Merge staging-next into staging

.github/labeler.yml

@@ -217,9 +217,9 @@
     - changed-files:
       - any-glob-to-any-file:
         - doc/languages-frameworks/nim.section.md
-        - pkgs/development/compilers/nim/*
+        - pkgs/build-support/build-nim-package.nix
-        - pkgs/development/nim-packages/**/*
+        - pkgs/by-name/ni/nim*
-        - pkgs/top-level/nim-packages.nix
+        - pkgs/top-level/nim-overrides.nix
 
 "6.topic: nodejs":
   - any:

ci/OWNERS

@@ -339,7 +339,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/by-name/ne/nemo-*        @mkg20001
 
 # nim
-/pkgs/development/compilers/nim   @ehmry
+/doc/languages-frameworks/nim.section.md  @ehmry
+/pkgs/build-support/build-nim-package.nix @ehmry
+/pkgs/top-level/nim-overrides.nix         @ehmry
 
 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq

nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -71,20 +71,20 @@ nix-build -A nixosTests.hostname
 
 ### Testing outside the NixOS project {#sec-call-nixos-test-outside-nixos}
 
-Outside the `nixpkgs` repository, you can instantiate the test by first importing the NixOS library,
+Outside the `nixpkgs` repository, you can use the `runNixOSTest` function from
+`pkgs.testers`:
 
 ```nix
-let nixos-lib = import (nixpkgs + "/nixos/lib") { };
+let pkgs = import <nixpkgs> {};
 in
 
-nixos-lib.runTest {
+pkgs.testers.runNixOSTest {
   imports = [ ./test.nix ];
-  hostPkgs = pkgs;  # the Nixpkgs package set used outside the VMs
   defaults.services.foo.package = mypkg;
 }
 ```
 
-`runTest` returns a derivation that runs the test.
+`runNixOSTest` returns a derivation that runs the test.
 
 ## Configuring the nodes {#sec-nixos-test-nodes}
 

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -757,6 +757,8 @@
 
 - The arguments from [](#opt-services.postgresql.initdbArgs) now get shell-escaped.
 
+- Mattermost has been updated from 9.5 to 9.11 ESR. See the [changelog](https://docs.mattermost.com/about/mattermost-v9-changelog.html#release-v9-11-extended-support-release) for more details.
+
 - `cargo-tauri.hook` was introduced to help users build [Tauri](https://tauri.app/) projects. It is meant to be used alongside
   `rustPlatform.buildRustPackage` and Node hooks such as `npmConfigHook`, `pnpm.configHook`, and the new `yarnConfig`
 

nixos/modules/programs/_1password.nix

@@ -17,7 +17,7 @@ in
       enable = lib.mkEnableOption "the 1Password CLI tool";
 
       package = lib.mkPackageOption pkgs "1Password CLI" {
-        default = [ "_1password" ];
+        default = [ "_1password-cli" ];
       };
     };
   };

nixos/modules/programs/wayland/uwsm.nix

@@ -108,18 +108,19 @@ in
     systemd.packages = [ cfg.package ];
     environment.pathsToLink = [ "/share/uwsm" ];
 
-    services.graphical-desktop.enable = true;
-
     # UWSM recommends dbus broker for better compatibility
     services.dbus.implementation = "broker";
 
-    services.displayManager.sessionPackages = lib.mapAttrsToList (
+    services.displayManager = {
-      name: value:
+      enable = true;
-      mk_uwsm_desktop_entry {
+      sessionPackages = lib.mapAttrsToList (
-        inherit name;
+        name: value:
-        inherit (value) prettyName comment binPath;
+        mk_uwsm_desktop_entry {
-      }
+          inherit name;
-    ) cfg.waylandCompositors;
+          inherit (value) prettyName comment binPath;
+        }
+      ) cfg.waylandCompositors;
+    };
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/misc/calibre-server.nix

@@ -12,7 +12,7 @@ let
       "--port" = cfg.port;
       "--auth-mode" = cfg.auth.mode;
       "--userdb" = cfg.auth.userDb;
-    }) ++ [(lib.optionalString (cfg.auth.enable == true) "--enable-auth")])
+    }) ++ [ (lib.optionalString (cfg.auth.enable == true) "--enable-auth") ] ++ cfg.extraFlags)
   );
 in
 
@@ -42,6 +42,15 @@ in
         '';
       };
 
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Extra flags to pass to the calibre-server command.
+          See the [calibre-server documentation](${generatedDocumentationLink}) for details.
+        '';
+      };
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "calibre-server";
@@ -73,6 +82,13 @@ in
         '';
       };
 
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description =
+          "Open ports in the firewall for the Calibre Server web interface.";
+      };
+
       auth = {
         enable = lib.mkOption {
           type = lib.types.bool;
@@ -137,6 +153,9 @@ in
       };
     };
 
+    networking.firewall =
+      lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
+
   };
 
   meta.maintainers = with lib.maintainers; [ gaelreyrol ];

nixos/tests/all-tests.nix

@@ -849,8 +849,8 @@ in {
   qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-store = runTest ./qemu-vm-store.nix;
-  qgis = handleTest ./qgis.nix { qgisPackage = pkgs.qgis; };
+  qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
-  qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
+  qgis-ltr = handleTest ./qgis.nix { package = pkgs.qgis-ltr; };
   qownnotes = handleTest ./qownnotes.nix {};
   qtile = handleTestOn ["x86_64-linux" "aarch64-linux"] ./qtile/default.nix {};
   quake3 = handleTest ./quake3.nix {};

nixos/tests/qgis.nix

@@ -1,5 +1,6 @@
-import ./make-test-python.nix ({ pkgs, lib, qgisPackage, ... }:
+import ./make-test-python.nix ({ pkgs, lib, package, ... }:
   let
+    qgisPackage = package.override { withServer = true; };
     testScript = pkgs.writeTextFile {
       name = "qgis-test.py";
       text = (builtins.readFile ../../pkgs/applications/gis/qgis/test.py);
@@ -12,19 +13,74 @@ import ./make-test-python.nix ({ pkgs, lib, qgisPackage, ... }:
     };
 
     nodes = {
-      machine = { pkgs, ... }: {
+      machine = { config, pkgs, ... }:
+
+      let
+        qgisServerUser = config.services.nginx.user;
+        qgisServerSocket = "/run/qgis_mapserv.socket";
+      in
+      {
         virtualisation.diskSize = 2 * 1024;
 
         imports = [ ./common/x11.nix ];
-        environment.systemPackages = [ qgisPackage ];
+        environment.systemPackages = [
+          qgisPackage
+        ];
 
+        systemd.sockets.qgis-server = {
+          listenStreams = [ qgisServerSocket ];
+          socketConfig = {
+            Accept = false;
+            SocketUser = qgisServerUser;
+            SocketMode = 0600;
+          };
+          wantedBy = ["sockets.target" "qgis-server.service"];
+          before = [ "qgis-server.service" ];
+        };
+
+        systemd.services.qgis-server = {
+          description = "QGIS server";
+          serviceConfig = {
+            User = qgisServerUser;
+            StandardOutput = "null";
+            StandardError = "journal";
+            StandardInput = "socket";
+            Environment = [
+              "QT_QPA_PLATFORM_PLUGIN_PATH=${pkgs.libsForQt5.qt5.qtbase}/${pkgs.libsForQt5.qt5.qtbase.qtPluginPrefix}/platforms"
+              "QGIS_SERVER_LOG_LEVEL=0"
+              "QGIS_SERVER_LOG_STDERR=1"
+            ];
+            ExecStart = "${qgisPackage}/lib/cgi-bin/qgis_mapserv.fcgi";
+          };
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."qgis" = {
+            locations."~".extraConfig = ''
+              gzip off;
+              include ${pkgs.nginx}/conf/fastcgi_params;
+              include ${pkgs.nginx}/conf/fastcgi.conf;
+              fastcgi_pass unix:${qgisServerSocket};
+            '';
+          };
+        };
       };
     };
 
     testScript = ''
       start_all()
 
+      # test desktop
       machine.succeed("${qgisPackage}/bin/qgis --version | grep 'QGIS ${qgisPackage.version}'")
       machine.succeed("${qgisPackage}/bin/qgis --code ${testScript}")
+
+      # test server
+      machine.succeed("${qgisPackage}/bin/qgis_mapserver --version | grep 'QGIS ${qgisPackage.version}'")
+
+      machine.succeed("curl --head http://localhost | grep 'Server:.*${qgisPackage.version}'")
+      machine.succeed("curl http://localhost/index.json | grep 'Landing page as JSON'")
     '';
   })

pkgs/applications/audio/ashuffle/default.nix

@@ -7,7 +7,6 @@
 , ninja
 , libmpdclient
 , yaml-cpp
-, darwin
 }:
 
 stdenv.mkDerivation rec {
@@ -24,11 +23,14 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeConfigure = true;
   nativeBuildInputs = [ cmake pkg-config meson ninja ];
-  buildInputs = [ libmpdclient yaml-cpp ]
+  buildInputs = [ libmpdclient yaml-cpp ];
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.CoreFoundation ];
 
   mesonFlags = [ "-Dunsupported_use_system_yamlcpp=true" ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework CoreFoundation";
+  };
+
   meta = with lib; {
     homepage = "https://github.com/joshkunz/ashuffle";
     description = "Automatic library-wide shuffle for mpd";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -2008,20 +2008,23 @@ in
     meta.homepage = "https://github.com/ackyshake/Spacegray.vim/";
   };
 
-  sqlite-lua = super.sqlite-lua.overrideAttrs (oa: {
+  sqlite-lua = super.sqlite-lua.overrideAttrs (
-    postPatch =
+    oa:
-      let
+    let
-        libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
+      libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
-      in
+    in
-      ''
+    {
+      postPatch = ''
         substituteInPlace lua/sqlite/defs.lua \
-          --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
+          --replace-fail "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or '${lib.escapeShellArg libsqlite}'"
       '';
 
-    passthru = oa.passthru // {
+      passthru = oa.passthru // {
-      initLua = ''vim.g.sqlite_clib_path = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}"'';
+        initLua = ''vim.g.sqlite_clib_path = "${libsqlite}"'';
-    };
+      };
-  });
+      nvimRequireCheck = "sqlite";
+    }
+  );
 
   ssr = super.ssr-nvim.overrideAttrs {
     dependencies = with self; [ nvim-treesitter ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4585,8 +4585,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "108.3.3";
+          version = "109.1.0";
-          hash = "sha256-q7w8DPzBLpD+13v7RnyDdC3ocDKAihHBVt3pnwSTwio=";
+          hash = "sha256-ozD9k/zfklwBJtc1WdC52hgJckxBgVRmcZOwSYboACM=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";

pkgs/applications/gis/qgis/default.nix

@@ -8,11 +8,13 @@
 
 # unwrapped package parameters
 , withGrass ? false
+, withServer ? false
 , withWebKit ? false
 }:
 let
   qgis-unwrapped = libsForQt5.callPackage ./unwrapped.nix {
     withGrass = withGrass;
+    withServer = withServer;
     withWebKit = withWebKit;
   };
 in symlinkJoin rec {

pkgs/applications/gis/qgis/ltr.nix

@@ -8,11 +8,13 @@
 
 # unwrapped package parameters
 , withGrass ? false
+, withServer ? false
 , withWebKit ? false
 }:
 let
   qgis-ltr-unwrapped = libsForQt5.callPackage ./unwrapped-ltr.nix {
     withGrass = withGrass;
+    withServer = withServer;
     withWebKit = withWebKit;
   };
 in symlinkJoin rec {

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -7,6 +7,7 @@
 , wrapQtAppsHook
 
 , withGrass
+, withServer
 , withWebKit
 
 , bison
@@ -155,7 +156,10 @@ in mkDerivation rec {
     "-DWITH_PDAL=True"
     "-DENABLE_TESTS=False"
   ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass (let
+    ++ lib.optional withServer [
+    "-DWITH_SERVER=True"
+    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
+  ] ++ lib.optional withGrass (let
         gmajor = lib.versions.major grass.version;
         gminor = lib.versions.minor grass.version;
       in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"

pkgs/applications/gis/qgis/unwrapped.nix

@@ -7,6 +7,7 @@
 , wrapQtAppsHook
 
 , withGrass
+, withServer
 , withWebKit
 
 , bison
@@ -157,7 +158,10 @@ in mkDerivation rec {
     "-DENABLE_TESTS=False"
     "-DQT_PLUGINS_DIR=${qtbase}/${qtbase.qtPluginPrefix}"
   ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass (let
+    ++ lib.optional withServer [
+    "-DWITH_SERVER=True"
+    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
+  ] ++ lib.optional withGrass (let
         gmajor = lib.versions.major grass.version;
         gminor = lib.versions.minor grass.version;
       in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"

pkgs/applications/misc/gollum/Gemfile.lock

@@ -5,7 +5,7 @@ GEM
     asciidoctor (2.0.23)
     base64 (0.2.0)
     builder (3.3.0)
-    concurrent-ruby (1.3.3)
+    concurrent-ruby (1.3.4)
     crass (1.0.6)
     creole (0.5.0)
     expression_parser (0.9.0)
@@ -43,36 +43,38 @@ GEM
       mime-types (~> 3.4)
       rugged (~> 1.5)
     htmlentities (4.3.4)
-    i18n (1.14.5)
+    i18n (1.14.6)
       concurrent-ruby (~> 1.0)
-    json (2.7.2)
+    json (2.7.4)
     kramdown (2.4.0)
       rexml
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    loofah (2.22.0)
+    logger (1.6.1)
+    loofah (2.23.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mime-types (3.5.2)
+    mime-types (3.6.0)
+      logger
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0702)
+    mime-types-data (3.2024.1001)
     mini_portile2 (2.8.7)
     multi_json (1.15.0)
     mustache (1.1.1)
     mustache-sinatra (2.0.0)
       mustache (~> 1.0)
-    mustermann (3.0.0)
+    mustermann (3.0.3)
       ruby2_keywords (~> 0.0.1)
     nokogiri (1.16.7)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    octicons (19.11.0)
+    octicons (19.12.0)
     org-ruby (0.9.12)
       rubypants (~> 0.2)
     psych (5.1.2)
       stringio
-    racc (1.8.0)
+    racc (1.8.1)
-    rack (3.1.7)
+    rack (3.1.8)
     rack-protection (4.0.0)
       base64 (>= 0.1.0)
       rack (>= 3.0.0, < 4)
@@ -83,10 +85,9 @@ GEM
       webrick (~> 1.8)
     rdoc (6.7.0)
       psych (>= 4.0.0)
-    rexml (3.3.2)
+    rexml (3.3.9)
-      strscan
     rouge (3.30.0)
-    rss (0.3.0)
+    rss (0.3.1)
       rexml
     ruby2_keywords (0.0.5)
     rubypants (0.7.1)
@@ -109,7 +110,6 @@ GEM
     sprockets-helpers (1.4.0)
       sprockets (>= 2.2)
     stringio (3.1.1)
-    strscan (3.1.0)
     therubyrhino (2.1.2)
       therubyrhino_jar (>= 1.7.4, < 1.7.9)
     therubyrhino_jar (1.7.8)
@@ -120,7 +120,7 @@ GEM
       unf_ext
     unf_ext (0.0.9.1)
     useragent (0.16.10)
-    webrick (1.8.1)
+    webrick (1.8.2)
     wikicloth (0.8.3)
       builder
       expression_parser

