default"];
···
     version = "0.1.0";
   };
   gitlab-safe_request_store = {
-    dependencies = ["request_store"];
+    dependencies = ["rack" "request_store"];
     groups = ["default"];
     platforms = [];
     source = {
···
     version = "0.2.3";
   };
   gitlab-secret_detection = {
-    dependencies = ["re2" "toml-rb"];
+    dependencies = ["parallel" "re2" "toml-rb"];
     groups = ["default"];
     platforms = [];
     source = {
···
       path = "${src}/vendor/gems/sidekiq-reliable-fetch";
       type = "path";
     };
-    version = "0.10.0";
+    version = "0.11.0";
   };
   gitlab-styles = {
     dependencies = ["rubocop" "rubocop-graphql" "rubocop-performance" "rubocop-rails" "rubocop-rspec"];
···
     version = "11.0.0";
   };
   gitlab-utils = {
-    dependencies = ["actionview" "activesupport" "addressable" "nokogiri" "rake"];
+    dependencies = ["actionview" "activesupport" "addressable" "rake"];
     groups = ["monorepo"];
     platforms = [];
     source = {
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18m35p6kizkaw829lwvh6mc7r8q94gmyhkq9qggx7r78h8iafiqd";
+      sha256 = "0anhwfn9dnd8zkjwkq3qycjswfxqksfnwvl7dr6azz2zvjnxnii1";
       type = "gem";
     };
-    version = "1.9.0";
+    version = "1.11.0";
   };
   globalid = {
     dependencies = ["activesupport"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18yiqq657lbqbrbdfbxfspdrkiynd0wf49l3cgdw939z36cy0h77";
+      sha256 = "02sh4rp14wmpfv9r7xrap6xgcakg0lk6zjvq1gsi5y38swhn2blw";
       type = "gem";
     };
-    version = "3.25.1";
+    version = "3.25.2";
   };
   googleapis-common-protos = {
     dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dnbb3gxwbmvhzvzb22prwaim9wmvilm0nm91ndw2ggf324rsrvb";
+      sha256 = "0jj98w80ry1ir8lc3347130s0z8yd7gk727r9ynwwk782x6gkvrs";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "2.0.0";
   };
   grape-entity = {
     dependencies = ["activesupport" "multi_json"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ql1acy68n9xkvjzda1vpscf20zqqwjm959b7cx3w1yl40d2f9rf";
+      sha256 = "1mq2cwy0jvprq3wdilds1n865jdl58sqg00im4w6fybf5kjiclmd";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "2.0.1";
   };
   grape-swagger = {
-    dependencies = ["grape"];
+    dependencies = ["grape" "rack-test"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17y6smk7shplblgic4jvi5njhd0x91n1xrvds3l6cjsjfs2d7lhg";
+      sha256 = "1467ni6f0yy4z3qldjs8x0h50n9ym6zyjbx5gqqzbq6zhvgbx40g";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "2.0.1";
   };
   grape-swagger-entity = {
     dependencies = ["grape-entity" "grape-swagger"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1shlh68vjqyj092ig2b571anbr5npg8kp66a7cq5h9a1387nnckn";
+      sha256 = "060vz5dx0ag3ggpwhwfcadfim0g8aabl0b1dvnzagizymfsw2g92";
       type = "gem";
     };
-    version = "0.52.0";
+    version = "0.53.0";
   };
   hamlit = {
     dependencies = ["temple" "thor" "tilt"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xk64wghkscs6bv2n22853k2nh39d131c6rfpnlw12mbjnnv9v1v";
+      sha256 = "0xkjz56qc7hl7zy7i7bhiyw5pl85wwjsa4p70rj6s958xj2sd1lm";
       type = "gem";
     };
-    version = "2.5.8";
+    version = "2.7.0";
   };
   no_proxy_fix = {
     groups = ["default" "development"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "004ip9x9281fxhpipwi8di1sb1dnabscq9dy1p3cxgdwbniqqi12";
+      sha256 = "1l8b0i24h4irivyhwy9xmkjbggw86cxkzkiqdqg0jpcp9qc8h4rl";
       type = "gem";
     };
-    version = "1.15.5";
+    version = "1.16.0";
   };
   notiffany = {
     dependencies = ["nenv" "shellany"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ldi3j95dh3c29w4bliykfdd08r95d4zvbdblk385w9b4knr2afc";
+      sha256 = "1a3fbwzzzdsbzipv63mcq1q761mqc6w8k1vxkbrbf3aqi2489p8b";
       type = "gem";
     };
-    version = "1.63.0";
+    version = "1.64.0";
   };
   pact-mock_service = {
-    dependencies = ["filelock" "find_a_port" "json" "pact-support" "rack" "rspec" "term-ansicolor" "thor" "webrick"];
+    dependencies = ["find_a_port" "json" "pact-support" "rack" "rspec" "thor" "webrick"];
     groups = ["default" "development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09syv4y0g0pvjshxj8i0yg7mrvszgp503is1b78k86bgv6wc73l9";
+      sha256 = "0lds3xpkrx91lm74pa3n5167c8mkmqyki9axj7bjj0m18r2ybna2";
       type = "gem";
     };
-    version = "3.10.0";
+    version = "3.11.2";
   };
   pact-support = {
     dependencies = ["awesome_print" "diff-lcs" "expgen" "rainbow"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xh4idg0m1mr0pkywj5f79nlr4g6n4waism86gj34h8wicf9c9aa";
+      sha256 = "0waq8ywxhljm5sjk7m3q7f6s2pvcfshg3ncs9dl7kcsg2ail7hs1";
       type = "gem";
     };
-    version = "1.18.1";
+    version = "1.20.0";
   };
   parallel = {
     groups = ["development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r69dbh6h6j4d54isany2ir4ni4gf2ysvk3k44awi6amz18nggpd";
+      sha256 = "181faqz59p2mbfab5q4l1r298pq0nxl0k85rjcb58g0lardmv321";
       type = "gem";
     };
-    version = "3.2.2.4";
+    version = "3.3.0.2";
   };
   parslet = {
     groups = ["default" "development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "172qxf1zyrhxzwbn4c7gz12zdyb1jkdqrqvb2c7863lmxp53rrxs";
+      sha256 = "0qiv9irrca2la1awqgvzsg7a17z2nydqyq43w4fhapdkq2l7xwa7";
       type = "gem";
     };
-    version = "0.18.0";
+    version = "0.19.0";
   };
   proc_to_ast = {
     dependencies = ["coderay" "parser" "unparser"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xfy4g3bwgqb1hn948aw3zfwxvak3886gxdyf0cnajzjfp9z33pq";
+      sha256 = "19mi424kwalrzdm7cvzjx2w0rw778mxqb75y9wn20nc277nxglvb";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.1.0";
   };
   protocol = {
     dependencies = ["ruby_parser"];
···
     };
     version = "0.7.7";
   };
+  rack-session = {
+    dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xhxhlsz6shh8nm44jsmd9276zcnyzii364vhcvf0k8b8bjia8d0";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
   rack-test = {
     dependencies = ["rack"];
     groups = ["default" "development" "test"];
···
     version = "2.0.3";
   };
   rails-html-sanitizer = {
-    dependencies = ["loofah"];
-    groups = ["default" "development" "test"];
+    dependencies = ["loofah" "nokogiri"];
+    groups = ["default" "development" "monorepo" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ygav4xyq943qqyhjmi3mzirn180j565mc9h5j4css59x1sn0cmz";
+      sha256 = "1pm4z853nyz1bhhqr7fzl44alnx4bjachcr6rh6qjj375sfz3sc6";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.0";
   };
   rails-i18n = {
     dependencies = ["i18n" "railties"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pj5qq4phswviw9vybvz4ql5921ddxkkmn9iywm992x0kbvhvn0f";
+      sha256 = "131sa2jvc7b1yld3nzc0xq7lvwvql7b8c09i0xv2brzjybammlv5";
       type = "gem";
     };
-    version = "0.9.83";
+    version = "0.9.86";
   };
   rbtrace = {
     dependencies = ["ffi" "msgpack" "optimist"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ih6igmfcb4b9a8hd46ggn85zfyclz9h828d0xafy2pq5qlz9fs2";
+      sha256 = "0sj80r3gy4sb27mrgc6pwcf2lra669p8p81axdv2p5pfm6k3mqbq";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.6.0";
   };
   recaptcha = {
     dependencies = ["json"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h4iq67p5jjkg9kny7ki6yzkivyakmhbp6ckkhl6mlnriw5avc9z";
+      sha256 = "0h1mx8shrzpcj27k9kw77f4cq7i217vxfd1ksqb4g485md4zc37i";
       type = "gem";
     };
-    version = "5.3.0";
+    version = "5.4.0";
+  };
+  redis-client = {
+    dependencies = ["connection_pool"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k9jaqsdc2s2qm713pdv19dawk1b11vxnfclsps7ra2szwisznbf";
+      type = "gem";
+    };
+    version = "0.19.0";
   };
   redis-namespace = {
     dependencies = ["redis"];
···
     version = "1.10.0";
   };
   redis-rack = {
-    dependencies = ["rack" "redis-store"];
+    dependencies = ["rack-session" "redis-store"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0k3pn706wnf7lb24l6hwsi00c8rx693hvgfnccw3qj1y635ywwh8";
+      sha256 = "10438w0y1jbgr205zndvmz6md0mrqazh2j9fr88lvb8hms10pddb";
       type = "gem";
     };
-    version = "2.1.4";
+    version = "3.0.0";
   };
   redis-store = {
     dependencies = ["redis"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0787fwmlvpx5k360dxlcs8r7vijgl2iyvh3zyvl7qyvgshw78k3v";
+      sha256 = "17mhr1g3lmacrgjndbmrklngy32g55165n53111q70kykx7qjn7j";
       type = "gem";
     };
-    version = "1.9.1";
+    version = "1.10.0";
   };
   regexp_parser = {
     groups = ["default" "development" "test"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zsd9ax4xzk8y1hflzbmfq1l0fpflwqhrggd8x2f4j9ap6z464lg";
+      sha256 = "1g1vdas991rv6lrjppjxjbfyzif4jxbncrcg9shgzrmibzilbnwr";
       type = "gem";
     };
-    version = "0.13.1";
+    version = "0.13.2";
   };
   ruby-lsp-rails = {
     dependencies = ["actionpack" "activerecord" "railties" "ruby-lsp" "sorbet-runtime"];
···
     version = "5.1.0";
   };
   sidekiq = {
-    dependencies = ["connection_pool" "rack" "redis"];
+    dependencies = ["concurrent-ruby" "connection_pool" "rack" "redis-client"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zqr9is8y7mg5dfs1q8w5jl9spwvqkhbi9r6np8208n40hi3pydl";
+      sha256 = "18j3g31ps6ga9nzza0z0d00qjrn810fhkhx2pqi3rvxwsmkdlnbq";
       type = "gem";
     };
-    version = "6.5.12";
+    version = "7.1.6";
   };
   sidekiq-cron = {
     dependencies = ["fugit" "globalid" "sidekiq"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fa49cdssxllj1j37a56kq27wsibx5lmqxkqdk1rz3452y0bsydy";
+      sha256 = "094gk72ckazf495qc76gk09b5i318d5l9m7bicg2wxlrjcm3qm96";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "0.13.0";
   };
   uri_template = {
     groups = ["default"];

pkgs/applications/version-management/mercurial/default.nix

···
       cp contrib/hgk $out/bin
       cat >> $out/etc/mercurial/hgrc << EOF
       [extensions]
-      hgk=$out/lib/${python.libPrefix}/site-packages/hgext/hgk.py
+      hgk=$out/${python.sitePackages}/hgext/hgk.py
       EOF
       # setting HG so that hgk can be run itself as well (not only hg view)
       WRAP_TK=" --set TK_LIBRARY ${tk}/lib/${tk.libPrefix}

pkgs/applications/virtualization/docker/default.nix

···
           url = "https://github.com/moby/moby/pull/43136.patch";
           hash = "sha256-1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
         })
+      ] ++ lib.optionals (lib.versions.major version == "24") [
+        # docker_24 has LimitNOFILE set to "infinity", which causes a wide variety of issues in containers.
+        # Issues range from higher-than-usual ressource usage, to containers not starting at all.
+        # This patch (part of the release candidates for docker_25) simply removes this unit option
+        # making systemd use its default "1024:524288", which is sane. See commit message and/or the PR for
+        # more details: https://github.com/moby/moby/pull/45534
+        (fetchpatch {
+          name = "LimitNOFILE-systemd-default.patch";
+          url = "https://github.com/moby/moby/pull/45534/commits/c8930105bc9fc3c1a8a90886c23535cc6c41e130.patch";
+          hash = "sha256-nyGLxFrJaD0TrDqsAwOD6Iph0aHcFH9sABj1Fy74sec=";
+        })
       ];
 
       postPatch = ''

pkgs/build-support/testers/hasPkgConfigModules/tester.nix

···
     for moduleName in $moduleNames; do
       echo "checking pkg-config module $moduleName in $buildInputs"
       set +e
-      version="$(pkg-config --modversion $moduleName)"
+      version="$($PKG_CONFIG --modversion $moduleName)"
       r=$?
       set -e
       if [[ $r = 0 ]]; then
···
         printf '%s\t%s\n' "$moduleName" "$version" >> "$out"
       else
         echo "These modules were available in the input propagation closure:"
-        pkg-config --list-all
+        $PKG_CONFIG --list-all
         echo "❌ pkg-config module $moduleName was not found"
         false
       fi

pkgs/by-name/al/alsa-lib-with-plugins/package.nix

···
+{ lib
+, pkgs
+, alsa-lib
+, plugins ? [ pkgs.alsa-plugins ]
+, lndir
+, symlinkJoin
+, runCommand
+}:
+let
+  merged = symlinkJoin { name = "alsa-plugins-merged"; paths = plugins; };
+in
+runCommand "${alsa-lib.pname}-${alsa-lib.version}" {
+  meta = with lib; {
+    description = "wrapper to ease access to ALSA plugins";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ gm6k ];
+  };
+  outputs = alsa-lib.outputs;
+} (
+    (
+      lib.concatMapStringsSep "\n" (
+        output: ''
+          mkdir ${builtins.placeholder output}
+          ${lndir}/bin/lndir ${lib.attrByPath [output] null alsa-lib} \
+            ${builtins.placeholder output}
+        ''
+      ) alsa-lib.outputs
+    ) + ''
+    cp -r ${merged}/lib/alsa-lib $out/lib
+    (
+      echo $out | wc -c
+      echo ${alsa-lib} | wc -c
+    ) | xargs echo | grep -q "^\(.*\) \1$" || (
+      echo cannot binary patch
+      exit 1
+    )
+    rm $out/lib/libasound.la
+    rm $out/lib/libasound.so.?.?.?
+    rm $dev/lib/pkgconfig/alsa.pc
+    rm $dev/nix-support/propagated-build-inputs
+    cp ${alsa-lib}/lib/libasound.la $out/lib
+    cp ${alsa-lib}/lib/libasound.so.?.?.? $out/lib
+    cp ${alsa-lib.dev}/lib/pkgconfig/alsa.pc $dev/lib/pkgconfig
+    cp ${alsa-lib.dev}/nix-support/propagated-build-inputs $dev/nix-support
+    sed -i \
+        $out/lib/libasound.la \
+        $out/lib/libasound.so.?.?.? \
+        $dev/lib/pkgconfig/alsa.pc \
+        $dev/nix-support/propagated-build-inputs \
+      -e "s@${alsa-lib}@$out@g"
+  ''
+)

