Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
- pkgs/development/libraries/gdcm/default.nix

CONTRIBUTING.md

@@ -322,6 +322,8 @@ All the review template samples provided in this section are generic and meant a
 
 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
 
+If a pull request contains documentation changes that might require feedback from the documentation team, ping @NixOS/documentation-team on the pull request.
+
 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
 
 Container system, boot system and library changes are some examples of the pull requests fitting this category.
@@ -512,34 +514,19 @@ To get a sense for what changes are considered mass rebuilds, see [previously me
 
 - If you have commits `pkg-name: oh, forgot to insert whitespace`: squash commits in this case. Use `git rebase -i`.
 
-- Format the commit messages in the following way:
+- For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
 
-  ```
-  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
-
-  (Motivation for change. Link to release notes. Additional information.)
-  ```
-
-  For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
-
-  Examples:
-
-  * nginx: init at 2.0.1
-  * firefox: 54.0.1 -> 55.0
-
-    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
-  * nixos/hydra: add bazBaz option
-
-    Dual baz behavior is needed to do foo.
-  * nixos/nginx: refactor config generation
-
-    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
-
-  When adding yourself as maintainer, in the same pull request, make a separate
+- When adding yourself as maintainer in the same pull request, make a separate
   commit with the message `maintainers: add <handle>`.
   Add the commit before those making changes to the package or module.
   See [Nixpkgs Maintainers](./maintainers/README.md) for details.
 
+- Make sure you read about any commit conventions specific to the area you're touching. See:
+  - [Commit conventions](./pkgs/README.md#commit-conventions) for changes to `pkgs`.
+  - [Commit conventions](./lib/README.md#commit-conventions) for changes to `lib`.
+  - [Commit conventions](./nixos/README.md#commit-conventions) for changes to `nixos`.
+  - [Commit conventions](./doc/README.md#commit-conventions) for changes to `doc`, the Nixpkgs manual.
+
 ### Writing good commit messages
 
 In addition to writing properly formatted commit messages, it's important to include relevant information so other developers can later understand *why* a change was made. While this information usually can be found by digging code, mailing list/Discourse archives, pull request discussions or upstream changes, it may require a lot of work.

doc/README.md

@@ -114,3 +114,24 @@ pear
 watermelon
 :   green fruit with red flesh
 ```
+
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- If creating a commit purely for documentation changes, format the commit message in the following way:
+
+  ```
+  doc: (documentation summary)
+
+  (Motivation for change, relevant links, additional information.)
+  ```
+
+  Examples:
+
+  * doc: update the kernel config documentation to use `nix-shell`
+  * doc: add information about `nix-update-script`
+
+    Closes #216321.
+
+- If the commit contains more than just documentation changes, follow the commit message format relevant for the rest of the changes.

doc/languages-frameworks/go.section.md

@@ -20,7 +20,7 @@ In the following is an example expression using `buildGoModule`, the following a
 
   To obtain the actual hash, set `vendorHash = lib.fakeHash;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
-- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash` (or `vendorSha256`). Note that if you change this attribute, you need to update `vendorHash` (or `vendorSha256`) attribute.
+- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash`. Note that if you change this attribute, you need to update `vendorHash` attribute.
 
 ```nix
 pet = buildGoModule rec {

lib/README.md

@@ -74,3 +74,23 @@ path/tests/prop.sh
 # Run the lib.fileset tests
 fileset/tests.sh
 ```
+
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  lib.(section): (init | add additional argument | refactor | etc)
+
+  (Motivation for change. Additional information.)
+  ```
+
+  Examples:
+
+  * lib.getExe': check arguments
+  * lib.fileset: Add an additional argument in the design docs
+
+    Closes #264537
+

nixos/README.md

@@ -8,6 +8,27 @@ https://nixos.org/nixos and in the manual in doc/manual.
 
 You can add new module to your NixOS configuration file (usually it’s `/etc/nixos/configuration.nix`). And do `sudo nixos-rebuild test -I nixpkgs=<path to your local nixpkgs folder> --fast`.
 
