Merge staging-next into staging

doc/languages-frameworks/python.section.md

@@ -74,8 +74,9 @@ and the aliases
 
 #### `buildPythonPackage` function {#buildpythonpackage-function}
 
-The `buildPythonPackage` function is implemented in
+The `buildPythonPackage` function has its name binding in
-`pkgs/development/interpreters/python/mk-python-derivation.nix`
+`pkgs/development/interpreters/python/python-packages-base.nix` and is
+implemented in `pkgs/development/interpreters/python/mk-python-derivation.nix`
 using setup hooks.
 
 The following is an example:

maintainers/maintainer-list.nix

@@ -6227,6 +6227,12 @@
     githubId = 303897;
     name = "Fabián Heredia Montiel";
   };
+  fabianrig = {
+    email = "fabianrig@posteo.de";
+    github = "fabianrig";
+    githubId = 88741530;
+    name = "Fabian Rigoll";
+  };
   fadenb = {
     email = "tristan.helmich+nixos@gmail.com";
     github = "fadenb";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -85,6 +85,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [ollama](https://ollama.ai), server for running large language models locally.
 
+- [Mihomo](https://github.com/MetaCubeX/mihomo), a rule-based proxy in Go. Available as [services.mihomo.enable](#opt-services.mihomo.enable).
+
 - [hebbot](https://github.com/haecker-felix/hebbot), a Matrix bot to generate "This Week in X" like blog posts. Available as [services.hebbot](#opt-services.hebbot.enable).
 
 - [Python Matter Server](https://github.com/home-assistant-libs/python-matter-server), a

nixos/modules/image/repart-image.nix

@@ -2,8 +2,8 @@
 # NixOS module that can be imported.
 
 { lib
+, stdenvNoCC
 , runCommand
-, runCommandLocal
 , python3
 , black
 , ruff
@@ -26,15 +26,18 @@
 , xz
 
   # arguments
+, name
+, version
 , imageFileBasename
 , compression
 , fileSystems
-, partitions
+, partitionsJSON
 , split
 , seed
 , definitionsDirectory
 , sectorSize
 , mkfsEnv ? {}
+, createEmpty ? true
 }:
 
 let
@@ -52,11 +55,6 @@ let
     mypy --strict $out
   '';
 
-  amendedRepartDefinitions = runCommandLocal "amended-repart.d" {} ''
-    definitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
-    cp -r $definitions $out
-  '';
-
   fileSystemToolMapping = {
     "vfat" = [ dosfstools mtools ];
     "ext4" = [ e2fsprogs.bin ];
@@ -78,53 +76,88 @@ let
     "xz" = "xz --keep --verbose --threads=0 -${toString compression.level}";
   }."${compression.algorithm}";
 in
-
+  stdenvNoCC.mkDerivation (finalAttrs:
-runCommand imageFileBasename
+  (if (version != null)
-{
+  then { pname = name; inherit version; }
+  else { inherit name;  }
+  ) // {
   __structuredAttrs = true;
 
   nativeBuildInputs = [
     systemd
     fakeroot
     util-linux
+  ] ++ lib.optionals (compression.enable) [
     compressionPkg
   ] ++ fileSystemTools;
 
   env = mkfsEnv;
 
+  inherit partitionsJSON definitionsDirectory;
+
+  # relative path to the repart definitions that are read by systemd-repart
+  finalRepartDefinitions = "repart.d";
+
   systemdRepartFlags = [
     "--dry-run=no"
-    "--empty=create"
     "--size=auto"
     "--seed=${seed}"
-    "--definitions=${amendedRepartDefinitions}"
+    "--definitions=${finalAttrs.finalRepartDefinitions}"
     "--split=${lib.boolToString split}"
     "--json=pretty"
+  ] ++ lib.optionals createEmpty [
+    "--empty=create"
   ] ++ lib.optionals (sectorSize != null) [
     "--sector-size=${toString sectorSize}"
   ];
 
-  passthru = {
+  dontUnpack = true;
-    inherit amendRepartDefinitions amendedRepartDefinitions;
+  dontConfigure = true;
-  };
+  doCheck = false;
-} ''
-  mkdir -p $out
-  cd $out
 
-  echo "Building image with systemd-repart..."
+  patchPhase = ''
-  unshare --map-root-user fakeroot systemd-repart \
+    runHook prePatch
-    ''${systemdRepartFlags[@]} \
-    ${imageFileBasename}.raw \
-    | tee repart-output.json
 
+    amendedRepartDefinitionsDir=$(${amendRepartDefinitions} $partitionsJSON $definitionsDirectory)
+    ln -vs $amendedRepartDefinitionsDir $finalRepartDefinitions
+
+    runHook postPatch
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    echo "Building image with systemd-repart..."
+    unshare --map-root-user fakeroot systemd-repart \
+      ''${systemdRepartFlags[@]} \
+      ${imageFileBasename}.raw \
+      | tee repart-output.json
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+  ''
   # Compression is implemented in the same derivation as opposed to in a
   # separate derivation to allow users to save disk space. Disk images are
   # already very space intensive so we want to allow users to mitigate this.
-  if ${lib.boolToString compression.enable}; then
+  + lib.optionalString compression.enable
+  ''
     for f in ${imageFileBasename}*; do
       echo "Compressing $f with ${compression.algorithm}..."
       # Keep the original file when compressing and only delete it afterwards
       ${compressionCommand} $f && rm $f
     done
-  fi
+  '' + ''
-''
+    mv -v repart-output.json ${imageFileBasename}* $out
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit amendRepartDefinitions;
+  };
+})

nixos/modules/image/repart.nix

@@ -211,6 +211,15 @@ in
       '';
     };
 
+    finalPartitions = lib.mkOption {
+      type = lib.types.attrs;
+      internal = true;
+      readOnly = true;
+      description = lib.mdDoc ''
+        Convenience option to access partitions with added closures.
+      '';
+    };
+
   };
 
   config = {
@@ -224,6 +233,16 @@ in
             "zstd" = ".zst";
             "xz" = ".xz";
           }."${cfg.compression.algorithm}";
+
+        makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };
+
+        # Add the closure of the provided Nix store paths to cfg.partitions so
+        # that amend-repart-definitions.py can read it.
+        addClosure = _name: partitionConfig: partitionConfig // (
+          lib.optionalAttrs
+            (partitionConfig.storePaths or [ ] != [ ])
+            { closure = "${makeClosure partitionConfig.storePaths}/store-paths"; }
+        );
       in
       {
         name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
@@ -239,6 +258,8 @@ in
             "xz" = 3;
           }."${cfg.compression.algorithm}";
         };
+
+        finalPartitions = lib.mapAttrs addClosure cfg.partitions;
       };
 
     system.build.image =
@@ -247,36 +268,25 @@ in
           (f: f != null)
           (lib.mapAttrsToList (_n: v: v.repartConfig.Format or null) cfg.partitions);
 
-        makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };
-
-        # Add the closure of the provided Nix store paths to cfg.partitions so
-        # that amend-repart-definitions.py can read it.
-        addClosure = _name: partitionConfig: partitionConfig // (
-          lib.optionalAttrs
-            (partitionConfig.storePaths or [ ] != [ ])
-            { closure = "${makeClosure partitionConfig.storePaths}/store-paths"; }
-        );
-
-        finalPartitions = lib.mapAttrs addClosure cfg.partitions;
 
         format = pkgs.formats.ini { };
 
         definitionsDirectory = utils.systemdUtils.lib.definitions
           "repart.d"
           format
-          (lib.mapAttrs (_n: v: { Partition = v.repartConfig; }) finalPartitions);
+          (lib.mapAttrs (_n: v: { Partition = v.repartConfig; }) cfg.finalPartitions);
 
-        partitions = pkgs.writeText "partitions.json" (builtins.toJSON finalPartitions);
+        partitionsJSON = pkgs.writeText "partitions.json" (builtins.toJSON cfg.finalPartitions);
 
         mkfsEnv = mkfsOptionsToEnv cfg.mkfsOptions;
       in
       pkgs.callPackage ./repart-image.nix {
         systemd = cfg.package;
-        inherit (cfg) imageFileBasename compression split seed sectorSize;
+        inherit (cfg) name version imageFileBasename compression split seed sectorSize;
-        inherit fileSystems definitionsDirectory partitions mkfsEnv;
+        inherit fileSystems definitionsDirectory partitionsJSON mkfsEnv;
       };
 
-    meta.maintainers = with lib.maintainers; [ nikstur ];
+    meta.maintainers = with lib.maintainers; [ nikstur willibutz ];
 