pkgs/by-name/an/anytype/package.nix

···
 
 let
   pname = "anytype";
-  version = "0.37.3";
+  version = "0.38.0";
   name = "Anytype-${version}";
-  nameExecutable = pname;
   src = fetchurl {
     url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-W3p67L07XOEtXYluI+TvggXBdaNRadypZc9MO6QTh4M=";
+    hash = "sha256-tcAOj7omrhyyG8elnAvbj/FtYaYOBeBkclpPHhSoass=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
-in
-appimageTools.wrapType2 {
+in appimageTools.wrapType2 {
   inherit name src;
 
   extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs)

pkgs/by-name/au/authentik/ldap.nix

···
+{ lib, buildGoModule, authentik }:
+
+buildGoModule {
+  pname = "authentik-ldap-outpost";
+  inherit (authentik) version src;
+
+  vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+  CGO_ENABLED = 0;
+
+  subPackages = [ "cmd/ldap" ];
+
+  meta = authentik.meta // {
+    description = "The authentik ldap outpost. Needed for the extendal ldap API.";
+    homepage = "https://goauthentik.io/docs/providers/ldap/";
+    mainProgram = "ldap";
+  };
+}

pkgs/by-name/au/authentik/outposts.nix

···
+{ callPackage }:
+
+{
+  ldap = callPackage ./ldap.nix { };
+}

pkgs/by-name/au/authentik/package.nix

···
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, buildNpmPackage
+, buildGoModule
+, runCommand
+, openapi-generator-cli
+, nodejs
+, python3
+, codespell
+, makeWrapper }:
+
+let
+  version = "2023.10.7";
+
+  src = fetchFromGitHub {
+    owner = "goauthentik";
+    repo = "authentik";
+    rev = "version/${version}";
+    hash = "sha256-+1IdXRt28UZ2KTa0zsmjneNUOcutP99UUwqcYyVyqTI=";
+  };
+
+  meta = with lib; {
+    description = "The authentication glue you need";
+    changelog = "https://github.com/goauthentik/authentik/releases/tag/version%2F${version}";
+    homepage = "https://goauthentik.io/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jvanbruegge ];
+  };
+
+  website = buildNpmPackage {
+    pname = "authentik-website";
+    inherit version src meta;
+    npmDepsHash = "sha256-4dgFxEvMnp+35nSQNsEchtN1qoS5X2KzEbLPvMnyR+k=";
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    postPatch = ''
+      cd website
+    '';
+
+    installPhase = ''
+      cp -r help $out
+    '';
+
+    npmInstallFlags = [ "--include=dev" ];
+    npmBuildScript = "build-docs-only";
+  };
+
+  clientapi = stdenvNoCC.mkDerivation {
+    pname = "authentik-client-api";
+    inherit version src meta;
+
+    postPatch = ''
+      rm Makefile
+
+      substituteInPlace ./scripts/api-ts-config.yaml \
+        --replace-fail '/local' "$(pwd)/"
+    '';
+
+    nativeBuildInputs = [ openapi-generator-cli ];
+    buildPhase = ''
+      runHook preBuild
+      openapi-generator-cli generate -i ./schema.yml \
+      -g typescript-fetch -o $out \
+      -c ./scripts/api-ts-config.yaml \
+        --additional-properties=npmVersion=${nodejs.pkgs.npm.version} \
+        --git-repo-id authentik --git-user-id goauthentik
+      runHook postBuild
+    '';
+  };
+
+  webui = buildNpmPackage {
+    pname = "authentik-webui";
+    inherit version meta;
+
+    src = runCommand "authentik-webui-source" {} ''
+      mkdir -p $out/web/node_modules/@goauthentik/
+      cp -r ${src}/web $out/
+      ln -s ${src}/website $out/
+      ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
+    '';
+    npmDepsHash = "sha256-5aCKlArtoEijGqeYiY3zoV0Qo7/Xt5hSXbmy2uYZpok=";
+
+    postPatch = ''
+      cd web
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist $out/dist
+      cp -r authentik $out/authentik
+      runHook postInstall
+    '';
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmInstallFlags = [ "--include=dev" ];
+  };
+
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      authentik-django = prev.buildPythonPackage {
+        pname = "authentik-django";
+        inherit version src meta;
+        pyproject = true;
+
+        postPatch = ''
+          substituteInPlace authentik/root/settings.py \
+            --replace-fail 'Path(__file__).absolute().parent.parent.parent' "\"$out\""
+          substituteInPlace authentik/lib/default.yml \
+            --replace-fail '/blueprints' "$out/blueprints"
+          substituteInPlace pyproject.toml \
+            --replace-fail 'dumb-init = "*"' "" \
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
+        '';
+
+        nativeBuildInputs = [ prev.poetry-core ];
+
+        propagatedBuildInputs = with prev; [
+          argon2-cffi
+          celery
+          channels
+          channels-redis
+          colorama
+          dacite
+          daphne
+          deepmerge
+          defusedxml
+          django
+          django-filter
+          django-guardian
+          django-model-utils
+          django-prometheus
+          django-redis
+          djangorestframework
+          djangorestframework-guardian2
+          docker
+          drf-spectacular
+          duo-client
+          facebook-sdk
+          flower
+          geoip2
+          gunicorn
+          httptools
+          kubernetes
+          ldap3
+          lxml
+          opencontainers
+          packaging
+          paramiko
+          psycopg
+          pycryptodome
+          pydantic
+          pydantic-scim
+          pyjwt
+          pyyaml
+          requests-oauthlib
+          sentry-sdk
+          structlog
+          swagger-spec-validator
+          twilio
+          twisted
+          ua-parser
+          urllib3
+          uvicorn
+          uvloop
+          watchdog
+          webauthn
+          websockets
+          wsproto
+          xmlsec
+          zxcvbn
+          jsonpatch
+        ] ++ [
+          codespell
+        ];
+
+        postInstall = ''
+          mkdir -p $out/web $out/website
+          cp -r lifecycle manage.py $out/${prev.python.sitePackages}/
+          cp -r blueprints $out/
+          cp -r ${webui}/dist ${webui}/authentik $out/web/
+          cp -r ${website} $out/website/help
+          ln -s $out/${prev.python.sitePackages}/lifecycle $out/lifecycle
+        '';
+      };
+    };
+  };
+
+  inherit (python.pkgs) authentik-django;
+
+  proxy = buildGoModule {
+    pname = "authentik-proxy";
+    inherit version src meta;
+
+    postPatch = ''
+      substituteInPlace internal/gounicorn/gounicorn.go \
+        --replace-fail './lifecycle' "${authentik-django}/lifecycle"
+      substituteInPlace web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+      substituteInPlace internal/web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+    '';
+
+    CGO_ENABLED = 0;
+
+    vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+    postInstall = ''
+      mv $out/bin/server $out/bin/authentik
+    '';
+
+    subPackages = [ "cmd/server" ];
+  };
+
+in stdenvNoCC.mkDerivation {
+  pname = "authentik";
+  inherit src version;
+
+  postPatch = ''
+    rm Makefile
+    patchShebangs lifecycle/ak
+
+    # This causes issues in systemd services
+    substituteInPlace lifecycle/ak \
+      --replace-fail 'printf' '>&2 printf' \
+      --replace-fail '> /dev/stderr' ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp -r lifecycle/ak $out/bin/
+
+    wrapProgram $out/bin/ak \
+      --prefix PATH : ${lib.makeBinPath [ (python.withPackages (ps: [ps.authentik-django])) proxy ]} \
+      --set TMPDIR /dev/shm \
+      --set PYTHONDONTWRITEBYTECODE 1 \
+      --set PYTHONUNBUFFERED 1
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = meta // {
+    mainProgram = "ak";
+  };
+}

pkgs/by-name/co/codeium/package.nix

···
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-6ki5sIzypyBhCFhUDXlD3mT13o9A4OQ4cFFfCWTFPaA=";
-    aarch64-linux = "sha256-LoFDQDsQDRZZiyEpWmGTfEWE/kJDk4GNKA8AsoqxXmY=";
-    x86_64-darwin = "sha256-o13H5phQ0aWCchizRpIWuy1nO/19qoRRZNq52QHbINY=";
-    aarch64-darwin = "sha256-N7N1y3/C5Q4NT0fISjjUuU3a9IV1Ur5VEa/Z4wVoApU=";
+    x86_64-linux = "sha256-vS3rHYxsRTWejp2SAQk7gI/C6ElOYOjPA5cHxy7ef3U=";
+    aarch64-linux = "sha256-FxbJL5qzkVBPL6o52/gNJ8dC7Sgm/v5KFi8DL+SxiTc=";
+    x86_64-darwin = "sha256-zPas9sZzl9FqcsoqMxIjvW75JhexW/cuWvku8fPUS1Q=";
+    aarch64-darwin = "sha256-EZC9EEzilsm7H+oEr1Le5tNevWu1ldLB2UH0fS1RlLk=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.6.26";
+  version = "1.6.28";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";

pkgs/by-name/fl/flarectl/package.nix

···
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.86.0";
+  version = "0.87.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-BGjay9DTlIU563bCSjprq5YwF47Xqj+ZulCda5t2t5I=";
+    hash = "sha256-M3Qc9PAcYASOQyEjWdGrLKx9h6uQGPftMJnD0Uc2buc=";
   };
 
   vendorHash = "sha256-Bn2SDvFWmmMYDpOe+KBuzyTZLpdDtYDPc8HixgEgX+M=";

pkgs/by-name/li/littlefs-fuse/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "littlefs-fuse";
-  version = "2.7.4";
+  version = "2.7.5";
   src = fetchFromGitHub {
     owner = "littlefs-project";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-S4yLe6xugr/cQOmf4vS09ebCqFuDPCXySJKACr0AUDU=";
+    hash = "sha256-sSnk1iQV5aHcOPqVKbigWqojrZKlJK5CcrVlwilT2mE=";
   };
   buildInputs = [ fuse ];
   installPhase = ''

pkgs/by-name/ni/nixfmt-rfc-style/date.txt

···
-2024-01-15
[phone]

pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix

···
   pname = "nixfmt";
   version = "0.5.0";
   src = fetchzip {
-    url = "https://github.com/piegamesde/nixfmt/archive/1eff7a84ac82fbebb5f586244f1c80e1fcc4f494.tar.gz";
-    sha256 = "1pg876sr58h7v087kbjsnfr4pzvqpwzibl06w2468qs1sywmd283";
+    url = "https://github.com/piegamesde/nixfmt/archive/d6930fd0c62c4d7ec9e4a814adc3d2f590d96271.tar.gz";
+    sha256 = "1ijrdzdwricv4asmy296j7gzvhambv96nlxi3qrxb4lj1by6a34m";
   };
   isLibrary = true;
   isExecutable = true;

pkgs/by-name/of/offpunk/package.nix

···
 , timg
 , xdg-utils
 , xsel
-,
 }:
 
 let
···
     xsel
   ];
 in
-python3Packages.buildPythonPackage rec {
+python3Packages.buildPythonApplication rec {
   pname = "offpunk";
   version = "2.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.7";
 
···
   passthru.tests.version = testers.testVersion { package = offpunk; };
 
   meta = with lib; {
-    description = "An Offline-First browser for the smolnet ";
+    description = "A command-line and offline-first smolnet browser/feed reader";
     homepage = src.meta.homepage;
     maintainers = with maintainers; [ DamienCassou ];
     platforms = platforms.linux;

pkgs/by-name/on/onedrivegui/package.nix

···
     makeWrapper ${python3Packages.python.interpreter} $out/bin/onedrivegui \
       --prefix PATH : ${lib.makeBinPath [ onedrive ]} \
       --prefix PYTHONPATH : ${python3Packages.makePythonPath (propagatedBuildInputs ++ [(placeholder "out")])} \
-      --add-flags $out/lib/${python3Packages.python.libPrefix}/site-packages/OneDriveGUI.py
+      --add-flags $out/${python3Packages.python.sitePackages}/OneDriveGUI.py
   '';
 
   meta = with lib; {

pkgs/by-name/pp/ppsspp/package.nix

···
           + lib.optionalString enableQt "-qt"
           + lib.optionalString (!enableQt) "-sdl"
           + lib.optionalString forceWayland "-wayland";
-  version = "1.16.6";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-FCdYvYKcV+0TpQUSWiooNlTXKYtqbfnAWwjk7M8iF1Q=";
+    hash = "sha256-BJWcaxUUxNDiSX3YnhwXhgbp3iymcrR493BKrtivn3U=";
   };
 
   postPatch = ''
···
     makeWrapper
     pkg-config
     python3
-  ] ++ lib.optional enableQt wrapQtAppsHook;
+  ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
 
   buildInputs = [
     SDL2
···
   ] ++ lib.optionals enableQt [
     qtbase
     qtmultimedia
-  ] ++ lib.optional enableVulkan vulkan-loader
+  ] ++ lib.optionals enableVulkan [ vulkan-loader ]
   ++ lib.optionals vulkanWayland [ wayland libffi ];
 
   cmakeFlags = [
-    "-DHEADLESS=${if enableQt then "OFF" else "ON"}"
-    "-DOpenGL_GL_PREFERENCE=GLVND"
-    "-DUSE_SYSTEM_FFMPEG=ON"
-    "-DUSE_SYSTEM_LIBZIP=ON"
-    "-DUSE_SYSTEM_SNAPPY=ON"
-    "-DUSE_WAYLAND_WSI=${if vulkanWayland then "ON" else "OFF"}"
-    "-DUSING_QT_UI=${if enableQt then "ON" else "OFF"}"
+    (lib.cmakeBool "HEADLESS" (!enableQt))
+    (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
+    (lib.cmakeBool "USE_SYSTEM_LIBZIP" true)
+    (lib.cmakeBool "USE_SYSTEM_SNAPPY" true)
+    (lib.cmakeBool "USE_WAYLAND_WSI" vulkanWayland)
+    (lib.cmakeBool "USING_QT_UI" enableQt)
+    (lib.cmakeFeature "OpenGL_GL_PREFERENCE" "GLVND")
   ];
 
   desktopItems = [
···
       runHook preInstall
 
       mkdir -p $out/share/{applications,ppsspp,icons}
-    '' + (if enableQt then ''
+    ''
+    + (if enableQt then ''
       install -Dm555 PPSSPPQt $out/bin/ppsspp
       wrapProgram $out/bin/ppsspp \
     '' else ''
···
       install -Dm555 PPSSPPSDL $out/share/ppsspp/
       makeWrapper $out/share/ppsspp/PPSSPPSDL $out/bin/ppsspp \
         --set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"} \
-    '') + lib.optionalString enableVulkan ''
+    '')
+    + lib.optionalString enableVulkan ''
         --prefix LD_LIBRARY_PATH : ${vulkanPath} \
-    '' + "\n" + ''
+    ''
+    + ''
+
       mv assets $out/share/ppsspp
       mv ../icons/hicolor $out/share/icons
 
···
     homepage = "https://www.ppsspp.org/";
     description = "A HLE Playstation Portable emulator, written in C++ ("
                   + (if enableQt then "Qt" else "SDL + headless") + ")";
+    longDescription = ''
+      PPSSPP is a PSP emulator, which means that it can run games and other
+      software that was originally made for the Sony PSP.
+
+      The PSP had multiple types of software. The two most common are native PSP
+      games on UMD discs and downloadable games (that were stored in the
+      directory PSP/GAME on the "memory stick"). But there were also UMD Video
+      discs, and PS1 games that could run in a proprietary emulator. PPSSPP does
+      not run those.
+    '';
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.AndersonTorres ];
+    mainProgram = "ppsspp";
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/pr/pretalx/package.nix