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  nixos/(module): (init module | add setting | refactor | etc)
+
+  (Motivation for change. Link to release notes. Additional information.)
+  ```
+
+  Examples:
+
+  * nixos/hydra: add bazBaz option
+
+    Dual baz behavior is needed to do foo.
+  * nixos/nginx: refactor config generation
+
+    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
+
 ## Reviewing contributions
 
 When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break people’s installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from \@edolstra.

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -335,6 +335,8 @@
 
 - Package `pash` was removed due to being archived upstream. Use `powershell` as an alternative.
 
+- The option `services.plausible.releaseCookiePath` has been removed: Plausible does not use any distributed Erlang features, and does not plan to (see [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)), so NixOS now disables them, and the Erlang cookie becomes unnecessary. You may delete the file that `releaseCookiePath` was set to.
+
 - `security.sudo.extraRules` now includes `root`'s default rule, with ordering
   priority 400. This is functionally identical for users not specifying rule
   order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
@@ -533,6 +535,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - The Home Assistant module now offers support for installing custom components and lovelace modules. Available at [`services.home-assistant.customComponents`](#opt-services.home-assistant.customComponents) and [`services.home-assistant.customLovelaceModules`](#opt-services.home-assistant.customLovelaceModules).
 
+- The argument `vendorSha256` of `buildGoModule` is deprecated. Use `vendorHash` instead. ([\#259999](https://github.com/NixOS/nixpkgs/pull/259999))
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.

nixos/modules/services/hardware/fwupd.nix

@@ -187,13 +187,20 @@ in {
       # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
       # instead and ensure we take ownership of /var/lib/fwupd
       services.fwupd-refresh.serviceConfig = {
-        DynamicUser = true;
         StateDirectory = "fwupd";
+        # Better for debugging, upstream sets stderr to null for some reason..
+        StandardError = "inherit";
       };
 
       timers.fwupd-refresh.wantedBy = [ "timers.target" ];
     };
 
+    users.users.fwupd-refresh = {
+      isSystemUser = true;
+      group = "fwupd-refresh";
+    };
+    users.groups.fwupd-refresh = {};
+
     security.polkit.enable = true;
   };
 

nixos/modules/services/networking/harmonia.nix

@@ -28,6 +28,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    nix.settings.extra-allowed-users = [ "harmonia" ];
+
     systemd.services.harmonia = {
       description = "harmonia binary cache service";
 

nixos/modules/services/web-apps/plausible.nix

@@ -11,13 +11,6 @@ in {
 
     package = mkPackageOptionMD pkgs "plausible" { };
 
-    releaseCookiePath = mkOption {
-      type = with types; either str path;
-      description = lib.mdDoc ''
-        The path to the file with release cookie. (used for remote connection to the running node).
-      '';
-    };
-
     adminUser = {
       name = mkOption {
         default = "admin";
@@ -92,6 +85,13 @@ in {
           framework docs](https://hexdocs.pm/phoenix/Mix.Tasks.Phx.Gen.Secret.html#content).
         '';
       };
+      listenAddress = mkOption {
+        default = "127.0.0.1";
+        type = types.str;
+        description = lib.mdDoc ''
+          The IP address on which the server is listening.
+        '';
+      };
       port = mkOption {
         default = 8000;
         type = types.port;
@@ -162,6 +162,10 @@ in {
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ] "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed")
+  ];
+
   config = mkIf cfg.enable {
     assertions = [
       { assertion = cfg.adminUser.activate -> cfg.database.postgres.setup;
@@ -180,8 +184,6 @@ in {
       enable = true;
     };
 
-    services.epmd.enable = true;
-
     environment.systemPackages = [ cfg.package ];
 
     systemd.services = mkMerge [
@@ -209,6 +211,32 @@ in {
             # Configuration options from
             # https://plausible.io/docs/self-hosting-configuration
             PORT = toString cfg.server.port;
+            LISTEN_IP = cfg.server.listenAddress;
+
+            # Note [plausible-needs-no-erlang-distributed-features]:
+            # Plausible does not use, and does not plan to use, any of
+            # Erlang's distributed features, see:
+            #     https://github.com/plausible/analytics/pull/1190#issuecomment-1018820934
+            # Thus, disable distribution for improved simplicity and security:
+            #
+            # When distribution is enabled,
+            # Elixir spwans the Erlang VM, which will listen by default on all
+            # interfaces for messages between Erlang nodes (capable of
+            # remote code execution); it can be protected by a cookie; see
+            # https://erlang.org/doc/reference_manual/distributed.html#security).
+            #
+            # It would be possible to restrict the interface to one of our choice
+            # (e.g. localhost or a VPN IP) similar to how we do it with `listenAddress`
+            # for the Plausible web server; if distribution is ever needed in the future,
+            # https://github.com/NixOS/nixpkgs/pull/130297 shows how to do it.
+            #
+            # But since Plausible does not use this feature in any way,
+            # we just disable it.
+            RELEASE_DISTRIBUTION = "none";
+            # Additional safeguard, in case `RELEASE_DISTRIBUTION=none` ever
+            # stops disabling the start of EPMD.
+            ERL_EPMD_ADDRESS = "127.0.0.1";
+
             DISABLE_REGISTRATION = if isBool cfg.server.disableRegistration then boolToString cfg.server.disableRegistration else cfg.server.disableRegistration;
 
             RELEASE_TMP = "/var/lib/plausible/tmp";
@@ -238,7 +266,10 @@ in {
           path = [ cfg.package ]
             ++ optional cfg.database.postgres.setup config.services.postgresql.package;
           script = ''
-            export RELEASE_COOKIE="$(< $CREDENTIALS_DIRECTORY/RELEASE_COOKIE )"
+            # Elixir does not start up if `RELEASE_COOKIE` is not set,
+            # even though we set `RELEASE_DISTRIBUTION=none` so the cookie should be unused.
+            # Thus, make a random one, which should then be ignored.
+            export RELEASE_COOKIE=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 20)
             export ADMIN_USER_PWD="$(< $CREDENTIALS_DIRECTORY/ADMIN_USER_PWD )"
             export SECRET_KEY_BASE="$(< $CREDENTIALS_DIRECTORY/SECRET_KEY_BASE )"
 
@@ -265,7 +296,6 @@ in {
             LoadCredential = [
               "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"
               "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"
-              "RELEASE_COOKIE:${cfg.releaseCookiePath}"
             ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];
           };
         };

nixos/tests/plausible.nix

@@ -8,9 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     virtualisation.memorySize = 4096;
     services.plausible = {
       enable = true;
-      releaseCookiePath = "${pkgs.runCommand "cookie" { } ''
-        ${pkgs.openssl}/bin/openssl rand -base64 64 >"$out"
-      ''}";
       adminUser = {
         email = "admin@example.org";
         passwordFile = "${pkgs.writeText "pwd" "foobar"}";
@@ -28,6 +25,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     machine.wait_for_unit("plausible.service")
     machine.wait_for_open_port(8000)
 
+    # Ensure that the software does not make not make the machine
+    # listen on any public interfaces by default.
+    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+
     machine.succeed("curl -f localhost:8000 >&2")
 
     machine.succeed("curl -f localhost:8000/js/script.js >&2")

pkgs/README.md

@@ -114,6 +114,25 @@ Now that this is out of the way. To add a package to Nixpkgs:
 
 7. Optionally commit the new package and open a pull request [to nixpkgs](https://github.com/NixOS/nixpkgs/pulls), or use [the Patches category](https://discourse.nixos.org/t/about-the-patches-category/477) on Discourse for sending a patch without a GitHub account.
 
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  (pkg-name): (from -> to | init at version | refactor | etc)
+
+  (Motivation for change. Link to release notes. Additional information.)
+  ```
+
+  Examples:
+
+  * nginx: init at 2.0.1
+  * firefox: 54.0.1 -> 55.0
+
+    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
+
 ## Category Hierarchy
 [categories]: #category-hierarchy
 

pkgs/applications/backup/unifi-protect-backup/default.nix

@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
-  version = "0.9.4";
+  version = "0.10.1";
 
   format = "pyproject";
 
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "ep1cman";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-MFg518iodxdHbr7k5kpkTWI59Kk7pPwyIVswVcjasl8=";
+    hash = "sha256-5SarQw4xvLzL2JyBOqv5AtMAk3T4IHJN7fwk+OmujLM=";
   };
 
   pythonRelaxDeps = [

pkgs/applications/editors/emacs/make-emacs.nix

@@ -89,6 +89,7 @@
 , withX ? !(stdenv.isDarwin || noGui || withPgtk)
 , withXinput2 ? withX && lib.versionAtLeast version "29"
 , withXwidgets ? !stdenv.isDarwin && !noGui && (withGTK3 || withPgtk)
+, withSmallJaDic ? false
 
 # Options
 , siteStart ? ./site-start.el
@@ -337,6 +338,7 @@ mkDerivation (finalAttrs: {
   ++ lib.optional withTreeSitter "--with-tree-sitter"
   ++ lib.optional withXinput2 "--with-xinput2"
   ++ lib.optional withXwidgets "--with-xwidgets"
+  ++ lib.optional withSmallJaDic "--with-small-ja-dic"
   ;
 
   env = lib.optionalAttrs withNativeCompilation {

pkgs/applications/networking/instant-messengers/qq/sources.nix

@@ -1,8 +1,8 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-10-16
+# Last updated: 2023-11-14
 {
-  version = "3.2.1-17412";
-  urlhash = "423936b9";
-  arm64_hash = "sha256-gvKBcfQafDtNioFg4Cyy92VMAX4uKL5H7wBkxQgDwjI=";
-  amd64_hash = "sha256-cg2YXB1/pf5eDRHFgzydIb4GICjh9XRtCquPspgCL6c=";
+  version = "3.2.2-18394";
+  urlhash = "fd2e886e";
+  arm64_hash = "sha256-6E3h7Z4936YKZb+G0FoMb90T3EzH8z07mmGMnL4SDFk=";
+  amd64_hash = "sha256-L1M8O0FzVKLXNNYGGMPf1Nbh/DFxLHBlbzapr7uz5Sk=";
 }

pkgs/applications/networking/instant-messengers/qq/update.sh

@@ -9,7 +9,7 @@ payload=$(curl https://im.qq.com/rainbow/linuxQQDownload | grep -oP "var params=
 amd64_url=$(jq -r .x64DownloadUrl.deb <<< "$payload")
 arm64_url=$(jq -r .armDownloadUrl.deb <<< "$payload")
 