   };
 }

nixos/modules/module-list.nix

@@ -1018,6 +1018,7 @@
   ./services/networking/lxd-image-server.nix
   ./services/networking/magic-wormhole-mailbox-server.nix
   ./services/networking/matterbridge.nix
+  ./services/networking/mihomo.nix
   ./services/networking/minidlna.nix
   ./services/networking/miniupnpd.nix
   ./services/networking/miredo.nix

nixos/modules/services/networking/mihomo.nix

@@ -0,0 +1,118 @@
+# NOTE:
+# cfg.configFile contains secrets such as proxy servers' credential!
+# we dont want plaintext secrets in world-readable `/nix/store`.
+
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  cfg = config.services.mihomo;
+in
+{
+  options.services.mihomo = {
+    enable = lib.mkEnableOption "Mihomo, A rule-based proxy in Go.";
+
+    package = lib.mkPackageOption pkgs "mihomo" { };
+
+    configFile = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.path;
+      description = "Configuration file to use.";
+    };
+
+    webui = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.path;
+      description = ''
+        Local web interface to use.
+
+        You can also use the following website, just in case:
+        - metacubexd:
+          - https://d.metacubex.one
+          - https://metacubex.github.io/metacubexd
+          - https://metacubexd.pages.dev
+        - yacd:
+          - https://yacd.haishan.me
+        - clash-dashboard (buggy):
+          - https://clash.razord.top
+      '';
+    };
+
+    extraOpts = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.str;
+      description = "Extra command line options to use.";
+    };
+
+    tunMode = lib.mkEnableOption ''
+      necessary permission for Mihomo's systemd service for TUN mode to function properly.
+
+      Keep in mind, that you still need to enable TUN mode manually in Mihomo's configuration.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    ### systemd service
+    systemd.services."mihomo" = {
+      description = "Mihomo daemon, A rule-based proxy in Go.";
+      documentation = [ "https://wiki.metacubex.one/" ];
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig =
+        {
+          ExecStart = lib.concatStringsSep " " [
+            (lib.getExe cfg.package)
+            "-d /var/lib/private/mihomo"
+            (lib.optionalString (cfg.configFile != null) "-f \${CREDENTIALS_DIRECTORY}/config.yaml")
+            (lib.optionalString (cfg.webui != null) "-ext-ui ${cfg.webui}")
+            (lib.optionalString (cfg.extraOpts != null) cfg.extraOpts)
+          ];
+
+          DynamicUser = true;
+          StateDirectory = "mihomo";
+          LoadCredential = "config.yaml:${cfg.configFile}";
+
+          ### Hardening
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RestrictNamespaces = true;
+          RestrictAddressFamilies = "AF_INET AF_INET6";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = "@system-service bpf";
+          UMask = "0077";
+        }
+        // lib.optionalAttrs cfg.tunMode {
+          AmbientCapabilities = "CAP_NET_ADMIN";
+          CapabilityBoundingSet = "CAP_NET_ADMIN";
+          PrivateDevices = false;
+          PrivateUsers = false;
+          RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK";
+        };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ Guanran928 ];
+}

nixos/modules/services/x11/window-managers/nimdow.nix

@@ -8,16 +8,23 @@ in
 {
   options = {
     services.xserver.windowManager.nimdow.enable = mkEnableOption (lib.mdDoc "nimdow");
+    services.xserver.windowManager.nimdow.package = mkOption {
+      type = types.package;
+      default = pkgs.nimdow;
+      defaultText = "pkgs.nimdow";
+      description = lib.mdDoc "nimdow package to use";
+    };
   };
 
+
   config = mkIf cfg.enable {
     services.xserver.windowManager.session = singleton {
       name = "nimdow";
       start = ''
-        ${pkgs.nimdow}/bin/nimdow &
+        ${cfg.package}/bin/nimdow &
         waitPID=$!
       '';
     };
-    environment.systemPackages = [ pkgs.nimdow ];
+    environment.systemPackages = [ cfg.package pkgs.st ];
   };
 }

nixos/tests/all-tests.nix

@@ -529,6 +529,7 @@ in {
   memcached = handleTest ./memcached.nix {};
   merecat = handleTest ./merecat.nix {};
   metabase = handleTest ./metabase.nix {};
+  mihomo = handleTest ./mihomo.nix {};
   mindustry = handleTest ./mindustry.nix {};
   minecraft = handleTest ./minecraft.nix {};
   minecraft-server = handleTest ./minecraft-server.nix {};
@@ -581,6 +582,7 @@ in {
   ndppd = handleTest ./ndppd.nix {};
   nebula = handleTest ./nebula.nix {};
   netbird = handleTest ./netbird.nix {};
+  nimdow = handleTest ./nimdow.nix {};
   neo4j = handleTest ./neo4j.nix {};
   netdata = handleTest ./netdata.nix {};
   networking.networkd = handleTest ./networking.nix { networkd = true; };

nixos/tests/mihomo.nix

@@ -0,0 +1,44 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "mihomo";
+  meta.maintainers = with pkgs.lib.maintainers; [ Guanran928 ];
+
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.curl ];
+
+    services.nginx = {
+      enable = true;
+      statusPage = true;
+    };
+
+    services.mihomo = {
+      enable = true;
+      configFile = pkgs.writeTextFile {
+        name = "config.yaml";
+        text = ''
+          mixed-port: 7890
+          external-controller: 127.0.0.1:9090
+          authentication:
+          - "user:supersecret"
+        '';
+      };
+    };
+  };
+
+  testScript = ''
+    # Wait until it starts
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("mihomo.service")
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(7890)
+    machine.wait_for_open_port(9090)
+
+    # Proxy
+    machine.succeed("curl --fail --max-time 10 --proxy http://user:supersecret@localhost:7890 http://localhost")
+    machine.succeed("curl --fail --max-time 10 --proxy socks5://user:supersecret@localhost:7890 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy http://user:supervillain@localhost:7890 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy socks5://user:supervillain@localhost:7890 http://localhost")
+
+    # Web UI
+    machine.succeed("curl --fail http://localhost:9090") == '{"hello":"clash"}'
+  '';
+})

nixos/tests/nimdow.nix

@@ -0,0 +1,25 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "nimdow";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ marcusramberg ];
+  };
+
+  nodes.machine = { lib, ... }: {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+    test-support.displayManager.auto.user = "alice";
+    services.xserver.displayManager.defaultSession = lib.mkForce "none+nimdow";
+    services.xserver.windowManager.nimdow.enable = true;
+  };
+
+  testScript = { ... }: ''
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
+
+    with subtest("ensure we can open a new terminal"):
+        machine.send_key("meta_l-ret")
+        machine.wait_for_window(r"alice.*?machine")
+        machine.screenshot("terminal")
+  '';
+})

pkgs/applications/editors/cpeditor/default.nix

@@ -5,6 +5,7 @@
 , qtbase
 , qttools
 , wrapQtAppsHook
+, syntax-highlighting
 , cmake
 , ninja
 , python3
@@ -13,25 +14,23 @@
 
 stdenv.mkDerivation rec {
   pname = "cpeditor";
-  version = "6.11.2";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "cpeditor";
     repo = "cpeditor";
     rev = version;
-    sha256 = "sha256-zotbXzRjIwZdYluJiz6GWUIOXl/wz1TWt+dcTwMhURo=";
+    hash = "sha256-t7nn3sO45dOQq5OMWhaseO9XHicQ/1fjukXal5yPMgY";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapQtAppsHook python3 ];
-  buildInputs = [ qtbase qttools ];
+  buildInputs = [ qtbase qttools syntax-highlighting ];
 
   postPatch = ''
-    substituteInPlace src/Core/Runner.cpp --replace "/bin/bash" "${runtimeShell}"
+    substituteInPlace src/Core/Runner.cpp --replace-fail "/bin/bash" "${runtimeShell}"
   '';
 