···
+{ lib
+, buildNpmPackage
+, gettext
+, python3
+, fetchFromGitHub
+, nixosTests
+}:
+
+let
+  python = python3.override {
+    packageOverrides = final: prev: {
+      django-bootstrap4 = prev.django-bootstrap4.overridePythonAttrs (oldAttrs: rec {
+        version = "3.0.0";
+        src = oldAttrs.src.override {
+          rev = "v${version}";
+          hash = "sha256-a8BopUwZjmvxOzBVqs4fTo0SY8sEEloGUw90daYWfz8=";
+        };
+
+        propagatedBuildInputs = with final; [
+          beautifulsoup4
+          django
+        ];
+
+        # fails with some assertions
+        doCheck = false;
+      });
+    };
+  };
+
+  version = "2023.1.3";
+
+  src = fetchFromGitHub {
+    owner = "pretalx";
+    repo = "pretalx";
+    rev = "v${version}";
+    hash = "sha256-YxmkjfftNrInIcSkK21wJXiEU6hbdDa1Od8p+HiLprs=";
+  };
+
+  meta = with lib; {
+    description = "Conference planning tool: CfP, scheduling, speaker management";
+    homepage = "https://github.com/pretalx/pretalx";
+    license = licenses.asl20;
+    maintainers = teams.c3d2.members;
+    platforms = platforms.linux;
+  };
+
+  frontend = buildNpmPackage {
+    pname = "pretalx-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/src/pretalx/frontend/schedule-editor";
+
+    npmDepsHash = "sha256-4cnBHZ8WpHgp/bbsYYbdtrhuD6ffUAZq9ZjoLpWGfRg=";
+
+    npmBuildScript = "build";
+
+    inherit meta;
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "pretalx";
+  inherit version src;
+  pyproject = true;
+
+  outputs = [
+    "out"
+    "static"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/pretalx/common/management/commands/rebuild.py \
+      --replace 'subprocess.check_call(["npm", "run", "build"], cwd=frontend_dir, env=env)' ""
+
+    substituteInPlace src/setup.cfg \
+      --replace "--cov=./" ""
+  '';
+
+  nativeBuildInputs = [
+    gettext
+    python.pkgs.pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "bleach"
+    "cssutils"
+    "django-filter"
+    "django-formtools"
+    "libsass"
+    "markdown"
+    "pillow"
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    beautifulsoup4
+    bleach
+    celery
+    css-inline
+    csscompressor
+    cssutils
+    defusedcsv
+    django
+    django-bootstrap4
+    django-compressor
+    django-context-decorator
+    django-countries
+    django-csp
+    django-filter
+    django-formset-js-improved
+    django-formtools
+    django-hierarkey
+    django-i18nfield
+    django-libsass
+    django-scopes
+    djangorestframework
+    libsass
+    markdown
+    pillow
+    publicsuffixlist
+    python-dateutil
+    qrcode
+    reportlab
+    requests
+    rules
+    urlman
+    vobject
+    whitenoise
+    zxcvbn
+  ] ++ beautifulsoup4.optional-dependencies.lxml;
+
+  passthru.optional-dependencies = {
+    mysql = with python.pkgs; [
+      mysqlclient
+    ];
+    postgres = with python.pkgs; [
+      psycopg2
+    ];
+    redis = with python.pkgs; [
+      redis
+    ];
+  };
+
+  postBuild = ''
+    rm -r ./src/pretalx/frontend/schedule-editor
+    ln -s ${frontend}/lib/node_modules/@pretalx/schedule-editor ./src/pretalx/frontend/schedule-editor
+
+    # Generate all static files, see https://docs.pretalx.org/administrator/commands.html#python-m-pretalx-rebuild
+    PYTHONPATH=$PYTHONPATH:./src python -m pretalx rebuild
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cp ./src/manage.py $out/bin/pretalx-manage
+
+    # The processed source files are in the static output, except for fonts, which are duplicated.
+    # See <https://github.com/pretalx/pretalx/issues/1585> for more details.
+    find $out/${python.sitePackages}/pretalx/static \
+      -mindepth 1 \
+      -not -path "$out/${python.sitePackages}/pretalx/static/fonts*" \
+      -delete
+
+    # Copy generated static files into dedicated output
+    mkdir -p $static
+    cp -r ./src/static.dist/** $static/
+
+    # Copy frontend files
+    ln -s ${frontend}/lib/node_modules/@pretalx/schedule-editor/dist/* $static
+  '';
+
+  preCheck = ''
+    export PRETALX_CONFIG_FILE="$src/src/tests/ci_sqlite.cfg"
+    cd src
+  '';
+
+  nativeCheckInputs = with python.pkgs; [
+    faker
+    freezegun
+    pytest-django
+    pytest-mock
+    pytest-xdist
+    pytestCheckHook
+    responses
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  disabledTests = [
+    # tries to run npm run i18n:extract
+    "test_common_custom_makemessages_does_not_blow_up"
+    # Expected to perform X queries or less but Y were done
+    "test_schedule_export_public"
+    "test_schedule_frab_json_export"
+    "test_schedule_frab_xml_export"
+  ];
+
+  passthru = {
+    inherit python;
+    tests = {
+      inherit (nixosTests) pretalx;
+    };
+  };
+
+  inherit meta;
+}

pkgs/by-name/py/pysqlrecon/package.nix

···
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "pysqlrecon";
+  version = "0.1.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Tw1sm";
+    repo = "PySQLRecon";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IxIYJo2wG8xqetBqgUOePNWPSx9FaZPhqhOFy3kG6Uk=";
+  };
+
+  pythonRelaxDeps = [
+    "rich"
+    "typer"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    impacket
+    rich
+    typer
+  ];
+
+  pythonImportsCheck = [
+    "pysqlrecon"
+  ];
+
+  meta = with lib; {
+    description = "Offensive MSSQL toolkit";
+    homepage = "https://github.com/Tw1sm/PySQLRecon";
+    changelog = "https://github.com/Tw1sm/PySQLRecon/blob/${version}/CHANGELOG.md";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "pysqlrecon";
+  };
+}

pkgs/by-name/re/renode-dts2repl/package.nix

···
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "unstable-2024-01-09";
+  version = "unstable-2024-01-20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "429ebc65e0bcbd967ccfe1f9a970abd5b5b6258f";
-    hash = "sha256-/62KAVIMCM6VNhW4rDqnKXOFrAO0cHpybGS3lconCqY=";
+    rev = "bd09db556fa762cb1a4857d874545957d91b0010";
+    hash = "sha256-bGDM23PuON4fx4pNCNVYw2bN0tIWjmwZqghhksAIVGA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sh/shopware-cli/package.nix

···
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.18";
+  version = "0.4.22";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-LOmGxH/czICSii8AkoXi1cQPL+MErV92iUZtJc2eg64=";
+    hash = "sha256-P93wxAApV2iWXSQGXsCPjmvj2gGMwbKw6+yMgiainb4=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-KMNPw2B4fLaOdSIFHBIAKXUtnu0sMwksJg3RUZKLDsE=";
+  vendorHash = "sha256-FalN3qhw2o9NvSIfEU4juevPAsxQoksNjL3eATf0umU=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"

pkgs/data/fonts/0xproto/default.nix

···
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "0xproto";
-  version = "1.500";
+  version = "1.601";
 
   src = let
     underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
   in
     fetchzip {
       url = "https://github.com/0xType/0xProto/releases/download/${version}/0xProto_${underscoreVersion}.zip";
-      hash = "sha256-4yZtYjNLHDsF16brUADzwS4/Ha0g+g0mU+sl8Gb9Zm0=";
+      hash = "sha256-f/5YmyIF66+7w2Tb0V0UKRjwDYDdZ0BEqsEuyN0FaDQ=";
     };
 
   installPhase = ''

pkgs/data/fonts/ibm-plex/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "ibm-plex";
-  version = "6.2.0";
+  version = "6.4.0";
 
   src = fetchzip {
     url = "https://github.com/IBM/plex/releases/download/v${version}/OpenType.zip";
-    hash = "sha256-RvD/aeZrvltJiuAHqYMNaRsjLgTdcC1/5zqlcd4qKAA=";
+    hash = "sha256-/aR3bu03VxenSPed6EqrGoPjWCcKT//MVtb9OC8tSRs=";
   };
 
   installPhase = ''

pkgs/desktops/cinnamon/cinnamon-session/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "6.0.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-AO4/JUysQyGDsQDbP9X7sqmcxyRSkNGjjTEu4fFzDZA=";
+    hash = "sha256-dNg1e339NWRzyEsRp7I91SwK2H+lU28Ra+7MSgUDk8w=";
   };
 
   patches = [

pkgs/desktops/deepin/apps/deepin-compressor/default.nix

···
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , dtkwidget
 , qt5integration
 , qt5platform-plugins
···
 
 stdenv.mkDerivation rec {
   pname = "deepin-compressor";
-  version = "5.12.20";
+  version = "5.12.23";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-oOxto0X/GBAA9q691uwC0PtCdHDTMBqi80ov4xCXPn0=";
+    hash = "sha256-8qfpNM2rci4subdodxfJZLP3OvAxXl7QRl4MHGr15nA=";
   };
-
-  patches = [
-    (fetchpatch {
-      name = "fix-build-failures-for-new-dtkgui.patch";
-      url = "https://github.com/linuxdeepin/deepin-compressor/commit/0ee07030034b06021e366d8d6109f344d47ea26c.patch";
-      hash = "sha256-P++SxzZCWoXJnLQhC0H/64/LjW/dqnl3hCGBWHVDn9Q=";
-    })
-  ];
 
   postPatch = ''
     substituteInPlace src/source/common/pluginmanager.cpp \

pkgs/desktops/gnome/core/nautilus/default.nix

···
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
+    mainProgram = "nautilus";
   };
 })

pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/2002-Nixpkgs-versioned-QML-path.patch.in

···
+From ca4c52a80532732243067eb00ec12b4ef84010a6 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <[e-mail]>
+Date: Tue, 30 Jan 2024 19:46:09 +0100
+Subject: [PATCH] Nixpkgs versioned QML path
+
+---
+ src/LomiriToolkit/uctheme.cpp | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/LomiriToolkit/uctheme.cpp b/src/LomiriToolkit/uctheme.cpp
+index a10c89344..4b0653589 100644
+--- a/src/LomiriToolkit/uctheme.cpp
++++ b/src/LomiriToolkit/uctheme.cpp
+@@ -180,6 +180,12 @@ QStringList themeSearchPath()
+         pathList << QStandardPaths::standardLocations(QStandardPaths::GenericDataLocation);
+     }
+
++    // append versioned QML import path from Nixpkgs
++    const QString nixpkgsQmlImportPath = QString::fromLocal8Bit(getenv("NIXPKGS_QT@qtVersion@_QML_IMPORT_PATH"));
++    if (!nixpkgsQmlImportPath.isEmpty()) {
++        pathList << nixpkgsQmlImportPath.split(':', QString::SkipEmptyParts);
++    }
++
+     // append QML import path(s); we must explicitly support env override here
+     const QString qml2ImportPath = QString::fromLocal8Bit(getenv("QML2_IMPORT_PATH"));
+     if (!qml2ImportPath.isEmpty()) {
+--
+2.42.0
+

pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix

···
 , fetchFromGitLab
 , fetchpatch
 , gitUpdater
+, substituteAll
 , testers
 , dbus-test-runner
 , dpkg
···
     })
 
     ./2001-Mark-problematic-tests.patch
+    (substituteAll {
+      src = ./2002-Nixpkgs-versioned-QML-path.patch.in;
+      name = "2002-Nixpkgs-versioned-QML-path.patch";
+      qtVersion = lib.versions.major qtbase.version;
+    })
   ];
 
   postPatch = ''

pkgs/development/compilers/koka/default.nix

···
-{ stdenv, pkgsHostTarget, cmake, makeWrapper, mkDerivation, fetchFromGitHub
-, alex, array, base, bytestring, cond, containers, directory, extra
-, filepath, hpack, hspec, hspec-core, isocline, json, lib, mtl
-, parsec, process, regex-compat, text, time }:
+{ stdenv
+, pkgsHostTarget
+, cmake
+, makeWrapper
+, mkDerivation
+, fetchFromGitHub
+, alex
+, lib
+, hpack
+, aeson
+, array
+, async
+, base
+, bytestring
+, co-log-core
+, cond
+, containers
+, directory
+, FloatingHex
+, isocline
+, lens
+, lsp
+, mtl
+, network
+, network-simple
+, parsec
+, process
+, text
+, text-rope
+, time
+}:
 
 let
-  version = "2.4.2";
+  version = "3.0.4";
   src = fetchFromGitHub {
     owner = "koka-lang";
     repo = "koka";
     rev = "v${version}";
-    sha256 = "sha256-sVjaIzOxNuBtDswpDl5gLB10Sw945TQAf2ywrKumqqk=";
+    sha256 = "sha256-U8BW1Aq9t3je0YDV8NkE0MzdnjwXBJQbmekh5ufOs3k=";
     fetchSubmodules = true;
   };
   kklib = stdenv.mkDerivation {
···
   isExecutable = true;
   libraryToolDepends = [ hpack ];
   executableHaskellDepends = [
-    array base bytestring cond containers directory isocline mtl
-    parsec process text time kklib
+    aeson
+    array
+    async
+    base
+    bytestring
+    co-log-core
+    cond
+    containers
+    directory
+    FloatingHex
+    isocline
+    lens
+    lsp
+    mtl
+    network
+    network-simple
+    parsec
+    process
+    text
+    text-rope
+    time
+    kklib
   ];
   executableToolDepends = [ alex makeWrapper ];
   postInstall = ''

pkgs/development/compilers/unison/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unison-code-manager";
-  version = "0.5.13";
+  version = "0.5.14";
 
   src = if stdenv.isDarwin then
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos.tar.gz";
-      hash = "sha256-/iaL3jTwUeGhfPgZ08njopkOC5t4RY3zggn0n2zLTnw=";
+      hash = "sha256-LLyJy0qz5qm08Xj+mb09lBN5sw3v8AnaSYv832sYefg=";
     }
   else
     fetchurl {
       url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux.tar.gz";
-      hash = "sha256-ZxuHpcyt0zxXMiltue99Tzrlvsrrb1cL3LNcGIo5NsI=";
+      hash = "sha256-sIw3mc78cGPi+E+fXEpMvt+IEfPW03lex30bs0TVevo=";
     };
 
   # The tarball is just the prebuilt binary, in the archive root.

pkgs/development/haskell-modules/configuration-darwin.nix

···
   }) (disableCabalFlag "fixity-th" super.fourmolu);
 
   # https://github.com/NixOS/nixpkgs/issues/149692
-  Agda = removeConfigureFlag "-foptimise-heavily" super.Agda;
+  Agda = disableCabalFlag "optimise-heavily" super.Agda;
 
 } // lib.optionalAttrs pkgs.stdenv.isx86_64 {  # x86_64-darwin
 

pkgs/development/haskell-modules/configuration-nix.nix

···
     preCheck = "export CI=true";
   }) super.aeson-typescript;
 
-  # Enable extra optimisations which increase build time, but also
-  # later compiler performance, so we should do this for user's benefit.
-  # Flag added in Agda 2.6.2
-  Agda = appendConfigureFlag "-foptimise-heavily" super.Agda;
+  Agda = lib.pipe super.Agda [
+    # Enable extra optimisations which increase build time, but also
+    # later compiler performance, so we should do this for user's benefit.
+    # Flag added in Agda 2.6.2
+    (enableCabalFlag "optimise-heavily")
+    # Enable debug printing, which worsens performance slightly but is
+    # very useful.
+    # Flag added in Agda 2.6.4.1, was always enabled before
+    (enableCabalFlag "debug")
+  ];
 