-urlhash=$(grep -oP "(?<=QQNT/)[a-e0-9]+(?=/linuxqq)" <<< "$amd64_url")
+urlhash=$(grep -oP "(?<=QQNT/)[a-f0-9]+(?=/linuxqq)" <<< "$amd64_url")
 version=$(grep -oP "(?<=/linuxqq_).*(?=_amd64.deb)" <<< "$amd64_url")
 
 amd64_hash=$(nix-prefetch-url $amd64_url)

pkgs/applications/networking/kubo/default.nix

@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.23.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.24.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "15"; # Also update kubo-migrator when changing the repo version
@@ -15,7 +15,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-ycXn8h8sFGJXVMldneN51lZgXoPaZ/XeXLtqqJ4w6H0=";
+    hash = "sha256-stSjLvg8G1EiXon3Qby4wLgbhX7Aaj9pnxcvE32/42k=";
   };
 
   # tarball contains multiple files/directories

pkgs/applications/office/fava/default.nix

@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.26.1";
+  version = "1.26.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pj4kaQDXahjhN7bu7xxT/ZuoCfPdGyo898482S5gnlE=";
+    hash = "sha256-+rMuVfe6BDAcZgJkBb18YLFZirOBfad6WGbWtAT21uI=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
@@ -31,6 +31,11 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'setuptools_scm>=8.0' 'setuptools_scm'
+  '';
+
   preCheck = ''
     export HOME=$TEMPDIR
   '';

pkgs/applications/version-management/gh/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.38.0";
+  version = "2.39.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-t+JpCxJM2PO9nT9nYn/Rsz/s2lQQviggbjuEy0OQV88=";
+    hash = "sha256-cBdP514ZW7iSMzecGFCgiXz3bGZZ1LzxnVpEd9b4Dy0=";
   };
 
-  vendorHash = "sha256-XZhZDYdbjA/1g7/mPxm5u1b+z/TmwoH60/sJZ63LQMg=";
+  vendorHash = "sha256-RFForZy/MktbrNrcpp9G6VCB7A98liJvCxS0Yb16sMc=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/virtualization/podman-tui/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-XaZgvy8b/3XUjO/GAQV6fxfqlR+eSMeosC7ugoYsEJM=";
+    hash = "sha256-l6jbc/+Fi5xx7yhK0e5/iqcm7i8JnU37Qr4niVG4OvU=";
   };
 
   vendorHash = null;

pkgs/applications/virtualization/singularity/packages.nix

@@ -7,14 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      version = "1.2.2";
+      version = "1.2.4";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
-        rev = "v${version}";
-        hash = "sha256-CpNuoG+QykP+HDCyFuIbZKYez5XnYrE75SWFoWu34rg=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-VaVOepfjMBf8F56S1Clpn8HPw65MNQMoZsQguKQ4Sg0=";
       };
 
       # Update by running
@@ -38,25 +38,26 @@ let
   singularity = callPackage
     (import ./generic.nix rec {
       pname = "singularity-ce";
-      version = "3.11.4";
+      version = "4.0.1";
       projectName = "singularity";
 
       src = fetchFromGitHub {
         owner = "sylabs";
         repo = "singularity";
-        rev = "v${version}";
-        hash = "sha256-v8iHbn2OzK/egP2Go76BI74iX8izfy2PM4Uo8LsE8FY=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-rdpIAiLh4mlSu+1UUDN79gIzxy5X5wOB5XOW9oBm+HU=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-24Hnpq6LRh3JgaiJWCmHfJKoWLxsbceCdJutjPqZsX8=";
+      vendorHash = "sha256-kV4Yu9MBoF8spJroWqLOUt2v8YV79AoNUG9hYgPgXRc=";
 
-      # Do not build conmon from the Git submodule source,
+      # Do not build conmon and squashfuse from the Git submodule sources,
       # Use Nixpkgs provided version
       extraConfigureFlags = [
         "--without-conmon"
+        "--without-squashfuse"
       ];
 
       extraDescription = " (Sylabs Inc's fork of Singularity, a.k.a. SingularityCE)";

pkgs/build-support/go/module.nix

@@ -297,6 +297,7 @@ let
     } // meta;
   });
 in
+lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
   package

pkgs/by-name/am/amazon-ssm-agent/package.nix

@@ -2,6 +2,7 @@
 , writeShellScriptBin
 , buildGoModule
 , makeWrapper
+, darwin
 , fetchFromGitHub
 , coreutils
 , nettools
@@ -40,13 +41,13 @@ let
 in
 buildGoModule rec {
   pname = "amazon-ssm-agent";
-  version = "3.2.1705.0";
+  version = "3.2.1798.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     rev = "refs/tags/${version}";
-    hash = "sha256-4KhDD5G/fS1rHitQdbYqIz6RSQ3PTMZsUENC202a/Do=";
+    hash = "sha256-A7M8UbOJT9zvbcwlARMwA7a+LGk8KYmo9j31yzh5FDQ=";
   };
 
   vendorHash = null;
@@ -60,7 +61,11 @@ buildGoModule rec {
     ./0002-version-gen-don-t-use-unnecessary-constants.patch
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.DarwinTools
+  ];
 
   # See the list https://github.com/aws/amazon-ssm-agent/blob/3.2.1630.0/makefile#L120-L138
   # The updater is not built because it cannot work on NixOS
@@ -137,7 +142,8 @@ buildGoModule rec {
   ];
 
   postFixup = ''
-    wrapProgram $out/bin/amazon-ssm-agent --prefix PATH : ${bashInteractive}/bin
+    wrapProgram $out/bin/amazon-ssm-agent \
+      --prefix PATH : "${lib.makeBinPath [ bashInteractive ]}"
   '';
 
   passthru = {
@@ -148,6 +154,8 @@ buildGoModule rec {
     };
   };
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Agent to enable remote management of your Amazon EC2 instance configuration";
     changelog = "https://github.com/aws/amazon-ssm-agent/releases/tag/${version}";
@@ -155,8 +163,5 @@ buildGoModule rec {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [ copumpkin manveru anthonyroussel ];
-
-    # Darwin support is broken
-    broken = stdenv.isDarwin;
   };
 }

pkgs/by-name/ce/certspotter/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "certspotter";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "SSLMate";
     repo = "certspotter";
     rev = "v${version}";
-    hash = "sha256-6ghS+9b8FZiYdiTk54XRHP46lOq98sN1RDYvRYTt6eU=";
+    hash = "sha256-nyeqpDMRZRuHjfl3cI/I00KpVg3udjr0B8MEBZcF7nY=";
   };
 