-  env.NIX_CFLAGS_COMPILE = "-std=c++14";
-
   meta = with lib; {
     description = "An IDE specially designed for competitive programming";
     homepage = "https://cpeditor.org";

pkgs/applications/gis/qgis/set-pyqt-package-dirs-ltr.patch

@@ -1,59 +0,0 @@
-diff --git a/cmake/FindPyQt5.cmake b/cmake/FindPyQt5.cmake
-index b51fd0075e..87ee317e05 100644
---- a/cmake/FindPyQt5.cmake
-+++ b/cmake/FindPyQt5.cmake
-@@ -25,7 +25,7 @@ ELSE(EXISTS PYQT5_VERSION_STR)
-   IF(SIP_BUILD_EXECUTABLE)
-     # SIP >= 5.0 path
- 
--    FILE(GLOB _pyqt5_metadata "${Python_SITEARCH}/PyQt5-*.dist-info/METADATA")
-+    FILE(GLOB _pyqt5_metadata "@pyQt5PackageDir@/PyQt5-*.dist-info/METADATA")
-     IF(_pyqt5_metadata)
-       FILE(READ ${_pyqt5_metadata} _pyqt5_metadata_contents)
-       STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" PYQT5_VERSION_STR ${_pyqt5_metadata_contents})
-@@ -34,8 +34,8 @@ ELSE(EXISTS PYQT5_VERSION_STR)
-     ENDIF(_pyqt5_metadata)
- 
-     IF(PYQT5_VERSION_STR)
--      SET(PYQT5_MOD_DIR "${Python_SITEARCH}/PyQt5")
--      SET(PYQT5_SIP_DIR "${Python_SITEARCH}/PyQt5/bindings")
-+      SET(PYQT5_MOD_DIR "@pyQt5PackageDir@/PyQt5")
-+      SET(PYQT5_SIP_DIR "@pyQt5PackageDir@/PyQt5/bindings")
-       FIND_PROGRAM(__pyuic5 "pyuic5")
-       GET_FILENAME_COMPONENT(PYQT5_BIN_DIR ${__pyuic5} DIRECTORY)
- 
-diff --git a/cmake/FindQsci.cmake b/cmake/FindQsci.cmake
-index 69e41c1fe9..5456c3d59b 100644
---- a/cmake/FindQsci.cmake
-+++ b/cmake/FindQsci.cmake
-@@ -24,7 +24,7 @@ ELSE(QSCI_MOD_VERSION_STR)
-   IF(SIP_BUILD_EXECUTABLE)
-     # SIP >= 5.0 path
- 
--    FILE(GLOB _qsci_metadata "${Python_SITEARCH}/QScintilla*.dist-info/METADATA")
-+    FILE(GLOB _qsci_metadata "@qsciPackageDir@/QScintilla*.dist-info/METADATA")
-     IF(_qsci_metadata)
-       FILE(READ ${_qsci_metadata} _qsci_metadata_contents)
-       STRING(REGEX REPLACE ".*\nVersion: ([^\n]+).*$" "\\1" QSCI_MOD_VERSION_STR ${_qsci_metadata_contents})
-@@ -33,7 +33,7 @@ ELSE(QSCI_MOD_VERSION_STR)
-     ENDIF(_qsci_metadata)
- 
-     IF(QSCI_MOD_VERSION_STR)
--      SET(QSCI_SIP_DIR "${PYQT5_SIP_DIR}")
-+      SET(QSCI_SIP_DIR "@qsciPackageDir@/PyQt5/bindings")
-       SET(QSCI_FOUND TRUE)
-     ENDIF(QSCI_MOD_VERSION_STR)
- 
-diff --git a/python/CMakeLists.txt b/python/CMakeLists.txt
-index 4cd19c3af4..668cc6a5e6 100644
---- a/python/CMakeLists.txt
-+++ b/python/CMakeLists.txt
-@@ -206,7 +206,7 @@ if (WITH_GUI)
-     install(FILES ${QGIS_PYTHON_OUTPUT_DIRECTORY}/_gui.pyi DESTINATION ${QGIS_PYTHON_DIR})
-   endif()
-   if(QSCI_SIP_DIR)
--    set(SIP_EXTRA_OPTIONS ${SIP_EXTRA_OPTIONS} -I ${QSCI_SIP_DIR})
-+    set(SIP_BUILD_EXTRA_OPTIONS ${SIP_BUILD_EXTRA_OPTIONS} --include-dir=${QSCI_SIP_DIR})
-   else()
-     message(STATUS "Qsci sip file not found - disabling bindings for derived classes")
-     set(SIP_DISABLE_FEATURES ${SIP_DISABLE_FEATURES} HAVE_QSCI_SIP)

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -1,17 +1,17 @@
 { lib
-, callPackage
 , fetchFromGitHub
-, fetchpatch
 , makeWrapper
 , mkDerivation
 , substituteAll
 , wrapGAppsHook
+, wrapQtAppsHook
 
 , withGrass ? true
 , withWebKit ? false
 
 , bison
 , cmake
+, draco
 , exiv2
 , fcgi
 , flex
@@ -25,7 +25,7 @@
 , netcdf
 , ninja
 , openssl
-# , pdal
+, pdal
 , postgresql
 , proj
 , protobuf
@@ -36,6 +36,7 @@
 , qtbase
 , qtkeychain
 , qtlocation
+, qtmultimedia
 , qtsensors
 , qtserialport
 , qtwebkit
@@ -63,8 +64,8 @@ let
     owslib
     psycopg2
     pygments
-    pyqt-builder
     pyqt5
+    pyqt-builder
     python-dateutil
     pytz
     pyyaml
@@ -76,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.28.15";
+  version = "3.34.4";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-R6p1MVeCMbaD74Eqn+OLQkTYP+00y9mBucJR1JXPEJ4=";
+    hash = "sha256-yEltpPhNFT/XB1EB5FvhCKcP0YY4j/q7luhd1mI0ZJU=";
   };
 
   passthru = {
@@ -94,6 +95,7 @@ in mkDerivation rec {
   nativeBuildInputs = [
     makeWrapper
     wrapGAppsHook
+    wrapQtAppsHook
 
     bison
     cmake
@@ -102,32 +104,34 @@ in mkDerivation rec {
   ];
 
   buildInputs = [
-    openssl
+    draco
-    proj
-    geos
-    sqlite
-    gsl
-    qwt
     exiv2
-    protobuf
     fcgi
+    geos
+    gsl
+    hdf5
     libspatialindex
     libspatialite
-    postgresql
-    txt2tags
     libzip
-    hdf5
     netcdf
-    qtbase
+    openssl
-    qtsensors
+    pdal
+    postgresql
+    proj
+    protobuf
     qca-qt5
-    qtkeychain
     qscintilla
+    qt3d
+    qtbase
+    qtkeychain
     qtlocation
+    qtmultimedia
+    qtsensors
     qtserialport
     qtxmlpatterns
-    qt3d
+    qwt
-    # pdal
+    sqlite
+    txt2tags
     zstd
   ] ++ lib.optional withGrass grass
     ++ lib.optional withWebKit qtwebkit
@@ -135,22 +139,22 @@ in mkDerivation rec {
 
   patches = [
     (substituteAll {
-      src = ./set-pyqt-package-dirs-ltr.patch;
+      src = ./set-pyqt-package-dirs.patch;
       pyQt5PackageDir = "${py.pkgs.pyqt5}/${py.pkgs.python.sitePackages}";
       qsciPackageDir = "${py.pkgs.qscintilla-qt5}/${py.pkgs.python.sitePackages}";
     })
-    (fetchpatch {
-      name = "qgis-3.28.9-exiv2-0.28.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-geosciences/qgis/files/qgis-3.28.9-exiv2-0.28.patch?id=002882203ad6a2b08ce035a18b95844a9f4b85d0";
-      hash = "sha256-mPRo0A7ko4GCHJrfJ2Ls0dUKvkFtDmhKekI2CR9StMw=";
-    })
   ];
 
-  # PDAL is disabled until https://github.com/qgis/QGIS/pull/54940
+  # Add path to Qt platform plugins
-  # is backported.
+  # (offscreen is needed by "${APIS_SRC_DIR}/generate_console_pap.py")
+  preBuild = ''
+    export QT_QPA_PLATFORM_PLUGIN_PATH=${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms
+  '';
+
   cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
     "-DWITH_3D=True"
-    "-DWITH_PDAL=False"  # TODO: re-enable PDAL
+    "-DWITH_PDAL=True"
     "-DENABLE_TESTS=False"
   ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
     ++ lib.optional withGrass (let
@@ -159,6 +163,10 @@ in mkDerivation rec {
       in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"
     );
 
+  qtWrapperArgs = [
+    "--set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-${qtbase.version}/plugins/platforms"
+  ];
+
   dontWrapGApps = true; # wrapper params passed below
 
   postFixup = lib.optionalString withGrass ''

pkgs/applications/networking/flexget/default.nix

@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.24";
+  version = "3.11.25";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GivnZ7WWoS4fc7/uUfZFTdT0W+pW7W6Vhb56CmkEb0k=";
+    hash = "sha256-bvCogSBB990LIkk273EMTlqNN303JKr5WCI8g7hLU9Q=";
   };
 
   postPatch = ''

pkgs/applications/science/electronics/dataexplorer/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dataexplorer";
-  version = "3.8.3";
+  version = "3.8.5";
 
   src = fetchurl {
     url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-vU9klb6Mweg8yxnClsIdelG4uW92if64SJ7UHumYYbs=";
+    sha256 = "sha256-b68xIZNbzHdPyZwLngcnjcoBtI6AeTdrblz/qx/HbGQ=";
   };
 
   nativeBuildInputs = [ ant makeWrapper ];

pkgs/by-name/au/authentik/ldap.nix

@@ -4,7 +4,7 @@ buildGoModule {
   pname = "authentik-ldap-outpost";
   inherit (authentik) version src;
 
-  vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+  vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
 