   # ats-format uses cli-setup in Setup.hs which is quite happy to write
   # to arbitrary files in $HOME. This doesn't either not achieve anything

pkgs/development/interpreters/wasmtime/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "16.0.0";
+  version = "17.0.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kySJme79RQMI8PP2Jhx1mjqJpUIf5jPn2TvbPEzw5hY=";
+    hash = "sha256-HGs82LMDJJZl1bPaFsVetpMR7ytBgGmOkH1tt7xmUMA=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-2XlnR4OBvdQyMUUOL6VvqDxf8jGYlhz2PDuPd24Ocxw=";
+  cargoHash = "sha256-bNGpBgAhLN4s90saQqIgFb6hXtfC9NIjOfy+hvkRJ6E=";
   cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/agda/1lab/default.nix

···
     hash = "sha256-0U6s6sXdynk2IWRBDXBJCf7Gc+gE8AhR1PXZl0DS4yU=";
   };
 
-  # We don't need anything in support; avoid installing LICENSE.agda
   postPatch = ''
+    # We don't need anything in support; avoid installing LICENSE.agda
     rm -rf support
+
+    # Remove verbosity options as they make Agda take longer and use more memory.
+    shopt -s globstar extglob
+    sed -Ei '/OPTIONS/s/ -v ?[^ #]+//g' src/**/*.@(agda|lagda.md)
   '';
 
   libraryName = "1lab";

pkgs/development/libraries/httplib/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "httplib";
-  version = "0.14.3";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-53EBZTpz0INtjVSmjvg7XOQf0Bs2ADVe2//+nK6xRyE=";
+    hash = "sha256-HV2RiWu4rt3rau/flcha500R67oGwbmyEPPnklpAvgY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/openvdb/default.nix

···
 
   cmakeFlags = [ "-DOPENVDB_CORE_STATIC=OFF" ];
 
+  # error: aligned deallocation function of type 'void (void *, std::align_val_t) noexcept' is only available on macOS 10.13 or newer
+  env = lib.optionalAttrs (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13" && lib.versionAtLeast tbb.version "2021.8.0") {
+    NIX_CFLAGS_COMPILE = "-faligned-allocation";
+  };
+
   postFixup = ''
     substituteInPlace $dev/lib/cmake/OpenVDB/FindOpenVDB.cmake \
       --replace \''${OPENVDB_LIBRARYDIR} $out/lib \

pkgs/development/libraries/qwlroots/default.nix

···
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wrapQtAppsHook
+, wayland-scanner
+, qtbase
+, wayland
+, wayland-protocols
+, wlr-protocols
+, pixman
+, mesa
+, vulkan-loader
+, libinput
+, xorg
+, seatd
+, wlroots
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qwlroots";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "vioken";
+    repo = "qwlroots";
+    rev = finalAttrs.version;
+    hash = "sha256-ev4oCKR43XaYNTavj9XI3RAtB6RFprChpBFsrA2nVsM=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    qtbase
+    wayland
+    wayland-protocols
+    wlr-protocols
+    pixman
+    mesa
+    vulkan-loader
+    libinput
+    xorg.libXdmcp
+    xorg.xcbutilerrors
+    seatd
+  ];
+
+  propagatedBuildInputs = [
+    wlroots
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "PREFER_QT_5" (lib.versionOlder qtbase.version "6"))
+  ];
+
+  meta = {
+    description = "Qt and QML bindings for wlroots";
+    homepage = "https://github.com/vioken/qwlroots";
+    license = with lib.licenses; [ gpl3Only lgpl3Only asl20 ];
+    platforms = wlroots.meta.platforms;
+    maintainers = with lib.maintainers; [ rewine ];
+  };
+})
+

pkgs/development/libraries/science/networking/ns-3/default.nix

···
     "-DPython3_EXECUTABLE=${pythonEnv}/bin/python"
     "-DNS3_PYTHON_BINDINGS=ON"
     "-DNS3_DES_METRICS=ON"
-    "-DNS3_BINDINGS_INSTALL_DIR=lib/${pythonEnv.libPrefix}/site-packages"
+    "-DNS3_BINDINGS_INSTALL_DIR=${pythonEnv.sitePackages}"
     "-DNS3_LOG=ON"
     "-DNS3_ASSERT=ON"
     "-DNS3_GTK3=ON"

pkgs/development/libraries/spglib/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "spglib";
-  version = "2.2.0"; # N.B: if you change this, please update: pythonPackages.spglib
+  version = "2.3.0"; # N.B: if you change this, please update: pythonPackages.spglib
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "spglib";
     rev = "v${version}";
-    hash = "sha256-VaTW7n7DTeYBr/PrxPhfzfx/gLxzJikw5aL1tEbMtbs=";
+    hash = "sha256-S/i0sIg7VwgpnB2Uo0d4FdVcSIb5tcGJ+0URmkNkxe8=";
   };
 
   nativeBuildInputs = [ cmake gfortran gtest ];

pkgs/development/libraries/talloc/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "talloc";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchurl {
     url = "mirror://samba/talloc/${pname}-${version}.tar.gz";
-    sha256 = "sha256-QQpUfwhVcAe+DogZTyGIaDWO3Aq5jJi6jBZ5MNs9M/k=";
+    sha256 = "sha256-hez55GXiD5j5lQpS6aQR4UMgvFVfolfYdpe356mx2KY=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/vigra/default.nix

···
     python
   ];
 
-  preConfigure = "cmakeFlags+=\" -DVIGRANUMPY_INSTALL_DIR=$out/lib/${python.libPrefix}/site-packages\"";
+  preConfigure = "cmakeFlags+=\" -DVIGRANUMPY_INSTALL_DIR=$out/${python.sitePackages}\"";
 
   cmakeFlags = [ "-DWITH_OPENEXR=1" ]
     ++ lib.optionals (stdenv.hostPlatform.system == "x86_64-linux")

pkgs/development/libraries/xxHash/default.nix

···
     '';
     homepage = "https://github.com/Cyan4973/xxHash";
     license = with licenses; [ bsd2 gpl2 ];
+    mainProgram = "xxhsum";
     maintainers = with maintainers; [ orivej ];
     platforms = platforms.all;
   };

pkgs/development/misc/umr/default.nix

···
-{ lib, stdenv, fetchgit, bash-completion, cmake, pkg-config
-, json_c, libdrm, libpciaccess, llvmPackages, nanomsg, ncurses, SDL2
+{ lib
+, stdenv
+
+, fetchFromGitLab
+
+, cmake
+, pkg-config
+
+, libdrm
+, mesa # libgbm
+, libpciaccess
+, llvmPackages
+, nanomsg
+, ncurses
+, SDL2
+, bash-completion
+
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "umr";
-  version = "unstable-2022-08-23";
+  version = "1.0.8";
 
-  src = fetchgit {
-    url = "https://gitlab.freedesktop.org/tomstdenis/umr";
-    rev = "87f814b1ffdbac8bfddd8529d344a7901cd7e112";
-    hash = "sha256-U1VP1AicSGWzBwzz99i7+3awATZocw5jaqtAxuRNaBE=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "tomstdenis";
+    repo = "umr";
+    rev = version;
+    hash = "sha256-ODkTYHDrKWNvjiEeIyfsCByf7hyr5Ps9ytbKb3253bU=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config llvmPackages.llvm.dev ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
   buildInputs = [
-    bash-completion
-    json_c
     libdrm
+    mesa
     libpciaccess
     llvmPackages.llvm
     nanomsg
     ncurses
     SDL2
+
+    bash-completion # Tries to create bash-completions in /var/empty otherwise?
   ];
 
   # Remove static libraries (there are no dynamic libraries in there)
   postInstall = ''
     rm -r $out/lib
   '';
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "A userspace debugging and diagnostic tool for AMD GPUs";

pkgs/development/python-modules/aioelectricitymaps/default.nix

···
 , aiohttp
 , aresponses
 , buildPythonPackage
-, dataclasses-json
 , fetchFromGitHub
+, mashumaro
+, orjson
 , poetry-core
 , pytest-asyncio
 , pytestCheckHook
···
 
 buildPythonPackage rec {
   pname = "aioelectricitymaps";
-  version = "0.1.6";
+  version = "0.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "jpbede";
     repo = "aioelectricitymaps";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SyI+2hxKOiSdx5e+vkHLsIk5xj4gNvmfZTYZ10oJhfc=";
+    hash = "sha256-cwRmUHVIviQquZtcQRtCFxBZTt4QEyaCixbY1ExUL9A=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-warn "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiohttp
-    dataclasses-json
+    mashumaro
+    orjson
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/apache-beam/default.nix

···
 
   # Make sure we're running the tests for the actually installed
   # package, so that cython's .so files are available.
-  preCheck = "cd $out/lib/${python.libPrefix}/site-packages";
+  preCheck = "cd $out/${python.sitePackages}";
 
   disabledTestPaths = [
     # Fails with

pkgs/development/python-modules/appthreat-vulnerability-db/default.nix

···
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.5.10";
+  version = "5.6.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yBB66H8l+kjVcpmt3gYzggRgfxjFvMPwy3rcYuKYqks=";
+    hash = "sha256-tRC+w9HyXuN6eWbNaccK0xtcOnJpuErcHaB7+lvTiQI=";
   };
 
   postPatch = ''
-    substituteInPlace pytest.ini \
-      --replace " --cov-append --cov-report term --cov vdb" ""
+    substituteInPlace pyproject.toml \
+      --replace-warn " --cov-report=term-missing --no-cov-on-fail --cov vdb" ""
   '';
 
   pythonRelaxDeps = [

pkgs/development/python-modules/azure-common/default.nix

···
   ] ++ lib.optionals (!isPy3k) [ setuptools ]; # need for namespace lookup
 
   postInstall = lib.optionalString (!isPy3k) ''
-    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/__init__.py
+    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/${python.sitePackages}"/azure/__init__.py
   '';
 
   doCheck = false;

pkgs/development/python-modules/azure-mgmt-common/default.nix

···
   ];
 
   postInstall = pkgs.lib.optionalString (!isPy3k) ''
-    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/mgmt/__init__.py
-    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/__init__.py
+    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/${python.sitePackages}"/azure/mgmt/__init__.py
+    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/${python.sitePackages}"/azure/__init__.py
   '';
 
   doCheck = false;

pkgs/development/python-modules/backports-zoneinfo/default.nix

···
     (substituteAll {
       name = "zoneinfo-path";
       src = ./zoneinfo.patch;
-      zoneinfo = "${tzdata}/lib/${python.libPrefix}/site-packages/tzdata/zoneinfo";
+      zoneinfo = "${tzdata}/${python.sitePackages}/tzdata/zoneinfo";
     })
   ];
 

pkgs/development/python-modules/distutils-cfg/default.nix

···
   dontUnpack = true;
 
   installPhase = ''
-    dest="$out/lib/${python.libPrefix}/site-packages/distutils"
+    dest="$out/${python.sitePackages}/distutils"
     mkdir -p $dest
     ln -s ${python}/lib/${python.libPrefix}/distutils/* $dest
     ln -s ${distutilsCfg} $dest/distutils.cfg

pkgs/development/python-modules/django-crispy-bootstrap5/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, django
+, setuptools
+, pytestCheckHook
+, pytest-django
+, django-crispy-forms
+}:
+
+buildPythonPackage rec {
+  pname = "django-crispy-bootstrap5";
+  version = "2023.10";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "django-crispy-forms";
+    repo = "crispy-bootstrap5";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AUMlLj3GmI+0vYw56Dw2+iF5s1l6GF+zV7PRD889ldg=";
+  };
+
+  propagatedBuildInputs = [
+    django
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+    django-crispy-forms
+  ];
+
+  pythonImportsCheck = [ "crispy_bootstrap5" ];
+
+  meta = with lib; {
+    description = "Bootstrap 5 template pack for django-crispy-forms";
+    homepage = "https://github.com/django-crispy-forms/crispy-bootstrap5";
+    license = licenses.mit;
+    maintainers = with maintainers; [ onny ];
+  };
+}

pkgs/development/python-modules/gentools/default.nix

···
 
 buildPythonPackage rec {
   pname = "gentools";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "ariebovenberg";
     repo = "gentools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RBUIji3FOIRjfp4t7zBAVSeiWaYufz4ID8nTWmhDkf8=";
+    hash = "sha256-+6KTFxOpwvGOCqy6JU87gOZmDa6MvjR10qES5wIfrjI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/git-annex-adapter/default.nix

···
-{ lib, buildPythonPackage, isPy3k, fetchFromGitHub, fetchpatch, substituteAll
-, python, util-linux, pygit2, gitMinimal, git-annex, cacert
+{ lib
+, buildPythonPackage
+, cacert
+, fetchFromGitHub
+, fetchpatch
+, git-annex
+, gitMinimal
+, pygit2
+, pytestCheckHook
+, python
+, pythonOlder
+, setuptools
+, substituteAll
+, util-linux
 }:
 
 buildPythonPackage rec {
   pname = "git-annex-adapter";
   version = "0.2.2";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";
 
-  # No tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "alpernebbi";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0666vqspgnvmfs6j3kifwyxr6zmxjs0wlwis7br4zcq0gk32zgdx";
+    repo = "git-annex-adapter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vb0vxnwAs0/yOjpyyoGWvX6Tu+cuziGNdnXbdzXexhg=";
   };
 
   patches = [
···
     })
   ];
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    pygit2
+    cacert
+  ];
+
   nativeCheckInputs = [
     gitMinimal
     util-linux # `rev` is needed in tests/test_process.py
+    pytestCheckHook
   ];
 
-  propagatedBuildInputs = [ pygit2 cacert ];
+  pythonImportsCheck = [
+    "git_annex_adapter"
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest
-  '';
-  pythonImportsCheck = [ "git_annex_adapter" ];
+  disabledTests = [
+    # KeyError and AssertionError
+    "test_jsonprocess_annex_metadata_batch"
+    "test_process_annex_metadata_batch"
+    "test_batchjson_metadata"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/alpernebbi/git-annex-adapter";

pkgs/development/python-modules/griffe/default.nix

···
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.39.1";
+  version = "0.40.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-1YHfwiQzt348fuyKpr5YXLeAnXzZljargnTugytvNK0=";
+    hash = "sha256-VUQmyNO2e4SoXzGbd751l7TtRgvaiWOr75gSGwKGPUI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/gruut-ipa/default.nix

···
   postPatch = ''
     patchShebangs bin/*
     substituteInPlace bin/speak-ipa \
-      --replace '${"\${src_dir}:"}' "$out/lib/${python.libPrefix}/site-packages:" \
+      --replace '${"\${src_dir}:"}' "$out/${python.sitePackages}:" \
       --replace "do espeak" "do ${espeak}/bin/espeak"
   '';
 

pkgs/development/python-modules/gurobipy/linux.nix

···
 
   postFixup = ''
     patchelf --set-rpath $out/lib \
-      $out/lib/${python.libPrefix}/site-packages/gurobipy/gurobipy.so
+      $out/${python.sitePackages}/gurobipy/gurobipy.so
   '';
 
   meta = with lib; {

pkgs/development/python-modules/hg-commitsigs/default.nix

···
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/lib/${python.libPrefix}/site-packages/hgext3rd/
+    mkdir -p $out/${python.sitePackages}/hgext3rd/
     install -D $src/commitsigs.py \
-               $out/lib/${python.libPrefix}/site-packages/hgext3rd/
+               $out/${python.sitePackages}/hgext3rd/
   '';
 
   meta = with lib; {

pkgs/development/python-modules/hwi/default.nix

···
 
 buildPythonPackage rec {
   pname = "hwi";
-  version = "2.3.1";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "bitcoin-core";
     repo = "HWI";
     rev = "refs/tags/${version}";
-    hash = "sha256-V4BWB4mCONQ8kjAy6ySonAbCUTaKpBTvhSnHmoH8TQM=";
+    hash = "sha256-a1ppYDuY7CtNrKSvuAofS79nvDaYUMIm4FCHiiQYrtQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/influxdb-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "influxdb-client";
-  version = "1.39.0";
+  version = "1.40.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "influxdata";
     repo = "influxdb-client-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cj3qeT5wE/RqrwOW1MV9sVG+khxyRAO5438omqbKbmY=";
+    hash = "sha256-+I5DxcxNxIRDwtfYXLvXPl8Z3FKcSWyaYtv1KHT9QO4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/jq/jq-py-setup.patch