pkgs/applications/misc/gollum/gemset.nix

@@ -34,10 +34,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0skwdasxq7mnlcccn6aqabl7n9r3jd7k19ryzlzzip64cn4x572g";
+      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
       type = "gem";
     };
-    version = "1.3.3";
+    version = "1.3.4";
   };
   crass = {
     groups = ["default"];
@@ -139,20 +139,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
+      sha256 = "0k31wcgnvcvd14snz0pfqj976zv6drfsnq6x8acz10fiyms9l8nw";
       type = "gem";
     };
-    version = "1.14.5";
+    version = "1.14.6";
   };
   json = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
+      sha256 = "1klf2mnfilzjqwcjdi5qb1zl3ghrifz1amcnvwjvsfnx9a5jb9ly";
       type = "gem";
     };
-    version = "2.7.2";
+    version = "2.7.4";
   };
   kramdown = {
     dependencies = ["rexml"];
@@ -176,37 +176,47 @@
     };
     version = "1.1.0";
   };
+  logger = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
   loofah = {
     dependencies = ["crass" "nokogiri"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zkjqf37v2d7s11176cb35cl83wls5gm3adnfkn2zcc61h3nxmqh";
+      sha256 = "0ppp2cgli5avzk0z3dwnah6y65ymyr793yja28p2fs9vrci7986h";
       type = "gem";
     };
-    version = "2.22.0";
+    version = "2.23.1";
   };
   mime-types = {
-    dependencies = ["mime-types-data"];
+    dependencies = ["logger" "mime-types-data"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r64z0m5zrn4k37wabfnv43wa6yivgdfk6cf2rpmmirlz889yaf1";
+      sha256 = "0r34mc3n7sxsbm9mzyzy8m3dvq7pwbryyc8m452axkj0g2axnwbg";
       type = "gem";
     };
-    version = "3.5.2";
+    version = "3.6.0";
   };
   mime-types-data = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "104r7glqjal9fgvnv49wjzp4ssai9hmyn3npkari51s2ska3jnr0";
+      sha256 = "06dbn0j13jwdrmlvrjd50mxqrjlkh3lvxp0afh4glyzbliqvqpsd";
       type = "gem";
     };
-    version = "3.2024.0702";
+    version = "3.2024.1001";
   };
   mini_portile2 = {
     groups = ["default"];
@@ -255,10 +265,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
+      sha256 = "123ycmq6pkivv29bqbv79jv2cs04xakzd0fz1lalgvfs5nxfky6i";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.0.3";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -276,10 +286,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07nb9i9yl3xk6dr7aacxx3dfrrslrw9cn9a55gn9rrhgckb3pymy";
+      sha256 = "00ld13van1xiayr24gwpbxfb63zbw44fx25xs9cp29g6cdzi5hrp";
       type = "gem";
     };
-    version = "19.11.0";
+    version = "19.12.0";
   };
   org-ruby = {
     dependencies = ["rubypants"];
@@ -308,20 +318,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "021s7maw0c4d9a6s07vbmllrzqsj2sgmrwimlh8ffkvwqdjrld09";
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.1";
   };
   rack = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12z55b90vvr4sh93az2yfr3fg91jivsag8lcg0k360d99vdq568f";
+      sha256 = "1cd13019gnnh2c0a3kj27ij5ibk72v0bmpypqv4l6ayw8g5cpyyk";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   rack-protection = {
     dependencies = ["base64" "rack"];
@@ -378,15 +388,14 @@
     version = "4.3.4";
   };
   rexml = {
-    dependencies = ["strscan"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zr5qpa8lampaqzhdcjcvyqnrqcjl7439mqjlkjz43wdhmpnh4s5";
+      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
       type = "gem";
     };
-    version = "3.3.2";
+    version = "3.3.9";
   };
   rouge = {
     groups = ["default"];
@@ -404,10 +413,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wv27axi39hhr0nmaffdl5bdjqiafcvp9xhfgnsgfczsblja50sn";
+      sha256 = "0dv74a07j3ih5ykyszs1k2cjvgs5c1pzrvcb1wc2bfai8p038qml";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.3.1";
   };
   ruby2_keywords = {
     groups = ["default"];
@@ -493,16 +502,6 @@
     };
     version = "3.1.1";
   };
-  strscan = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mamrl7pxacbc79ny5hzmakc9grbjysm3yy6119ppgsg44fsif01";
-      type = "gem";
-    };
-    version = "3.1.0";
-  };
   therubyrhino = {
     dependencies = ["therubyrhino_jar"];
     groups = ["default"];
@@ -581,10 +580,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
+      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
       type = "gem";
     };
-    version = "1.8.1";
+    version = "1.8.2";
   };
   wikicloth = {
     dependencies = ["builder" "expression_parser" "htmlentities" "nokogiri" "twitter-text"];

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -81,13 +81,13 @@
     "vendorHash": "sha256-0UM4I/oxIsWIP1G93KJsJxYofXrO4Yy86PEk0FnB1DE="
   },
   "artifactory": {
-    "hash": "sha256-6VwEQ6fGZ1V5AkI5FvQwuFipjREduVkZePGwQqpyxig=",
+    "hash": "sha256-ehwskBqWAlbv+3ULOic8792kWulKuJ8v9/UmPngooRY=",
     "homepage": "https://registry.terraform.io/providers/jfrog/artifactory",
     "owner": "jfrog",
     "repo": "terraform-provider-artifactory",
-    "rev": "v12.2.0",
+    "rev": "v12.3.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-HAZZ/P7zDbHs/xkIY69QbbcxwgPHEZOqeKCX8jIZTQE="
+    "vendorHash": "sha256-detefSJ3hVIk2xXsAB16XiQkaOAiBkGTnaIku7veFQU="
   },
   "auth0": {
     "hash": "sha256-5drMyf+jymrKb6cxB2eCnvVE9hPo9aDGaloZVlOeRlI=",

pkgs/applications/networking/instant-messengers/jackline/default.nix

@@ -4,15 +4,15 @@ with ocamlPackages;
 
 buildDunePackage rec {
   pname = "jackline";
-  version = "unstable-2024-02-28";
+  version = "unstable-2024-10-21";
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";
 
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev  = "31b90275a5f848cfc8c4f5b75e7d1933bec37852";
+    rev  = "cf6b26e37e37b0b48be9fd2e74fc563375f757f0";
-    hash = "sha256-G2jjsc/i9Qgo0TP+ZE4gB/1cjuZ9l8R7e59K2DGD5GY=";
+    hash = "sha256-6QZZ77C1G3x/GOJsUEQMrCatVsyyxNjq36ez/TgeHSY=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,6 @@ buildDunePackage rec {
     uuseg
     uutf
     dns-client
-    cstruct
     base64
     happy-eyeballs-lwt
     ppx_sexp_conv

pkgs/applications/version-management/gitlab/data.json

@@ -1,15 +1,15 @@
 {
-  "version": "17.2.9",
+  "version": "17.3.6",
-  "repo_hash": "060d5rzbcnhr1fsvbaiirgjm5rjr5c5r6yi601lxvksffyn5hmxw",
+  "repo_hash": "1dysv5xblm33z4vlnkz2s43w6cqrhmzq1729sab3x0zznyaa5vks",
-  "yarn_hash": "10y540bxwaz355p9r4q34199aibadrd5p4d9ck2y3n6735k0hm74",
+  "yarn_hash": "1g5xqggdbrxz6ablav119jw8a2v8qdd2cwlbvpygablbcxqak41l",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.2.9-ee",
+  "rev": "v17.3.6-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.2.9",
+    "GITALY_SERVER_VERSION": "17.3.6",
-    "GITLAB_PAGES_VERSION": "17.2.9",
+    "GITLAB_PAGES_VERSION": "17.3.6",
-    "GITLAB_SHELL_VERSION": "14.37.0",
+    "GITLAB_SHELL_VERSION": "14.38.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
-    "GITLAB_WORKHORSE_VERSION": "17.2.9"
+    "GITLAB_WORKHORSE_VERSION": "17.3.6"
   }
 }

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "17.2.9";
+  version = "17.3.6";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -20,10 +20,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-UgNQtM3NdAUJVP+vvTHtZWSjCmVzsHlEtXQroxKorIY=";
+      hash = "sha256-nXblQfr9ml6F5nNz64haN7ub+cuN3eao14N0Y2d3n0Y=";
     };
 
-    vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
+    vendorHash = "sha256-spfSOOe+9NGu+2ZbEGb93X3HnANEXYbvP73DD6neIXQ=";
 
     ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];
 
@@ -46,6 +46,9 @@ buildGoModule ({
   preConfigure = ''
     mkdir -p _build/bin
     cp -r ${auxBins}/bin/* _build/bin
+    for f in ${git}/bin/git-*; do
+      cp "$f" "_build/bin/gitaly-$(basename $f)";
+    done
   '';
 
   outputs = [ "out" ];

pkgs/applications/version-management/gitlab/gitaly/git.nix

@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gitaly-git";
-  version = "2.44.2.gl1";
+  version = "2.45.2";
 
   # `src` attribute for nix-update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "git";
     rev = "v${version}";
-    hash = "sha256-VIffbZZEbGjVW1No8zojSQlX/ciJ2DJnaogNlQtc77o=";
+    hash = "sha256-R4K5b4d1DQw+pwoOCAK4EJtVPXQDPossTUmVv0LJtUs=";
   };
 
   # we actually use the gitaly build system

pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.10.0";
+  version = "4.11.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-9OiuA0TqRfnZKfAeLbIcPUw5qH6twWKqt0IP8roaWNg=";
+    hash = "sha256-wUypldxi3O5sm4i9v2HiZjqUy/JwtcRPvCCmINCk4YU=";
   };
 
-  vendorHash = "sha256-Bzhg5coOrs3JO6Qslr9csUIrnCMJiG89Fio8ziJjH9k=";
+  vendorHash = "sha256-Ed+WvdWpEU5c9v14eM1PdCcT3qRnaRF/XeUKedPmaSU=";
 
   postPatch = ''
     # Disable flaky inmemory storage driver test

pkgs/applications/version-management/gitlab/gitlab-pages/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.2.9";
+  version = "17.3.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-ggfPZ/PMjgfRzzPZdVCVydd/4mdCfh2xh7QWGjp5U/0=";
+    hash = "sha256-yieOM9QQuQQ4RkfjASpcEvIKwbYMT9LkkJPHAYhY7uY=";
   };
 
-  vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
+  vendorHash = "sha256-O8kWiOpgVCUD6DdM95F1b+j4Gv9LTLRdBjByqXWV7Pk=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.37.0";
+  version = "14.38.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    hash = "sha256-to4ZIFKEiM4FCznoLrvHua9/hIqiHcviALzfay+1rb8=";
+    hash = "sha256-oYvsSjdzfJn4ujy1qbMmqZyEQFbYTSke8t3KBqjr/Vc=";
   };
 
   buildInputs = [ ruby libkrb5 ];
@@ -18,7 +18,7 @@ buildGoModule rec {
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-TbjpCCo/ZdFP+yE2h8B8kwS08iUilXNgBT2F5Si7/dc=";
+  vendorHash = "sha256-YOShgZv0zdfXgKi//IENt6wE2m0S1Kqa+2ndvCwKDLQ=";
 
   postInstall = ''
     cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.2.9";
+  version = "17.3.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-ZWpuJTlGCsjjURa8iYTaGMKulx99uyYJ+dr2cL9hiwo=";
+  vendorHash = "sha256-sLr9kFKRNYOlCj9bmP+J7/Iu/OfFTEjAm64BUni+eiY=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+def next?
+  File.basename(__FILE__) == "Gemfile.next"
+end
+
 source 'https://rubygems.org'
 
 if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental
@@ -24,7 +28,12 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', requir
 # https://gitlab.com/gitlab-org/gitlab/-/issues/375713
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
-gem 'rails', '~> 7.0.8.4' # rubocop:todo Gemfile/MissingFeatureCategory
+
+if next?
+  gem 'rails', '~> 7.1.3.4', feature_category: :shared
+else
+  gem 'rails', '~> 7.0.8.4', feature_category: :shared
+end
 
 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab' # rubocop:todo Gemfile/MissingFeatureCategory
 
@@ -50,7 +59,7 @@ gem 'responders', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'sprockets', '~> 3.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'sprockets-rails', '~>  3.5.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'view_component', '~> 3.12.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'view_component', '~> 3.13.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Supported DBs
 gem 'pg', '~> 1.5.6', feature_category: :database
@@ -59,7 +68,11 @@ gem 'neighbor', '~> 0.3.2', feature_category: :duo_chat
 
 gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'faraday', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday', '~> 2', feature_category: :shared
+gem 'faraday-retry', '~> 2', feature_category: :shared
+# Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
+gem 'logger', '~> 1.5.3' # rubocop:todo Gemfile/MissingFeatureCategory
+
 gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Authorization
@@ -75,8 +88,8 @@ gem 'bcrypt', '~> 3.1', '>= 3.1.14' # rubocop:todo Gemfile/MissingFeatureCategor
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'doorkeeper-device_authorization_grant', '~> 1.0.0', feature_category: :system_access
-gem 'rexml', '~> 3.2.6' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rexml', '~> 3.3.2' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'ruby-saml', '~> 1.17.0', feature_category: :system_access
+gem 'ruby-saml', '~> 1.17.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-auth0', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -85,16 +98,16 @@ gem 'omniauth-github', '2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-google-oauth2', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-oauth2-generic', '~> 0.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-saml', '~> 2.2.1', feature_category: :system_access
+gem 'omniauth-saml', '~> 2.2.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-shibboleth-redux', '~> 2.0', require: 'omniauth-shibboleth' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'omniauth_openid_connect', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
 # See https://docs.gitlab.com/ee/development/emails.html#rationale.
-gem 'openid_connect', '= 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'openid_connect', '~> 2.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-salesforce', '~> 1.0.5', path: 'vendor/gems/omniauth-salesforce' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'rack-oauth2', '~> 1.21.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rack-oauth2', '~> 2.2.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'jwt', '~> 2.5' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Kerberos authentication. EE-only
@@ -116,7 +129,7 @@ gem 'attr_encrypted', '~> 3.2.4', path: 'vendor/gems/attr_encrypted' # rubocop:t
 gem 'validates_hostname', '~> 1.0.13' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'rubyzip', '~> 2.3.2', require: 'zip' # rubocop:todo Gemfile/MissingFeatureCategory
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'acme-client', '~> 2.0.18' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Browser detection
 gem 'browser', '~> 5.3.1' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -146,7 +159,17 @@ gem 'graphql', '~> 2.3.5', feature_category: :api
 gem 'graphql-docs', '~> 5.0.0', group: [:development, :test], feature_category: :api
 gem 'graphiql-rails', '~> 1.10', feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
-gem 'graphlient', '~> 0.6.0', feature_category: :importers # Used by BulkImport feature (group::import)
+gem 'graphlient', '~> 0.8.0', feature_category: :importers # Used by BulkImport feature (group::import)
+
+# Cells
+gem 'gitlab-topology-service-client', '~> 0.1',
+  path: 'vendor/gems/gitlab-topology-service-client',
+  feature_category: :cell
+
+# Duo Workflow
+gem 'gitlab-duo-workflow-service-client', '~> 0.1',
+  path: 'vendor/gems/gitlab-duo-workflow-service-client',
+  feature_category: :duo_workflow
 
 # Generate Fake data
 gem 'ffaker', '~> 2.23' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -177,7 +200,7 @@ gem 'fog-local', '~> 0.8' # rubocop:todo Gemfile/MissingFeatureCategory
 # We may want to update this dependency if this is ever addressed upstream, e.g. via
 # https://github.com/aliyun/aliyun-oss-ruby-sdk/pull/93
 gem 'fog-aliyun', '~> 0.4' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'gitlab-fog-azure-rm', '~> 1.9.1', require: 'fog/azurerm' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-fog-azure-rm', '~> 2.0.1', require: 'fog/azurerm', feature_category: :shared
 
 # for Google storage
 
@@ -205,14 +228,16 @@ gem 'google-cloud-compute-v1', '~> 2.6.0', feature_category: :shared
 gem 'seed-fu', '~> 2.3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Search
-gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
-gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
-gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.199.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-core', '~> 3.201.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-s3', '~> 1.154.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.157.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
-gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
+# Used with Elasticsearch to support http keep-alive connections
+gem 'typhoeus', '~> 1.4.0', feature_category: :global_search
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.14.3', feature_category: :team_planning
@@ -253,9 +278,6 @@ end
 # State machine
 gem 'state_machines-activerecord', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
-# CI domain tags
-gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Gemfile/MissingFeatureCategory
-
 # Background jobs
 gem 'sidekiq', '~> 7.1.6', feature_category: :scalability
 gem 'sidekiq-cron', '~> 1.12.0', feature_category: :scalability
@@ -331,9 +353,7 @@ gem 'loofah', '~> 2.22.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'licensee', '~> 9.16' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Detect and convert string character encoding
-# We forked charlock_holmes at https://gitlab.com/gitlab-org/ruby/gems/charlock_holmes
+gem 'charlock_holmes', '~> 0.7.9', feature_category: :shared
-# but changed it's name to 'static_holmes' in the gemspec file.
-gem 'static_holmes', '~> 0.7.11', require: 'charlock_holmes', feature_category: :shared
 
 # Detect mime content type from content
 gem 'ruby-magic', '~> 0.6' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -347,7 +367,7 @@ gem 'gitlab_chronic_duration', '~> 0.12' # rubocop:todo Gemfile/MissingFeatureCa
 
 gem 'rack-proxy', '~> 0.7.7' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'cssbundling-rails', '1.4.0', feature_category: :shared
+gem 'cssbundling-rails', '1.4.1', feature_category: :shared
 gem 'terser', '1.0.2' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'click_house-client', path: 'gems/click_house-client', require: 'click_house/client' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -363,9 +383,9 @@ gem 'gitlab-license', '~> 2.5', feature_category: :shared
 gem 'rack-attack', '~> 6.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Sentry integration
-gem 'sentry-ruby', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-ruby', '~> 5.18.0', feature_category: :error_tracking
-gem 'sentry-rails', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-rails', '~> 5.18.0', feature_category: :error_tracking
-gem 'sentry-sidekiq', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-sidekiq', '~> 5.18.0', feature_category: :error_tracking
 