   CGO_ENABLED = 0;
 

pkgs/by-name/au/authentik/package.nix

@@ -11,13 +11,13 @@
 , makeWrapper }:
 
 let
-  version = "2023.10.7";
+  version = "2024.2.2";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     rev = "version/${version}";
-    hash = "sha256-+1IdXRt28UZ2KTa0zsmjneNUOcutP99UUwqcYyVyqTI=";
+    hash = "sha256-2B1RgKY5tpDBdzguEyWqzg15w5x/dLS2ffjbnxbpINs=";
   };
 
   meta = with lib; {
@@ -32,7 +32,7 @@ let
   website = buildNpmPackage {
     pname = "authentik-website";
     inherit version src meta;
-    npmDepsHash = "sha256-4dgFxEvMnp+35nSQNsEchtN1qoS5X2KzEbLPvMnyR+k=";
+    npmDepsHash = "sha256-paACBXG7hEQSLekxCvxNns2Tg9rN3DUgz6o3A/lAhA8=";
 
     NODE_ENV = "production";
     NODE_OPTIONS = "--openssl-legacy-provider";
@@ -82,7 +82,7 @@ let
       ln -s ${src}/website $out/
       ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
     '';
-    npmDepsHash = "sha256-5aCKlArtoEijGqeYiY3zoV0Qo7/Xt5hSXbmy2uYZpok=";
+    npmDepsHash = "sha256-Xtzs91m+qu7jTwr0tMeS74gjlZs4vufGGlplPVf9yew=";
 
     postPatch = ''
       cd web
@@ -105,26 +105,68 @@ let
   python = python3.override {
     self = python;
     packageOverrides = final: prev: {
+      django-tenants = prev.buildPythonPackage rec {
+        pname = "django-tenants";
+        version = "unstable-2024-01-11";
+        src = fetchFromGitHub {
+          owner = "rissson";
+          repo = pname;
+          rev = "a7f37c53f62f355a00142473ff1e3451bb794eca";
+          hash = "sha256-YBT0kcCfETXZe0j7/f1YipNIuRrcppRVh1ecFS3cvNo=";
+        };
+        format = "setuptools";
+        doCheck = false; # Tests require postgres
+
+        propagatedBuildInputs = with prev; [
+          django
+          psycopg
+          gunicorn
+        ];
+      };
+
+      tenant-schemas-celery = prev.buildPythonPackage rec {
+        pname = "tenant-schemas-celery";
+        version = "2.2.0";
+        src = fetchFromGitHub {
+          owner = "maciej-gol";
+          repo = pname;
+          rev = version;
+          hash = "sha256-OpIJobjWZE5GQGnHADioeoJo3A6DAKh0HdO10k4rsX4=";
+        };
+        format = "setuptools";
+        doCheck = false;
+
+        propagatedBuildInputs = with prev; [
+          freezegun
+          more-itertools
+          psycopg2
+        ];
+      };
+
       authentik-django = prev.buildPythonPackage {
         pname = "authentik-django";
         inherit version src meta;
         pyproject = true;
 
         postPatch = ''
+          rm lifecycle/system_migrations/tenant_files.py
           substituteInPlace authentik/root/settings.py \
             --replace-fail 'Path(__file__).absolute().parent.parent.parent' "\"$out\""
           substituteInPlace authentik/lib/default.yml \
-            --replace-fail '/blueprints' "$out/blueprints"
+            --replace-fail '/blueprints' "$out/blueprints" \
+            --replace-fail './media' '/var/lib/authentik/media'
           substituteInPlace pyproject.toml \
             --replace-fail 'dumb-init = "*"' "" \
-            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2' \
+            --replace-fail 'version = "4.9.4"' 'version = "*"' \
+            --replace-fail 'version = "<2"' 'version = "*"'
           substituteInPlace authentik/stages/email/utils.py \
             --replace-fail 'web/' '${webui}/'
         '';
 
         nativeBuildInputs = [ prev.poetry-core ];
 
-        propagatedBuildInputs = with prev; [
+        propagatedBuildInputs = with final; [
           argon2-cffi
           celery
           channels
@@ -140,6 +182,8 @@ let
           django-model-utils
           django-prometheus
           django-redis
+          django-storages
+          django-tenants
           djangorestframework
           djangorestframework-guardian2
           docker
@@ -153,6 +197,7 @@ let
           kubernetes
           ldap3
           lxml
+          jsonpatch
           opencontainers
           packaging
           paramiko
@@ -164,8 +209,10 @@ let
           pyyaml
           requests-oauthlib
           sentry-sdk
+          service-identity
           structlog
           swagger-spec-validator
+          tenant-schemas-celery
           twilio
           twisted
           ua-parser
@@ -178,7 +225,6 @@ let
           wsproto
           xmlsec
           zxcvbn
-          jsonpatch
         ] ++ [
           codespell
         ];
@@ -212,7 +258,7 @@ let
 
     CGO_ENABLED = 0;
 
-    vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+    vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
 
     postInstall = ''
       mv $out/bin/server $out/bin/authentik

pkgs/by-name/cu/cups-printers/package.nix

@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "cups-printers";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "audiusGmbH";
+    repo = "cups-printers";
+    rev = "refs/tags/${version}";
+    hash = "sha256-HTR9t9ElQmCzJfdWyu+JQ8xBfDNpXl8XtNsJxGSfBXk=";
+  };
+
+  pythonRelaxDeps = [
+    "validators"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pycups
+    typer
+    validators
+  ] ++ typer.optional-dependencies.all;
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "cups_printers"
+  ];
+
+  meta = with lib; {
+    description = "Tool for interacting with a CUPS server";
+    homepage = "https://github.com/audiusGmbH/cups-printers";
+    changelog = "https://github.com/audiusGmbH/cups-printers/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "cups-printers";
+  };
+}

pkgs/by-name/hi/hifiscan/package.nix

@@ -0,0 +1,28 @@
+{ lib
+, python3Packages
+, fetchPypi
+}:
+let
+  pname = "hifiscan";
+  version = "1.5.2";
+  hash = "sha256-8eystqjNdDP2X9beogRcsa+Wqu50uMHZv59jdc5GjUc=";
+in
+  python3Packages.buildPythonApplication {
+    inherit pname version;
+
+    pythonPath = with python3Packages; [ eventkit numpy sounddevice pyqt6 pyqt6-sip pyqtgraph ];
+
+    dontUseSetuptoolsCheck = true;
+
+    src = fetchPypi {
+      inherit pname version hash;
+    };
+
+    meta = with lib; {
+      homepage = "https://github.com/erdewit/HiFiScan";
+      description = "Optimize the audio quality of your loudspeakers";
+      license = licenses.bsd2;
+      maintainers = with maintainers; [ cab404 ];
+      mainProgram = "hifiscan";
+    };
+  }

pkgs/by-name/mi/mihomo/package.nix

@@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -31,6 +32,11 @@ buildGoModule rec {
   # network required
   doCheck = false;
 
+
+  passthru.tests = {
+    mihomo = nixosTests.mihomo;
+  };
+
   meta = with lib; {
     description = "A rule-based tunnel in Go";
     homepage = "https://github.com/MetaCubeX/mihomo";

pkgs/by-name/ni/nimdow/package.nix

@@ -1,4 +1,4 @@
-{ lib, buildNimPackage, fetchFromGitHub, testers }:
+{ lib, buildNimPackage, fetchFromGitHub, nixosTests, testers }:
 
 buildNimPackage (finalAttrs: {
   pname = "nimdow";
@@ -25,14 +25,18 @@ buildNimPackage (finalAttrs: {
     substituteInPlace src/nimdowpkg/config/configloader.nim --replace "/usr/share/nimdow" "$out/share/nimdow"
   '';
 
-  passthru.tests.version = testers.testVersion {
+  passthru.tests = {
-    package = finalAttrs.finalPackage;
+    nimdow = nixosTests.nimdow;
-    version = "v${finalAttrs.version}";
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      version = "v${finalAttrs.version}";
+    };
   };
 
   meta = with lib;
     finalAttrs.src.meta // {
       description = "Nim based tiling window manager";
+      platforms = platforms.linux;
       license = [ licenses.gpl2 ];
       maintainers = [ maintainers.marcusramberg ];
       mainProgram = "nimdow";

pkgs/by-name/qa/qadwaitadecorations/package.nix

@@ -19,13 +19,13 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "qadwaitadecorations";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "QAdwaitaDecorations";
     rev = finalAttrs.version;
-    hash = "sha256-vG6nK+9hUX0ZxNFz5ZA/EC1rSFTGl5rDTBlsraRlrTU=";
+    hash = "sha256-aqjm93tmBfDkmce1WG5xx8MCDCvo6AOrRHArj/+Ko9E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/resonance/package.nix