   vendorHash = "sha256-6dV9FoPV8UfS0z5RuuopE99fHcT3RAWCdDi7jpHzVRE=";

pkgs/by-name/co/cowsql/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cowsql";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "cowsql";
     repo = "cowsql";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-+za3pIcV4BhoImKvJlKatCK372wL4OyPbApQvGxGGGk=";
+    hash = "sha256-JbLiwWXOrEhqCdM8tWwxl68O5Sga4T7NYCXzqP9+Dh0=";
   };
 
   nativeBuildInputs = [
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
+    changelog = "https://github.com/cowsql/cowsql/releases/tag/${version}";
     description = "Embeddable, replicated and fault tolerant SQL engine";
     homepage = "https://github.com/cowsql/cowsql";
     license = licenses.lgpl3Only;

pkgs/by-name/sh/shopware-cli/package.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.3.6";
+  version = "0.3.12";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-3Js44cLS6GLI6wFuT2wxgwyMF3beXaULVeaejfxxtA0=";
+    hash = "sha256-vGtHz1lSKbucR4MmXv542lv9kbON9Cwo7vB5TaeqoX8=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-QZ/zU67oUW75T8DOzjQwmEAr6gjIg/6ZO4Vm/47Lc40=";
+  vendorHash = "sha256-vE9gh0u8j2NViK2dUd39zZtUuaoKv0hf8VhSX/P4ar8=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"

pkgs/by-name/us/usql/package.nix

@@ -10,18 +10,18 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    hash = "sha256-SJypezOTQr+TiG/rePXxgjrspeErqj6qw9TBen41e4Q=";
+    hash = "sha256-XfzCJOr0lOkimUKbOW0+qFNQMmYc0DBgi+0ItmEOjwE=";
   };
 
   buildInputs = [ unixODBC icu ];
 
-  vendorHash = "sha256-i2lH6ajRmfJHsh7nzCjt7mi3issA4kSBdG42w67pOC4=";
+  vendorHash = "sha256-sijt6YOp1pFNhaxLIOLH90Z5ODVbWFj/mp8Csx8n+ac=";
   proxyVendor = true;
 
   # Exclude broken genji, hive & impala drivers (bad group)
@@ -35,7 +35,7 @@ buildGoModule rec {
     "impala"
   ];
 
-  # These tags and flags are copied from build-release.sh
+  # These tags and flags are copied from build.sh
   tags = [
     "most"
     "sqlite_app_armor"
@@ -46,7 +46,6 @@ buildGoModule rec {
     "sqlite_stat4"
     "sqlite_userauth"
     "sqlite_vtable"
-    "sqlite_icu"
     "no_adodb"
   ];
 

pkgs/data/fonts/noto-fonts/default.nix

@@ -160,8 +160,8 @@ rec {
 
   noto-fonts-cjk-serif = mkNotoCJK {
     typeface = "Serif";
-    version = "2.001";
-    sha256 = "sha256-y1103SS0qkZMhEL5+7kQZ+OBs5tRaqkqOcs4796Fzhg=";
+    version = "2.002";
+    sha256 = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
   };
 
   noto-fonts-color-emoji =

pkgs/data/themes/colloid-gtk-theme/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
-, gitUpdater
 , gnome-themes-extra
 , gtk-engine-murrine
 , jdupes
@@ -23,13 +22,13 @@ lib.checkListOfEnum "${pname}: tweaks" [ "nord" "dracula" "gruvbox" "all" "black
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-08-12";
+  version = "2023-10-28";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    hash = "sha256-Ss6IXd4vYUvIF5/Hn4IVLNvDSaewTY0GNZp7X5Lmz/c=";
+    hash = "sha256-NxIWH3qLW8sEguovAv9wfgnlnmPlTipRJTmMo3rSHNY=";
   };
 
   nativeBuildInputs = [
@@ -64,8 +63,6 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.updateScript = gitUpdater { };
-
   meta = with lib; {
     description = "A modern and clean Gtk theme";
     homepage = "https://github.com/vinceliuice/Colloid-gtk-theme";

pkgs/data/themes/utterly-nord-plasma/default.nix

@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, breeze-icons
+, kdeclarative
+, kirigami2
+, plasma-framework
+, plasma-workspace
+}:
+
+stdenv.mkDerivation rec {
+  pname = "utterly-nord-plasma";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "HimDek";
+    repo = pname;
+    rev = "6d9ffe008f0bee47c8346c9a7ec71f206d999fd0";
+    hash = "sha256-B5pIwV0BHxDluKWKTy+xuBPaE3N6UOHXip1SIAm2kM8=";
+  };
+
+  propagatedUserEnvPkgs = [
+    breeze-icons
+    kdeclarative.bin
+    kirigami2
+    plasma-framework.bin
+    plasma-workspace
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{color-schemes,Kvantum,plasma/look-and-feel,sddm/themes,wallpapers,konsole}
+
+    cp -a look-and-feel $out/share/plasma/look-and-feel/Utterly-Nord
+    cp -a look-and-feel-solid $out/share/plasma/look-and-feel/Utterly-Nord-solid
+    cp -a look-and-feel-light $out/share/plasma/look-and-feel/Utterly-Nord-light
+    cp -a look-and-feel-light-solid $out/share/plasma/look-and-feel/Utterly-Nord-light-solid
+
+    cp -a *.colors $out/share/color-schemes/
+
+    cp -a wallpaper $out/share/wallpapers/Utterly-Nord
+
+    cp -a kvantum $out/share/Kvantum/Utterly-Nord
+    cp -a kvantum-solid $out/share/Kvantum/Utterly-Nord-Solid
+    cp -a kvantum-light $out/share/Kvantum/Utterly-Nord-Light
+    cp -a kvantum-light-solid $out/share/Kvantum/Utterly-Nord-Light-Solid
+
+    cp -a *.colorscheme $out/share/konsole/
+
+    cp -a sddm $out/share/sddm/themes/Utterly-Nord
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Plasma theme with Nordic Colors, transparency, blur and round edges for UI elements";
+    homepage = "https://himdek.com/Utterly-Nord-Plasma/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}

pkgs/development/interpreters/php/8.3.nix

@@ -2,14 +2,12 @@
 
 let
   base = (callPackage ./generic.nix (_args // {
-    version = "8.3.0RC5";
-    hash = null;
-  })).overrideAttrs (oldAttrs: {
-    src = fetchurl {
-      url = "https://downloads.php.net/~jakub/php-8.3.0RC5.tar.xz";
-      hash = "sha256-I42ded2tZO5ZQ+iU5DeNKjT+mNNoowew8gNOYDeB5aY=";
+    version = "8.3.0RC6";
+    phpSrc = fetchurl {
+      url = "https://downloads.php.net/~eric/php-8.3.0RC6.tar.xz";
+      hash = "sha256-Hntdz+vEkh7EQgnB4IrnG2sQ5bG2uJW7T3a0RIbHBe0=";
     };
-  });
+  }));
 in
 base.withExtensions ({ all, ... }: with all; ([
   bcmath