 # PostgreSQL query parsing
 #
@@ -404,7 +424,8 @@ gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureC
 gem 'prometheus-client-mmap', '~> 1.1', '>= 1.1.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Event-driven reactor for Ruby
-gem 'async', '~> 2.12.1' # rubocop:disable Gemfile/MissingFeatureCategory -- This is general utility gem
+# Required manually in config/initializers/require_async_gem
+gem 'async', '~> 2.12.1', require: false # rubocop:disable Gemfile/MissingFeatureCategory -- This is general utility gem
 
 # OpenTelemetry
 group :opentelemetry do
@@ -472,7 +493,7 @@ group :development, :test do
 
   gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'database_cleaner-active_record', '~> 2.1.0', feature_category: :database
+  gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
   gem 'rspec-rails', '~> 6.1.1', feature_category: :shared
   gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling
 
@@ -494,7 +515,7 @@ group :development, :test do
   # Profiling data from CI/CD pipelines
   gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling
 
-  gem 'knapsack', '~> 1.22.0', feature_category: :tooling
+  gem 'knapsack', '~> 4.0.0', feature_category: :tooling
   gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
   gem 'test_file_finder', '~> 0.3.1', feature_category: :tooling
 
@@ -511,7 +532,7 @@ group :development, :test do
   # For now we only use vite in development / test, and not for production builds
   # See: https://gitlab.com/gitlab-org/frontend/rfcs/-/issues/106
   gem 'vite_rails', '~> 3.0.17', feature_category: :shared
-  gem 'vite_ruby', '~> 3.5.0', feature_category: :shared
+  gem 'vite_ruby', '~> 3.7.0', feature_category: :shared
 
   gem 'gitlab-housekeeper', path: 'gems/gitlab-housekeeper', feature_category: :tooling
 end
@@ -524,7 +545,7 @@ group :development, :test, :coverage do
   gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
   gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling
   gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling
-  gem 'undercover', '~> 0.4.4', require: false, feature_category: :tooling
+  gem 'undercover', '~> 0.5.0', require: false, feature_category: :tooling
 end
 
 # Gems required in omnibus-gitlab pipeline
@@ -565,17 +586,19 @@ group :test do
   # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
   gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 
-  gem 'gitlab_quality-test_tooling', '~> 1.31.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 1.33.0', require: false, feature_category: :tooling
 end
 
 gem 'octokit', '~> 9.0', feature_category: :importers
+# Needed by octokit: https://github.com/octokit/octokit.rb/pull/1688
+gem 'faraday-multipart', '~> 1.0', feature_category: :importers
 
 gem 'gitlab-mail_room', '~> 0.0.24', require: 'mail_room', feature_category: :shared
 
 gem 'email_reply_trimmer', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'html2text' # rubocop:todo Gemfile/MissingFeatureCategory
 
-gem 'stackprof', '~> 0.2.25', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'stackprof', '~> 0.2.26', require: false, feature_category: :shared
 gem 'rbtrace', '~> 0.4', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'memory_profiler', '~> 1.0', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'activerecord-explain-analyze', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
@@ -600,12 +623,16 @@ gem 'ssh_data', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 17.1.0', feature_category: :gitaly
+gem 'gitaly', '~> 17.2.0', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
-gem 'kas-grpc', '~> 0.5.0', feature_category: :deployment_management
+gem 'kas-grpc', '~> 0.6.0', feature_category: :deployment_management
 
-gem 'grpc', '~> 1.63', feature_category: :shared
+# Lock the version before issues below are resolved:
+# https://gitlab.com/gitlab-org/gitlab/-/issues/473169#note_2028352939
+# Or we can upgrade to a more recent version as long as we can confirm
+# that it doesn't have the same issues.
+gem 'grpc', '= 1.63.0', feature_category: :shared
 
 gem 'google-protobuf', '~> 3.25', '>= 3.25.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
@@ -654,7 +681,7 @@ gem 'valid_email', '~> 0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 # JSON
 gem 'jsonb_accessor', '~> 1.3.10' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'json', '~> 2.7.2', feature_category: :shared
-gem 'json_schemer', '~> 0.2.18' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'json_schemer', '~> 2.3.0', feature_category: :shared
 gem 'oj', '~> 3.13.21' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'oj-introspect', '~> 0.7' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'multi_json', '~> 1.14.1' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -702,3 +729,5 @@ gem 'net-http', '= 0.4.1', feature_category: :shared
 gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 
 gem 'gitlab-sdk', '~> 0.3.0', feature_category: :application_instrumentation
+
+gem 'openbao_client', path: 'gems/openbao_client' # rubocop:todo Gemfile/MissingFeatureCategory

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -27,7 +27,9 @@ PATH
   remote: gems/gitlab-backup-cli
   specs:
     gitlab-backup-cli (0.0.1)
-      activesupport (~> 7.0.8)
+      activesupport (< 7.2)
+      google-cloud-storage_transfer (~> 1.2.0)
+      googleauth (~> 1.8.1)
       rainbow (~> 3.0)
       thor (~> 1.3)
 
@@ -104,6 +106,12 @@ PATH
       diffy (~> 3.4)
       oj (~> 3.13.16)
 
+PATH
+  remote: gems/openbao_client
+  specs:
+    openbao_client (1.0.0)
+      typhoeus (~> 1.0, >= 1.0.1)
+
 PATH
   remote: vendor/gems/attr_encrypted
   specs:
@@ -137,6 +145,18 @@ PATH
   specs:
     diff_match_patch (0.1.0)
 