@@ -0,0 +1,83 @@
+{ lib
+, cargo
+, dbus
+, desktop-file-utils
+, fetchFromGitHub
+, glib
+, gst_all_1
+, gtk4
+, libadwaita
+, libxml2
+, meson
+, ninja
+, nix-update-script
+, openssl
+, pkg-config
+, python3
+, python3Packages
+, rustPlatform
+, rustc
+, sqlite
+, stdenv
+, wrapGAppsHook4
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "resonance";
+  version = "0-unstable-2023-06-06";
+
+  src = fetchFromGitHub {
+    owner = "nate-xyz";
+    repo = "resonance";
+    rev = "97826093e22418c0efdb4e61cc75d981bb82c120";
+    hash = "sha256-DgNUjb8+2WTw91OGgFf97YL6lnODtkftYAP/c05RUPI=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    src = finalAttrs.src;
+    hash = "sha256-/v3OokClOk95GOzidBHRkUG7kjHQm35yPeC1n3PzcyM=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    desktop-file-utils
+    meson
+    ninja
+    pkg-config
+    python3
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    dbus
+    glib
+    gtk4
+    libadwaita
+    libxml2
+    openssl
+    sqlite
+  ] ++ (with gst_all_1; [
+    gst-libav
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-ugly
+    gstreamer
+  ]);
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PYTHONPATH : ${python3.pkgs.makePythonPath (with python3Packages; [ tqdm mutagen loguru ])})
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Intuitive GTK4/LibAdwaita music player";
+    homepage = "https://github.com/nate-xyz/resonance";
+    license = licenses.gpl3Plus;
+    mainProgram = "resonance";
+    maintainers = with maintainers; [ Guanran928 ];
+    platforms = platforms.linux;
+  };
+})

pkgs/by-name/ro/rofimoji/package.nix

@@ -1,13 +1,11 @@
-{ buildPythonApplication
+{ lib
+, python3Packages
 , fetchFromGitHub
-, lib
-, python3
 , installShellFiles
 
 , waylandSupport ? true
 , x11Support ? true
 
-, configargparse
 , rofi
 , wl-clipboard
 , wtype
@@ -15,28 +13,28 @@
 , xsel
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "rofimoji";
-  version = "6.1.0";
+  version = "6.2.0";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofimoji";
-    rev = "refs/tags/${version}";
+    rev = version;
-    sha256 = "sha256-eyzdTMLW9nk0x74T/AhvoVSrxXugc1HgNJy8EB5BApE=";
+    hash = "sha256-9P9hXBEfq6sqCvb2SfPBNadEoXAdWF3cmcKGEOK+EHE=";
   };
 
   nativeBuildInputs = [
-    python3.pkgs.poetry-core
+    python3Packages.poetry-core
     installShellFiles
   ];
 
   # `rofi` and the `waylandSupport` and `x11Support` dependencies
   # contain binaries needed at runtime.
-  propagatedBuildInputs = with lib; [ configargparse rofi ]
+  propagatedBuildInputs = [ python3Packages.configargparse rofi ]
-    ++ optionals waylandSupport [ wl-clipboard wtype ]
+    ++ lib.optionals waylandSupport [ wl-clipboard wtype ]
-    ++ optionals x11Support [ xdotool xsel ];
+    ++ lib.optionals x11Support [ xdotool xsel ];
 
   # The 'extractors' sub-module is used for development
   # and has additional dependencies.
@@ -52,6 +50,7 @@ buildPythonApplication rec {
     description = "A simple emoji and character picker for rofi";
     mainProgram = "rofimoji";
     homepage = "https://github.com/fdw/rofimoji";
+    changelog = "https://github.com/fdw/rofimoji/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ justinlovinger ];

pkgs/by-name/te/technitium-dns-server/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeWrapper,
+  dotnet-sdk_8,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "technitium-dns-server";
+  version = "12.1";
+
+  src = fetchurl {
+    url = "https://download.technitium.com/dns/archive/${version}/DnsServerPortable.tar.gz";
+    hash = "sha256-G0M2xuYBZA3XXXaPs4pLrJmzAMbVJhiqISAvuCw3iZo=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/${pname}-${version}}
+    cp -r * $out/share/${pname}-${version}/.
+    rm $out/share/${pname}-${version}/start.{sh,bat}
+    rm $out/share/${pname}-${version}/DnsServerApp.exe
+    rm $out/share/${pname}-${version}/env-vars
+    # Remove systemd.service in favor of a separate module (including firewall configuration).
+    rm $out/share/${pname}-${version}/systemd.service
+
+    makeWrapper "${dotnet-sdk_8}/bin/dotnet" $out/bin/technitium-dns-server \
+      --add-flags "$out/share/${pname}-${version}/DnsServerApp.dll"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md";
+    description = "Authorative and Recursive DNS server for Privacy and Security";
+    homepage = "https://github.com/TechnitiumSoftware/DnsServer";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "technitium-dns-server";
+    maintainers = with lib.maintainers; [ fabianrig ];
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+  };
+}

pkgs/data/themes/andromeda-gtk-theme/default.nix

@@ -10,7 +10,7 @@ stdenvNoCC.mkDerivation {
       repo = "Andromeda-gtk";
       rev = "250751a546dd0fa2e67eef86d957fbf993b61dfe";
       hash = "sha256-exr9j/jW2P9cBhKUPQy3AtK5Vgav5vOyWInXUyVhBk0=";
-      name = "Andromeda-gtk";
+      name = "Andromeda";
     })
 
     (fetchFromGitHub {
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation {
       repo = "Andromeda-gtk";
       rev = "11a6194d19cb846447db048455a5e782ec830ae1";
       hash = "sha256-Yy3mih0nyA+ahLqj2D99EKqtmWYJRsvQMkmlLfUPcqQ=";
-      name = "Andromeda-gtk-standard-buttons";
+      name = "Andromeda-standard-buttons";
     })
   ];
 
@@ -35,6 +35,7 @@ stdenvNoCC.mkDerivation {
     cp -a Andromeda* $out/share/themes
 
     # remove uneeded files, which are not distributed in https://www.gnome-look.org/p/2039961/
+    rm -rf $out/share/themes/*/.gitignore
     rm -rf $out/share/themes/*/Art
     rm -rf $out/share/themes/*/LICENSE
     rm -rf $out/share/themes/*/README.md

pkgs/development/compilers/circt/default.nix

@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.68.0";
+  version = "1.70.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-N2OpKzniVUqi+L48mD5W1wW1GdECPVWZCo30f4XD3n0=";
+    hash = "sha256-OELkfyN0fxnQIGQxfwuRM/+DYdb+8m5wlT/H+eQNjq0=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/libdbi-drivers/default.nix

@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libdbi sqlite postgresql ] ++ lib.optional (libmysqlclient != null) libmysqlclient;
 
+  patches = [
+    # https://sourceforge.net/p/libdbi-drivers/libdbi-drivers/ci/24f48b86c8988ee3aaebc5f303d71e9d789f77b6
+    ./libdbi-drivers-0.9.0-buffer_overflow.patch
+  ];
+
   postPatch = ''
     sed -i '/SQLITE3_LIBS/ s/-lsqlite/-lsqlite3/' configure;
   '';
@@ -41,6 +46,11 @@ stdenv.mkDerivation rec {
     "--with-pgsql_libdir=${postgresql.lib}/lib"
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+    "-Wno-error=incompatible-function-pointer-types"
+    "-Wno-error=int-conversion"
+  ]);
+
   installFlags = [ "DESTDIR=\${out}" ];
 
   postInstall = ''

pkgs/development/libraries/libdbi-drivers/libdbi-drivers-0.9.0-buffer_overflow.patch

@@ -0,0 +1,11 @@
+--- a/drivers/sqlite3/dbd_sqlite3.c
++++ b/drivers/sqlite3/dbd_sqlite3.c
+@@ -1451,7 +1451,7 @@ static int getTables(char** tables, int
+ 		    break;
+ 		  }
+ 
+-		  word_lower[item-start+1];
++		  char word_lower[item-start+1];
+ 		  strncpy(word_lower,start,item-start);
+ 		  word_lower[item-start] = '\0';
+ 		  int i = 0;

pkgs/development/libraries/pdal/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , callPackage
 , fetchFromGitHub
-, fetchpatch
 , testers
 
 , enableE57 ? lib.meta.availableOn stdenv.hostPlatform libe57format
@@ -28,24 +27,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdal";
-  version = "2.6.3";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "PDAL";
     repo = "PDAL";
     rev = finalAttrs.version;
-    sha256 = "sha256-wrgEbCYOGW1yrVxyX+UDa5jcUqab3letEGuvWnYvtac=";
+    sha256 = "sha256-knyDVUZH+X563UzKkvDpi08EcXU5s4+Jvya3Xprpt1A=";
   };
 