pkgs/development/libraries/gdcm/default.nix

@@ -10,6 +10,11 @@
 , enablePython ? false
 , python ? null
 , swig4
+, expat
+, libuuid
+, openjpeg
+, zlib
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +32,10 @@ stdenv.mkDerivation rec {
     "-DGDCM_BUILD_APPLICATIONS=ON"
     "-DGDCM_BUILD_SHARED_LIBS=ON"
     "-DGDCM_BUILD_TESTING=ON"
+    "-DGDCM_USE_SYSTEM_EXPAT=ON"
+    "-DGDCM_USE_SYSTEM_ZLIB=ON"
+    "-DGDCM_USE_SYSTEM_UUID=ON"
+    "-DGDCM_USE_SYSTEM_OPENJPEG=ON"
     # hack around usual "`RUNTIME_DESTINATION` must not be an absolute path" issue:
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DCMAKE_INSTALL_BINDIR=bin"
@@ -38,9 +47,17 @@ stdenv.mkDerivation rec {
     "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}"
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = lib.optionals enableVTK [
+  buildInputs = [
+    expat
+    libuuid
+    openjpeg
+    zlib
+  ] ++ lib.optionals enableVTK [
     vtk
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices

pkgs/development/libraries/libhugetlbfs/default.nix

@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
     "EXEDIR=$(bin)/bin"
     "DOCDIR=$(doc)/share/doc/libhugetlbfs"
     "MANDIR=$(man)/share/man"
+  ] ++ lib.optionals (stdenv.buildPlatform.system != stdenv.hostPlatform.system) [
+    # The ARCH logic defaults to querying `uname`, which will return build platform arch
+    "ARCH=${stdenv.hostPlatform.uname.processor}"
   ];
 
   # Default target builds tests as well, and the tests want a static

pkgs/development/libraries/science/math/amd-libflame/default.nix

@@ -9,7 +9,7 @@
 
 , withOpenMP ? true
 , blas64 ? false
-, withAMDOpt ? false
+, withAMDOpt ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -37,15 +37,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ amd-blis aocl-utils ];
 
   cmakeFlags = [
-    "-DLIBAOCLUTILS_LIBRARY_PATH=${lib.getLib aocl-utils}/lib"
+    "-DLIBAOCLUTILS_LIBRARY_PATH=${lib.getLib aocl-utils}/lib/libaoclutils${stdenv.hostPlatform.extensions.sharedLibrary}"
     "-DLIBAOCLUTILS_INCLUDE_PATH=${lib.getDev aocl-utils}/include"
     "-DENABLE_BUILTIN_LAPACK2FLAME=ON"
     "-DENABLE_CBLAS_INTERFACES=ON"
     "-DENABLE_EXT_LAPACK_INTERFACE=ON"
   ]
-  ++ lib.optional (!withOpenMP) "ENABLE_MULTITHREADING=OFF"
-  ++ lib.optional blas64 "ENABLE_ILP64=ON"
-  ++ lib.optional withAMDOpt "ENABLE_AMD_OPT=ON";
+  ++ lib.optional (!withOpenMP) "-DENABLE_MULTITHREADING=OFF"
+  ++ lib.optional blas64 "-DENABLE_ILP64=ON"
+  ++ lib.optional withAMDOpt "-DENABLE_AMD_OPT=ON";
 
   postInstall = ''
     ln -s $out/lib/libflame.so $out/lib/liblapack.so.3

pkgs/development/libraries/science/math/blis/default.nix

@@ -48,8 +48,8 @@ in stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    ln -s $out/lib/libblis.so.3 $out/lib/libblas.so.3
-    ln -s $out/lib/libblis.so.3 $out/lib/libcblas.so.3
+    ln -s $out/lib/libblis.so.4 $out/lib/libblas.so.3
+    ln -s $out/lib/libblis.so.4 $out/lib/libcblas.so.3
     ln -s $out/lib/libblas.so.3 $out/lib/libblas.so
     ln -s $out/lib/libcblas.so.3 $out/lib/libcblas.so
   '';

pkgs/development/python-modules/duo-client/default.nix

@@ -3,7 +3,8 @@
 , fetchFromGitHub
 , freezegun
 , mock
-, nose2
+, pytestCheckHook
+, pythonOlder
 , pytz
 , setuptools
 , six
@@ -12,6 +13,9 @@
 buildPythonPackage rec {
   pname = "duo-client";
   version = "5.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "duosecurity";
@@ -26,15 +30,18 @@ buildPythonPackage rec {
       --replace "flake8" ""
   '';
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     setuptools
+  ];
+
+  propagatedBuildInputs = [
     six
   ];
 
   nativeCheckInputs = [
     freezegun
     mock
-    nose2
+    pytestCheckHook
     pytz
   ];
 
@@ -42,6 +49,12 @@ buildPythonPackage rec {
     "duo_client"
   ];
 
+  disabledTests = [
+    # Tests require network access
+    "test_server_hostname"
+    "test_server_hostname_with_port"
+  ];
+
   meta = with lib; {
     description = "Python library for interacting with the Duo Auth, Admin, and Accounts APIs";
     homepage = "https://github.com/duosecurity/duo_client_python";

pkgs/development/python-modules/pycyphal/default.nix

@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, can
+, cobs
+, libpcap
+, nunavut
+, numpy
+, pyserial
+}:
+
+buildPythonPackage rec {
+  pname = "pycyphal";
+  version = "1.15.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-KVX+DwcJp1sjpcG1Utl9me1LwWDZPof+O6hoUt1xlXA=";
+  };
+
+  propagatedBuildInputs = [
+    can
+    cobs
+    libpcap
+    numpy
+    nunavut
+    pyserial
+  ];
+
+  # Can't seem to run the tests on nix
+  doCheck = false;
+  pythonImportsCheck = [
+    "pycyphal"
+  ];
+
+  meta = with lib; {
+    description = "A full-featured implementation of the Cyphal protocol stack in Python";
+    longDescription = ''
+      Cyphal is an open technology for real-time intravehicular distributed computing and communication based on modern networking standards (Ethernet, CAN FD, etc.).
+    '';
+    homepage = "https://opencyphal.org/";
+    license = licenses.mit;
+    maintainers = [ teams.ororatech ];
+  };
+}

pkgs/development/python-modules/pyperf/default.nix

@@ -1,30 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , pythonOlder
 , psutil
 , unittestCheckHook
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pyperf";
-  version = "2.6.1";
-  format = "setuptools";
+  version = "2.6.2";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Fxrqabjv3mEhDlEhZth2Tndlqcdni3aAUhdLAfNJ8kc=";
+    hash = "sha256-ZNj63OanT0ePKYMsHqoqBIVmVev/FyktUjf8gxfDo8U=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-pythonpath-in-tests.patch";
-      url = "https://github.com/psf/pyperf/commit/d373c5e56c0257d2d7abd705b676bea25cf66566.patch";
-      hash = "sha256-2q1fTf+uU3qj3BG8P5otX4f7mSTnQxm4sfmmgIUuszA=";
-    })
+  nativeBuildInputs = [
+    setuptools
   ];
 
   propagatedBuildInputs = [
@@ -35,12 +31,21 @@ buildPythonPackage rec {
     unittestCheckHook
   ];
 