+PATH
+  remote: vendor/gems/gitlab-duo-workflow-service-client
+  specs:
+    gitlab-duo-workflow-service-client (0.1)
+      grpc
+
+PATH
+  remote: vendor/gems/gitlab-topology-service-client
+  specs:
+    gitlab-topology-service-client (0.1)
+      grpc
+
 PATH
   remote: vendor/gems/mail-smtp_pool
   specs:
@@ -186,9 +206,9 @@ GEM
     CFPropertyList (3.0.5)
       rexml
     RedCloth (4.3.3)
-    acme-client (2.0.11)
+    acme-client (2.0.18)
       faraday (>= 1.0, < 3.0.0)
-      faraday-retry (~> 1.0)
+      faraday-retry (>= 1.0, < 3.0.0)
     actioncable (7.0.8.4)
       actionpack (= 7.0.8.4)
       activesupport (= 7.0.8.4)
@@ -257,8 +277,6 @@ GEM
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-    acts-as-taggable-on (10.0.0)
-      activerecord (>= 6.1, < 7.2)
     addressable (2.8.1)
       public_suffix (>= 2.0.2, < 6.0)
     aes_key_wrap (1.1.0)
@@ -291,7 +309,7 @@ GEM
       io-event (~> 1.6, >= 1.6.5)
     atlassian-jwt (0.2.1)
       jwt (~> 2.1)
-    attr_required (1.0.1)
+    attr_required (1.0.2)
     awesome_print (1.9.2)
     awrence (1.2.1)
     aws-eventstream (1.3.0)
@@ -299,7 +317,7 @@ GEM
     aws-sdk-cloudformation (1.41.0)
       aws-sdk-core (~> 3, >= 3.99.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.199.0)
+    aws-sdk-core (3.201.4)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
@@ -307,10 +325,10 @@ GEM
     aws-sdk-kms (1.76.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.154.0)
+    aws-sdk-s3 (1.157.0)
-      aws-sdk-core (~> 3, >= 3.199.0)
+      aws-sdk-core (~> 3, >= 3.201.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.8)
+      aws-sigv4 (~> 1.5)
     aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
     axe-core-api (4.9.1)
@@ -324,14 +342,6 @@ GEM
       descendants_tracker (~> 0.0.4)
       ice_nine (~> 0.11.0)
       thread_safe (~> 0.3, >= 0.3.1)
-    azure-storage-blob (2.0.3)
-      azure-storage-common (~> 2.0)
-      nokogiri (~> 1, >= 1.10.8)
-    azure-storage-common (2.0.4)
-      faraday (~> 1.0)
-      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
-      net-http-persistent (~> 4.0)
-      nokogiri (~> 1, >= 1.10.8)
     babosa (2.0.0)
     backport (1.2.0)
     base32 (0.3.2)
@@ -353,7 +363,7 @@ GEM
     bindata (2.4.11)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
-    bootsnap (1.18.3)
+    bootsnap (1.18.4)
       msgpack (~> 1.2)
     browser (5.3.1)
     builder (3.2.4)
@@ -383,6 +393,7 @@ GEM
       ssrf_filter (~> 1.0, < 1.1.0)
     cbor (0.5.9.8)
     character_set (1.8.0)
+    charlock_holmes (0.7.9)
     chef-config (18.3.0)
       addressable
       chef-utils (= 18.3.0)
@@ -429,7 +440,7 @@ GEM
       git
     css_parser (1.14.0)
       addressable
-    cssbundling-rails (1.4.0)
+    cssbundling-rails (1.4.1)
       railties (>= 6.0.0)
     cvss-suite (3.0.1)
     danger (9.4.2)
@@ -448,7 +459,7 @@ GEM
     danger-gitlab (8.0.0)
       danger
       gitlab (~> 4.2, >= 4.2.0)
-    database_cleaner-active_record (2.1.0)
+    database_cleaner-active_record (2.2.0)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
@@ -525,27 +536,28 @@ GEM
     dumb_delegator (1.0.0)
     duo_api (1.3.0)
     e2mmap (0.1.0)
-    ecma-re-validator (0.3.0)
-      regexp_parser (~> 2.0)
     ed25519 (1.3.0)
-    elasticsearch (7.13.3)
+    elasticsearch (7.17.11)
-      elasticsearch-api (= 7.13.3)
+      elasticsearch-api (= 7.17.11)
-      elasticsearch-transport (= 7.13.3)
+      elasticsearch-transport (= 7.17.11)
-    elasticsearch-api (7.13.3)
+    elasticsearch-api (7.17.11)
       multi_json
-    elasticsearch-model (7.2.0)
+    elasticsearch-model (7.2.1)
       activesupport (> 3)
       elasticsearch (~> 7)
       hashie
     elasticsearch-rails (7.2.1)
-    elasticsearch-transport (7.13.3)
+    elasticsearch-transport (7.17.11)
-      faraday (~> 1)
+      base64
+      faraday (>= 1, < 3)
       multi_json
     email_reply_trimmer (0.1.6)
     email_spec (2.2.0)
       htmlentities (~> 4.3.3)
       launchy (~> 2.1)
       mail (~> 2.7)
+    email_validator (2.2.4)
+      activemodel
     encryptor (3.0.0)
     erubi (1.12.0)
     escape_utils (1.3.0)
@@ -565,36 +577,28 @@ GEM
     factory_bot_rails (6.4.3)
       factory_bot (~> 6.4)
       railties (>= 5.0.0)
-    faraday (1.10.3)
+    faraday (2.10.1)
-      faraday-em_http (~> 1.0)
+      faraday-net_http (>= 2.0, < 3.2)
-      faraday-em_synchrony (~> 1.0)
+      logger
-      faraday-excon (~> 1.1)
+    faraday-follow_redirects (0.3.0)
-      faraday-httpclient (~> 1.0)
+      faraday (>= 1, < 3)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
-    faraday-excon (1.1.0)
     faraday-http-cache (2.5.0)
       faraday (>= 0.8)
-    faraday-httpclient (1.0.1)
     faraday-multipart (1.0.4)
       multipart-post (~> 2)
-    faraday-net_http (1.0.1)
+    faraday-net_http (3.1.0)
-    faraday-net_http_persistent (1.2.0)
+      net-http
-    faraday-patron (1.0.0)
+    faraday-net_http_persistent (2.1.0)
-    faraday-rack (1.0.0)
+      faraday (~> 2.5)
-    faraday-retry (1.0.3)
+      net-http-persistent (~> 4.0)
-    faraday_middleware (1.2.0)
+    faraday-retry (2.2.1)
-      faraday (~> 1.0)
+      faraday (~> 2.0)
-    faraday_middleware-aws-sigv4 (0.3.0)
+    faraday-typhoeus (1.1.0)
+      faraday (~> 2.0)
+      typhoeus (~> 1.4)
+    faraday_middleware-aws-sigv4 (1.0.1)
       aws-sigv4 (~> 1.0)
-      faraday (>= 0.15)
+      faraday (>= 2.0, < 3)
     fast_blank (1.0.1)
     fast_gettext (2.3.0)
     ffaker (2.23.0)
@@ -688,7 +692,7 @@ GEM
     git (1.18.0)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (17.1.2)
+    gitaly (17.2.0)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
@@ -702,12 +706,15 @@ GEM
     gitlab-experiment (0.9.1)
       activesupport (>= 3.0)
       request_store (>= 1.0)
-    gitlab-fog-azure-rm (1.9.1)
+    gitlab-fog-azure-rm (2.0.1)
-      azure-storage-blob (~> 2.0)
+      faraday (~> 2.0)
-      azure-storage-common (~> 2.0)
+      faraday-follow_redirects (~> 0.3.0)
+      faraday-net_http_persistent (~> 2.0)
       fog-core (~> 2.1)
       fog-json (~> 1.2)
       mime-types
+      net-http-persistent (~> 4.0)
+      nokogiri (~> 1, >= 1.10.8)
     gitlab-glfm-markdown (0.0.17)
       rb_sys (= 0.9.94)
     gitlab-labkit (0.36.1)
@@ -745,7 +752,7 @@ GEM
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (1.31.0)
+    gitlab_quality-test_tooling (1.33.0)
       activesupport (>= 7.0, < 7.2)
       amatch (~> 0.4.1)
       gitlab (~> 4.19)
@@ -833,7 +840,13 @@ GEM
       google-cloud-core (~> 1.6)
       googleauth (>= 0.16.2, < 2.a)
       mini_mime (~> 1.0)
-    google-protobuf (3.25.3)
+    google-cloud-storage_transfer (1.2.0)
+      google-cloud-core (~> 1.6)
+      google-cloud-storage_transfer-v1 (>= 0.5, < 2.a)
+    google-cloud-storage_transfer-v1 (0.8.0)
+      gapic-common (>= 0.20.0, < 2.a)
+      google-cloud-errors (~> 1.0)
+    google-protobuf (3.25.4)
     googleapis-common-protos (1.4.0)
       google-protobuf (~> 3.14)
       googleapis-common-protos-types (~> 1.2)
@@ -874,9 +887,8 @@ GEM
       rack
     graphiql-rails (1.10.0)
       railties
-    graphlient (0.6.0)
+    graphlient (0.8.0)
-      faraday (>= 1.0)
+      faraday (~> 2.0)
-      faraday_middleware
       graphql-client
     graphlyte (1.0.0)
     graphql (2.3.5)
@@ -985,16 +997,18 @@ GEM
       regexp_parser (~> 2.5)
       regexp_property_values (~> 1.0)
     json (2.7.2)
-    json-jwt (1.15.3)
+    json-jwt (1.16.6)
       activesupport (>= 4.2)
       aes_key_wrap
+      base64
       bindata
-      httpclient
+      faraday (~> 2.0)
-    json_schemer (0.2.18)
+      faraday-follow_redirects
-      ecma-re-validator (~> 0.3)
+    json_schemer (2.3.0)
+      bigdecimal
       hana (~> 1.3)
       regexp_parser (~> 2.0)
-      uri_template (~> 0.7)
+      simpleidn (~> 0.2)
     jsonb_accessor (1.3.10)
       activerecord (>= 5.0)
       activesupport (>= 5.0)
@@ -1014,9 +1028,9 @@ GEM
       activerecord
       kaminari-core (= 1.2.2)
     kaminari-core (1.2.2)
-    kas-grpc (0.5.0)
+    kas-grpc (0.6.0)
       grpc (~> 1.0)
-    knapsack (1.22.0)
+    knapsack (4.0.0)
       rake
     kramdown (2.3.2)
       rexml
@@ -1060,7 +1074,7 @@ GEM
       rake (~> 13.0)
     locale (2.1.3)
     lockbox (1.3.0)
-    logger (1.6.0)
+    logger (1.5.3)
     lograge (0.11.2)
       actionpack (>= 4)
       activesupport (>= 4)
@@ -1212,21 +1226,24 @@ GEM
       ruby-saml (~> 1.17)
     omniauth-shibboleth-redux (2.0.0)
       omniauth (>= 2.0.0)
-    omniauth_openid_connect (0.6.1)
+    omniauth_openid_connect (0.8.0)
       omniauth (>= 1.9, < 3)
-      openid_connect (~> 1.1)
+      openid_connect (~> 2.2)
     open4 (1.3.4)
-    openid_connect (1.3.0)
+    openid_connect (2.3.0)
       activemodel
       attr_required (>= 1.0.0)
-      json-jwt (>= 1.5.0)
+      email_validator
-      rack-oauth2 (>= 1.6.1)
+      faraday (~> 2.0)
-      swd (>= 1.0.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.16)
+      mail
+      rack-oauth2 (~> 2.2)
+      swd (~> 2.0)
       tzinfo
-      validate_email
       validate_url
-      webfinger (>= 1.0.1)
+      webfinger (~> 2.0)
-    openssl (3.1.0)
+    openssl (3.2.0)
     openssl-signature_algorithm (1.3.0)
       openssl (> 2.0)
     opentelemetry-api (1.2.5)
@@ -1241,6 +1258,10 @@ GEM
       opentelemetry-semantic_conventions
     opentelemetry-helpers-sql-obfuscation (0.1.0)
       opentelemetry-common (~> 0.20)
+    opentelemetry-instrumentation-action_mailer (0.1.0)
+      opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-active_support (~> 0.1)
+      opentelemetry-instrumentation-base (~> 0.22.1)
     opentelemetry-instrumentation-action_pack (0.9.0)
       opentelemetry-api (~> 1.0)
       opentelemetry-instrumentation-base (~> 0.22.1)
@@ -1305,8 +1326,9 @@ GEM
       opentelemetry-api (~> 1.0)
       opentelemetry-common (~> 0.21.0)
       opentelemetry-instrumentation-base (~> 0.22.1)
-    opentelemetry-instrumentation-rails (0.30.1)
+    opentelemetry-instrumentation-rails (0.30.2)
       opentelemetry-api (~> 1.0)
+      opentelemetry-instrumentation-action_mailer (~> 0.1.0)
       opentelemetry-instrumentation-action_pack (~> 0.9.0)
       opentelemetry-instrumentation-action_view (~> 0.7.0)
       opentelemetry-instrumentation-active_job (~> 0.7.0)
@@ -1419,10 +1441,11 @@ GEM
       rack (>= 1.0, < 4)
     rack-cors (2.0.2)
       rack (>= 2.0.0)
-    rack-oauth2 (1.21.3)
+    rack-oauth2 (2.2.1)
       activesupport
       attr_required
-      httpclient
+      faraday (~> 2.0)
+      faraday-follow_redirects
       json-jwt (>= 1.11.0)
       rack (>= 2.1.0)
     rack-protection (2.2.2)
@@ -1505,7 +1528,7 @@ GEM
     redis-rack (3.0.0)
       rack-session (>= 0.2.0)
       redis-store (>= 1.2, < 2)
-    redis-store (1.10.0)
+    redis-store (1.11.0)
       redis (>= 4, < 6)
     regexp_parser (2.6.0)
     regexp_property_values (1.0.0)
@@ -1526,7 +1549,8 @@ GEM
     retriable (3.1.2)
     reverse_markdown (1.4.0)
       nokogiri
-    rexml (3.2.6)
+    rexml (3.3.2)
+      strscan
     rinku (2.0.0)
     rotp (6.3.0)
     rouge (4.3.0)
@@ -1618,8 +1642,8 @@ GEM
       prism (>= 0.29.0, < 0.31)
       rbs (>= 3, < 4)
       sorbet-runtime (>= 0.5.10782)
-    ruby-lsp-rails (0.3.7)
+    ruby-lsp-rails (0.3.8)
-      ruby-lsp (>= 0.17.0, < 0.18.0)
+      ruby-lsp (>= 0.17.2, < 0.18.0)
     ruby-lsp-rspec (0.1.12)
       ruby-lsp (~> 0.17.0)
     ruby-magic (0.6.0)
@@ -1655,24 +1679,25 @@ GEM
     seed-fu (2.3.7)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    selenium-webdriver (4.21.1)
+    selenium-webdriver (4.23.0)
       base64 (~> 0.2)
+      logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    semver_dialects (3.4.0)
+    semver_dialects (3.4.3)
       deb_version (~> 1.0.1)
       pastel (~> 0.8.0)
       thor (~> 1.3)
       tty-command (~> 0.10.1)
-    sentry-rails (5.17.3)
+    sentry-rails (5.18.2)
       railties (>= 5.0)
-      sentry-ruby (~> 5.17.3)
+      sentry-ruby (~> 5.18.2)
-    sentry-ruby (5.17.3)
+    sentry-ruby (5.18.2)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
-    sentry-sidekiq (5.17.3)
+    sentry-sidekiq (5.18.2)
-      sentry-ruby (~> 5.17.3)
+      sentry-ruby (~> 5.18.2)
       sidekiq (>= 3.0)
     sexp_processor (4.17.1)
     shellany (0.0.1)
@@ -1704,6 +1729,7 @@ GEM
     simplecov-html (0.12.3)
     simplecov-lcov (0.8.0)
     simplecov_json_formatter (0.1.4)
+    simpleidn (0.2.3)
     singleton (0.1.1)
     sixarm_ruby_unaccent (1.2.0)
     slack-messenger (2.3.6)
@@ -1743,7 +1769,7 @@ GEM
       sprockets (>= 3.0.0)
     ssh_data (1.3.0)
     ssrf_filter (1.0.8)
-    stackprof (0.2.25)
+    stackprof (0.2.26)
     state_machines (0.5.0)
     state_machines-activemodel (0.8.0)
       activemodel (>= 5.1)
@@ -1751,16 +1777,17 @@ GEM
     state_machines-activerecord (0.8.0)
       activerecord (>= 5.1)
       state_machines-activemodel (>= 0.8.0)
-    static_holmes (0.7.11)
     strings (0.2.1)
       strings-ansi (~> 0.2)
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
-    swd (1.3.0)
+    strscan (3.1.0)
+    swd (2.0.3)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
-      httpclient (>= 2.4)
+      faraday (~> 2.0)
+      faraday-follow_redirects
     sync (0.5.0)
     sys-filesystem (1.4.3)
       ffi (~> 1.1)
@@ -1778,7 +1805,7 @@ GEM
       unicode-display_width (>= 1.1.1, < 3)
     terser (1.0.2)
       execjs (>= 0.3.0, < 3)
-    test-prof (1.3.3)
+    test-prof (1.3.3.1)
     test_file_finder (0.3.1)
       faraday (>= 1.0, < 3.0, != 2.0.0)
     text (1.3.1)
@@ -1827,15 +1854,16 @@ GEM
       tty-screen (~> 0.8)
       wisper (~> 2.0)
     tty-screen (0.8.1)
-    typhoeus (1.4.0)
+    typhoeus (1.4.1)
       ethon (>= 0.9.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     uber (0.1.0)
-    undercover (0.4.6)
+    undercover (0.5.0)
+      bigdecimal
       imagen (>= 0.1.8)
       rainbow (>= 2.1, < 4.0)
-      rugged (>= 0.27, < 1.7)
+      rugged (>= 0.27, < 1.8)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.8.2)
@@ -1848,13 +1876,9 @@ GEM
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
     uri (0.13.0)
-    uri_template (0.7.0)
     valid_email (0.1.3)
       activemodel
       mail (>= 2.6.1)
-    validate_email (0.1.6)
-      activemodel (>= 3.0)
-      mail (>= 2.2.5)
     validate_url (1.0.15)
       activemodel (>= 3.0.0)
       public_suffix
@@ -1863,7 +1887,7 @@ GEM
       activesupport (>= 3.0)
     version_gem (1.1.0)
     version_sorter (2.3.0)
-    view_component (3.12.1)
+    view_component (3.13.0)
       activesupport (>= 5.2.0, < 8.0)
       concurrent-ruby (~> 1.0)
       method_source (~> 1.0)
@@ -1874,7 +1898,7 @@ GEM
     vite_rails (3.0.17)
       railties (>= 5.1, < 8)
       vite_ruby (~> 3.0, >= 3.2.2)
-    vite_ruby (3.5.0)
+    vite_ruby (3.7.0)
       dry-cli (>= 0.7, < 2)
       rack-proxy (~> 0.6, >= 0.6.1)
       zeitwerk (~> 2.2)
@@ -1891,9 +1915,10 @@ GEM
       openssl (>= 2.2)
       safety_net_attestation (~> 0.4.0)
       tpm-key_attestation (~> 0.12.0)
-    webfinger (1.2.0)
+    webfinger (2.1.3)
       activesupport
-      httpclient (>= 2.4)
+      faraday (~> 2.0)
+      faraday-follow_redirects
     webmock (3.23.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -1924,10 +1949,9 @@ PLATFORMS
 DEPENDENCIES
   CFPropertyList (~> 3.0.0)
   RedCloth (~> 4.3.3)
-  acme-client (~> 2.0)
+  acme-client (~> 2.0.18)
   activerecord-explain-analyze (~> 0.1)
   activerecord-gitlab!
-  acts-as-taggable-on (~> 10.0)
   addressable (~> 2.8)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.1.6)
@@ -1942,8 +1966,8 @@ DEPENDENCIES
   attr_encrypted (~> 3.2.4)!
   awesome_print
   aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.199.0)
+  aws-sdk-core (~> 3.201.0)
-  aws-sdk-s3 (~> 1.154.0)
+  aws-sdk-s3 (~> 1.157.0)
   axe-core-rspec (~> 4.9.0)
   babosa (~> 2.0)
   base32 (~> 0.3.0)
@@ -1960,6 +1984,7 @@ DEPENDENCIES
   capybara (~> 3.40)
   capybara-screenshot (~> 1.0.26)
   carrierwave (~> 1.3)
+  charlock_holmes (~> 0.7.9)
   circuitbox (= 2.0.0)
   click_house-client!
   cloud_profiler_agent (~> 0.0.0)!
@@ -1970,10 +1995,10 @@ DEPENDENCIES
   coverband (= 6.1.2)
   creole (~> 0.5.0)
   crystalball (~> 0.7.0)
-  cssbundling-rails (= 1.4.0)
+  cssbundling-rails (= 1.4.1)
   csv_builder!
   cvss-suite (~> 3.0.1)
-  database_cleaner-active_record (~> 2.1.0)
+  database_cleaner-active_record (~> 2.2.0)
   deckar01-task_list (= 2.3.4)
   declarative_policy (~> 1.1.0)
   deprecation_toolkit (~> 1.5.1)
@@ -1991,15 +2016,18 @@ DEPENDENCIES
   doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
   duo_api (~> 1.3)
   ed25519 (~> 1.3.0)
-  elasticsearch-api (= 7.13.3)
+  elasticsearch-api (= 7.17.11)
   elasticsearch-model (~> 7.2)
   elasticsearch-rails (~> 7.2)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   error_tracking_open_api!
   factory_bot_rails (~> 6.4.3)
-  faraday (~> 1.10.3)
+  faraday (~> 2)
-  faraday_middleware-aws-sigv4 (~> 0.3.0)
+  faraday-multipart (~> 1.0)
+  faraday-retry (~> 2)
+  faraday-typhoeus (~> 1.1)
+  faraday_middleware-aws-sigv4 (~> 1.0.1)
   fast_blank (~> 1.0.1)
   ffaker (~> 2.23)
   flipper (~> 0.26.2)
@@ -2015,12 +2043,13 @@ DEPENDENCIES
   gdk-toogle (~> 0.9, >= 0.9.5)
   gettext (~> 3.4, >= 3.4.9)
   gettext_i18n_rails (~> 1.12.0)
-  gitaly (~> 17.1.0)
+  gitaly (~> 17.2.0)
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 4.8.0)
+  gitlab-duo-workflow-service-client (~> 0.1)!
   gitlab-experiment (~> 0.9.1)
-  gitlab-fog-azure-rm (~> 1.9.1)
+  gitlab-fog-azure-rm (~> 2.0.1)
   gitlab-glfm-markdown (~> 0.0.17)
   gitlab-housekeeper!
   gitlab-http!
@@ -2037,10 +2066,11 @@ DEPENDENCIES
   gitlab-secret_detection!
   gitlab-sidekiq-fetcher!
   gitlab-styles (~> 12.0.1)
+  gitlab-topology-service-client (~> 0.1)!
   gitlab-utils!
   gitlab_chronic_duration (~> 0.12)
   gitlab_omniauth-ldap (~> 2.2.0)
-  gitlab_quality-test_tooling (~> 1.31.0)
+  gitlab_quality-test_tooling (~> 1.33.0)
   gon (~> 6.4.0)
   google-apis-androidpublisher_v3 (~> 0.34.0)
   google-apis-cloudbilling_v1 (~> 0.21.0)
@@ -2066,11 +2096,11 @@ DEPENDENCIES
   grape-swagger-entity (~> 0.5.1)
   grape_logging (~> 1.8, >= 1.8.4)
   graphiql-rails (~> 1.10)
-  graphlient (~> 0.6.0)
+  graphlient (~> 0.8.0)
   graphlyte (~> 1.0.0)
   graphql (~> 2.3.5)
   graphql-docs (~> 5.0.0)
-  grpc (~> 1.63)
+  grpc (= 1.63.0)
   gssapi (~> 1.3.1)
   guard-rspec
   haml_lint (~> 0.58)
@@ -2089,12 +2119,12 @@ DEPENDENCIES
   jira-ruby (~> 2.3.0)
   js_regex (~> 3.8)
   json (~> 2.7.2)
-  json_schemer (~> 0.2.18)
+  json_schemer (~> 2.3.0)
   jsonb_accessor (~> 1.3.10)
   jwt (~> 2.5)
   kaminari (~> 1.2.2)
-  kas-grpc (~> 0.5.0)
+  kas-grpc (~> 0.6.0)
-  knapsack (~> 1.22.0)
+  knapsack (~> 4.0.0)
   kramdown (~> 2.3.1)
   kubeclient (~> 4.11.0)
   lefthook (~> 1.6.8)
@@ -2103,6 +2133,7 @@ DEPENDENCIES
   licensee (~> 9.16)
   listen (~> 3.7)
   lockbox (~> 1.3.0)
+  logger (~> 1.5.3)
   lograge (~> 0.5)
   loofah (~> 2.22.0)
   lookbook (~> 2.3)
@@ -2139,8 +2170,9 @@ DEPENDENCIES
   omniauth-saml (~> 2.2.1)
   omniauth-shibboleth-redux (~> 2.0)
   omniauth_crowd (~> 2.4.0)!
-  omniauth_openid_connect (~> 0.6.1)
+  omniauth_openid_connect (~> 0.8.0)
-  openid_connect (= 1.3.0)
+  openbao_client!
+  openid_connect (~> 2.3.0)
   openssl (~> 3.0)
   opentelemetry-exporter-otlp
   opentelemetry-instrumentation-action_pack
@@ -2184,7 +2216,7 @@ DEPENDENCIES
   rack (~> 2.2.9)
   rack-attack (~> 6.7.0)
   rack-cors (~> 2.0.1)
-  rack-oauth2 (~> 1.21.3)
+  rack-oauth2 (~> 2.2.1)
   rack-proxy (~> 0.7.7)
   rack-timeout (~> 0.7.0)
   rails (~> 7.0.8.4)
@@ -2201,7 +2233,7 @@ DEPENDENCIES
   request_store (~> 1.5.1)
   responders (~> 3.0)
   retriable (~> 3.1.2)
-  rexml (~> 3.2.6)
+  rexml (~> 3.3.2)
   rouge (~> 4.3.0)
   rqrcode (~> 2.2)
   rspec-benchmark (~> 0.6.0)
@@ -2226,9 +2258,9 @@ DEPENDENCIES
   seed-fu (~> 2.3.7)
   selenium-webdriver (~> 4.21, >= 4.21.1)
   semver_dialects (~> 3.0)
-  sentry-rails (~> 5.17.3)
+  sentry-rails (~> 5.18.0)
-  sentry-ruby (~> 5.17.3)
+  sentry-ruby (~> 5.18.0)
-  sentry-sidekiq (~> 5.17.3)
+  sentry-sidekiq (~> 5.18.0)
   shoulda-matchers (~> 5.1.0)
   sidekiq (~> 7.1.6)
   sidekiq-cron (~> 1.12.0)
@@ -2247,9 +2279,8 @@ DEPENDENCIES
   sprockets (~> 3.7.0)
   sprockets-rails (~> 3.5.1)
   ssh_data (~> 1.3)
-  stackprof (~> 0.2.25)
+  stackprof (~> 0.2.26)
   state_machines-activerecord (~> 0.8.0)
-  static_holmes (~> 0.7.11)
   sys-filesystem (~> 1.4.3)
   tanuki_emoji (~> 0.9)
   telesignenterprise (~> 2.2)
@@ -2262,14 +2293,14 @@ DEPENDENCIES
   truncato (~> 0.7.12)
   tty-prompt (~> 0.23)
   typhoeus (~> 1.4.0)
-  undercover (~> 0.4.4)
+  undercover (~> 0.5.0)
   unleash (~> 3.2.2)
   valid_email (~> 0.1)
   validates_hostname (~> 1.0.13)
   version_sorter (~> 2.3)
-  view_component (~> 3.12.1)
+  view_component (~> 3.13.0)
   vite_rails (~> 3.0.17)
-  vite_ruby (~> 3.5.0)
+  vite_ruby (~> 3.7.0)
   vmstat (~> 2.3.0)
   warning (~> 1.3.0)
   webauthn (~> 3.0)

pkgs/by-name/ca/cargo-pio/package.nix

@@ -0,0 +1,27 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-pio";
+  version = "0.25.6";
+
+  src = fetchFromGitHub {
+    owner = "esp-rs";
+    repo = "embuild";
+    rev = "cargo-pio-v${version}";
+    hash = "sha256-YH2CPb3uBlPncd+KkP25xhCVvDB7HDxJuSqWOJ1LT3k=";
+  };
+
+  cargoHash = "sha256-41ZDe7yP4C9JcX5trcDxcqdgZ+SnhDIIq51hM0Viv9w=";
+
+  buildAndTestSubdir = "cargo-pio";
+
+  meta = with lib; {
+    description = "Build Rust embedded projects with PlatformIO";
+    homepage = "https://github.com/esp-rs/embuild/tree/master/cargo-pio";
+    license = with lib.licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ dannixon ];
+    mainProgram = "cargo-pio";
+  };
+}

pkgs/by-name/fl/flatpak/package.nix

@@ -74,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     "installedTests"
   ];
 