-  patches = [
-    # Fix running tests
-    # https://github.com/PDAL/PDAL/issues/4280
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/PDAL/PDAL/pull/4291.patch";
-      sha256 = "sha256-jFS+trwMRBfm+MpT0CcuD/hdYmfyuQj2zyoe06B6G9U=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/development/ocaml-modules/mdx/default.nix

@@ -6,13 +6,13 @@
 
 buildDunePackage rec {
   pname = "mdx";
-  version = "2.3.1";
+  version = "2.4.1";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/realworldocaml/mdx/releases/download/${version}/mdx-${version}.tbz";
-    hash = "sha256-mkCkX6p41H4pOSvU/sJg0UAWysGweOSrAW6jrcCXQ/M=";
+    hash = "sha256-GkDMkcxVPe0KIMmNQ0NUlTvbdZ7Mka02u7mn3QQSrxM=";
   };
 
   nativeBuildInputs = [ cppo ];

pkgs/development/python-modules/approvaltests/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "11.1.1";
+  version = "11.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kVGCAht3ZP6ENhFJG3LoYs6PTH7OSNoj/h5QACwjKG8=";
+    hash = "sha256-VM4TP98bS9NmhxZz+YHMJrHKr5g6E6aYidxjKQyXp7k=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/argostranslate/default.nix

@@ -18,13 +18,13 @@ let
 in
 buildPythonPackage rec {
   pname = "argostranslate";
-  version = "1.9.1";
+  version = "1.9.3";
 
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-OlVrRfBhbJpIFjWdLQsn7zEteRP6UfkIpGT4Y933QKk=";
+    sha256 = "sha256-N1Dh8238cDKpIMeQT645lDvYMbOWjVqGuWxt37+TQmQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/catppuccin/default.nix

@@ -10,14 +10,18 @@
 
 buildPythonPackage rec {
   pname = "catppuccin";
-  version = "2.1.0";
+  version = "1.3.2";
+  # Note: updating to later versions breaks catppuccin-gtk
+  # It would be ideal to only update this after catppuccin-gtk
+  # gets support for the newer version
+
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "catppuccin";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/RINDyO0cngDy9APqsFHBFBKi8aDf7Tah/IIFdXQURo=";
+    hash = "sha256-spPZdQ+x3isyeBXZ/J2QE6zNhyHRfyRQGiHreuXzzik=";
   };
 
   build-system = [
@@ -34,6 +38,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
+  # can be removed next version
+  disabledTestPaths = [
+    "tests/test_flavour.py" # would download a json to check correctness of flavours
+  ];
+
   pythonImportsCheck = [ "catppuccin" ];
 
   meta = {

pkgs/development/python-modules/eventkit/default.nix

@@ -0,0 +1,26 @@
+{ buildPythonPackage
+, lib
+, fetchPypi
+, numpy
+}:
+let
+  pname = "eventkit";
+  version = "1.0.3";
+  hash = "sha256-mUl/bzxjilD/dhby+M2Iexi7/zdl3BvYaBVU2xRnyTM=";
+in buildPythonPackage {
+  inherit pname version;
+
+  src = fetchPypi {
+    inherit pname version hash;
+  };
+
+  propagatedBuildInputs = [ numpy ];
+  dontUseSetuptoolsCheck = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/erdewit/eventkit";
+    description = "Event-driven data pipelines";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ cab404 ];
+  };
+}

pkgs/development/python-modules/extract-msg/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "extract-msg";
-  version = "0.48.2";
+  version = "0.48.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "TeamMsgExtractor";
     repo = "msg-extractor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qCOi4CRBGF5MuGcHVUk+zb76pchZXbE1cBUIlzl9++w=";
+    hash = "sha256-oN5blYU8LR2O1LEb6naL33UXjBk9xpINl4h6HSaN7PQ=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/htmldate/default.nix

@@ -1,28 +1,34 @@
 { lib
+, backports-datetime-fromisoformat
 , buildPythonPackage
-, fetchPypi
-, pythonOlder
 , charset-normalizer
 , dateparser
+, faust-cchardet
+, fetchPypi
 , lxml
 , pytestCheckHook
 , python-dateutil
+, pythonOlder
+, setuptools
 , urllib3
-, backports-datetime-fromisoformat
 }:
 
 buildPythonPackage rec {
   pname = "htmldate";
-  version = "1.7.0";
+  version = "1.8.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AqgA3SJMv3S/SDsEL2ThT1e6DkDGtEBLKE6YvGwwto0=";
+    hash = "sha256-+Ux9AX9Coc9CLlp8XvEMrLridohjFPJ6mGRkYn8wuxU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     charset-normalizer
     dateparser
@@ -33,6 +39,21 @@ buildPythonPackage rec {
     backports-datetime-fromisoformat
   ];
 
+  passthru.optional-dependencies = {
+    speed = [
+      faust-cchardet
+      urllib3
+    ] ++ lib.optionals (pythonOlder "3.11") [
+      backports-datetime-fromisoformat
+    ] ++ urllib3.optional-dependencies.brotli;
+    all = [
+      faust-cchardet
+      urllib3
+    ] ++ lib.optionals (pythonOlder "3.11") [
+      backports-datetime-fromisoformat
+    ] ++ urllib3.optional-dependencies.brotli;
+  };
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -44,14 +65,16 @@ buildPythonPackage rec {
     "test_download"
   ];
 
-  pythonImportsCheck = [ "htmldate" ];
+  pythonImportsCheck = [
+    "htmldate"
+  ];
 
   meta = with lib; {
-    description = "Fast and robust extraction of original and updated publication dates from URLs and web pages";
+    description = "Module for the extraction of original and updated publication dates from URLs and web pages";
-    mainProgram = "htmldate";
     homepage = "https://htmldate.readthedocs.io";
     changelog = "https://github.com/adbar/htmldate/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jokatzke ];
+    mainProgram = "htmldate";
   };
 }

pkgs/development/python-modules/langsmith/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.29";
+  version = "0.1.31";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E+N+Ge4BnkR4fvoe6HeTJOX1t+XYBpPitrQClLUzkK0=";
+    hash = "sha256-eQ2oP1I7uc9s9vrDqKCIqMGuh1+MjUpLFukp3Fg0RM0=";
   };
 
   sourceRoot = "${src.name}/python";

pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "kiota-serialization-json";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "kiota-serialization-json-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DhuDIRTm6xATnXpQ+xLpMuaBcWxZHdr8dO1Rl8OvCKQ=";
+    hash = "sha256-igMqwoKArfQ37pzdjUICgXY795dfg/MX65iwTVe0sLM=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -47,7 +47,7 @@ let
     };
 in
 rec {
-  mypy-boto3-accessanalyzer = buildMypyBoto3Package "accessanalyzer" "1.34.54" "sha256-ZglQkseFlqe160S+v5baZ3rfI5QqKsh9IIRPOJEcD3E=";
+  mypy-boto3-accessanalyzer = buildMypyBoto3Package "accessanalyzer" "1.34.67" "sha256-tgiKSWgKebdPAsyuJTQoFGR9BSLfGMeTVbi1rnPnvfQ=";
 
   mypy-boto3-account = buildMypyBoto3Package "account" "1.34.0" "sha256-C2iAiA83tZ/7XRlccf1iddDfDNkuO2F0B5aOxKbHy2Q=";
 
@@ -141,7 +141,7 @@ rec {
 
   mypy-boto3-clouddirectory = buildMypyBoto3Package "clouddirectory" "1.34.0" "sha256-lWJQClNEhyq9CN8ThcHtVcEsowIp+V8RXh4rgHAclfM=";
 
-  mypy-boto3-cloudformation = buildMypyBoto3Package "cloudformation" "1.34.65" "sha256-CQJJPyXyPnCNYxKUt3m7uz6UaFQt1+JH3m6KyOJHelQ=";
+  mypy-boto3-cloudformation = buildMypyBoto3Package "cloudformation" "1.34.66" "sha256-KV3bh48/S2FIm4O9S62Uk4LeuKR4/1rmbCLKP/urvpU=";
 
   mypy-boto3-cloudfront = buildMypyBoto3Package "cloudfront" "1.34.0" "sha256-3n/WEiQdcE253J+CFsskoYlNMXASdzkhPTWneSHDKoM=";
 
@@ -161,7 +161,7 @@ rec {
 
   mypy-boto3-codeartifact = buildMypyBoto3Package "codeartifact" "1.34.0" "sha256-iUgoanqMSyxRopVctyFLiu+otFSgRvdgQPw4mKX3QIk=";
 
-  mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.64" "sha256-ZsTKKDanTLB4jFOGLQTLPEterhabpShrchHvvWcUBMo=";
+  mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.67" "sha256-Kvd8zAHfepA4dulpiQCaT2pfKCH567d6CYd5QlweXIY=";
 
   mypy-boto3-codecatalyst = buildMypyBoto3Package "codecatalyst" "1.34.0" "sha256-TsXVy8bx6kaj84PJiNNU+075Tx3WW0mrtZFOyLx9yT4=";
 