-  unittestFlagsArray = [ "-s" "pyperf/tests/" "-v" ];
+  unittestFlagsArray = [
+    "-s"
+    "pyperf/tests/"
+    "-v"
+  ];
+
+  pythonImportsCheck = [
+    "pyperf"
+  ];
 
   meta = with lib; {
     description = "Python module to generate and modify perf";
     homepage = "https://pyperf.readthedocs.io/";
+    changelog = "https://github.com/psf/pyperf/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/pysuez/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, requests
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pysuez";
+  version = "0.2.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "ooii";
+    repo = "pySuez";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Xgd0E/oFO2yyytBjuwr1vDJfKWC0Iw8P6GStCuCni/g=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pysuez"
+  ];
+
+  meta = with lib; {
+    description = "Module to get water consumption data from Suez";
+    homepage = "https://github.com/ooii/pySuez";
+    changelog = "https://github.com/ooii/pySuez/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/pyvips/default.nix

@@ -1,5 +1,6 @@
 { stdenv
 , buildPythonPackage
+, pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
 , glib
@@ -13,6 +14,8 @@ buildPythonPackage rec {
   pname = "pyvips";
   version = "2.2.1";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "libvips";
     repo = "pyvips";
@@ -45,6 +48,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A python wrapper for libvips";
     homepage = "https://github.com/libvips/pyvips";
+    changelog = "https://github.com/libvips/pyvips/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ccellado anthonyroussel ];
   };

pkgs/development/python-modules/simple-salesforce/default.nix

@@ -1,49 +1,52 @@
 { lib
-, fetchFromGitHub
 , buildPythonPackage
-, authlib
-, requests
-, nose
+, cryptography
+, fetchFromGitHub
+, more-itertools
+, pendulum
 , pyjwt
+, pytestCheckHook
 , pythonOlder
 , pytz
+, requests
 , responses
+, setuptools
 , zeep
 }:
 
 buildPythonPackage rec {
   pname = "simple-salesforce";
   version = "1.12.5";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "simple-salesforce";
+    repo = "simple-salesforce";
     rev = "refs/tags/v${version}";
     hash = "sha256-mj7lbBGEybsEzWo4TYmPrN3mBXItdo/JomVIYmzIDAY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    authlib
+    cryptography
+    more-itertools
+    pendulum
     pyjwt
     requests
     zeep
   ];
 
   nativeCheckInputs = [
-    nose
+    pytestCheckHook
     pytz
     responses
   ];
 
-  checkPhase = ''
-    runHook preCheck
-    nosetests -v
-    runHook postCheck
-  '';
-
   pythonImportsCheck = [
     "simple_salesforce"
   ];

pkgs/development/tools/misc/yakut/default.nix

@@ -0,0 +1,51 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+, stdenv
+, click
+, coloredlogs
+, psutil
+, pycyphal
+, pyserial
+, ruamel-yaml
+, requests
+, scipy
+, simplejson
+}:
+
+buildPythonApplication rec {
+  pname = "yakut";
+  version = "0.13.0";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-MBVSt01D36rBPW2bopujyu8Opwwavmm7S3tdaWp5ACw=";
+  };
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    click
+    coloredlogs
+    psutil
+    pycyphal
+    pyserial
+    ruamel-yaml
+    requests
+    scipy
+    simplejson
+  ];
+
+  # Can't seem to run the tests on nix
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Simple CLI tool for diagnostics and debugging of Cyphal networks";
+    longDescription = ''
+      Yakút is a simple cross-platform command-line interface (CLI) tool for diagnostics and debugging of Cyphal networks. By virtue of being based on PyCyphal, Yakut supports all Cyphal transports (UDP, serial, CAN, ...) and is compatible with all major features of the protocol. It is designed to be usable with GNU/Linux, Windows, and macOS.
+    '';
+    homepage = "https://github.com/OpenCyphal/yakut/";
+    license = licenses.mit;
+    maintainers = [ teams.ororatech ];
+  };
+}

pkgs/development/tools/okteto/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.21.0";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-4arcK/g9j/lv1HWP7rvhAXJpYRMKgmSbGPZjy2UkhyE=";
+    hash = "sha256-HqMnZireYw8k7TXkR+M+Ct97OISaBUNCABR0nYqljjQ=";
   };
 
-  vendorHash = "sha256-u1oMX2ZplmDGx7ePfA5vKHUuDmWYVCJrYh2HQ23dTfU=";
+  vendorHash = "sha256-z4ERIfwLPYIMpSetepDx0U2WUA+9RXjoQICMbp+qS3k=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.

pkgs/development/tools/parsing/spicy/default.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "spicy";
-  version = "1.8.1";
+  version = "1.9.0";
 
   strictDeps = true;
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     owner = "zeek";
     repo = "spicy";
     rev = "v${version}";
-    hash = "sha256-Cb+HYUObL3So3ZcG4Iy276rdO0TC9rholwEBIYA5BNU=";
+    hash = "sha256-nVHm0JJsFXGnYlBBlcR5zBS46PZuALle3ik3GMTPYTQ=";
     fetchSubmodules = true;
   };
 

pkgs/development/tools/sqldef/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.16.9";
+  version = "0.16.10";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-Y4H8tPUHaRMMZaZt1VjkZT5JJgEIY/dhocNccvoHf1Y=";
+    hash = "sha256-NwSQLpqgOuVBH+EYjSch3h0BMJZPK3/FcKO4iUnNt+E=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-Qn10+uTAo68OTQp592H/T7D99LNIvG76aG/ye+xx2sk=";
+  vendorHash = "sha256-2MwibiWT9rrbNVva61wR1OPrG+fZkxTDznC2pdm3CKE=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 

pkgs/games/sgt-puzzles/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20230918.2d9e414";
+  version = "20231025.35f7965";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-YsvJ/5DTevRb+sCxWc/KcD2X5IXwAXvWGVfokr06nUM=";
+    hash = "sha256-c9D8lr5V/1BrKQjBsj931uGpnpR5p80CgP0Y/HNc40E=";
   };
 
   sgt-puzzles-menu = fetchurl {

pkgs/os-specific/darwin/sketchybar/default.nix

@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.19.2";
+  version = "2.19.3";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nuK1Ip/B1yGMtKwtRIiQ4ATJU5JEDfpQyq6+WR46EMw=";
+    hash = "sha256-QT926AnV9jLc1KvYks6ukIAcMbVHOupTJWQ6vBHpcxc=";
   };
 
   buildInputs = [

pkgs/os-specific/darwin/yabai/default.nix

@@ -17,7 +17,7 @@
 
 let
   pname = "yabai";
-  version = "6.0.0";
+  version = "6.0.1";
 
   test-version = testers.testVersion {
     package = yabai;
@@ -53,7 +53,7 @@ in
 
     src = fetchzip {
       url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-KeZ5srx9dfQN9u6Fgg9BtIhLhFWp975iz72m78bWINo=";
+      hash = "sha256-CXkGVoJcGSkooxe7eIhwaM6FkOI45NVw5jdLJAzgFBM=";
     };
 