+  separateDebugInfo = true;
+
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
     hash = "sha256-a73HkIEnNQrYWkpH1wKSyi9MRul3sysf0jHCpxnYIc0=";

pkgs/by-name/fy/fyne/package.nix

@@ -17,16 +17,16 @@
 
 buildGoModule rec {
   pname = "fyne";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "fyne-io";
     repo = "fyne";
     rev = "refs/tags/v${version}";
-    hash = "sha256-21/52Uub5+l0TcuWZ9QSyckgR1kKNfDvro1CF5QuZWA=";
+    hash = "sha256-XaD7t1hSv5plDa6QHDTyoWgzvSFMRezvHl47YphXoig=";
   };
 
-  vendorHash = "sha256-+g11BRf9xRXjtF8InzdTHGOGOf8lJgLKEdBR5DcpEmo=";
+  vendorHash = "sha256-uV+pbGxAV/uuHV0xl2vPZpgGYRj9/E0rhFtLfCV5rnE=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/gi/github-markdown-toc-go/package.nix

@@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "github-markdown-toc-go";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ekalinin";
+    repo = "github-markdown-toc.go";
+    rev = "v${version}";
+    hash = "sha256-tZGAvbC9lrNhtRubCJUkQShRsfCsaAeI6XHhSp4FkS0=";
+  };
+
+  vendorHash = "sha256-K5yb7bnW6eS5UESK9wgNEUwGjB63eJk6+B0jFFiFero=";
+
+  meta = {
+    homepage = "https://github.com/ekalinin/github-markdown-toc.go";
+    description = "Easy TOC creation for GitHub README.md (in go)";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dannixon ];
+    mainProgram = "gh-md-toc";
+  };
+}

pkgs/by-name/gr/granian/package.nix

@@ -8,21 +8,20 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "granian";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     rev = "v${version}";
-    hash = "sha256-ZIwZrLl7goweYUj3t5e0yaOqeppFHXvK9PL3chNZZRw=";
+    hash = "sha256-Cuojg2Ko+KH/279z7HGYEthrMAqLgmnoHGjZ8HL7unw=";
   };
 
-  cargoDeps = rustPlatform.importCargoLock {
+  cargoDeps = rustPlatform.fetchCargoTarball {
-    lockFile = ./Cargo.lock;
+    inherit src;
-    outputHashes = {
+    name = "${pname}-${version}";
-      "pyo3-log-0.11.0" = "sha256-UU8064vM7cf20lwfifyPC205CY4tIgif0slDz/Pjf9Q=";
+    hash = "sha256-dRBjN0/EmQlGtQ1iGvSPE30KOHVlkWpjpMU2lpIGUdA=";
-    };
   };
 
   nativeBuildInputs = with rustPlatform; [

pkgs/by-name/ma/mattermost/package.nix

@@ -12,13 +12,13 @@ buildGoModule rec {
   # See https://docs.mattermost.com/upgrade/extended-support-release.html
   # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
   # the version regex in passthru.updateScript as well.
-  version = "9.5.11";
+  version = "9.11.3";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost";
     rev = "v${version}";
-    hash = "sha256-kPsBQjBMHxh5EGTFPNceE51nSEKSu6ieifIAV8PjpAc=";
+    hash = "sha256-CuFkydl1ZZUAWmrDIV1Jp9S6jIKYmglAe5XW2lTRgtQ=";
   };
 
   # Needed because buildGoModule does not support go workspaces yet.
@@ -34,14 +34,14 @@ buildGoModule rec {
 
   webapp = fetchurl {
     url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
-    hash = "sha256-dRB0CqUoEIkCDlH/vcn/S1TLlhz9iWp61WM2kk+ToZk=";
+    hash = "sha256-4JzhL2+G3T98pNFgKugs/eoSrbm7QSk5grVlprrIKEI=";
   };
 
   # Makes nix-update-script pick up the fetchurl for the webapp.
   # https://github.com/Mic92/nix-update/blob/1.3.1/nix_update/eval.py#L179
   offlineCache = webapp;
 
-  vendorHash = "sha256-3IiW5ZAMX0bbN65iFgD2CH3BmXd1Uv2HgcCqY8VQgrA=";
+  vendorHash = "sha256-Gwv6clnq7ihoFC8ox8iEM5xp/us9jWUrcmqA9/XbxBE=";
 
   modRoot = "./server";
   preBuild = ''
@@ -73,7 +73,7 @@ buildGoModule rec {
 
   passthru = {
     updateScript = nix-update-script {
-      extraArgs = [ "--version-regex" "^v(9\.5\.[0-9]+)$" ];
+      extraArgs = [ "--version-regex" "^v(9\.11\.[0-9]+)$" ];
     };
     tests.mattermost = nixosTests.mattermost;
   };

pkgs/by-name/nf/nf-test/package.nix

@@ -10,11 +10,11 @@
 stdenv.mkDerivation rec {
 
   pname = "nf-test";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchurl {
     url = "https://github.com/askimed/nf-test/releases/download/v${version}/nf-test-${version}.tar.gz";
-    hash = "sha256-PhI866NrbokMsSrU6YeSv03S1+VcNqVJsocI3xPfDcc=";
+    hash = "sha256-NjmB6bL9j6p4CWeVWU9q+aAe+dgH6lwUNZYARm41p8M=";
   };
   sourceRoot = ".";
 

pkgs/by-name/ni/nim-1_0/package.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-1,
+  nim,
+}:
+
+nim.passthru.wrapNim {
+  nimUnwrapped = nim-unwrapped-1;
+  patches = [ ./nim.cfg.patch ];
+}

pkgs/by-name/ni/nim-2_0/package.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-2_0,
+  nim-2_2,
+}:
+
+nim-2_2.passthru.wrapNim {
+  nimUnwrapped = nim-unwrapped-2_0;
+  inherit (nim-2_2) patches;
+}

pkgs/by-name/ni/nim-2_2/package.nix

@@ -0,0 +1,156 @@
+# When updating this package please check that all other versions of Nim
+# evaluate because they reuse definitions from the latest compiler.
+{
+  lib,
+  stdenv,
+  buildPackages,
+  darwin,
+  makeWrapper,
+  openssl,
+  pcre,
+  nim-unwrapped-2_2 ? buildPackages.nim-unwrapped-2_2,
+  Security ? darwin.Security,
+}:
+
+let
+  wrapNim =
+    { nimUnwrapped, patches }:
+    let
+      targetPlatformConfig = stdenv.targetPlatform.config;
+    in
+    stdenv.mkDerivation (finalAttrs: {
+      name = "${targetPlatformConfig}-nim-wrapper-${nimUnwrapped.version}";
+      inherit (nimUnwrapped) version;
+      preferLocalBuild = true;
+      strictDeps = true;
+
+      nativeBuildInputs = [ makeWrapper ];
+
+      # Needed for any nim package that uses the standard library's
+      # 'std/sysrand' module.
+      depsTargetTargetPropagated = lib.optional stdenv.hostPlatform.isDarwin Security;
+
+      inherit patches;
+
+      unpackPhase = ''
+        runHook preUnpack
+        tar xf ${nimUnwrapped.src} nim-$version/config
+        cd nim-$version
+        runHook postUnpack
+      '';
+
+      dontConfigure = true;
+
+      buildPhase =
+        # Configure the Nim compiler to use $CC and $CXX as backends
+        # The compiler is configured by two configuration files, each with
+        # a different DSL. The order of evaluation matters and that order
+        # is not documented, so duplicate the configuration across both files.
+        ''
+          runHook preBuild
+          cat >> config/config.nims << WTF
+
+          switch("os", "${nimUnwrapped.passthru.nimTarget.os}")
+          switch("cpu", "${nimUnwrapped.passthru.nimTarget.cpu}")
+          switch("define", "nixbuild")
+
+          # Configure the compiler using the $CC set by Nix at build time
+          import strutils
+          let cc = getEnv"CC"
+          if cc.contains("gcc"):
+            switch("cc", "gcc")
+          elif cc.contains("clang"):
+            switch("cc", "clang")
+          WTF
+
+          mv config/nim.cfg config/nim.cfg.old
+          cat > config/nim.cfg << WTF
+          os = "${nimUnwrapped.passthru.nimTarget.os}"
+          cpu =  "${nimUnwrapped.passthru.nimTarget.cpu}"
+          define:"nixbuild"
+          WTF
+
+          cat >> config/nim.cfg < config/nim.cfg.old
+          rm config/nim.cfg.old
+
+          cat >> config/nim.cfg << WTF
+
+          clang.cpp.exe %= "\$CXX"
+          clang.cpp.linkerexe %= "\$CXX"
+          clang.exe %= "\$CC"
+          clang.linkerexe %= "\$CC"
+          gcc.cpp.exe %= "\$CXX"
+          gcc.cpp.linkerexe %= "\$CXX"
+          gcc.exe %= "\$CC"
+          gcc.linkerexe %= "\$CC"
+          WTF
+
+          runHook postBuild
+        '';
+
+      wrapperArgs = lib.optionals (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) [
+        "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${placeholder "out"}/bin"
+        # Used by nim-gdb
+
+        "--prefix LD_LIBRARY_PATH : ${
+          lib.makeLibraryPath [
+            openssl
+            pcre
+          ]
+        }"
+        # These libraries may be referred to by the standard library.
+        # This is broken for cross-compilation because the package
+        # set will be shifted back by nativeBuildInputs.
+
+        "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
+        # Use the custom configuration
+      ];
+
+      installPhase =
+        ''
+          runHook preInstall
+
+          mkdir -p $out/bin $out/etc
+
+          cp -r config $out/etc/nim
+
+          for binpath in ${nimUnwrapped}/bin/nim?*; do
+            local binname=`basename $binpath`
+            makeWrapper \
+              $binpath $out/bin/${targetPlatformConfig}-$binname \
+              $wrapperArgs
+            ln -s $out/bin/${targetPlatformConfig}-$binname $out/bin/$binname
+          done
+
+          makeWrapper \
+            ${nimUnwrapped}/nim/bin/nim $out/bin/${targetPlatformConfig}-nim \
+            --set-default CC $(command -v $CC) \
+            --set-default CXX $(command -v $CXX) \
+            $wrapperArgs
+          ln -s $out/bin/${targetPlatformConfig}-nim $out/bin/nim
+
+          makeWrapper \
+            ${nimUnwrapped}/bin/testament $out/bin/${targetPlatformConfig}-testament \
+            $wrapperArgs
+          ln -s $out/bin/${targetPlatformConfig}-testament $out/bin/testament
+
+        ''
+        + ''
+          runHook postInstall
+        '';
+
+      passthru = nimUnwrapped.passthru // {
+        inherit wrapNim;
+        nim = nimUnwrapped;
+      };
+
+      meta = nimUnwrapped.meta // {
+        description = nimUnwrapped.meta.description + " (${targetPlatformConfig} wrapper)";
+        platforms = with lib.platforms; unix ++ genode ++ windows;
+      };
+    });
+in
+wrapNim {
+  nimUnwrapped = nim-unwrapped-2_2;
+  patches = [ ./nim2.cfg.patch ];
+}

pkgs/by-name/ni/nim-unwrapped-1_0/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  nim-unwrapped-2,
+}:
+
+nim-unwrapped-2.overrideAttrs (
+  finalAttrs: prevAttrs: {
+    version = "1.6.20";
+    src = fetchurl {
+      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+      hash = "sha256-/+0EdQTR/K9hDw3Xzz4Ce+kaKSsMnFEWFQTC87mE/7k=";
+    };
+
+    patches =
+      builtins.filter (
+        p:
+        builtins.elem (builtins.baseNameOf p) [
+          "NIM_CONFIG_DIR.patch"
+          "nixbuild.patch"
+        ]
+      ) nim-unwrapped-2.patches
+      ++ [
+        ./extra-mangling.patch
+        # Mangle store paths of modules to prevent runtime dependence.
+      ]
+      ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
+  }
+)

pkgs/by-name/ni/nim-unwrapped-2_0/package.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchurl,
+  nim-unwrapped-1,
+  nim-unwrapped-2_2,
+}:
+
+nim-unwrapped-2_2.overrideAttrs (
+  finalAttrs: previousAttrs: {
+    version = "2.0.10";
+    src = fetchurl {
+      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+      hash = "sha256-8UVDwjOpLHub0np9mEx4yfnBvXMyAwrBa+fFQMdbDqA=";
+    };
+    patches = lib.lists.unique (
+      builtins.filter (
+        p:
+        builtins.elem (builtins.baseNameOf p) [
+          "NIM_CONFIG_DIR.patch"
+          "nixbuild.patch"
+          "extra-mangling.patch"
+          "openssl.patch"
+        ]
+      ) (nim-unwrapped-1.patches ++ nim-unwrapped-2_2.patches)
+    );
+  }
+)

pkgs/by-name/ni/nim-unwrapped-2_2/package.nix

@@ -0,0 +1,187 @@
+# When updating this package please check that all other versions of Nim
+# evaluate because they reuse definitions from the latest compiler.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  boehmgc,
+  openssl,
+  pcre,
+  readline,
+  sqlite,
+  darwin,
+  Security ? darwin.Security,
+}:
+
+let
+  parseCpu =
+    platform:
+    with platform;
+    # Derive a Nim CPU identifier
+    if isAarch32 then
+      "arm"
+    else if isAarch64 then
+      "arm64"
+    else if isAlpha then
+      "alpha"
+    else if isAvr then
+      "avr"
+    else if isMips && is32bit then
+      "mips"
+    else if isMips && is64bit then
+      "mips64"
+    else if isMsp430 then
+      "msp430"
+    else if isPower && is32bit then
+      "powerpc"
+    else if isPower && is64bit then
+      "powerpc64"
+    else if isRiscV && is64bit then
+      "riscv64"
+    else if isSparc then
+      "sparc"
+    else if isx86_32 then
+      "i386"
+    else if isx86_64 then
+      "amd64"
+    else
+      abort "no Nim CPU support known for ${config}";
+
+  parseOs =
+    platform:
+    with platform;
+    # Derive a Nim OS identifier
+    if isAndroid then
+      "Android"
+    else if isDarwin then
+      "MacOSX"
+    else if isFreeBSD then
+      "FreeBSD"
+    else if isGenode then
+      "Genode"
+    else if isLinux then
+      "Linux"
+    else if isNetBSD then
+      "NetBSD"
+    else if isNone then
+      "Standalone"
+    else if isOpenBSD then
+      "OpenBSD"
+    else if isWindows then
+      "Windows"
+    else if isiOS then
+      "iOS"
+    else
+      abort "no Nim OS support known for ${config}";
+
+  parsePlatform = p: {
+    cpu = parseCpu p;
+    os = parseOs p;
+  };
+
+  nimHost = parsePlatform stdenv.hostPlatform;
+  nimTarget = parsePlatform stdenv.targetPlatform;
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nim-unwrapped";
+  version = "2.2.0";
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
+    hash = "sha256-zphChJyXYOSH7N0c2t98DyhEyvrmBUAcfHKuJXZEiTw=";
+  };
+
+  buildInputs = [
+    boehmgc
+    openssl
+    pcre
+    readline
+    sqlite
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+
+  patches = [
+    ./NIM_CONFIG_DIR.patch
+    # Override compiler configuration via an environmental variable
+
+    ./nixbuild.patch
+    # Load libraries at runtime by absolute path
+
+    ./extra-mangling-2.patch
+    # Mangle store paths of modules to prevent runtime dependence.
+
+    ./openssl.patch
+    # dlopen is widely used by Python, Ruby, Perl, ... what you're really telling me here is that your OS is fundamentally broken. That might be news for you, but it isn't for me.
+  ];
+
+  configurePhase =
+    let
+      bootstrapCompiler = stdenv.mkDerivation {
+        pname = "nim-bootstrap";
+        inherit (finalAttrs) version src preBuild;
+        enableParallelBuilding = true;
+        installPhase = ''
+          runHook preInstall
+          install -Dt $out/bin bin/nim
+          runHook postInstall
+        '';
+      };
+    in
+    ''
+      runHook preConfigure
+      cp ${bootstrapCompiler}/bin/nim bin/
+      echo 'define:nixbuild' >> config/nim.cfg
+      runHook postConfigure
+    '';
+
+  kochArgs =
+    [
+      "--cpu:${nimHost.cpu}"
+      "--os:${nimHost.os}"
+      "-d:release"
+      "-d:useGnuReadline"
+    ]
+    ++ lib.optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) "-d:nativeStacktrace";
+
+  preBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+    substituteInPlace makefile \
+      --replace "aarch64" "arm64"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    local HOME=$TMPDIR
+    ./bin/nim c --parallelBuild:$NIX_BUILD_CORES koch
+    ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
+    ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
+    ./bin/nim js -d:release tools/dochack/dochack.nim
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/bin bin/*
+    ln -sf $out/nim/bin/nim $out/bin/nim
+    ln -sf $out/nim/lib $out/lib
+    ./install.sh $out
+    cp -a tools dist $out/nim/
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit nimHost nimTarget;
+  };
+
+  meta = with lib; {
+    description = "Statically typed, imperative programming language";
+    homepage = "https://nim-lang.org/";
+    license = licenses.mit;
+    mainProgram = "nim";
+    maintainers = with maintainers; [
+      ehmry
+      eveeifyeve
+    ];
+  };
+
+})

pkgs/by-name/ni/nimlsp/package.nix

@@ -1,6 +1,12 @@
-{ lib, buildNimPackage, fetchFromGitHub, srcOnly, nim-unwrapped-2 }:
+{ lib, buildNimPackage, fetchFromGitHub, srcOnly, nim-2_0, nim-unwrapped-2_0 }:
 