···
-diff --git a/setup.py b/setup.py
-index 01cc813..15e9048 100644
---- a/setup.py
-+++ b/setup.py
-@@ -1,97 +1,18 @@
- #!/usr/bin/env python
- 
- import os
--import subprocess
--import tarfile
--import shutil
--import sysconfig
- 
- from setuptools import setup
--from setuptools.command.build_ext import build_ext
- from setuptools.extension import Extension
- 
--
--def _path_in_dir(relative_path):
--    return os.path.abspath(os.path.join(os.path.dirname(__file__), relative_path))
--
--def _dep_source_path(relative_path):
--    return os.path.join(_path_in_dir("deps"), relative_path)
--
--def _dep_build_path(relative_path):
--    return os.path.join(_path_in_dir("_deps/build"), relative_path)
--
- def _read(fname):
-     return open(os.path.join(os.path.dirname(__file__), fname)).read()
- 
- 
--jq_lib_tarball_path = _dep_source_path("jq-1.6.tar.gz")
--jq_lib_dir = _dep_build_path("jq-1.6")
--
--oniguruma_version = "6.9.4"
--oniguruma_lib_tarball_path = _dep_source_path("onig-{}.tar.gz".format(oniguruma_version))
--oniguruma_lib_build_dir = _dep_build_path("onig-{}".format(oniguruma_version))
--oniguruma_lib_install_dir = _dep_build_path("onig-install-{}".format(oniguruma_version))
--
--class jq_build_ext(build_ext):
--    def run(self):
--        if not os.path.exists(_dep_build_path(".")):
--            os.makedirs(_dep_build_path("."))
--        self._build_oniguruma()
--        self._build_libjq()
--        build_ext.run(self)
--
--    def _build_oniguruma(self):
--        self._build_lib(
--            tarball_path=oniguruma_lib_tarball_path,
--            lib_dir=oniguruma_lib_build_dir,
--            commands=[
--                ["./configure", "CFLAGS=-fPIC", "--prefix=" + oniguruma_lib_install_dir],
--                ["make"],
--                ["make", "install"],
--            ])
--
--
--    def _build_libjq(self):
--        self._build_lib(
--            tarball_path=jq_lib_tarball_path,
--            lib_dir=jq_lib_dir,
--            commands=[
--                ["./configure", "CFLAGS=-fPIC -pthread", "--disable-maintainer-mode", "--with-oniguruma=" + oniguruma_lib_install_dir],
--                ["make"],
--            ])
--
--    def _build_lib(self, tarball_path, lib_dir, commands):
--        self._extract_tarball(
--            tarball_path=tarball_path,
--            lib_dir=lib_dir,
--        )
--
--        macosx_deployment_target = sysconfig.get_config_var("MACOSX_DEPLOYMENT_TARGET")
--        if macosx_deployment_target:
--            os.environ['MACOSX_DEPLOYMENT_TARGET'] = str(macosx_deployment_target)
--
--        def run_command(args):
--            print("Executing: %s" % ' '.join(args))
--            subprocess.check_call(args, cwd=lib_dir)
--
--        for command in commands:
--            run_command(command)
--
--    def _extract_tarball(self, tarball_path, lib_dir):
--        if os.path.exists(lib_dir):
--            shutil.rmtree(lib_dir)
--        tarfile.open(tarball_path, "r:gz").extractall(_dep_build_path("."))
--
--
- jq_extension = Extension(
-     "jq",
-     sources=["jq.c"],
--    include_dirs=[os.path.join(jq_lib_dir, "src")],
--    extra_link_args=["-lm"],
--    extra_objects=[
--        os.path.join(jq_lib_dir, ".libs/libjq.a"),
--        os.path.join(oniguruma_lib_install_dir, "lib/libonig.a"),
--    ],
-+    libraries=["jq"]
- )
- 
- setup(
-@@ -104,7 +25,6 @@ def _extract_tarball(self, tarball_path, lib_dir):
-     python_requires='>=3.5',
-     license='BSD 2-Clause',
-     ext_modules = [jq_extension],
--    cmdclass={"build_ext": jq_build_ext},
-     classifiers=[
-         'Development Status :: 5 - Production/Stable',
-         'Intended Audience :: Developers',

pkgs/development/python-modules/kaa-base/default.nix

···
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
+    mkdir -p "$out/${python.sitePackages}"
 
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --install-lib=$out/${python.sitePackages} \
       --prefix="$out"
 
-    eapth="$out/lib/${python.libPrefix}"/site-packages/easy-install.pth
+    eapth="$out/${python.sitePackages}/easy-install.pth"
     if [ -e "$eapth" ]; then
     mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
     fi
 
-    rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+    rm -f "$out/${python.sitePackages}"/site.py*
 
     runHook postInstall
   '';

pkgs/development/python-modules/kaa-metadata/default.nix

···
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
+    mkdir -p "$out/${python.sitePackages}"
 
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --install-lib=$out/${python.sitePackages} \
       --prefix="$out"
 
-    eapth="$out/lib/${python.libPrefix}"/site-packages/easy-install.pth
+    eapth="$out/${python.sitePackages}/easy-install.pth"
     if [ -e "$eapth" ]; then
     mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
     fi
 
-    rm -f "$out/lib/${python.libPrefix}"/site-packages/site.py*
+    rm -f "$out/${python.sitePackages}"/site.py*
 
     runHook postInstall
   '';

pkgs/development/python-modules/langchain-community/default.nix

···
 
 buildPythonPackage rec {
   pname = "langchain-community";
-  version = "0.0.13";
+  version = "0.0.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
   src = fetchPypi {
     pname = "langchain_community";
     inherit version;
-    hash = "sha256-z2bG/3/L61gvXojuAN7Op/3spczd2nJQRvKO/Gl8Qac=";
+    hash = "sha256-wGUSqTAToG+6dnnNWhJU/4uSfN3S0fvgzERL97vfC4w=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/maestral/default.nix

···
   makeWrapperArgs = [
     # Add the installed directories to the python path so the daemon can find them
     "--prefix PYTHONPATH : ${makePythonPath propagatedBuildInputs}"
-    "--prefix PYTHONPATH : $out/lib/${python.libPrefix}/site-packages"
+    "--prefix PYTHONPATH : $out/${python.sitePackages}"
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/meep/default.nix

···
   checkPhase = ''
     runHook preCheck
 
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     # Generate a python test script
     cat > test.py << EOF

pkgs/development/python-modules/mpi4py/default.nix

···
   configurePhase = "";
 
   installPhase = ''
-    mkdir -p "$out/lib/${python.libPrefix}/site-packages"
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    mkdir -p "$out/${python.sitePackages}"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
 
     ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/lib/${python.libPrefix}/site-packages \
+      --install-lib=$out/${python.sitePackages} \
       --prefix="$out"
 
     # --install-lib:

pkgs/development/python-modules/oras/default.nix

···
 
 buildPythonPackage rec {
   pname = "oras";
-  version = "0.1.26";
+  version = "0.1.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
···
     owner = "oras-project";
     repo = "oras-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-t3098ZeAkwLhinyrFwmi7KKrFgZZKPN6qvp3REQNwG8=";
+    hash = "sha256-T2zuflew91UsEjhPKPjNxPBN+C//S1vWvXKVT602EVI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pmdarima/default.nix

···
   # Make sure we're running the tests for the actually installed
   # package, so that cython's compiled files are available.
   preCheck = ''
-    cd $out/lib/${python.libPrefix}/site-packages
+    cd $out/${python.sitePackages}
   '';
 
   nativeCheckInputs = [ pytestCheckHook ];

pkgs/development/python-modules/py-sonic/default.nix

···
 
 buildPythonPackage rec {
   pname = "py-sonic";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "setuptools";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9ho0F5kf74pCsLujwLt+pU+Ikxu70/kk+WP7lnD7CiE=";
+    hash = "sha256-DU1T86T0jQ6ptkWdjuV70VC8MFx/rK5aQFYjbK6F2Hk=";
   };
 
   # package has no tests

pkgs/development/python-modules/pycaption/default.nix

···
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.1";
+  version = "2.2.2";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pbs";
     repo = "pycaption";
-    rev = version;
-    hash = "sha256-IPCU9MsBY+Vsk6SrR9+3j4Izfhw5LeUrK0KUa3seSs4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-6c16S77K1UC7+rz8tF0tLlBspienhDbgSXhdJzkQZII=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pygit2/default.nix

···
 , pycparser
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pygit2";
-  version = "1.13.3";
-  format = "setuptools";
+  version = "1.14.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AlfGJgEeSvuZvbIIdUQ/cG+EIB1MkmN/AiFbmOrBPe0=";
+    hash = "sha256-9SntlmDtv5tiXMrn5RCY73NmLmFJZgkAl3LUYnqCaqg=";
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
     export DYLD_LIBRARY_PATH="${libgit2}/lib"
   '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   buildInputs = [
     libgit2
···
   meta = with lib; {
     description = "A set of Python bindings to the libgit2 shared library";
     homepage = "https://github.com/libgit2/pygit2";
+    changelog = "https://github.com/libgit2/pygit2/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ ];
   };

pkgs/development/python-modules/pygmo/default.nix

···
   };
 
   cmakeFlags = [
-    "-DPYGMO_INSTALL_PATH=${placeholder "out"}/lib/${python.libPrefix}/site-packages"
+    "-DPYGMO_INSTALL_PATH=${placeholder "out"}/${python.sitePackages}"
   ];
 
   nativeBuildInputs = [

pkgs/development/python-modules/pysnmplib/default.nix

···
 
 buildPythonPackage rec {
   pname = "pysnmplib";
-  version = "5.0.23";
+  version = "5.0.24";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "pysnmp";
     repo = "pysnmp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1h87fqaWMJN25SOD0xOkP3PFm1GPK99sT0o6ILCFVUI=";
+    hash = "sha256-AtQqXiy943cYhHDsyz9Yk5uA4xK7Q4p21CT3X3zYzrQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/rdkit/default.nix

···
   checkPhase = ''
     export QT_QPA_PLATFORM='offscreen'
     export RDBASE=$(realpath ..)
-    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
     (cd $RDBASE/rdkit/Chem && python $RDBASE/rdkit/TestRunner.py test_list.py)
   '';
 

pkgs/development/python-modules/recipe-scrapers/default.nix

···
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "14.53.0";
+  version = "14.54.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-uYUzn3JlsZmzzbk740aD3PW3OuGqdsAfU7HlYX5kPrY=";
+    hash = "sha256-Q7ubT7SBHNxyvfqFhDmBjnW7ssoXBsMZR+eYg5CntHY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/recursive-pth-loader/default.nix

···
 
   installPhase =
     ''
-      dst=$out/lib/${python.libPrefix}/site-packages
+      dst=$out/${python.sitePackages}
       mkdir -p $dst
       cp sitecustomize.* $dst/
     '';

pkgs/development/python-modules/requests-pkcs12/default.nix

···
 
 buildPythonPackage rec {
   pname = "requests-pkcs12";
-  version = "1.22";
+  version = "1.24";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "m-click";
     repo = "requests_pkcs12";
     rev = version;
-    hash = "sha256-YMFeWbPTwxP/+lYojXEbJf87FNHL6QrzOdOKF5JERSE=";
+    hash = "sha256-JLFUdg7kbjhlpGgrQ29U1TRTKhjDlvMGc/FRE+awfLc=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/rokuecp/default.nix

···
 
 buildPythonPackage rec {
   pname = "rokuecp";
-  version = "0.18.2";
+  version = "0.19.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "ctalkington";
     repo = "python-rokuecp";
     rev = "refs/tags/${version}";
-    hash = "sha256-fgnR3TZh+cHvC8qJnvwfrrtxCdEr89Uw8ciACzaQPYE=";
+    hash = "sha256-e7BY0Y2SdAtECKqOCUZfq7PcCR2bhQ4lESQD9jTaqpI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/safetensors/default.nix

···
 
 buildPythonPackage rec {
   pname = "safetensors";
-  version = "0.3.3";
-  format = "pyproject";
+  version = "0.4.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "huggingface";
-    repo = pname;
+    repo = "safetensors";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U+indMoLFN6vMZkJTWFG08lsdXuK5gOfgaHmUVl6DPk=";
+    hash = "sha256-hdPUI8k7CCQwt2C/AsjUHRmAL6ob+yCN97KkWtqOQL8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/bindings/python";
-    hash = "sha256-MhRs9tFCmVZI5O0EVRUbo4ZnUVRQ0EfQTU+E1K+qKZI=";
+    hash = "sha256-7n9aYlha6IaPsZ2zMfD5EIkrk8ENwMBwj41s6QU7ml0=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
···
     cargo
     rustc
     rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
   ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];

pkgs/development/python-modules/scmrepo/default.nix

···
 
 buildPythonPackage rec {
   pname = "scmrepo";
-  version = "2.0.4";
+  version = "2.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-gBGfL6Xet7ASdwRTFJ5nHpyeXi/pqlrL9o5nC3m48hk=";
+    hash = "sha256-KG7Y+1qqsgDwgRYsb3XbZnF6FduHJCAEizfuugBi0Go=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/selenium/default.nix

···
   '';
 
   postInstall = ''
-    DST_PREFIX=$out/lib/${python.libPrefix}/site-packages/selenium/webdriver/
+    DST_PREFIX=$out/${python.sitePackages}/selenium/webdriver/
     DST_REMOTE=$DST_PREFIX/remote/
     DST_FF=$DST_PREFIX/firefox
     cp ../rb/lib/selenium/webdriver/atoms/getAttribute.js $DST_REMOTE

pkgs/development/python-modules/stdlibs/default.nix

···
 
 buildPythonPackage rec {
   pname = "stdlibs";
-  version = "2023.12.15";
+  version = "2024.1.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
···
     owner = "omnilib";
     repo = "stdlibs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1Av10FNJkCC2XGNx1LDqd0GwiNPIDPXPFatW8+2XoaI=";
+    hash = "sha256-xf46ih7viVUKNIT1tLs5MQPNjNtQlQ2N9BJIGPt4Srk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/subarulink/default.nix

···
 
 buildPythonPackage rec {
   pname = "subarulink";
-  version = "0.7.9";
+  version = "0.7.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "G-Two";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-dRhZWV58tHoGpJ2bDWFov1timTHYnqTPILySauutyzg=";
+    hash = "sha256-OKZ55J294I3wPo2vL+wuMMCA4N1ejgtquA8Bf7wPiIs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/transformers/default.nix

···
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.37.1";
+  version = "4.37.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
···
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1W6Ec3+zdv75qd6s6Ogy/wkAKc+lA0xjZNAcMo8Q3ns=";
+    hash = "sha256-O8A+6f6Qwr/OqwzA3i3MPCmcwg1BoQY6mvhozrLz16Y=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/types-aiobotocore/default.nix

···
 
 buildPythonPackage rec {
   pname = "types-aiobotocore";
-  version = "2.11.0";
+  version = "2.11.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gw6q/ht30klxav7Du4siFvAkU6Mx2VIzNyDbJzaK47Y=";
+    hash = "sha256-LsG7jHSIEk//iAiBD6SwL6JjlQSezBFGEzrxeYtPrkQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/uamqp/default.nix