@@ -197,7 +197,7 @@ rec {
 
   mypy-boto3-config = buildMypyBoto3Package "config" "1.34.45" "sha256-LN1CcIOj9cgzSNCvnUVwLRNPXlitHAlt+5jj6wu6i8E=";
 
-  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.64" "sha256-ijgvxHI9taQXYZa1d4yLMp63bCrEFfE0Ug/vmKUGaNM=";
+  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.67" "sha256-kWjC/FacCsC0xevx2dOs67UxaKG1WM3xMahcO3CqZL8=";
 
   mypy-boto3-connect-contact-lens = buildMypyBoto3Package "connect-contact-lens" "1.34.0" "sha256-Wx9vcjlgXdWZ2qP3Y/hTY2LAeTd+hyyV5JSIuKQ5I5k=";
 
@@ -245,13 +245,13 @@ rec {
 
   mypy-boto3-ds = buildMypyBoto3Package "ds" "1.34.0" "sha256-qVtMpsnVLF2rN4WaEhrqlTvWvW28RcHIBjsZYwmYapc=";
 
-  mypy-boto3-dynamodb = buildMypyBoto3Package "dynamodb" "1.34.57" "sha256-itDqozgR636w+OK8wtvO+obJHXohsTr1AMOousvpnbA=";
+  mypy-boto3-dynamodb = buildMypyBoto3Package "dynamodb" "1.34.67" "sha256-CUR+8+pr3+C+TjLKIyg4IFczQdNAvqMGXe0hU8xZPSI=";
 
   mypy-boto3-dynamodbstreams = buildMypyBoto3Package "dynamodbstreams" "1.34.0" "sha256-Zx5cJE+fU9NcvK5rLR966AGIKUvfIwdpLaWWdLmuDzc=";
 
   mypy-boto3-ebs = buildMypyBoto3Package "ebs" "1.34.0" "sha256-xIrrXOayZed+Jcn4CFXXNgKz/G+RdiuwA04wq+Ry/fs=";
 
-  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.64" "sha256-fDsnEbTo5UAgPGCoUqGbvk68+9RNN8qZpScW7t/Bq+Q=";
+  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.66" "sha256-Io0ExXqdar+5A4H66ryaApWIQnEcspQysfBsOit4WyY=";
 
   mypy-boto3-ec2-instance-connect = buildMypyBoto3Package "ec2-instance-connect" "1.34.63" "sha256-kExmGXEJ5jrvOewmWx7AjVb3boD5GU0cEUp/2PQhzlw=";
 
@@ -291,7 +291,7 @@ rec {
 
   mypy-boto3-evidently = buildMypyBoto3Package "evidently" "1.34.0" "sha256-MkBB5iTYJYg2cWFYHR3Qu7TcsDglLPEw0MnoHqij6+A=";
 
-  mypy-boto3-finspace = buildMypyBoto3Package "finspace" "1.34.24" "sha256-GMHF1MWsAt0EfwcK/OSG14AP80L+9dLNsWygvpU5344=";
+  mypy-boto3-finspace = buildMypyBoto3Package "finspace" "1.34.66" "sha256-G5FMKm9HymvRPtkjvYZt6NVhPUVuBwCR4kQq8/naUFs=";
 
   mypy-boto3-finspace-data = buildMypyBoto3Package "finspace-data" "1.34.0" "sha256-8mND5BbdKY5srFwdpxSyfCUTIP4fa9hztP4daUJOB8k=";
 
@@ -439,7 +439,7 @@ rec {
 
   mypy-boto3-location = buildMypyBoto3Package "location" "1.34.18" "sha256-rsjIGenXgdEdgxvilA3IKJkYkpDDQNDfjDQRoj/mxSU=";
 
-  mypy-boto3-logs = buildMypyBoto3Package "logs" "1.34.36" "sha256-FUm1TaiKhphSRY4YbliUSdU6eAU1S1r9fVO00nXFPC4=";
+  mypy-boto3-logs = buildMypyBoto3Package "logs" "1.34.66" "sha256-z1+sSAHdkvBQB/sbRET/mCWFRNHyHmTpIo40GIBG+EE=";
 
   mypy-boto3-lookoutequipment = buildMypyBoto3Package "lookoutequipment" "1.34.47" "sha256-M7NaoRHxlH5/zkuMnOlrco2BCPXErv/N7TAVwv2oZuA=";
 
@@ -457,7 +457,7 @@ rec {
 
   mypy-boto3-managedblockchain = buildMypyBoto3Package "managedblockchain" "1.34.0" "sha256-gUPuS8/ygIdsfCx6S1zpxP936Ah0o5BT4TaDiEW4wPQ=";
 
-  mypy-boto3-managedblockchain-query = buildMypyBoto3Package "managedblockchain-query" "1.34.33" "sha256-HByCyc+gnBu2+5qdtRw6LuRWCu7sVVXxmOJJZgWMFsI=";
+  mypy-boto3-managedblockchain-query = buildMypyBoto3Package "managedblockchain-query" "1.34.67" "sha256-c2BoAKpgurKaNOTkl3cqc3X1CiaQVfQL5kvQV3/WLww=";
 
   mypy-boto3-marketplace-catalog = buildMypyBoto3Package "marketplace-catalog" "1.34.41" "sha256-SZqNZO/36iGuf0jqNIZrbD1BOE7p6xMWhs5Y5VkUl8c=";
 
@@ -639,7 +639,7 @@ rec {
 
   mypy-boto3-sagemaker-runtime = buildMypyBoto3Package "sagemaker-runtime" "1.34.0" "sha256-OJYEdi4xILUZoePcGBcLRHAhwppeybNO+l0kyW3a0Co=";
 
-  mypy-boto3-savingsplans = buildMypyBoto3Package "savingsplans" "1.34.0" "sha256-HaloEU3+2VgDekIQ5JltgCCG1jJ/ap1qqDGWR51ggtU=";
+  mypy-boto3-savingsplans = buildMypyBoto3Package "savingsplans" "1.34.67" "sha256-t+0Ko+Onv24p1Sn59mvR/auXkDTowOEpKwpzuMUqk8w=";
 
   mypy-boto3-scheduler = buildMypyBoto3Package "scheduler" "1.34.0" "sha256-+gnQjWPtp7KVI/qIY2aXHD9iM7RZIDl0JwRostfhjzc=";
 

pkgs/development/python-modules/pillow-heif/default.nix

@@ -75,7 +75,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.isDarwin [
+  disabledTests = [
+    # Time based
+    "test_decode_threads"
+  ] ++ lib.optionals stdenv.isDarwin [
     # https://github.com/bigcat88/pillow_heif/issues/89
     # not reproducible in nixpkgs
     "test_opencv_crash"

pkgs/development/python-modules/prometheus-client/default.nix

@@ -1,6 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
+, twisted
 , pytestCheckHook
 , pythonOlder
 }:
@@ -8,9 +10,9 @@
 buildPythonPackage rec {
   pname = "prometheus-client";
   version = "0.20.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "prometheus";
@@ -19,11 +21,20 @@ buildPythonPackage rec {
     hash = "sha256-IMw0mpOUzjXBy4bMTeSFMc5pdibI5lGxZHKiufjPLbM=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
+  optional-dependencies.twisted = [
+    twisted
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ]
+  ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [
     "prometheus_client"

pkgs/development/python-modules/pytest-twisted/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-twisted";
-  version = "1.14.0";
+  version = "1.14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-IJv1pkUs+/th3o8BWQLBTsgSZACRFQcHS7LuTOjf4xM=";
+    sha256 = "sha256-qbGLyfykfSiG+O/j/SeHmoHxwLtJ8cVgZmyedkSRtjI=";
   };
 
   buildInputs = [

pkgs/development/python-modules/rpy2/default.nix

@@ -2,6 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , isPyPy
 , R
 , rWrapper
@@ -38,6 +39,12 @@ buildPythonPackage rec {
       # R_LIBS_SITE is used by the nix r package to point to the installed R libraries.
       # This patch sets R_LIBS_SITE when rpy2 is imported.
       ./rpy2-3.x-r-libs-site.patch
+
+      # https://github.com/rpy2/rpy2/pull/1094
+      (fetchpatch {
+        url = "https://github.com/rpy2/rpy2/commit/026d069a008163a62d12567bcb938410d0f9bf7a.diff";
+        hash = "sha256-x778upSY3zab5EiRyOcsbDpPj7vN/7XzefEs+wvkNg0=";
+      })
     ];
 
     postPatch = ''
@@ -82,10 +89,6 @@ buildPythonPackage rec {
 
     doCheck = !stdenv.isDarwin;
 