-buildNimPackage (finalAttrs: {
+let
+  buildNimPackage' = buildNimPackage.override {
+    # Do not build with Nim-2.2.x.
+    nim2 = nim-2_0;
+  };
+in
+buildNimPackage' (finalAttrs: {
   pname = "nimlsp";
   version = "0.4.6";
 
@@ -27,7 +33,7 @@ buildNimPackage (finalAttrs: {
 
   nimFlags = [
     "--threads:on"
-    "-d:explicitSourcePath=${srcOnly nim-unwrapped-2}"
+    "-d:explicitSourcePath=${srcOnly nim-unwrapped-2_0}"
     "-d:tempDir=/tmp"
   ];
 

pkgs/by-name/py/pytr/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pytr";
-  version = "0.2.5";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytr-org";
     repo = "pytr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9FKG4QgRBU+DaaYJIDMDqqxFMCAguv5iRUUrQr6RMz8=";
+    hash = "sha256-sMDWL0lA5iJ2v2dhUIhMgSZ1vk7LjkNMYZGiJRpd3XY=";
   };
 
   build-system = with python3Packages; [
@@ -49,7 +49,7 @@ python3Packages.buildPythonApplication rec {
   pythonImportsCheck = [ "pytr" ];
 
   meta = {
-    changelog = "https://github.com/pytr-org/pytr/releases/tag/${version}";
+    changelog = "https://github.com/pytr-org/pytr/releases/tag/${lib.removePrefix "refs/tags/" src.rev}";
     description = "Use TradeRepublic in terminal and mass download all documents";
     homepage = "https://github.com/pytr-org/pytr";
     license = lib.licenses.mit;

pkgs/by-name/tu/tun2proxy/package.nix

@@ -3,18 +3,19 @@
   rustPlatform,
   fetchFromGitHub,
 }:
+
 rustPlatform.buildRustPackage rec {
   pname = "tun2proxy";
-  version = "0.5.4";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "tun2proxy";
     repo = "tun2proxy";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-EeSXEPg4TxbjQXoM2jx8T9+VOT7VndBnxhy7pwwQ8Kk=";
+    hash = "sha256-LY7vVD85GVFqARYOBDeb4fS6rL2PwPXYXIAJtwm2goo=";
   };
 
-  cargoHash = "sha256-WwCUSnXSlSrO+YfqpZlC9WWsX/pM6ixYlqU1pZY4e5o=";
+  cargoHash = "sha256-o/zQjWR9qNs0XVL/dcRiMHgj+8Xvl6vVl/Yw5iLhroI=";
 
   cargoPatches = [
     ./Cargo.lock.patch
@@ -23,6 +24,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     homepage = "https://github.com/tun2proxy/tun2proxy";
     description = "Tunnel (TUN) interface for SOCKS and HTTP proxies";
+    changelog = "https://github.com/tun2proxy/tun2proxy/releases/tag/v${version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     mainProgram = "tun2proxy-bin";

pkgs/by-name/wi/wiremock/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "wiremock";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchurl {
     url = "mirror://maven/org/wiremock/wiremock-standalone/${finalAttrs.version}/wiremock-standalone-${finalAttrs.version}.jar";
-    hash = "sha256-cjqIDVDTsKFFrw3wfleMLLhed/6yIx5pkcmhNmkmkSw=";
+    hash = "sha256-d7iNxBwyaOPOOR8/7yIrDNBpbyhtP8NahLoi/8uHcBI=";
   };
 
   dontUnpack = true;

pkgs/development/compilers/elm/packages/lamdera/default.nix

@@ -8,16 +8,16 @@ let
   arch = if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
   hashes =
     {
-      "x86_64-linux" = "1v596zi4zmx88r4axrp7pmci3w9c6f1kz4izrbj65c7ch6wwa7f2";
+      "x86_64-linux" = "8534ff055073490719ed05be847bebef46250ebb7af1d72bdaa4fc115c6dcea3";
-      "aarch64-linux" = "0xf6lqm9xgph8q95h6smq6dzn5549nfsnayny5nyvm56nbmv5iw9";
+      "aarch64-linux" = "01397ce50cb0ad1dac18e4e0f7ab490bbf41a1c23d06a1946eec689e7811085b";
-      "x86_64-darwin" = "0kijrjfbr7hn469x67yya6ndfwj901m54gd96sq3yiay0jvmapga";
+      "x86_64-darwin" = "46305fb0de9fd7685fdf7cf175ad965d5320f76d4b5f2de2f9dc8403c8127d52";
-      "aarch64-darwin" = "1iigsd4ac0cbb1q2g02zxjxpcma6yyd7ms72ri8g2vq8i90zys9n";
+      "aarch64-darwin" = "b1e3d7bd624cdff0522bd71dc5825fa98b4eed1eae064df55a86a40b554ce0d1";
     };
 in
 
 stdenv.mkDerivation rec {
   pname = "lamdera";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchurl {
     url = "https://static.lamdera.com/bin/lamdera-${version}-${os}-${arch}";

pkgs/development/compilers/nim/default.nix

@@ -1,325 +0,0 @@
-# https://nim-lang.github.io/Nim/packaging.html
-# https://nim-lang.org/docs/nimc.html
-
-{ lib, callPackage, buildPackages, stdenv, fetchurl, fetchgit
-, makeWrapper, openssl, pcre, readline, boehmgc, sqlite, Security
-, nim-unwrapped-2, nim-unwrapped-1, nim }:
-
-let
-  parseCpu = platform:
-    with platform;
-    # Derive a Nim CPU identifier
-    if isAarch32 then
-      "arm"
-    else if isAarch64 then
-      "arm64"
-    else if isAlpha then
-      "alpha"
-    else if isAvr then
-      "avr"
-    else if isMips && is32bit then
-      "mips"
-    else if isMips && is64bit then
-      "mips64"
-    else if isMsp430 then
-      "msp430"
-    else if isPower && is32bit then
-      "powerpc"
-    else if isPower && is64bit then
-      "powerpc64"
-    else if isRiscV && is64bit then
-      "riscv64"
-    else if isSparc then
-      "sparc"
-    else if isx86_32 then
-      "i386"
-    else if isx86_64 then
-      "amd64"
-    else
-      abort "no Nim CPU support known for ${config}";
-
-  parseOs = platform:
-    with platform;
-    # Derive a Nim OS identifier
-    if isAndroid then
-      "Android"
-    else if isDarwin then
-      "MacOSX"
-    else if isFreeBSD then
-      "FreeBSD"
-    else if isGenode then
-      "Genode"
-    else if isLinux then
-      "Linux"
-    else if isNetBSD then
-      "NetBSD"
-    else if isNone then
-      "Standalone"
-    else if isOpenBSD then
-      "OpenBSD"
-    else if isWindows then
-      "Windows"
-    else if isiOS then
-      "iOS"
-    else
-      abort "no Nim OS support known for ${config}";
-
-  parsePlatform = p: {
-    cpu = parseCpu p;
-    os = parseOs p;
-  };
-
-  nimHost = parsePlatform stdenv.hostPlatform;
-  nimTarget = parsePlatform stdenv.targetPlatform;
-
-in {
-
-  nim-unwrapped-2 = stdenv.mkDerivation (finalAttrs: {
-    pname = "nim-unwrapped";
-    version = "2.2.0";
-    strictDeps = true;
-
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-zphChJyXYOSH7N0c2t98DyhEyvrmBUAcfHKuJXZEiTw=";
-    };
-
-    buildInputs = [ boehmgc openssl pcre readline sqlite ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin Security;
-
-    patches = [
-      ./NIM_CONFIG_DIR.patch
-      # Override compiler configuration via an environmental variable
-
-      ./nixbuild.patch
-      # Load libraries at runtime by absolute path
-
-      ./extra-mangling-2.patch
-      # Mangle store paths of modules to prevent runtime dependence.
-
-      ./openssl.patch
-      # dlopen is widely used by Python, Ruby, Perl, ... what you're really telling me here is that your OS is fundamentally broken. That might be news for you, but it isn't for me.
-    ];
-
-    configurePhase = let
-      bootstrapCompiler = stdenv.mkDerivation {
-        pname = "nim-bootstrap";
-        inherit (finalAttrs) version src preBuild;
-        enableParallelBuilding = true;
-        installPhase = ''
-          runHook preInstall
-          install -Dt $out/bin bin/nim
-          runHook postInstall
-        '';
-      };
-    in ''
-      runHook preConfigure
-      cp ${bootstrapCompiler}/bin/nim bin/
-      echo 'define:nixbuild' >> config/nim.cfg
-      runHook postConfigure
-    '';
-
-    kochArgs = [
-      "--cpu:${nimHost.cpu}"
-      "--os:${nimHost.os}"
-      "-d:release"
-      "-d:useGnuReadline"
-    ] ++ lib.optional (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) "-d:nativeStacktrace";
-
-    preBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
-      substituteInPlace makefile \
-        --replace "aarch64" "arm64"
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-      local HOME=$TMPDIR
-      ./bin/nim c --parallelBuild:$NIX_BUILD_CORES koch
-      ./koch boot $kochArgs --parallelBuild:$NIX_BUILD_CORES
-      ./koch toolsNoExternal $kochArgs --parallelBuild:$NIX_BUILD_CORES
-      ./bin/nim js -d:release tools/dochack/dochack.nim
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      install -Dt $out/bin bin/*
-      ln -sf $out/nim/bin/nim $out/bin/nim
-      ln -sf $out/nim/lib $out/lib
-      ./install.sh $out
-      cp -a tools dist $out/nim/
-      runHook postInstall
-    '';
-
-    passthru = {
-      updateScript.command = [ ./update.sh ];
-    };
-
-    meta = with lib; {
-      description = "Statically typed, imperative programming language";
-      homepage = "https://nim-lang.org/";
-      license = licenses.mit;
-      mainProgram = "nim";
-      maintainers = with maintainers; [ ehmry eveeifyeve ];
-    };
-  });
-
-  nim-unwrapped-1 = nim-unwrapped-2.overrideAttrs (finalAttrs: prevAttrs: {
-    version = "1.6.20";
-    src = fetchurl {
-      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-/+0EdQTR/K9hDw3Xzz4Ce+kaKSsMnFEWFQTC87mE/7k=";
-    };
-
-    patches = [
-      ./NIM_CONFIG_DIR.patch
-      # Override compiler configuration via an environmental variable
-
-      ./nixbuild.patch
-      # Load libraries at runtime by absolute path
-
-      ./extra-mangling.patch
-      # Mangle store paths of modules to prevent runtime dependence.
-    ] ++ lib.optional (!stdenv.hostPlatform.isWindows) ./toLocation.patch;
-  });
-
-} // (let
-  wrapNim = { nim', patches }:
-    let targetPlatformConfig = stdenv.targetPlatform.config;
-    in stdenv.mkDerivation (finalAttrs: {
-        name = "${targetPlatformConfig}-nim-wrapper-${nim'.version}";
-        inherit (nim') version;
-        preferLocalBuild = true;
-        strictDeps = true;
-
-        nativeBuildInputs = [ makeWrapper ];
-
-        # Needed for any nim package that uses the standard library's
-        # 'std/sysrand' module.
-        depsTargetTargetPropagated = lib.optional stdenv.hostPlatform.isDarwin Security;
-
-        inherit patches;
-
-        unpackPhase = ''
-          runHook preUnpack
-          tar xf ${nim'.src} nim-$version/config
-          cd nim-$version
-          runHook postUnpack
-        '';
-
-        dontConfigure = true;
-
-        buildPhase =
-          # Configure the Nim compiler to use $CC and $CXX as backends
-          # The compiler is configured by two configuration files, each with
-          # a different DSL. The order of evaluation matters and that order
-          # is not documented, so duplicate the configuration across both files.
-          ''
-            runHook preBuild
-            cat >> config/config.nims << WTF
-
-            switch("os", "${nimTarget.os}")
-            switch("cpu", "${nimTarget.cpu}")
-            switch("define", "nixbuild")
-
-            # Configure the compiler using the $CC set by Nix at build time
-            import strutils
-            let cc = getEnv"CC"
-            if cc.contains("gcc"):
-              switch("cc", "gcc")
-            elif cc.contains("clang"):
-              switch("cc", "clang")
-            WTF
-
-            mv config/nim.cfg config/nim.cfg.old
-            cat > config/nim.cfg << WTF
-            os = "${nimTarget.os}"
-            cpu =  "${nimTarget.cpu}"
-            define:"nixbuild"
-            WTF
-
-            cat >> config/nim.cfg < config/nim.cfg.old
-            rm config/nim.cfg.old
-
-            cat >> config/nim.cfg << WTF
-
-            clang.cpp.exe %= "\$CXX"
-            clang.cpp.linkerexe %= "\$CXX"
-            clang.exe %= "\$CC"
-            clang.linkerexe %= "\$CC"
-            gcc.cpp.exe %= "\$CXX"
-            gcc.cpp.linkerexe %= "\$CXX"
-            gcc.exe %= "\$CC"
-            gcc.linkerexe %= "\$CC"
-            WTF
-
-            runHook postBuild
-          '';
-
-        wrapperArgs = lib.optionals (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) [
-          "--prefix PATH : ${lib.makeBinPath [ buildPackages.gdb ]}:${
-            placeholder "out"
-          }/bin"
-          # Used by nim-gdb
-
-          "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl pcre ]}"
-          # These libraries may be referred to by the standard library.
-          # This is broken for cross-compilation because the package
-          # set will be shifted back by nativeBuildInputs.
-
-          "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
-          # Use the custom configuration
-        ];
-
-        installPhase = ''
-          runHook preInstall
-
-          mkdir -p $out/bin $out/etc
-
-          cp -r config $out/etc/nim
-
-          for binpath in ${nim'}/bin/nim?*; do
-            local binname=`basename $binpath`
-            makeWrapper \
-              $binpath $out/bin/${targetPlatformConfig}-$binname \
-              $wrapperArgs
-            ln -s $out/bin/${targetPlatformConfig}-$binname $out/bin/$binname
-          done
-
-          makeWrapper \
-            ${nim'}/nim/bin/nim $out/bin/${targetPlatformConfig}-nim \
-            --set-default CC $(command -v $CC) \
-            --set-default CXX $(command -v $CXX) \
-            $wrapperArgs
-          ln -s $out/bin/${targetPlatformConfig}-nim $out/bin/nim
-
-          makeWrapper \
-            ${nim'}/bin/testament $out/bin/${targetPlatformConfig}-testament \
-            $wrapperArgs
-          ln -s $out/bin/${targetPlatformConfig}-testament $out/bin/testament
-
-        '' + ''
-          runHook postInstall
-        '';
-
-        passthru = { nim = nim'; };
-
-        meta = nim'.meta // {
-          description = nim'.meta.description
-            + " (${targetPlatformConfig} wrapper)";
-          platforms = with lib.platforms; unix ++ genode ++ windows;
-        };
-      });
-in {
-
-  nim2 = wrapNim {
-    nim' = buildPackages.nim-unwrapped-2;
-    patches = [ ./nim2.cfg.patch ];
-  };
-
-  nim1 = wrapNim {
-    nim' = buildPackages.nim-unwrapped-1;
-    patches = [ ./nim.cfg.patch ];
-  };
-
-})

pkgs/development/compilers/nim/update.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update curl coreutils jq
-
-set -ex
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
-
-curl_github() {
-  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
-}
-
-
-case "$UPDATE_NIX_ATTR_PATH" in
-nim)
-  latestTag=$(curl_github https://api.github.com/repos/nim-lang/Nim/releases/latest | jq -r ".tag_name")
-  latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
-
-  echo "Updating Nim"
-  nix-update --version "$latestVersion" \
-    --override-filename "$SCRIPT_DIR/default.nix" \
-  nim
-*)
-  echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
-  ;;
-esac

pkgs/development/coq-modules/mathcomp-analysis/default.nix

@@ -9,6 +9,7 @@ let
   repo  = "analysis";
   owner = "math-comp";
 