     nativeBuildInputs = [
@@ -89,7 +89,7 @@ in
       owner = "koekeishiya";
       repo = "yabai";
       rev = "v${version}";
-      hash = "sha256-BQhFTn9KDBv9oG8kT2TFFpPZGHARg7DfN+IeQNNDE84=";
+      hash = "sha256-u+MkGd/rkT1RVkzC2IcAcFM9eClFdj3WBFnftUVwkwc=";
     };
 
     nativeBuildInputs = [

pkgs/os-specific/linux/kernel/zen-kernels.nix

@@ -12,8 +12,8 @@ let
   # ./update-zen.py lqx
   lqxVariant = {
     version = "6.5.11"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "02k4cfiygrfgyp3x6ivr7h6klknjzd5cwpszjnzcy2jc547512pd"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "0rak2ald95bwb5qlp8pf2g93a0gkv8rypiv5s8dpds3cilwmxrg9"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {

pkgs/os-specific/linux/targetcli/default.nix

@@ -1,14 +1,14 @@
-{ lib, python3, fetchFromGitHub }:
+{ lib, python3, fetchFromGitHub, nixosTests }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "targetcli";
-  version = "2.1.56";
+  version = "2.1.57";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "${pname}-fb";
     rev = "v${version}";
-    hash = "sha256-sWLwjfuy9WPnrGK0BxUGnNrhtGDoQyRFMY1OSlyxqs4=";
+    hash = "sha256-7JRNHKku9zTeSafL327hkM/E5EWTKqwPudCfmngvWuo=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ configshell rtslib ];
@@ -18,6 +18,10 @@ python3.pkgs.buildPythonApplication rec {
     install -D targetclid.8 -t $out/share/man/man8/
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) iscsi-root;
+  };
+
   meta = with lib; {
     description = "A command shell for managing the Linux LIO kernel target";
     homepage = "https://github.com/open-iscsi/targetcli-fb";

pkgs/servers/home-assistant/component-packages.nix

@@ -4145,7 +4145,8 @@
       subarulink
     ];
     "suez_water" = ps: with ps; [
-    ]; # missing inputs: pysuez
+      pysuez
+    ];
     "sun" = ps: with ps; [
     ];
     "supervisord" = ps: with ps; [

pkgs/servers/mediamtx/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "mediamtx";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7kEwP9ohDtFaA1J+IYEspwJ208tFN2es/ubCmBYlEuA=";
+    hash = "sha256-Upm/fiW3hXzBS+IpwzE3C6h6Z7ZpA2k+j2UqAWT8hF0=";
   };
 
-  vendorHash = "sha256-fcDyXWy/MzDIvJYfzZZyYLfYkl9tGpyeOsTT2zHxobI=";
+  vendorHash = "sha256-uaOfULtZ+BdbX1TmDyZtYnoXV8579RSW6eocmPsXyP8=";
 
   # Tests need docker
   doCheck = false;

pkgs/servers/monitoring/prometheus/node-exporter.nix

@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "node_exporter";
-  version = "1.6.1";
+  version = "1.7.0";
   rev = "v${version}";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "prometheus";
     repo = "node_exporter";
-    sha256 = "sha256-BCZLMSJP/63N+pZsK8er87Zem7IFGdkyruDs6UVDZSM=";
+    sha256 = "sha256-+KY/YXEqT/40QzODOk8lKAo0zMcNuiMvj6ippbJE9ho=";
   };
 
-  vendorHash = "sha256-hn2cMKhLl5qsm4sZErs6PXTs8yajowxw9a9vtHe5cAk=";
+  vendorHash = "sha256-HrlzDupZP9+GxB58Lg62tvku1Sl2zo2iV0KnBNwkM58=";
 
   # FIXME: tests fail due to read-only nix store
   doCheck = false;

pkgs/servers/sslh/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslh";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "yrutschle";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KfNQWSmAf86AFoInKlNZoiSuSwVLaJVnfo7SjZVY/VU=";
+    hash = "sha256-KXjoYtiGaOrdWRbI0umNfxbtS7p+YaW352lC/5f+AM4=";
   };
 
   postPatch = "patchShebangs *.sh";

pkgs/tools/graphics/vips/default.nix

@@ -18,7 +18,6 @@
 , libexif
 , librsvg
 , poppler
-, libgsf
 , libtiff
 , fftw
 , lcms2
@@ -26,7 +25,6 @@
 , libimagequant
 , imagemagick
 , pango
-, orc
 , matio
 , cfitsio
 , libwebp
@@ -36,19 +34,23 @@
 , openslide
 , libheif
 , cgif
+, libarchive
+, libhwy
+, testers
+, nix-update-script
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "vips";
-  version = "8.14.5";
+  version = "8.15.0";
 
   outputs = [ "bin" "out" "man" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "devdoc" ];
 
   src = fetchFromGitHub {
     owner = "libvips";
     repo = "libvips";
-    rev = "v${version}";
-    hash = "sha256-fG3DTP+3pO7sbqR/H9egJHU3cLKPU4Jad6qxcQ9evNw=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-WfKq+maLcAXyjk1sq66wSU92ALv4MfRDPKe4Mki0KRQ=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -76,7 +78,6 @@ stdenv.mkDerivation rec {
     libexif
     librsvg
     poppler
-    libgsf
     libtiff
     fftw
     lcms2
@@ -84,7 +85,6 @@ stdenv.mkDerivation rec {
     libimagequant
     imagemagick
     pango
-    orc
     matio
     cfitsio
     libwebp
@@ -94,6 +94,8 @@ stdenv.mkDerivation rec {
     openslide
     libheif
     cgif
+    libarchive
+    libhwy
   ] ++ lib.optionals stdenv.isDarwin [ ApplicationServices Foundation ];
 
   # Required by .pc file
@@ -109,13 +111,29 @@ stdenv.mkDerivation rec {
   ++ lib.optional (imagemagick == null) "-Dmagick=disabled"
   ;
 
+  passthru = {
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "vips --version";
+      };
+    };
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex" "v([0-9.]+)" ];
+    };
+  };
+
   meta = with lib; {
-    changelog = "https://github.com/libvips/libvips/blob/${src.rev}/ChangeLog";
-    homepage = "https://libvips.github.io/libvips/";
+    changelog = "https://github.com/libvips/libvips/blob/${finalAttrs.src.rev}/ChangeLog";
+    homepage = "https://www.libvips.org/";
     description = "Image processing system for large images";
     license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ kovirobi ];
+    maintainers = with maintainers; [ kovirobi anthonyroussel ];
+    pkgConfigModules = [ "vips" "vips-cpp" ];
     platforms = platforms.unix;
     mainProgram = "vips";
   };
-}
+})

pkgs/tools/misc/detox/default.nix

@@ -1,25 +1,24 @@
-{lib, stdenv, fetchurl, flex}:
+{ lib, stdenv, fetchFromGitHub, flex, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "detox";
-  version = "1.2.0";
+  version = "1.4.5";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/detox/${version}/detox-${version}.tar.gz";
-    sha256 = "02cfkf3yhw64xg8mksln8w24gdwgm2x9g3vps7gn6jbjbfd8mh45";
+  src = fetchFromGitHub {
+    owner = "dharple";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-cTuK5EIimRVZ1nfuTa1ds6xrawYIAbwNNIkNONd9y4Q=";
   };
 