-    # newlines in environment variables are a problem due to
-    # https://github.com/rpy2/rpy2/issues/1066
-    preCheck = "unset postPatch";
-
     nativeCheckInputs = [
       pytestCheckHook
     ];

pkgs/development/python-modules/setuptools-odoo/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "setuptools-odoo";
-  version = "3.2.1";
+  version = "3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "acsone";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-aS2a1G9lssgGk3uqWgPPWpOpEnqUkCUzWsqPLQfU55k=";
+    hash = "sha256-38YlkDH/PuJ1yvQ43OYmdnRd1SGJULv6fC/+fitLDJ8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/trafilatura/default.nix

@@ -10,20 +10,25 @@
 , justext
 , lxml
 , urllib3
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "trafilatura";
-  version = "1.7.0";
+  version = "1.8.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oWbmfwBaahLvGU9Ix8n6ThsONnVv3Stk4CRzw1aWLwQ=";
+    hash = "sha256-6lSHXtJPPq+vGZuKD4m1g1x880NzPDLvvEr50wV6j3I=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     certifi
     charset-normalizer
@@ -34,10 +39,12 @@ buildPythonPackage rec {
     urllib3
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  # disable tests that require an internet connection
   disabledTests = [
+    # Disable tests that require an internet connection
     "test_download"
     "test_fetch"
     "test_redirection"
@@ -51,18 +58,22 @@ buildPythonPackage rec {
   # patch out gui cli because it is not supported in this packaging
   # nixify path to the trafilatura binary in the test suite
   postPatch = ''
-    substituteInPlace setup.py --replace '"trafilatura_gui=trafilatura.gui:main",' ""
+    substituteInPlace setup.py \
-    substituteInPlace tests/cli_tests.py --replace "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
+      --replace-fail '"trafilatura_gui=trafilatura.gui:main",' ""
+    substituteInPlace tests/cli_tests.py \
+      --replace-fail "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
   '';
 
-  pythonImportsCheck = [ "trafilatura" ];
+  pythonImportsCheck = [
+    "trafilatura"
+  ];
 
   meta = with lib; {
     description = "Python package and command-line tool designed to gather text on the Web";
-    mainProgram = "trafilatura";
     homepage = "https://trafilatura.readthedocs.io";
     changelog = "https://github.com/adbar/trafilatura/blob/v${version}/HISTORY.md";
-    license = licenses.gpl3Plus;
+    license = licenses.asl20;
     maintainers = with maintainers; [ jokatzke ];
+    mainProgram = "trafilatura";
   };
 }

pkgs/development/python-modules/vispy/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.14.1";
+  version = "0.14.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JJpQl5/ACotlEJKDNU3PEs9BXBpdz5gh4RP25ZC5uTw=";
+    hash = "sha256-7ti0TW9ch70pWySqmi4OTm3GqQXM7gGy1ByPvwp2ez0=";
   };
 
   patches = [

pkgs/development/tools/analysis/checkov/default.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.39";
+  version = "3.2.42";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-WjCTJKk5n0TPZHu56+PnMNj3tNYjDFSt+dMzbaApwXk=";
+    hash = "sha256-2ZhG7j9kV5E1I1xRzUKSONZ32T1oaDZ7linXjfFrvRg=";
   };
 
   patches = [

pkgs/misc/jitsi-meet-prosody/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet-prosody";
-  version = "1.0.7762";
+  version = "1.0.7874";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "AbIr+nJEccZFWDbuo+VeTEpLkreOBzKkrJFZFvY1ppI=";
+    sha256 = "VI43yeuc1fkKv94A1d7hp4ptATT5XrpLXkTnaBpl7Hc=";
   };
 
   dontBuild = true;

pkgs/servers/jicofo/default.nix

@@ -2,10 +2,10 @@
 
 let
   pname = "jicofo";
-  version = "1.0-1062";
+  version = "1.0-1075";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "bU7h7kjs2yu1O+qhKcs6C63DH/omo/R1+Ms40KHkjHU=";
+    sha256 = "tRlCZGBWlonTkKMxr2Rry70ZqC3mjcbF627XEn2D2UI=";
   };
 in
 stdenv.mkDerivation {

pkgs/tools/filesystems/ceph/default.nix

@@ -169,7 +169,28 @@ let
 
   # Watch out for python <> boost compatibility
   python = python310.override {
-    packageOverrides = self: super: let cryptographyOverrideVersion = "40.0.1"; in {
+    packageOverrides = self: super: let
+      cryptographyOverrideVersion = "40.0.1";
+      bcryptOverrideVersion = "4.0.1";
+    in {
+      # Ceph does not support `bcrypt` > 4.0 yet:
+      # * Upstream issue: https://tracker.ceph.com/issues/63529
+      #   > Python Sub-Interpreter Model Used by ceph-mgr Incompatible With Python Modules Based on PyO3
+      bcrypt = super.bcrypt.overridePythonAttrs (old: rec {
+        pname = "bcrypt";
+        version = bcryptOverrideVersion;
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-J9N1kDrIJhz+QEf2cJ0W99GNObHskqr3KvmJVSplDr0=";
+        };
+        cargoRoot = "src/_bcrypt";
+        cargoDeps = rustPlatform.fetchCargoTarball {
+          inherit src;
+          sourceRoot = "${pname}-${version}/${cargoRoot}";
+          name = "${pname}-${version}";
+          hash = "sha256-lDWX69YENZFMu7pyBmavUZaalGvFqbHSHfkwkzmDQaY=";
+        };
+      });
       # Ceph does not support `cryptography` > 40 yet:
       # * https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602
       # * Upstream issue: https://tracker.ceph.com/issues/63529

pkgs/tools/misc/ollama/default.nix

@@ -51,6 +51,11 @@ let
   rocmPath = buildEnv {
     name = "rocm-path";
     paths = [
+      rocmPackages.clr
+      rocmPackages.hipblas
+      rocmPackages.rocblas
+      rocmPackages.rocsolver
+      rocmPackages.rocsparse
       rocmPackages.rocm-device-libs
       rocmClang
     ];

pkgs/tools/misc/scdl/default.nix

@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "scdl";
-  version = "2.7.3";
+  version = "2.7.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60284b7b058040d4847f2e4b0ab906b10e959d51f976a0188641e8e10685474f";
+    sha256 = "sha256-YoQaIbOfwLtkSZJGZd9CL7TZGgqjfohJfrnQ3t5uLU0=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/tools/security/exploitdb/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-03-19";
+  version = "2024-03-21";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-VfaUm1d/Hpqo3TfS3gssr0YRPHqxXewZzH52/nSLHXU=";
+    hash = "sha256-vacIdG4+9AiwtcikE5Xqf8L+TqExmrh6w7ZSGtnNe/c=";
   };
 
   nativeBuildInputs = [

pkgs/tools/typesetting/tex/texlive/build-tex-env.nix

@@ -172,7 +172,6 @@ let
 
   # emulate split output derivation
   splitOutputs = {
-    out = out // { outputSpecified = true; };
     texmfdist = texmfdist // { outputSpecified = true; };
     texmfroot = texmfroot // { outputSpecified = true; };
   } // (lib.genAttrs pkgList.nonEnvOutputs (outName: (buildEnv {
@@ -186,9 +185,9 @@ let
     inherit meta passthru;
   }).overrideAttrs { outputs = [ outName ]; } // { outputSpecified = true; }));
 
-  passthru = lib.optionalAttrs (! __combine) (splitOutputs // {
+  passthru = {
-    all = builtins.attrValues splitOutputs;
+    # these are not part of pkgList.nonEnvOutputs and must be exported in passthru
-  }) // {
+    inherit (splitOutputs) texmfdist texmfroot;
     # This is set primarily to help find-tarballs.nix to do its job
     requiredTeXPackages = builtins.filter lib.isDerivation (pkgList.bin ++ pkgList.nonbin
       ++ lib.optionals (! __fromCombineWrapper)

pkgs/top-level/all-packages.nix

@@ -34526,10 +34526,6 @@ with pkgs;
 
   rofi-systemd = callPackage ../tools/system/rofi-systemd { };
 
-  rofimoji = callPackage ../applications/misc/rofimoji {
-    inherit (python3Packages) buildPythonApplication configargparse;
-  };
-
   rootlesskit = callPackage ../tools/virtualization/rootlesskit { };
 
   rsclock = callPackage ../applications/misc/rsclock { };

pkgs/top-level/python-packages.nix

@@ -3865,6 +3865,8 @@ self: super: with self; {
 
   eve = callPackage ../development/python-modules/eve { };
 
+  eventkit = callPackage ../development/python-modules/eventkit { };
+
   eventlet = callPackage ../development/python-modules/eventlet { };
 
   events = callPackage ../development/python-modules/events { };