···
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , cython
 , certifi
 , CFNetwork
···
 
 buildPythonPackage rec {
   pname = "uamqp";
-  version = "1.6.5";
+  version = "1.6.8";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-uamqp-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-q8FxM4PBXLD5q68nrUJ+TGkui1yQJ3HHNF7jn+e+HkA=";
+    hash = "sha256-L4E7nnsVZ/VrOM0t4KtztU9ALmtGfi1vDzUi0ogtZOc=";
   };
 
   patches = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
     ./darwin-azure-c-shared-utility-corefoundation.patch
   ] ++ [
-    (fetchpatch {
-      name = "CVE-2024-21646.patch";
-      url = "https://github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78fe.patch";
-      stripLen = 1;
-      extraPrefix = "src/vendor/azure-uamqp-c/";
-      hash = "sha256-9o3TNKFeJvZRZeS6qo2Zl+JVFrrqAGYWDQbusz4Ou+g=";
-    })
     # Fix incompatible function pointer conversion error with clang 16.
     ./clang-fix-incompatible-function-pointer-conversion.patch
   ];

pkgs/development/python-modules/zcbor/default.nix

···
 
 buildPythonPackage rec {
   pname = "zcbor";
-  version = "0.8.0";
+  version = "0.8.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-47HwITfFcHNze3tt4vJxHB4BQ7oyl17DM8IV0WomM5Q=";
+    hash = "sha256-U3Y/r3tBhzK6bGnMxdqKzS7bLHyAzgpGZ5PVK9pw7Pk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python2-modules/pygtk/default.nix

···
   postInstall = ''
     rm $out/bin/pygtk-codegen-2.0
     ln -s ${pygobject2}/bin/pygobject-codegen-2.0  $out/bin/pygtk-codegen-2.0
-    ln -s ${pygobject2}/lib/${python.libPrefix}/site-packages/pygobject-${pygobject2.version}.pth \
-                  $out/lib/${python.libPrefix}/site-packages/${pname}-${version}.pth
+    ln -s ${pygobject2}/${python.sitePackages}/pygobject-${pygobject2.version}.pth \
+                  $out/${python.sitePackages}/${pname}-${version}.pth
   '';
 
   meta = with lib; {

pkgs/development/r-modules/default.nix

···
         substituteInPlace R/zzz.R \
           --replace ".onLoad <- function(...) {" \
             ".onLoad <- function(...) {
-          Sys.setenv(\"SPARK_HOME\" = Sys.getenv(\"SPARK_HOME\", unset = \"${pkgs.python3Packages.pyspark}/lib/${pkgs.python3Packages.python.libPrefix}/site-packages/pyspark\"))
+          Sys.setenv(\"SPARK_HOME\" = Sys.getenv(\"SPARK_HOME\", unset = \"${pkgs.python3Packages.pyspark}/${pkgs.python3Packages.python.sitePackages}/pyspark\"))
           Sys.setenv(\"JAVA_HOME\" = Sys.getenv(\"JAVA_HOME\", unset = \"${pkgs.jdk}\"))"
       '';
     });

pkgs/development/ruby-modules/gem-config/default.nix

···
           cp -R ext/fast_mmaped_file_rs $out
         '';
       };
-      hash = "sha256-XuQZPbFWqPHlrJvllkvLl1FjKeoAUbi8oKDrS2rY1KM=";
+      hash = if lib.versionAtLeast attrs.version "1.1.0"
+        then "sha256-tSyoCEBtMMkFfPynaMx8oc9bO7I+Pf6Y/f3Ld8uwlEE="
+        else "sha256-XuQZPbFWqPHlrJvllkvLl1FjKeoAUbi8oKDrS2rY1KM=";
     };
     nativeBuildInputs = [
       cargo

pkgs/development/tools/build-managers/moon/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-J/xlLKCoh+NekPcCAyM4ZN+OL6dLcworiO3gqCetu9A=";
+    hash = "sha256-wAY5jifyjK5jp5nlrwt/Krp96in06SnayTKx8inrf0A=";
   };
 
-  cargoHash = "sha256-TU1vWyAbbS9ScRdDgQMvY6Ov9uCv9TrzzhznyZleC0E=";
+  cargoHash = "sha256-qfDw+zmhk0M3gItiB7qfgiQCBRvOYBOirJFMyNRr714=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";

pkgs/development/tools/capnproto-java/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "capnproto-java";
-  version = "0.1.15";
+  version = "0.1.16";
 
   src = fetchFromGitHub {
     owner = "capnproto";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256:IcmzI1G0mXOlpzmiyeLD7o1p/eOeVpwkiGsgy5OIjxw=";
+    hash = "sha256-7uYtRHKsJvbE1b0HbNXGbRXpkUHHLjMDIWLlOUcQWDk=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/tools/database/clickhouse-backup/default.nix

···
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.4.22";
+  version = "2.4.23";
 
   src = fetchFromGitHub {
     owner = "AlexAkulov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PcUcafUV+SAzs0d/xrDDL0A5MMQN5IO1UjDBuENr37E=";
+    sha256 = "sha256-6S1XJEaZE6h69KfBddkJ+sE3OfUnY1KECPKyJ2pExRU=";
   };
 
   vendorHash = "sha256-DTykJR/dMIDKL5fTzDivsRf2DIfzJcm+AN3rQHflpJo=";

pkgs/development/tools/language-servers/jq-lsp/default.nix

···
 , fetchFromGitHub
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "jq-lsp";
-  version = "unstable-2023-10-27";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "jq-lsp";
-    rev = "b4707e7776a4eb3093b1a7533ebd41368240095a";
-    hash = "sha256-AU4xGweeFx+kSsrqkTtSjl+N77cITF/qvAVZGUZY5SE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-a3ZqVWG7kjWQzL1efrKc4s4D14qD/+6JM26vaduxhWg=";
   };
 
-  vendorHash = "sha256-ppQ81uERHBgOr/bm/CoDSWcK+IqHwvcL6RFi0DgoLuw=";
+  vendorHash = "sha256-bIe006I1ryvIJ4hC94Ux2YVdlmDIM4oZaK/qXafYYe0=";
+
+  # based on https://github.com/wader/jq-lsp/blob/master/.goreleaser.yml
+  CGO_ENABLED = 0;
+  GOFLAGS = [ "-trimpath" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.commit=${src.rev}"
+    "-X main.builtBy=Nix"
+  ];
 
   meta = with lib; {
     description = "jq language server";

pkgs/development/tools/minizinc/ide.nix

···
-{ lib, mkDerivation, fetchFromGitHub, qtbase, qtwebengine, qtwebkit, qmake, minizinc }:
+{ lib, stdenv, fetchFromGitHub, qtbase, qmake, qtwebsockets, minizinc, makeWrapper, Cocoa }:
 
-mkDerivation rec {
+let
+  executableLoc = if stdenv.isDarwin then "$out/Applications/MiniZincIDE.app/Contents/MacOS/MiniZincIDE" else "$out/bin/MiniZincIDE";
+in
+stdenv.mkDerivation rec {
   pname = "minizinc-ide";
-  version = "2.5.5";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "MiniZinc";
     repo = "MiniZincIDE";
     rev = version;
-    sha256 = "sha256-0U3KFRDam8psbCaEOcrwqzICAy1oBgo8SFEiR/PMqZk=";
+    hash = "sha256-3L/hulNI7e2wE9gMt2h3mS0ubHZ4kcVpwALCmWQtv7A=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ qmake ];
-  buildInputs = [ qtbase qtwebengine qtwebkit ];
+  nativeBuildInputs = [ qmake makeWrapper ];
+  buildInputs = [ qtbase qtwebsockets ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   sourceRoot = "${src.name}/MiniZincIDE";
 
   dontWrapQtApps = true;
 
-  postInstall = ''
-    wrapProgram $out/bin/MiniZincIDE --prefix PATH ":" ${lib.makeBinPath [ minizinc ]}
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    mv $out/bin/MiniZincIDE.app $out/Applications/
+  '' + ''
+    wrapProgram ${executableLoc} \
+      --prefix PATH ":" ${lib.makeBinPath [ minizinc ]} \
+      --set QT_QPA_PLATFORM_PLUGIN_PATH "${qtbase}/lib/qt-6/plugins/platforms"
   '';
 
   meta = with lib; {
···
       It is a subset of the higher-level language Zinc.
     '';
     license = licenses.mpl20;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = [ maintainers.dtzWill ];
   };
 }

pkgs/development/tools/misc/opengrok/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.13.1";
+  version = "1.13.2";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-3/BBLPoYX1/ft3MGiJD9OPtkB2PJM7bXkGRuXxTToXI=";
+    hash = "sha256-Er6f1KgMZ4e/o3TJkw6z96rxBGQ/KEc9gGI2W6m+b8U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/misc/texlab/default.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.12.2";
+  version = "5.12.3";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NEiUWMmJjhhK9XYbW1dla7iZJG4bdttbuSJmtO4f1UE=";
+    hash = "sha256-/QjaAzCPhXzsiRhnRRZcujmk1C9IONYlMfjp/a1iIDA=";
   };
 
-  cargoHash = "sha256-OFgBBO4RZ7oS2da9cGIePnLhfFdHfW3FdOT0B8bNC3g=";
+  cargoHash = "sha256-VDRLbhgQkPkeTpQxRsq8QEU53Zd4b5F0phoq2cAWIK8=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 

pkgs/development/tools/mysql-shell/innovation.nix

···
 , libssh
 , zstd
 , lz4
-, boost
 , readline
 , libtirpc
 , rpcsvc-proto
···
 let
   pythonDeps = with python3.pkgs; [ certifi paramiko pyyaml ];
 
-  mysqlShellVersion = "8.2.1";
-  mysqlServerVersion = "8.2.0";
+  mysqlShellVersion = "8.3.0";
+  mysqlServerVersion = "8.3.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell-innovation";
···
   srcs = [
     (fetchurl {
       url = "https://cdn.mysql.com//Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-itPj8cWuIVS+Y4rPVW6JgfcC0FKsxZV+d23xciwhGXk=";
+      hash = "sha256-HyFJWgt6grJKRT1S4hU6gUs8pwTsz5mXZtVFvOUvOG4=";
     })
     (fetchurl {
       url = "https://cdn.mysql.com//Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-m6WdFow28bxW52q+m8PniZCU/1Ej4secdPQi8GKlziE=";
+      hash = "sha256-O0j/gvS9fR/xp9plytjj249H7LY/+eyst1IsFpy318U=";
     })
   ];
 
···
     ++ lib.optionals stdenv.isDarwin [ cctools DarwinTools ];
 
   buildInputs = [
-    boost
     curl
     libedit
     libssh
···
     # Build MySQL
     echo "Building mysqlclient mysqlxclient"
 
-    cmake -DWITH_BOOST=system -DWITH_SYSTEM_LIBS=ON -DWITH_ROUTER=OFF -DWITH_UNIT_TESTS=OFF \
+    cmake -DWITH_SYSTEM_LIBS=ON -DWITH_FIDO=system -DWITH_ROUTER=OFF -DWITH_UNIT_TESTS=OFF \
       -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build
 
     cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} --target mysqlclient mysqlxclient

pkgs/development/tools/packer/default.nix

···
 
 buildGoModule rec {
   pname = "packer";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "packer";
     rev = "v${version}";
-    hash = "sha256-pHqYO3a9JruOCbMbLLQ2BqS4bcCeaBf82cBxGVHgLoY=";
+    hash = "sha256-P7QG4ldOJn83w5XxIzC1dhVmn2e/gcwHBT9cZiQmsbo=";
   };
 
-  vendorHash = "sha256-ydG1nINW9uGYv5uNlJ6p8GHSkIW83qGpUAfRU+yQXmc=";
+  vendorHash = "sha256-KtMK6jZ9c84OVWJC1njgOh1U+wrFo4G6Qt/XfOFvIhE=";
 
   subPackages = [ "." ];
 

pkgs/development/tools/postiats-utilities/default.nix

···
   '';
 
   installPhase = ''
-    libdir="$out/lib/${python3.libPrefix}/site-packages"
+    libdir="$out/${python3.sitePackages}"
     mkdir -p "$libdir"
     cp -r postiats "$libdir"
 

pkgs/development/tools/pscale/default.nix

···
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.178.0";
+  version = "0.181.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-Ttz6Ny9HYG07rp/6TkWw1E3DTRw1IkLvMBBm/gkI1j0=";
+    sha256 = "sha256-f/SrH/xdH0HYxGAbbIvr7yAgHJZlIfT/P1mC+yzQ7Vs=";
   };
 
-  vendorHash = "sha256-0xHyIe5fGld6LJmhKqTR/6toecRX/pyxEJabW47HU6Y=";
+  vendorHash = "sha256-Fj2yOENvomRcaIgP91NRl8rcggjPFZbKTwdUBBizios=";
 
   ldflags = [
     "-s" "-w"

pkgs/development/tools/sentry-cli/default.nix

···
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.26.0";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-9Qwonp2tGmaffYj5Vv09+Z3YcbFSFmeS/zc7PXjmrk4=";
+    sha256 = "sha256-dhIja1f+57QdgE0uYBNbgSsmFNE7h0GdcyBx4Z8bGpA=";
   };
   doCheck = false;
 
···
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoHash = "sha256-t1Gqis4Gd6Zdkka8u/tCRM5xmm3z85OqZIkINm9jNyc=";
+  cargoHash = "sha256-zLTdpbBy+41tVEItSjkHCu+D3YKiBJqlpAPMpUt5+VM=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";

pkgs/development/tools/twilio-cli/default.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.17.0";
+  version = "5.17.1";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-7BJ/9dqEKBjH89XDyIonRbfCn8cyjvgtV2PwdzGIUro=";
+    hash = "sha256-wgZdivfFjkX3bMmBLWY5vy32pXE7CqEkRGQqIhJrcdE=";
   };
 
   buildInputs = [ nodejs-slim ];

pkgs/development/tools/zed/default.nix

···
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mBJmAV7ax4F61gP8yeiJj/EQyJi3zaex6jT/CKzR3LU=";
+    sha256 = "sha256-xyTHCBvklK8x6V7WsWDYytnVEfLcja78crvs62WJJ9o=";
   };
 
-  vendorHash = "sha256-BWvMy1dc3PzAc3kDTXtI6Y8kjRGLWR+aUleItg5EgRU=";
+  vendorHash = "sha256-m8GOKBwXlNhjEIkkbaIOAGslX4WRVPZ0OknGEG29b4E=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 

pkgs/development/web/minify/default.nix

···
 
 buildGoModule rec {
   pname = "minify";
-  version = "2.20.15";
+  version = "2.20.16";
 
   src = fetchFromGitHub {
     owner = "tdewolff";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/CTQ1Ok9ODueM2cDpDTAnpu5vvvYAAVxqhF+Uu487N4=";
+    hash = "sha256-0RiSNRoRmN7X2udwgGaArXgIRTaxaGH4fo3usiCJNbA=";
   };
 
-  vendorHash = "sha256-OrBFQl/IBzMFK3O1C1vsJdRRrq9AP6rs2KUIcyx2IlQ=";
+  vendorHash = "sha256-8OEF2sAJZuGX4z/OsXCAkRR82JO3rYCEJQbidIjGOJ8=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/games/ferium/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "ferium";
-  version = "4.4.1";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "gorilla-devs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3ILDR6CmR/CTzZfUEPD10TQZRSDKSqHmwxU3GPHIyK8=";
+    sha256 = "sha256-1avmzaIDz4/ARewB7yLYMBVtwdkY4FFfwcHAZSyg1Xc=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoHash = "sha256-00rzn8eWcxRfPvIT2+EVQLd6e8gnMWx78QrwURpxstg=";
+  cargoHash = "sha256-IOnTJ/0mul7buBDNHkeqMM9NrFiX58xa03bVGrbAdNg=";
 