-  buildInputs = [flex];
+  nativeBuildInputs = [ flex autoreconfHook ];
 
   hardeningDisable = [ "format" ];
 
-  postInstall = ''
-    install -m644 safe.tbl $out/share/detox/
-  '';
-
   meta = with lib; {
-    homepage = "https://detox.sourceforge.net/";
+    homepage = "https://github.com/dharple/detox";
     description = "Utility designed to clean up filenames";
+    changelog = "https://github.com/dharple/detox/blob/v${version}/CHANGELOG.md";
     longDescription = ''
       Detox is a utility designed to clean up filenames. It replaces
       difficult to work with characters, such as spaces, with standard
@@ -29,5 +28,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
+    mainProgram = "detox";
   };
 }

pkgs/tools/misc/fluent-bit/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "2.1.10";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6uq5eOHx0P2S3WsN0PooNlGQS2ty7DdPsCEgoQsLmRM=";
+    hash = "sha256-E3fNU6aHyKMli+A+yiJUY065jchWkkAbumkdY8BaAAE=";
   };
 
   nativeBuildInputs = [ cmake flex bison ];

pkgs/tools/misc/pb/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pb";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "parseablehq";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jnMGBwwsQJnbvTTLxhpwORQ5m8xZxLA0PQVhW/MjMto=";
+    hash = "sha256-ZtjlrWCL1h2qtpLsr7HN6ZcYhybjnoSFwMAXFGCn00A=";
   };
 
-  vendorHash = "sha256-jC3P0b8fLZbL1hyWTnA/w3Uk4uqWSxpWDs6nQv55/0c=";
+  vendorHash = "sha256-dNSr0bQz7XdC2fTD82TI8tfmwKBuAcbxjaMC9KAjxlI=";
 
   ldflags = [
     "-s"

pkgs/tools/misc/rtx/default.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rtx";
-  version = "2023.10.2";
+  version = "2023.11.2";
 
   src = fetchFromGitHub {
     owner = "jdxcode";
     repo = "rtx";
     rev = "v${version}";
-    hash = "sha256-wp5+n8dSnCExxgnCHl0GhcWTu8J6nGBJnjzWmc7XJ3E=";
+    hash = "sha256-OdqHyxqufJJTfP7frjLKf5R0WNySDyZc7Sh0Mpdord0=";
   };
 
-  cargoHash = "sha256-Y/AUdg001/ezYHgOEt32go7DiIMLym9GyB88hG4NdKs=";
+  cargoHash = "sha256-KOte3zmJllrMp6OaKuFtUsRjdRKlSAxdJp1iJEOPcF0=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];

pkgs/tools/misc/tab-rs/default.nix

@@ -24,5 +24,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ ];
     mainProgram = "tab";
+    broken = (stdenv.isDarwin && stdenv.isAarch64); # Added 2023-11-13
   };
 }

pkgs/tools/package-management/harmonia/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harmonia";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-LzStxaqoez144LhqLjLP3yNgCj/HFqKSy+JcAW/FwM8=";
+    hash = "sha256-XtnK54HvZMKZGSCrVD0FO5PQLMo3Vkj8ezUlsfqStq0=";
   };
 
-  cargoHash = "sha256-4DXIMsT69PhxqZX1j2aJ/XDLjvX76WbzEN0yxrnP9v0=";
+  cargoHash = "sha256-oQVHrfNPhslYk6APB/bhW+h+vk/gNTW/ZypoGGb5zPk=";
 
   nativeBuildInputs = [
     pkg-config nix

pkgs/tools/system/collectd/default.nix

@@ -24,6 +24,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/collectd/collectd/commit/3f575419e7ccb37a3b10ecc82adb2e83ff2826e1.patch";
       sha256 = "0jwjdlfl0dp7mlbwygp6h0rsbaqfbgfm5z07lr5l26z6hhng2h2y";
     })
+    (fetchpatch {
+      name = "no_include_longintrepr.patch";
+      url = "https://github.com/collectd/collectd/commit/623e95394e0e62e7f9ced2104b786d21e9c0bf53.patch";
+      hash = "sha256-0eD7yNW3TWVyNMpLsADhYFDvy6COoCaI0kS1XJrwDgM=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];

pkgs/top-level/all-packages.nix

@@ -18336,6 +18336,8 @@ with pkgs;
 
   teller = callPackage ../development/tools/teller { };
 
+  yakut = python3Packages.callPackage ../development/tools/misc/yakut { };
+
   ### DEVELOPMENT / TOOLS / LANGUAGE-SERVERS
 
   ansible-language-server = callPackage ../development/tools/language-servers/ansible-language-server { };
@@ -30167,6 +30169,10 @@ with pkgs;
 
   unscii = callPackage ../data/fonts/unscii { };
 
+  utterly-nord-plasma = callPackage ../data/themes/utterly-nord-plasma {
+    inherit (libsForQt5) breeze-icons kdeclarative kirigami2 plasma-framework plasma-workspace;
+  };
+
   uw-ttyp0 = callPackage ../data/fonts/uw-ttyp0 { };
 
   u001-font = callPackage ../data/fonts/u001 { };
@@ -41266,8 +41272,6 @@ with pkgs;
 
   usb-reset = callPackage ../applications/misc/usb-reset { };
 
-  usql = callPackage ../applications/misc/usql { };
-
   utf8cpp = callPackage ../development/libraries/utf8cpp { };
 
   utf8proc = callPackage ../development/libraries/utf8proc { };

pkgs/top-level/python-packages.nix

@@ -9261,6 +9261,8 @@ self: super: with self; {
 
   pysubs2 = callPackage ../development/python-modules/pysubs2 { };
 
+  pysuez = callPackage ../development/python-modules/pysuez { };
+
   pysqlitecipher = callPackage ../development/python-modules/pysqlitecipher { };
 
   pysyncthru = callPackage ../development/python-modules/pysyncthru { };
@@ -9940,6 +9942,18 @@ self: super: with self; {
 
   pycxx = callPackage ../development/python-modules/pycxx { };
 
+  pycyphal = callPackage ../development/python-modules/pycyphal {
+    # Does not yet support nunavut 2+, use latest 1.X version instead
+    # https://github.com/OpenCyphal/pycyphal/issues/277
+    nunavut = self.nunavut.overridePythonAttrs (prev: rec {
+      version = "1.9.0";
+      src = prev.src.override {
+        inherit version;
+        hash = "sha256-KhgijXJ908uxM7VZdXo1WU/RGU0cfqctBCbpF2wOcy8=";
+      };
+    });
+  };
+
   pydaikin = callPackage ../development/python-modules/pydaikin { };
 
   pydal = callPackage ../development/python-modules/pydal { };