+  release."1.5.0".sha256 = "sha256-EWogrkr5TC5F9HjQJwO3bl4P8mij8U7thUGJNNI+k88=";
   release."1.4.0".sha256 = "sha256-eDggeuEU0fMK7D5FbxvLkbAgpLw5lwL/Rl0eLXAnJeg=";
   release."1.2.0".sha256 = "sha256-w6BivDM4dF4Iv4rUTy++2feweNtMAJxgGExPfYGhXxo=";
   release."1.1.0".sha256 = "sha256-wl4kZf4mh9zbFfGcqaFEgWRyp0Bj511F505mYodpS6o=";
@@ -33,7 +34,7 @@ let
 
   defaultVersion = let inherit (lib.versions) range; in
     lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (range "8.19" "8.20") (range "2.1.0" "2.2.0") ];   out = "1.4.0"; }
+      { cases = [ (range "8.19" "8.20") (range "2.1.0" "2.2.0") ];   out = "1.5.0"; }
       { cases = [ (range "8.17" "8.20") (range "2.0.0" "2.2.0") ];   out = "1.1.0"; }
       { cases = [ (range "8.17" "8.19") (range "1.17.0" "1.19.0") ]; out = "0.7.0"; }
       { cases = [ (range "8.17" "8.18") (range "1.15.0" "1.18.0") ]; out = "0.6.7"; }

pkgs/development/coq-modules/mathcomp-infotheo/default.nix

@@ -7,12 +7,14 @@
   inherit version;
 
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp-analysis.version] [
+    { cases = [ (range "8.18" "8.20") (isGe "1.5") ];            out = "0.7.3"; }
     { cases = [ (range "8.18" "8.19") (isGe "1.2") ];            out = "0.7.2"; }
     { cases = [ (range "8.17" "8.19") (isGe "1.0") ];                    out = "0.7.1"; }
     { cases = [ (isGe "8.17") (range "0.6.6" "0.7.0") ];         out = "0.6.1"; }
     { cases = [ (range "8.17" "8.18") (range "0.6.0" "0.6.7") ]; out = "0.5.2"; }
     { cases = [ (range "8.15" "8.16") (range "0.5.4" "0.6.5") ]; out = "0.5.1"; }
   ] null;
+  release."0.7.3".sha256 = "sha256-7+qPtE1KfDmo9ZsQtWMzoR2MYnFpTjFHK/yZYVm+GxA=";
   release."0.7.2".sha256 = "sha256-dekrdVmuTcqXXmKhIb831EKtMhbPrXHJZhzmGb9rdRo=";
   release."0.7.1".sha256 = "sha256-/4Elb35SmscG6EjEcHYDo+AmWrpBUlygZL0WhaD+fcY=";
   release."0.6.1".sha256 = "sha256-tFB5lrwRPIlHkP+ebgcJwu03Cc9yVaOINOAo8Bf2LT4=";

pkgs/development/interpreters/bqn/cbqn/sources.nix

@@ -10,13 +10,13 @@
   cbqn = let
     self = {
       pname = "cbqn";
-      version = "0.7.0";
+      version = "0.8.0";
 
       src = fetchFromGitHub {
         owner = "dzaima";
         repo = "CBQN";
         rev = "v${self.version}";
-        hash = "sha256-TUK0HrJ1IyiVi9Y3S1IrK/d4/EZxdRdWyxsAwj79KEc=";
+        hash = "sha256-vmd7CX0jgozysmjKK0p5GM4Qd3vY71q1kcKwfr+6fkw=";
       };
     };
   in
@@ -24,13 +24,13 @@
 
   cbqn-bytecode = {
     pname = "cbqn-bytecode";
-    version = "0-unstable-2024-05-22";
+    version = "0-unstable-2024-09-15";
 
     src = fetchFromGitHub {
       owner = "dzaima";
       repo = "cbqnBytecode";
-      rev = "c5674783c11d7569e5a4d166600ffcde2409331d";
+      rev = "c7d83937710889591bad3525077afc30a21e5148";
-      hash = "sha256-y7gqHzUxVUUVryutlq3Upuso8r3ZRSyF7ydMg1OVlwA=";
+      hash = "sha256-bEHyiJusddBuTk7MZX1NGvkj66WeOJv5qxBQV6Uhs1E=";
     };
   };
 
@@ -48,13 +48,13 @@
 
   singeli = {
     pname = "singeli";
-    version = "0-unstable-2024-02-26";
+    version = "0-unstable-2024-09-29";
 
     src = fetchFromGitHub {
       owner = "mlochbaum";
       repo = "Singeli";
-      rev = "ce6ef5d06d35777f0016bbfe0c6c1cf6a9c1b48e";
+      rev = "b43f3999b0c5a40b43ceee258fbe6bb8245d06af";
-      hash = "sha256-dDoWoq4LYMD2CKyPxXDAwoeH2E+f0FDyvngtWPEr67w=";
+      hash = "sha256-tf5mYIV368Y2cgYJ0U4OZQxuN6kldHUKi9oSjAHbA4Y=";
     };
   };
 }

pkgs/development/interpreters/php/8.2.nix

@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.24";
+    version = "8.2.25";
-    hash = "sha256-TMduxkTu6X0XySv+jQ6EcU/t8pmlOLffrcBjndDcQy8=";
+    hash = "sha256-B7QcXpbGDAllEORfAvgYQU0RvdDV2htoQN26K6colAE=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([

pkgs/development/ocaml-modules/kdf/default.nix

@@ -0,0 +1,30 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, digestif
+, mirage-crypto
+, alcotest
+, ohex
+}:
+
+buildDunePackage rec {
+  pname = "kdf";
+  version = "1.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/robur-coop/kdf/releases/download/v${version}/kdf-${version}.tbz";
+    hash = "sha256-0WFYKw7+ZtlY3WuMnCEGjp9kVM4hg3fWz4eCPexi4M4=";
+  };
+
+  propagatedBuildInputs = [ digestif mirage-crypto ];
+
+  checkInputs = [ alcotest ohex ];
+  doCheck = true;
+
+  meta = {
+    description = "Key Derivation Functions: HKDF RFC 5869, PBKDF RFC 2898, SCRYPT RFC 7914";
+    homepage = "https://github.com/robur-coop/kdf";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/otr/default.nix

@@ -1,19 +1,19 @@
 { lib, fetchurl, buildDunePackage
-, cstruct, sexplib0, mirage-crypto, mirage-crypto-pk, astring, base64
+, digestif, sexplib0, mirage-crypto, mirage-crypto-pk, astring, base64
 }:
 
 buildDunePackage rec {
   pname = "otr";
-  version = "0.3.10";
+  version = "1.0.0";
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";
 
   src = fetchurl {
-    url = "https://github.com/hannesm/ocaml-otr/releases/download/v${version}/otr-v${version}.tbz";
+    url = "https://github.com/hannesm/ocaml-otr/releases/download/v${version}/otr-${version}.tbz";
-    hash = "sha256:0dssc7p6s7z53n0mddyipjghzr8ld8bb7alaxqrx9gdpspwab1gq";
+    hash = "sha256-/CcVqLbdylB+LqpKNETkpvQ8SEAIcEFCO1MZqvdmJWU=";
   };
 
-  propagatedBuildInputs = [ cstruct sexplib0 mirage-crypto mirage-crypto-pk
+  propagatedBuildInputs = [ digestif sexplib0 mirage-crypto mirage-crypto-pk
                             astring base64 ];
 
   doCheck = true;
@@ -23,6 +23,5 @@ buildDunePackage rec {
     description = "Off-the-record messaging protocol, purely in OCaml";
     license = licenses.bsd2;
     maintainers = with maintainers; [ sternenseemann ];
-    broken = true; # Not compatible with mirage-crypto ≥ 1.0
   };
 }

pkgs/development/ocaml-modules/tls/default.nix

@@ -1,16 +1,16 @@
 { lib, fetchurl, buildDunePackage
-, domain-name, fmt, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ptime, x509
+, domain-name, fmt, logs, kdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, x509
 , ipaddr
 , alcotest, ounit2
 }:
 
 buildDunePackage rec {
   pname = "tls";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";
-    hash = "sha256-2uS1/8gD6ILphIBCWP+KrKe4N9hVbeaEABldpccKjYM=";
+    hash = "sha256-ohdRIAyzFG/+FUf11t4Ye1FH6O5r7RKwnVLAAtQrP+s=";
   };
 
   minimalOCamlVersion = "4.08";
@@ -19,12 +19,11 @@ buildDunePackage rec {
     domain-name
     fmt
     logs
-    hkdf
+    kdf
     mirage-crypto
     mirage-crypto-ec
     mirage-crypto-pk
     mirage-crypto-rng
-    ptime
     x509
     ipaddr
   ];

pkgs/development/python-modules/aiocoap/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiocoap";
-  version = "0.4.10";
+  version = "0.4.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "chrysn";
     repo = "aiocoap";
     rev = "refs/tags/${version}";
-    hash = "sha256-sKDkbv8OyPewfQpunFxezP0wjy3EAQxsQ0UfUm0REPM=";
+    hash = "sha256-a2qhMDFkRbMK4+xvPc140i0lPaWbTWeFlpvdLaNtOxA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/distrax/default.nix

@@ -74,6 +74,20 @@ buildPythonPackage rec {
     "distrax/_src/distributions/transformed_test.py"
     "distrax/_src/distributions/uniform_test.py"
     "distrax/_src/utils/transformations_test.py"
+    # https://github.com/google-deepmind/distrax/pull/270
+    "distrax/_src/distributions/deterministic_test.py"
+    "distrax/_src/distributions/epsilon_greedy_test.py"
+    "distrax/_src/distributions/gamma_test.py"
+    "distrax/_src/distributions/greedy_test.py"
+    "distrax/_src/distributions/gumbel_test.py"
+    "distrax/_src/distributions/logistic_test.py"
+    "distrax/_src/distributions/log_stddev_normal_test.py"
+    "distrax/_src/distributions/mvn_diag_test.py"
+    "distrax/_src/distributions/mvn_full_covariance_test.py"
+    "distrax/_src/distributions/mvn_tri_test.py"
+    "distrax/_src/distributions/one_hot_categorical_test.py"
+    "distrax/_src/distributions/softmax_test.py"
+    "distrax/_src/utils/hmm_test.py"
   ];
 
   meta = with lib; {
@@ -81,8 +95,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/deepmind/distrax";
     license = licenses.asl20;
     maintainers = with maintainers; [ onny ];
-    # Several tests fail with:
-    # AssertionError: [Chex] Assertion assert_type failed: Error in type compatibility check
-    broken = true;
   };
 }

pkgs/development/python-modules/django-modelcluster/default.nix

@@ -1,27 +1,22 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-
-  # dependencies
-  django,
-  pytz,
-
-  # optionals
   django-taggit,
-
+  django,
-  # tests
+  fetchFromGitHub,
   pytest-django,
   pytestCheckHook,
+  pythonOlder,
+  pytz,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "django-modelcluster";
   version = "6.3";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "wagtail";
@@ -30,7 +25,9 @@ buildPythonPackage rec {
     hash = "sha256-AUVl2aidjW7Uu//3HlAod7pxzj6Gs1Xd0uTt3NrrqAU=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     django
     pytz
   ];
@@ -44,14 +41,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ optional-dependencies.taggit;
 
-  # https://github.com/wagtail/django-modelcluster/issues/173
+  pythonImportsCheck = [ "modelcluster" ];
-  disabledTests = lib.optionals (lib.versionAtLeast django.version "4.2") [
-    "test_formfield_callback"
-  ];
 
   meta = with lib; {
     description = "Django extension to allow working with 'clusters' of models as a single unit, independently of the database";
     homepage = "https://github.com/torchbox/django-modelcluster/";
+    changelog = "https://github.com/wagtail/django-modelcluster/blob/v${version}/CHANGELOG.txt";
     license = licenses.bsd2;
     maintainers = with maintainers; [ desiderius ];
   };

pkgs/development/python-modules/django-otp-webauthn/default.nix

@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "django-otp-webauthn";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "django_otp_webauthn";
-    hash = "sha256-+Y46/PDeXL9zayoZykaU63faQmnLHzYPmqJJeRBx+hs=";
+    hash = "sha256-BXwIjQjynTjFK+bNML5i35qxQ7TJeb4Xc+duS6Y+5Fk=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/fyta-cli/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "fyta-cli";
-  version = "0.6.7";
+  version = "0.6.10";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dontinelli";
     repo = "fyta_cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KdrDRiPpkG8SDPWtGKU7A14WtQuuA4823t47uWHdGko=";
+    hash = "sha256-sPbN6gMPtNzYTYQ5F8w59m5DKobx/TV6v5v8Q9u1rXQ=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/git-filter-repo/default.nix

@@ -15,7 +15,7 @@ buildPythonPackage rec {
   docs_version = "71d71d4be238628bf9cb9b27be79b8bb824ed1a9";
   pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "git_filter_repo";
@@ -34,10 +34,9 @@ buildPythonPackage rec {
     installManPage ${docs}/man1/git-filter-repo.1
   '';
 
-  nativeBuildInputs = [
+  build-system = [ setuptools-scm ];
-    setuptools-scm
+
-    installShellFiles
+  nativeBuildInputs = [ installShellFiles ];
-  ];
 
   # Project has no tests
   doCheck = false;

pkgs/development/python-modules/knocki/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "knocki";
-  version = "0.3.5";
+  version = "0.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "swan-solutions";
     repo = "knocki-homeassistant";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Fb3skFttY5gtm80k1LCUQ4Z7/TQGClCNcWt1k6bLQoI=";
+    hash = "sha256-Eh/ykTbR2NMZ9Mjgcc53OU3+2EsX6FWV93DmwCDvsRg=";
   };
 
   postPatch = ''
@@ -54,6 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Asynchronous Python client for Knocki vibration / door sensors";
     homepage = "https://github.com/swan-solutions/knocki-homeassistant";
+    changelog = "https://github.com/swan-solutions/knocki-homeassistant/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ mindstorms6 ];
   };

pkgs/development/python-modules/okonomiyaki/default.nix

@@ -1,64 +1,86 @@
 {
-  buildPythonPackage,
-  stdenv,
-  fetchFromGitHub,
   lib,
+  stdenv,
   attrs,
+  buildPythonPackage,
   distro,
+  fetchFromGitHub,
+  parameterized,
   jsonschema,
-  six,
-  zipfile2,
-  hypothesis,
   mock,
   packaging,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
   testfixtures,
-  pythonAtLeast,
+  zipfile2,
 }:
 
 buildPythonPackage rec {
   pname = "okonomiyaki";
-  version = "1.4.0";
+  version = "2.0.0";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "enthought";
-    repo = pname;
+    repo = "okonomiyaki";
     rev = "refs/tags/${version}";
-    hash = "sha256-MEll1H7l41m8uz2/WK/Ilm7Dubg0uqYwe+ZgakO1aXQ=";
+    hash = "sha256-JQZhw0H4iSdxoyS6ODICJz1vAZsOISQitX7wTgSS1xc=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
-    distro
+    # Fixed for >= 2.0.0
-    attrs
+    substituteInPlace setup.cfg \
-    jsonschema
+      --replace-fail "long_description_content_type = rst" "long_description_content_type = text/x-rst"
-    six
+  '';
-    zipfile2
+
-  ];
+  build-system = [ setuptools ];
+
+  optional-dependencies = {
+    all = [
+      attrs
+      distro
+      jsonschema
+      zipfile2
+    ];
+    platforms = [
+      attrs
+      distro
+    ];
+    formats = [
+      attrs
+      distro
+      jsonschema
+      zipfile2
+    ];
+  };
+
+  nativeCheckInputs = [
+    packaging
+    parameterized
+    pytestCheckHook
+    testfixtures
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck =
     ''
       substituteInPlace okonomiyaki/runtimes/tests/test_runtime.py \
-        --replace 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
+        --replace-fail 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace okonomiyaki/platforms/tests/test_pep425.py \
-        --replace 'self.assertEqual(platform_tag, self.tag.platform)' 'raise unittest.SkipTest()'
+        --replace-fail 'self.assertEqual(platform_tag, self.tag.platform)' 'raise unittest.SkipTest()'
     '';
 