   # Disable the GUI file picker so that GTK/XDG dependencies aren't used
   buildNoDefaultFeatures = true;

pkgs/games/nile/default.nix

···
 
 buildPythonApplication rec {
   pname = "nile";
-  version = "unstable-2024-01-25";
+  version = "unstable-2024-01-27";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "nile";
-    rev = "731d653f71d679cc318b411d7b3a197396ca59d4";
-    hash = "sha256-oja7xSIXZT1/0t1qep0C9tU524L4GVMrXF5WWiIXwyA=";
+    rev = "f4eca37794b7c06affcf0bc28660de7c54eddc9a";
+    hash = "sha256-WsCR2xjQc4Kx1nUdApxbkkyX+nYoLl5IsSUVW3rjT1Q=";
   };
 
   disabled = pythonOlder "3.8";

pkgs/games/vintagestory/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.19.1";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-PrsClGSXTah5kkhww7slfkwpo0gJryf6pm61LsCYbiE=";
+    hash = "sha256-ULxwNdQLQCWJqCTiGtT1X/Y32f406FT/UPAJNBYrV/s=";
   };
 
 

pkgs/os-specific/darwin/airbuddy/default.nix

···
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
···
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AirBuddy.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AirBuddy.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    mnt=$(mktemp -d)
+    runHook preUnpack
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
+    7zz x $src
 
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AirBuddy.app";

pkgs/os-specific/darwin/aldente/default.nix

···
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
···
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AlDente.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AlDente.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    if ! [[ "$curSrc" =~ \.dmg$ ]]; then return 1; fi
-    mnt=$(mktemp -d -t ci-XXXXXXXXXX)
+    runHook preUnpack
 
-    function finish {
-      /usr/bin/hdiutil detach $mnt -force
-    }
-    trap finish EXIT
+    7zz x $src
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
-
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AlDente.app";

pkgs/os-specific/linux/lxc/default.nix

···
     systemd
   ];
 
-  patches = [ ./add-meson-options.patch ];
+  patches = [
+     # make build more nix compatible
+    ./add-meson-options.patch
+
+    # fix docbook2man version detection
+    ./docbook-hack.patch
+  ];
 
   mesonFlags = [
     "-Dinstall-init-files=false"

pkgs/os-specific/linux/lxc/docbook-hack.patch

···
+diff --git a/meson.build b/meson.build
+index d1527679e..360824994 100644
+--- a/meson.build
++++ b/meson.build
+@@ -320,15 +320,7 @@ docconf.set('LXC_USERNIC_CONF', lxc_user_network_conf)
+ docconf.set('LXC_USERNIC_DB', lxc_user_network_db)
+ docconf.set('PACKAGE_VERSION', version_data.get('LXC_VERSION'))
+ docconf.set('docdtd', '"-//OASIS//DTD DocBook XML" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"')
+-sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false, version: '>=0.8')
+-if not sgml2man.found()
+-    sgml2man = find_program('docbook2man', required: false, version: '<0.8')
+-    if sgml2man.found()
+-        docconf.set('docdtd', '"-//Davenport//DTD DocBook V3.0//EN"')
+-    elif want_mans
+-        error('missing required docbook2x or docbook-utils dependency')
+-    endif
+-endif
++sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false)
+ 
+ ## Threads.
+ threads = dependency('threads')

pkgs/servers/apache-airflow/python-package.nix

···
   ];
 
   postInstall = ''
-    cp -rv ${airflow-frontend}/static/dist $out/lib/${python.libPrefix}/site-packages/airflow/www/static
+    cp -rv ${airflow-frontend}/static/dist $out/${python.sitePackages}/airflow/www/static
     # Needed for pythonImportsCheck below
     export HOME=$(mktemp -d)
   '';

pkgs/servers/baserow/default.nix

···
 
   fixupPhase = ''
     cp -r src/baserow/contrib/database/{api,action,trash,formula,file_import} \
-      $out/lib/${python.libPrefix}/site-packages/baserow/contrib/database/
-    cp -r src/baserow/core/management/backup $out/lib/${python.libPrefix}/site-packages/baserow/core/management/
+      $out/${python.sitePackages}/baserow/contrib/database/
+    cp -r src/baserow/core/management/backup $out/${python.sitePackages}/baserow/core/management/
   '';
 
   disabledTests = [

pkgs/servers/dex/default.nix

···
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests, testers, dex-oidc }:
 
 buildGoModule rec {
   pname = "dex";
···
   ];
 
   ldflags = [
-    "-w" "-s" "-X github.com/dexidp/dex/version.Version=${src.rev}"
+    "-w" "-s" "-X main.version=${src.rev}"
   ];
 
   postInstall = ''
···
     cp -r $src/web $out/share/web
   '';
 
-  passthru.tests = { inherit (nixosTests) dex-oidc; };
+  passthru.tests = {
+    inherit (nixosTests) dex-oidc;
+    version = testers.testVersion {
+      package = dex-oidc;
+      command = "dex version";
+      version = "v${version}";
+    };
+  };
 
   meta = with lib; {
     description = "OpenID Connect and OAuth2 identity provider with pluggable connectors";

pkgs/servers/gpsd/default.nix

···
     substituteInPlace SConscript --replace "env['CCVERSION']" "env['CC']"
 
     sconsFlags+=" udevdir=$out/lib/udev"
-    sconsFlags+=" python_libdir=$out/lib/${python3Packages.python.libPrefix}/site-packages"
+    sconsFlags+=" python_libdir=$out/${python3Packages.python.sitePackages}"
   '';
 
   # - leapfetch=no disables going online at build time to fetch leap-seconds

pkgs/servers/komga/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.10.1";
+  version = "1.10.3";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-fgboHXS5lBvhnAfKUbCmKVjvRp+WF7kuU/VTEgky3VI=";
+    sha256 = "sha256-t/nwqEVrsBeELJLLtizDI737VnODRsuPfQlnDUBfoKc=";
   };
 
   nativeBuildInputs = [

pkgs/servers/matrix-synapse/default.nix

···
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.99.0";
+  version = "1.100.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-NS0in7zUkIS+fI5gQEua9y1UXspEHWNCntyZHZCtfPg=";
+    hash = "sha256-6YK/VV0ELvMJoA5ipmoB4S13HqA0UEOnQ6JbQdlkYWU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-FQhHpbp8Rkkqp6Ngly/HP8iWGlWh5CDaztgAwKB/afI=";
+    hash = "sha256-oXIraayA6Dd8aYirRhM9Av8x7bj+WZI6o7dEr9OCtdk=";
   };
 
   postPatch = ''

pkgs/servers/monitoring/prometheus/openvpn-exporter.nix

···
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "openvpn_exporter-unstable";
-  version = "0.3.0";
-
-  src = fetchFromGitHub {
-    owner = "kumina";
-    repo = "openvpn_exporter";
-    rev = "v${version}";
-    hash = "sha256-tIB4yujZj36APGAe4doKF4YlEUnieeC8bTV+FFKxpJI=";
-  };
-
-  vendorHash = "sha256-urxzQU0bBS49mBg2jm6jHNZA3MTS3DlQY7D5Fa0F/Mk=";
-
-  meta = with lib; {
-    inherit (src.meta) homepage;
-    description = "Prometheus exporter for OpenVPN";
-    broken = true;
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
-  };
-}

pkgs/servers/monitoring/prometheus/sql-exporter.nix

···
 
 buildGoModule rec {
   pname = "sql_exporter";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "justwatchcom";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TkTxmumL7T8stNPWkVrMdB23jjMyQcv2x9F+rK6Vj6E=";
+    sha256 = "sha256-Cp8+vVGyAwYcrBiEN1SmUnHqWFGtuypvzfDROJgOn28=";
   };
 
   vendorHash = null;

pkgs/servers/monitoring/prometheus/unbound-exporter.nix

···
 }:
 
 let
-  version = "0.4.4";
+  version = "0.4.5";
 in
 buildGoModule {
   pname = "unbound_exporter";
···
     owner = "letsencrypt";
     repo = "unbound_exporter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0eo56z5b+hzKCY5OKg/9F7rjLyoSKPJoHLoXeMjCuFU=";
+    hash = "sha256-p2VSIQXTnNGgqUSvWQ4J3SbrnWGBO21ps4VCWOjioLM=";
   };
 
-  vendorHash = "sha256-4aWuf9UTPQseEwDJfWIcQW4uGMffRnWlHhiu0yMz4vk=";
+  vendorHash = "sha256-q3JqAGeEU5WZWTzdFE9hR2dAnsFjMM44JiYdodZrnhs=";
 
   passthru.tests = {
     inherit (nixosTests.prometheus-exporters) unbound;

pkgs/servers/rustdesk-server/Cargo.lock

···
 
 [[package]]
 name = "hbbs"
-version = "1.1.9"
+version = "1.1.10-3"
 dependencies = [
  "async-speed-limit",
  "async-trait",
···
 
 [[package]]
 name = "mac_address"
-version = "1.1.3"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d1bc1084549d60725ccc53a2bfa07f67fe4689fda07b05a36531f2988104a"
+checksum = "4863ee94f19ed315bf3bc00299338d857d4b5bc856af375cc97d237382ad3856"
 dependencies = [
  "nix",
  "winapi",

pkgs/servers/rustdesk-server/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "rustdesk-server";
-  version = "1.1.9";
+  version = "1.1.10-3";
 
   src = fetchFromGitHub {
     owner = "rustdesk";
     repo = "rustdesk-server";
     rev = version;
-    hash = "sha256-bC1eraMSa9Lz5icvU7dPnEIeqE5TaW8HseBQMRmDCXQ=";
+    hash = "sha256-iXe5V99hvtdRi6t/2wUMQ/aSCWfscA1s48vrdO6H2Rw=";
   };
 
   cargoLock = {

pkgs/servers/seafile-server/default.nix

···
-{ stdenv, lib, fetchFromGitHub, pkg-config, python3, autoreconfHook
-, libuuid, sqlite, glib, libevent, libsearpc, openssl, fuse, libarchive, which
-, vala, cmake, oniguruma, nixosTests }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, python3
+, autoreconfHook
+, libuuid
+, sqlite
+, glib
+, libevent
+, libsearpc
+, openssl
+, fuse
+, libarchive
+, libjwt
+, curl
+, which
+, vala
+, cmake
+, oniguruma
+, nixosTests
+}:
 
 let
   # seafile-server relies on a specific version of libevhtp.
···
   libevhtp = import ./libevhtp.nix {
     inherit stdenv lib fetchFromGitHub cmake libevent;
   };
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "seafile-server";
-  version = "9.0.10";
+  version = "10.0.1";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-server";
-    rev = "079a8b65a543bfbc48e7671c3dbbffe19fd02944"; # using a fixed revision because upstream may re-tag releases :/
-    sha256 = "sha256-F1n4E6ajpri3CVM7B28UKoTV1oOLr5nTy6Lw0E5tCrc=";
+    rev = "db09baec1b88fc131bf4453a808ab63a3fc714c9"; # using a fixed revision because upstream may re-tag releases :/
+    sha256 = "sha256-a5vtJcbnaYzq6/3xmhbWk23BZ+Wil/Tb/q22ML4bDqs=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
···
     python3
     fuse
     libarchive
+    libjwt
+    curl
     which
     vala
     libevhtp

pkgs/test/buildFHSEnv/default.nix

···
+{ lib
+, buildFHSEnv
+, runCommand
+, stdenv
+, fetchurl
+, dpkg
+, glibc
+, callPackage
+}:
+
+let
+  getSharedObjectFromDebian = sharedObjectName: src: stdenv.mkDerivation  {
+    name = "${sharedObjectName}-fetcher";
+    inherit src;
+    nativeBuildInputs = [
+      dpkg
+    ];
+    dontBuild = true;
+    dontConfigure = true;
+    dontFixup = true;
+    installPhase = ''
+      echo shared objects found are:
+      ls -l usr/lib/*/
+      cp usr/lib/*/${sharedObjectName} $out
+    '';
+  };
+
+  makeSharedObjectTest = sharedObject: targetPkgs: let
+    lddFHSEnv = buildFHSEnv {
+      name = "ldd-with-ncurses-FHS-env";
+      inherit targetPkgs;
+      runScript = "ldd";
+    };
+    ldd-in-FHS = "${lddFHSEnv}/bin/${lddFHSEnv.name}";
+    ldd = "${lib.getBin glibc}/bin/ldd";
+    find_libFHSEnv = buildFHSEnv {
+      name = "ls-with-ncurses-FHS-env";
+      targetPkgs = p: [
+        p.ncurses5
+      ];
+      runScript = "find /lib/ -executable";
+    };
+    find_lib-in-FHS = "${find_libFHSEnv}/bin/${find_libFHSEnv.name}";
+  in runCommand "FHS-lib-test" {} ''
+    echo original ldd output is:
+    ${ldd} ${sharedObject}
+    lddOutput="$(${ldd-in-FHS} ${sharedObject})"
+    echo ldd output inside FHS is:
+    echo "$lddOutput"
+    if echo $lddOutput | grep -q "not found"; then
+      echo "shared object could not find all dependencies in the FHS!"
+      echo The libraries below where found in the FHS:
+      ${find_lib-in-FHS}
+      exit 1
+    else
+      echo $lddOutput > $out
+    fi
+  '';
+
+in {
+  # This test proves an issue with buildFHSEnv - don't expect it to succeed,
+  # this is discussed in https://github.com/NixOS/nixpkgs/pull/279844 .
+  libtinfo = makeSharedObjectTest (getSharedObjectFromDebian "libedit.so.2.0.70" (fetchurl {
+    url = "mirror://debian/pool/main/libe/libedit/libedit2_3.1-20221030-2_amd64.deb";
+    hash = "sha256-HPFKvycW0yedsS0GV6VzfPcAdKHnHTvfcyBmJePInOY=";
+  })) (p: let
+    ncurses' = p.ncurses.overrideAttrs (old: {
+      configureFlags = old.configureFlags ++ [ "--with-termlib" ];
+      postFixup = "";
+    });
+  in [
+    (ncurses'.override { unicodeSupport = false; })
+    p.libbsd
+  ]);
+
+  liblzma = makeSharedObjectTest (getSharedObjectFromDebian "libxml2.so.2.9.14" (fetchurl {
+    url = "mirror://debian/pool/main/libx/libxml2/libxml2_2.9.14+dfsg-1.3~deb12u1_amd64.deb";
+    hash = "sha256-NbdstwOPwclAIEpPBfM/+3nQJzU85Gk5fZrc+Pmz4ac=";
+  })) (p: [
+    p.xz
+    p.zlib
+    p.icu72
+  ]);
+}

pkgs/test/default.nix

···
 
   pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
 
+  buildFHSEnv = recurseIntoAttrs (callPackages ./buildFHSEnv { });
+
   nixpkgs-check-by-name = callPackage ./nixpkgs-check-by-name { };
 
   auto-patchelf-hook = callPackage ./auto-patchelf-hook { };

pkgs/tools/admin/balena-cli/default.nix

···
   };
 in buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "17.5.0";
+  version = "17.5.1";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-qc1qYDdWIk3r/0B9mpV0BqNFLvG5in2KSBs+0/s5oCk=";
+    hash = "sha256-DapVJAXfTdGjtVBIKuc+xKZ6yWw1eC2pxTwt5O0QrWk=";
   };
 
-  npmDepsHash = "sha256-WZoBSZuW8qLaiCc/KY9MO+IeUy3r44OFI5s5wdsNUaE=";
+  npmDepsHash = "sha256-yAcUGOSrQ+AB2b0eDKCMhZRP/LEKcmJmO5xNhVJcqX4=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/tools/admin/copilot-cli/default.nix

···
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.33.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4LDeilWi3FzvrvHjEyQKQi1GxouSlzDY96yBuMfpsXM=";
+    hash = "sha256-/xuS5tJBV67gXGHQ93FpMXMLXnhAgnicQnKx/pnwyAM=";
   };
 
-  vendorHash = "sha256-EqgOyjb2raE5hW3h+czbsi/F9SVNDwPWM1L6GC7v6IY=";
+  vendorHash = "sha256-ekAuvvLxk9cwIuElosc6QbsW7+3f/mO8vsA74DA82D0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/admin/gam/default.nix

···
     runHook preInstall
     mkdir -p $out/bin
     cp gam.py $out/bin/gam
-    mkdir -p $out/lib/${python3.libPrefix}/site-packages
-    cp -r gam $out/lib/${python3.libPrefix}/site-packages
+    mkdir -p $out/${python3.sitePackages}
+    cp -r gam $out/${python3.sitePackages}
     runHook postInstall
   '';
 

pkgs/tools/admin/qovery-cli/default.nix

···
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.81.1";
+  version = "0.82.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vzE2Slj69kJbXHNKM9mCBwPkbOqG3DkVa6y4DmfBdn0=";
+    hash = "sha256-jdYCJU+oQtfG79iJEvnbrDZUIcV06b1SNQv3d6aW+Bo=";
   };
 
   vendorHash = "sha256-IDKJaWnQsOtghpCh7UyO6RzWgSZS0S0jdF5hVV7xVbs=";

pkgs/tools/audio/tts/default.nix

···
 
     for file in $(grep -rl 'python TTS/bin' tests); do
       substituteInPlace "$file" \
-        --replace "python TTS/bin" "${python.interpreter} $out/lib/${python.libPrefix}/site-packages/TTS/bin"
+        --replace "python TTS/bin" "${python.interpreter} $out/${python.sitePackages}/TTS/bin"
     done
   '';
 

pkgs/tools/misc/debian-devscripts/default.nix

···
 
   preConfigure = ''
     export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${dpkg}";
-    tgtpy="$out/lib/${python.libPrefix}/site-packages"
+    tgtpy="$out/${python.sitePackages}"
     mkdir -p "$tgtpy"
     export PYTHONPATH="$PYTHONPATH''${PYTHONPATH:+:}$tgtpy"
     find lib po4a scripts -type f -exec sed -r \

pkgs/tools/misc/fastfetch/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-+p85f2cH+syRpnSozc++jPT4Hbn/kGkVsUv3L5Na8+s=";
+    hash = "sha256-s0N3Rt3lLOCyaeXeNYu6hlGtNtGR+YC7Aj4/3SeVMpQ=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/twm/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "twm";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "vinnymeller";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r9l5gNWoIkKHzjHOCK7qnPLfg6O+km7OX+6pHQKhN6g=";
+    sha256 = "sha256-gvo5+lZNe5QOHNI4nrPbCR65D+VFf/anmLVdu5RXJiY=";
   };
 
-  cargoHash = "sha256-0nCMgfnEqr0D3HpocUN/Hc9tG9byu2CYvBy/8vIU+bI=";
+  cargoHash = "sha256-5+1B+SbrIrswGjtNLlwbtLEhARMZNs75DFK8wQI2O0M=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];

pkgs/tools/misc/wasm-tools/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.0.55";
+  version = "1.0.57";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-9HcHM5ao0lSGctvjYQZNb5wlNsYPTD3NtPDZA/kHJdY=";
+    hash = "sha256-3syV4zPoSJtMiogmRu90pYTwNw2T/dRKFWczYI2J1r0=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-fU9tpN+tVlwbTNWinylcRACSLhDD/uPPGW6GNWm/tvo=";
+  cargoHash = "sha256-w1BVh7/L4+CXTgjkQKzbzgqw3XE49hYrkWtaNmcfDi4=";
   cargoBuildFlags = [ "--package" "wasm-tools" ];
   cargoTestFlags = [ "--all" ];
 

pkgs/tools/networking/xdp-tools/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "xdp-tools";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${version}";
-    hash = "sha256-5rc3RbAgWVd7Tt16NoHymFME5a9tBCmup+1ZmnMGPhs=";
+    hash = "sha256-kWgjt7mYwHtf8I4sXPzzrQJkWQyC8AC85ulGOWmQNZI=";
   };
 
   outputs = [ "out" "lib" ];

pkgs/tools/package-management/apx/default.nix

···
 
 buildGoModule rec {
   pname = "apx";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "apx";
     rev = "v${version}";
-    hash = "sha256-/RGL2mCfJiJInnt5zgc1xXPqZxXCAcoWIbky99okvL0=";
+    hash = "sha256-OLJrwibw9uX5ty7FRZ0q8zx0i1vQXRKK8reQsJFFxAI=";
   };
 
   vendorHash = null;
···
   '';
 
   postInstall = ''
-    install -m 444 -D config/apx.json -t $out/share/apx/
+    install -Dm444 config/apx.json -t $out/share/apx/
     installManPage man/man1/*
+    install -Dm444 README.md -t $out/share/docs/apx
+    install -Dm444 COPYING.md $out/share/licenses/apx/LICENSE
   '';
 
   meta = with lib; {

pkgs/tools/security/arubaotp-seed-extractor/default.nix

···
   ];
 
   installPhase = ''
-    libdir="$out/lib/${python3Packages.python.libPrefix}/site-packages/arubaotp-seed-extractor"
+    libdir="$out/${python3Packages.python.sitePackages}/arubaotp-seed-extractor"
     mkdir -p "$libdir"
     cp scripts/* "$libdir"
     chmod +x "$libdir/main.py"

pkgs/tools/security/cyclonedx-gomod/default.nix

···
 
 buildGoModule rec {
   pname = "cyclonedx-gomod";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-whAHZDUQBJaYu+OZiqcYzWxOru1GXDQ4FMDCj+ngCDs=";
+    hash = "sha256-3YHlh7edRWU8plAJh96RDkrC9YUQjvV4vNGOxmbS0sA=";
   };
 
-  vendorHash = "sha256-FpsZonGJSzbAsnM00qq/qiTJLUN4q08dR+6rhTKvX0I=";
+  vendorHash = "sha256-0Fx9pOofcY5rpX6DU2xPeg7xEZ8ows/DWwyV5B7LHGY=";
 
   # Tests require network access and cyclonedx executable
   doCheck = false;

pkgs/tools/security/hash-slinger/default.nix

···
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/man $out/lib/${python3.libPrefix}/site-packages
+    mkdir -p $out/bin $out/man $out/${python3.sitePackages}
     make install
     wrapPythonPrograms
   '';

pkgs/tools/security/notation/default.nix

···
 
 buildGoModule rec {
   pname = "notation";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "notaryproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KcB5l6TRZhciXO04mz5iORR4//cAhrh+o4Kdq7LA4A4=";
+    hash = "sha256-MJBFdtx+HkPCN1SIohKOy33BW746GNN2fWkr7TIuBmk=";
   };
 
-  vendorHash = "sha256-r58ZV63KIHKxh5HDeQRfd0OF0s7xpC4sXvsYLhm8AIE=";
+  vendorHash = "sha256-USkufc1dG4eyRfRJHSX4mVZHnvOc5onHenF98Aedac4=";
 
   # This is a Go sub-module and cannot be built directly (e2e tests).
   excludedPackages = [ "./test" ];
···
     homepage = "https://notaryproject.dev/";
     license = licenses.asl20;
     maintainers = with maintainers; [ aaronjheng ];
+    mainProgram = "notation";
   };
 }

pkgs/tools/security/nuclei/default.nix

···
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     rev = "refs/tags/v${version}";
-    hash = "sha256-O7GWH65zOKK9mPlap5BL302ow/ruXOz8CxUjaHfIj3w=";
+    hash = "sha256-uNPMQ4I85R8xY9IrEX3puaKXvk3+nTT32fimEpzStjM=";
   };
 
-  vendorHash = "sha256-mwqDoX79cnG6zPncN1l5uAdOSbyAVWzw2dV+2rnBsqw=";
+  vendorHash = "sha256-bk8vgCZqzLYmtO2sj5p3l22X5SSZ5zA5RvlrijsiW10=";
 
   subPackages = [
     "cmd/nuclei/"

pkgs/tools/security/pass/extensions/audit/default.nix

···
   installFlags = [ "DESTDIR=${placeholder "out"}" "PREFIX=" ];
   postInstall = ''
     wrapProgram $out/lib/password-store/extensions/audit.bash \
-      --prefix PYTHONPATH : "$out/lib/${pythonEnv.libPrefix}/site-packages" \
+      --prefix PYTHONPATH : "$out/${pythonEnv.sitePackages}" \
       --run "export COMMAND"
   '';
 

pkgs/tools/security/trufflehog/default.nix

···
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.65.0";
+  version = "3.66.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-v2RhyXwjCvlhbfFiTuURatEq5foylatGOdqQCYQbZAE=";
+    hash = "sha256-NTBZldpocuFVJvI+wL74S3mj6waiNu1Hkncan4oqd8U=";
   };
 
   vendorHash = "sha256-yhgNsiKh0sgVn0N1LqpWT1Utapc5DL+Ueposg+bAO5o=";

pkgs/tools/text/crowdin-cli/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.16.1";
+  version = "3.17.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    hash = "sha256-B68pCNQYly/0OQJkSjztP08bQGaGQeE+AAOiu5VbszY=";
+    hash = "sha256-thiwggDtzQsfbzwWF2tTMRQHfktq+W9fBH6QT7t2gKc=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];

pkgs/tools/text/diffstat/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "diffstat";
-  version = "1.65";
+  version = "1.66";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/diffstat/diffstat-${version}.tgz"
       "https://invisible-mirror.net/archives/diffstat/diffstat-${version}.tgz"
     ];
-    sha256 = "sha256-jPJ0JJJt682FkhdVw5FVWSiCRL0QP2LXQNxrg7VXooo=";
+    sha256 = "sha256-9UUxu+Mujg+kYfAYtB469Ra2MggBcvNh8F5QNn7Ltp4=";
   };
 
   meta = with lib; {

pkgs/tools/text/vale/default.nix

···
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.0.5";
+  version = "3.0.6";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
···
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-tRsfmQ3FkRQgIg3lD8xjbn1iV2QcwDdW5pmKh96+2Gs=";
+    hash = "sha256-hCGJI2copXuyrxq4X1akR2Vz3DYS87dv3RZdw3gopNM=";
   };
 
-  vendorHash = "sha256-AsBbJJQs+pU2UNfEFvNnPwaaabTrXvFBQLcriIA2ST4=";
+  vendorHash = "sha256-dkX/aQKuYNRynHuoj9m/6DI/mCEdp9XcKDt4TLx1rDU=";
 
   postInstall = ''
     mkdir -p $data/share/vale

pkgs/tools/wayland/hyprland-per-window-layout/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = pname;
     rev = version;
-    hash = "sha256-g6cFZXEWKB9IxP/ARe788tXFpDofJNDWMwUU15yKYhA=";
+    hash = "sha256-Tci3OR7c8hEWAnFsBlSNZYt7znAxPRDhJV+1q7fw6z8=";
   };
 
-  cargoHash = "sha256-kVu81NnwcKksHeS5ZM/SgTuh2olMgdBBxY3cJxwuW0Q=";
+  cargoHash = "sha256-lVNephJ6UfdM6dPnHs+jHG9A79qHEsrm7tcjcDralnY=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";

pkgs/top-level/aliases.nix

···
   probe-rs-cli = throw "probe-rs-cli is now part of the probe-rs package"; # Added 2023-07-03
   processing3 = throw "'processing3' has been renamed to/replaced by 'processing'"; # Converted to throw 2023-09-10
   prometheus-dmarc-exporter = dmarc-metrics-exporter; # added 2022-05-31
+  prometheus-openvpn-exporter = throw "'prometheus-openvpn-exporter' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-12-23
   prometheus-speedtest-exporter = throw "prometheus-speedtest-exporter was removed as unmaintained"; # Added 2023-07-31
   protobuf3_17 = throw "protobuf3_17 does not receive updates anymore and has been removed"; # Added 2023-05-21
   protobuf3_19 = throw "protobuf3_19 does not receive updates anymore and has been removed"; # Added 2023-10-01

pkgs/top-level/all-packages.nix

···
     inherit (darwin) cctools DarwinTools;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     antlr = antlr4_10;
-    boost = boost177; # Configure checks for specific version.
     icu =  icu69;
     protobuf = protobuf_21;
   };
···
   authenticator = callPackage ../applications/misc/authenticator { };
 
   authelia = callPackage ../servers/authelia { };
+
+  authentik-outposts = recurseIntoAttrs (callPackages ../by-name/au/authentik/outposts.nix { });
 
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
···
 
   publii = callPackage ../development/web/publii {};
 
-  umr = callPackage ../development/misc/umr {
-    llvmPackages = llvmPackages_14;
-  };
+  umr = callPackage ../development/misc/umr { };
 
   refurb = callPackage ../development/tools/refurb { };
 
···
   minify = callPackage ../development/web/minify { };
 
   minizinc = callPackage ../development/tools/minizinc { };
-  minizincide = libsForQt5.callPackage ../development/tools/minizinc/ide.nix { };
+  minizincide = qt6Packages.callPackage ../development/tools/minizinc/ide.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa;
+  };
 
   mkcert = callPackage ../development/tools/misc/mkcert { };
 
···
   };
   prometheus-nut-exporter = callPackage ../servers/monitoring/prometheus/nut-exporter.nix { };
   prometheus-openldap-exporter = callPackage ../servers/monitoring/prometheus/openldap-exporter.nix { } ;
-  prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
   prometheus-pgbouncer-exporter = callPackage ../servers/monitoring/prometheus/pgbouncer-exporter.nix { };
   prometheus-php-fpm-exporter = callPackage ../servers/monitoring/prometheus/php-fpm-exporter.nix { };
   prometheus-pihole-exporter = callPackage ../servers/monitoring/prometheus/pihole-exporter.nix {  };
···
       };
     };
   };
-  gnuradio3_8 = disable-warnings-if-gcc13 (callPackage ../applications/radio/gnuradio/wrapper.nix {
-    unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix {
+  gnuradio3_8 = callPackage ../applications/radio/gnuradio/wrapper.nix {
+    unwrapped = callPackage ../applications/radio/gnuradio/3.8.nix ({
       inherit (darwin.apple_sdk.frameworks) CoreAudio;
       python = python3;
-    };
-  });
+    } // lib.optionalAttrs stdenv.isLinux {
+      stdenv = pkgs.stdenvAdapters.useLibsFrom stdenv pkgs.gcc12Stdenv;
+    });
+  };
   gnuradio3_8Packages = lib.recurseIntoAttrs gnuradio3_8.pkgs;
   # A build without gui components and other utilites not needed if gnuradio is
   # used as a c++ library.
···
 
   printrun = callPackage ../applications/misc/printrun { };
 
-  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer { };
+  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer {
+    stdenv = if stdenv.isDarwin then overrideLibcxx darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv;
+  };
 
   super-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer/super-slicer.nix { };
 

pkgs/top-level/python-packages.nix

···
 
   django-crispy-bootstrap4 = callPackage ../development/python-modules/django-crispy-bootstrap4 { };
 
+  django-crispy-bootstrap5 = callPackage ../development/python-modules/django-crispy-bootstrap5 { };
+
   django-crispy-forms = callPackage ../development/python-modules/django-crispy-forms { };
 
   django-crontab = callPackage ../development/python-modules/django-crontab { };

pkgs/top-level/qt6-packages.nix

···
 
   qscintilla = callPackage ../development/libraries/qscintilla { };
 
+  qwlroots = callPackage ../development/libraries/qwlroots {
+    wlroots = pkgs.wlroots_0_17;
+  };
+
   qxlsx = callPackage ../development/libraries/qxlsx { };
 
   qzxing = callPackage ../development/libraries/qzxing { };