-  checkInputs = [
-    hypothesis
-    mock
-    packaging
-    testfixtures
-  ];
-
   pythonImportsCheck = [ "okonomiyaki" ];
 
   meta = with lib; {
-    homepage = "https://github.com/enthought/okonomiyaki";
     description = "Experimental library aimed at consolidating a lot of low-level code used for Enthought's eggs";
+    homepage = "https://github.com/enthought/okonomiyaki";
+    changelog = "https://github.com/enthought/okonomiyaki/releases/tag/${version}";
     maintainers = with maintainers; [ genericnerdyusername ];
     license = licenses.bsd3;
-    broken = pythonAtLeast "3.12"; # multiple tests are failing
   };
 }

pkgs/development/python-modules/okta/default.nix

@@ -18,6 +18,7 @@
   python-jose,
   pythonOlder,
   pyyaml,
+  setuptools,
   xmltodict,
   yarl,
 }:
@@ -25,7 +26,7 @@
 buildPythonPackage rec {
   pname = "okta";
   version = "2.9.8";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -34,7 +35,11 @@ buildPythonPackage rec {
     hash = "sha256-RDnRiPsc4p5yI9jFzOtRI+r00tvska8x4uCSjl+cWvo=";
   };
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "aenum" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     aenum
     aiohttp
     flatdict
@@ -66,6 +71,7 @@ buildPythonPackage rec {
     "test_update_org_contact_user"
     "test_get_role_subscription"
     "test_subscribe_unsubscribe"
+    "test_client_invalid_url"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/pylint-venv/default.nix

@@ -8,19 +8,19 @@
 
 buildPythonPackage rec {
   pname = "pylint-venv";
-  version = "3.0.3";
+  version = "3.0.4";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jgosmann";
-    repo = pname;
+    repo = "pylint-venv";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dsVEHJawsTNKVCVmeOa61wOU5GPeyzAU/eUDFrK9PPg=";
+    hash = "sha256-dJWVfltze4zT0CowBZSn3alqR2Y8obKUCmO8Nfw+ahs=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
   # Module has no tests
   doCheck = false;
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     description = "Module to make pylint respect virtual environments";
     homepage = "https://github.com/jgosmann/pylint-venv/";
     changelog = "https://github.com/jgosmann/pylint-venv/blob/v${version}/CHANGES.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/simplesat/default.nix

@@ -1,33 +1,24 @@
 {
-  buildPythonPackage,
-  fetchFromGitHub,
-  writeText,
   lib,
   attrs,
+  buildPythonPackage,
+  fetchFromGitHub,
   mock,
   okonomiyaki,
   pytestCheckHook,
+  pythonOlder,
   pyyaml,
   setuptools,
   six,
 }:
 
-let
-  version = "0.9.1";
-  versionFile = writeText "simplesat_ver" ''
-    version = '${version}'
-    full_version = '${version}'
-    git_revision = '0000000000000000000000000000000000000000'
-    is_released = True
-    msi_version = '${version}.000'
-    version_info = (${lib.versions.major version}, ${lib.versions.minor version}, ${lib.versions.patch version}, 'final', 0)
-  '';
-in
 buildPythonPackage rec {
   pname = "simplesat";
-  inherit version;
+  version = "0.9.1";
   pyproject = true;
 
+  disabled = pythonOlder "3.9";
+
   src = fetchFromGitHub {
     owner = "enthought";
     repo = "sat-solver";
@@ -35,8 +26,9 @@ buildPythonPackage rec {
     hash = "sha256-/fBnpf1DtaF+wQYZztcB8Y20/ZMYxrF3fH5qRsMucL0=";
   };
 
-  preConfigure = ''
+  postPatch = ''
-    cp ${versionFile} simplesat/_version.py
+    substituteInPlace setup.cfg \
+      --replace-fail "version = file: VERSION" "version = ${version}"
   '';
 
   build-system = [ setuptools ];
@@ -47,20 +39,26 @@ buildPythonPackage rec {
     six
   ];
 
-  pythonImportsCheck = [ "simplesat" ];
-
   nativeCheckInputs = [
     mock
     pytestCheckHook
     pyyaml
   ];
 
+  pythonImportsCheck = [ "simplesat" ];
+
+  preCheck = ''
+    substituteInPlace simplesat/tests/test_pool.py \
+      --replace-fail "assertRaisesRegexp" "assertRaisesRegex"
+  '';
+
   pytestFlagsArray = [ "simplesat/tests" ];
 
   meta = with lib; {
-    homepage = "https://github.com/enthought/sat-solver";
     description = "Prototype for SAT-based dependency handling";
-    maintainers = with maintainers; [ genericnerdyusername ];
+    homepage = "https://github.com/enthought/sat-solver";
+    changelog = "https://github.com/enthought/sat-solver/blob/v${version}/CHANGES.rst";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ genericnerdyusername ];
   };
 }

pkgs/development/python-modules/tpm2-pytss/default.nix

@@ -37,9 +37,6 @@ buildPythonPackage rec {
     [
       # Fix hardcoded `fapi-config.json` configuration path
       ./fapi-config.patch
-      # Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576
-      # This is likely to be dropped with the next major release (>= 2.3)
-      ./pr576-backport.patch
     ]
     ++ lib.optionals isCross [
       # pytss will regenerate files from headers of tpm2-tss.

pkgs/development/python-modules/tpm2-pytss/pr576-backport.patch

@@ -1,117 +0,0 @@
-Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576 on 2.2.1
-
-diff --git a/scripts/prepare_headers.py b/scripts/prepare_headers.py
-index 6ca9b64..a7529b3 100644
---- a/scripts/prepare_headers.py
-+++ b/scripts/prepare_headers.py
-@@ -32,6 +32,7 @@ def remove_common_guards(s):
- 
-     # Restructure #defines with ...
-     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\) \(.*?\)\)", "\g<1>...", s)
-+    s = re.sub("(#define [A-Za-z0-9_]+) +\(\(\(.*?\) .*\)", "\g<1>...", s)
-     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\).*?\) ", "\g<1>...", s)
-     s = re.sub(
-         "(#define [A-Za-z0-9_]+) .*\n.*?.*\)\)", "\g<1>...", s, flags=re.MULTILINE
-diff --git a/src/tpm2_pytss/internal/crypto.py b/src/tpm2_pytss/internal/crypto.py
-index 42030c5..f9d8c34 100644
---- a/src/tpm2_pytss/internal/crypto.py
-+++ b/src/tpm2_pytss/internal/crypto.py
-@@ -25,6 +25,7 @@ from cryptography.hazmat.backends import default_backend
- from cryptography.exceptions import UnsupportedAlgorithm, InvalidSignature
- from typing import Tuple, Type, Any
- import secrets
-+import inspect
- import sys
- 
- _curvetable = (
-diff --git a/test/test_encoding.py b/test/test_encoding.py
-index 1f58562..8cf4b51 100644
---- a/test/test_encoding.py
-+++ b/test/test_encoding.py
-@@ -1406,7 +1406,7 @@ class ToolsTest(TSS2_BaseTest):
-     def test_tools_decode_tpm2b_name(self):
-         if not self.has_tools:
-             self.skipTest("tools not in path")
--        key = ec.generate_private_key(ec.SECP256R1).public_key()
-+        key = ec.generate_private_key(ec.SECP256R1()).public_key()
-         kb = key.public_bytes(
-             serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
-         )
-diff --git a/test/test_fapi.py b/test/test_fapi.py
-index f702fc9..6b77c66 100644
---- a/test/test_fapi.py
-+++ b/test/test_fapi.py
-@@ -13,7 +13,7 @@ from cryptography.hazmat.primitives.asymmetric.padding import PSS
- 
- from tpm2_pytss import *
- 
--from tpm2_pytss.internal.utils import is_bug_fixed, _lib_version_atleast
-+from tpm2_pytss.internal.utils import is_bug_fixed
- 
- from .TSS2_BaseTest import TpmSimulator
- from tpm2_pytss.TSS2_Exception import TSS2_Exception
-@@ -614,8 +614,7 @@ class Common:
-         self.fapi.sign(key_path, b"\x22" * 32)
- 
-     @pytest.mark.skipif(
--        _lib_version_atleast("tss2-fapi", "4.0.1-170")
--        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2084",
-     )
-     def test_write_authorize_nv(self, esys):
-@@ -662,8 +661,7 @@ class Common:
-             self.fapi.quote(path=key_path, pcrs=[7, 9])
- 
-     @pytest.mark.skipif(
--        _lib_version_atleast("tss2-fapi", "4.0.1-170")
--        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2084",
-     )
-     def test_authorize_policy(self, sign_key):
-@@ -728,9 +726,7 @@ class Common:
-             self.fapi.quote(path=key_path, pcrs=[7, 9])
- 
-     @pytest.mark.skipif(
--        _lib_version_atleast("tss2-fapi", "4.0.1-170")
--        or not is_bug_fixed(fixed_in="3.2"),
--        reason="tpm2-tss bug, see #2080",
-+        not is_bug_fixed(fixed_in="3.2"), reason="tpm2-tss bug, see #2080"
-     )
-     def test_policy_signed(self, cryptography_key):
-         # create external signing key used by the signing authority external to the TPM
-@@ -792,10 +788,6 @@ class Common:
-         with pytest.raises(TSS2_Exception):
-             self.fapi.sign(path=key_path, digest=b"\x11" * 32)
- 
--    @pytest.mark.skipif(
--        _lib_version_atleast("tss2-fapi", "4.0.1-170"),
--        reason="issue on master branch.",
--    )
-     def test_policy_branched(self):
-         pcr_index = 15
-         pcr_data = b"ABCDEF"
-@@ -913,8 +905,7 @@ class Common:
-         self.fapi.delete(path=nv_path)
- 
-     @pytest.mark.skipif(
--        _lib_version_atleast("tss2-fapi", "4.0.1-170")
--        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
-         reason="tpm2-tss bug, see #2089",
-     )
-     def test_policy_action(self):
-diff --git a/test/test_policy.py b/test/test_policy.py
-index f18aa8a..5f56e21 100644
---- a/test/test_policy.py
-+++ b/test/test_policy.py
-@@ -47,7 +47,7 @@ class TestPolicy(TSS2_EsapiTest):
-         super().setUp()
-         self._has_secp192r1 = True
-         try:
--            ec.generate_private_key(ec.SECP192R1)
-+            ec.generate_private_key(ec.SECP192R1())
-         except Exception:
-             self._has_secp192r1 = False
- 

pkgs/development/python-modules/zipfile2/default.nix

@@ -1,31 +1,43 @@
 {
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
-  lib,
+  pytestCheckHook,
-  pythonAtLeast,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "zipfile2";
-  version = "0.0.12";
+  version = "0.0.12-unstable-2024-09-28";
-  format = "setuptools";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "cournape";
-    repo = pname;
+    repo = "zipfile2";
-    rev = "v${version}";
+    #rev = "refs/tags/v${version}";
-    hash = "sha256-BwcEgW4XrQqz0Jmtbyxf8q0mWTJXv2dL3Tk7N/IYuMI=";
+    rev = "8823f7253772e5c5811343306a591c00c764c6d0";
+    hash = "sha256-jDOyIj0sQS1dIsar4nyk5V2mme3Zc6VTms49/4n93ho=";
   };
 
-  patches = [ ./no-setuid.patch ];
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "zipfile2" ];
 
+  disabledTests = [
+    # PermissionError: [Errno 1] Operation not ...
+    "test_extract"
+  ];
+
   meta = with lib; {
-    homepage = "https://github.com/cournape/zipfile2";
     description = "Backwards-compatible improved zipfile class";
-    maintainers = with maintainers; [ genericnerdyusername ];
+    homepage = "https://github.com/cournape/zipfile2";
+    changelog = "https://github.com/itziakos/zipfile2/releases/tag/v${version}";
     license = licenses.psfl;
-    broken = pythonAtLeast "3.12"; # tests are failing because the signature of ZipInfo._decodeExtra changed
+    maintainers = with maintainers; [ genericnerdyusername ];
   };
 }

pkgs/development/tools/build-managers/gradle/default.nix

@@ -180,8 +180,8 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_8 = gen {
-    version = "8.10";
+    version = "8.10.2";
-    hash = "sha256-W5xes/n8LJSrrqV9kL14dHyhF927+WyFnTdBGBoSvyo=";
+    hash = "sha256-McVXE+QCM6gwOCfOtCykikcmegrUurkXcSMSHnFSTCY=";
     defaultJava = jdk21;
   };
 

pkgs/development/web/nodejs/v22.nix

@@ -5,14 +5,11 @@ let
     inherit openssl;
     python = python3;
   };
-
-  gypPatches = callPackage ./gyp-patches.nix { } ++ [
-  ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.9.0";
+  version = "22.10.0";
-  sha256 = "a55aeb368dee93432f610127cf94ce682aac07b93dcbbaadd856df122c9239df";
+  sha256 = "3180710d3130ad9df01466abf010e408d41b374be54301d1480d10eca73558e0";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
@@ -21,32 +18,5 @@ buildNodejs {
     ./node-npm-build-npm-package-logic.patch
     ./use-correct-env-in-tests.patch
     ./bin-sh-node-run-v22.patch
-
+  ];
-    # Patches for OpenSSL 3.2
-    # Patches not yet released
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/f8b7a171463e775da304bccf4cf165e634525c7e.patch?full_index=1";
-      hash = "sha256-imptUwt2oG8pPGKD3V6m5NQXuahis71UpXiJm4C0E6o=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/6dfa3e46d3d2f8cfba7da636d48a5c41b0132cd7.patch?full_index=1";
-      hash = "sha256-ITtGsvZI6fliirCKvbMH9N2Xoy3001bz+hS3NPoqvzg=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/29b9c72b05786061cde58a5ae11cfcb580ab6c28.patch?full_index=1";
-      hash = "sha256-xaqtwsrOIyRV5zzccab+nDNG8kUgO6AjrVYJNmjeNP0=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/cfe58cfdc488da71e655d3da709292ce6d9ddb58.patch?full_index=1";
-      hash = "sha256-9GblpbQcYfoiE5R7fETsdW7v1Mm2Xdr4+xRNgUpLO+8=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/2cec716c48cea816dcd5bf4997ae3cdf1fe4cd90.patch?full_index=1";
-      hash = "sha256-ExIkAj8yRJEK39OfV6A53HiuZsfQOm82/Tvj0nCaI8A=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/nodejs/node/commit/0f7bdcc17fbc7098b89f238f4bd8ecad9367887b.patch?full_index=1";
-      hash = "sha256-lXx6QyD2anlY9qAwjNMFM2VcHckBshghUF1NaMoaNl4=";
-    })
-  ] ++ gypPatches;
 }

pkgs/servers/limesurvey/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "limesurvey";
-  version = "6.4.1+240108";
+  version = "6.6.5+240924";
 
   src = fetchFromGitHub {
     owner = "LimeSurvey";
     repo = "LimeSurvey";
     rev = version;
-    hash = "sha256-Cpf8X6igF7LdRbFihGudFmx/8aY0Kf0BE7jHnEF1DYA=";
+    hash = "sha256-CuuTFCDY7jnF2njZdyB6e8/nRf0n0ybKgZ0QscC2IAI=";
   };
 
   phpConfig = writeText "config.php" ''

pkgs/servers/sql/pgpool/default.nix

@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "pgpool-II";
-  version = "4.5.2";
+  version = "4.5.4";
 
   src = fetchurl {
     url = "https://www.pgpool.net/mediawiki/download.php?f=pgpool-II-${version}.tar.gz";
     name = "pgpool-II-${version}.tar.gz";
-    hash = "sha256-SArCPwHNfWyFayk4a/F6hIcS+0tAV9TIq9XIv4Gb3wY=";
+    hash = "sha256-0TkudM4oB/iuYohyyxq3kUJJkhGA3JnfQKHWAmR6EP0=";
   };
 
   buildInputs = [

pkgs/tools/cd-dvd/cdrkit/default.nix

@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl, iconv, darwin}:
+{lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl}:
 
 stdenv.mkDerivation rec {
   pname = "cdrkit";
@@ -11,8 +11,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib bzip2 perl ] ++
-    lib.optionals stdenv.hostPlatform.isLinux [ libcap ] ++
+    lib.optionals stdenv.hostPlatform.isLinux [ libcap ];
-    lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Carbon IOKit iconv ]);
 
   hardeningDisable = [ "format" ];
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.hostPlatform.isMusl [
@@ -44,10 +43,8 @@ stdenv.mkDerivation rec {
   '';
 
   postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    for f in */CMakeFiles/*.dir/link.txt ; do
+    substituteInPlace  */CMakeFiles/*.dir/link.txt \
-      substituteInPlace "$f" \
+      --replace-warn "-lrt" "-framework IOKit -framework CoreFoundation"
-        --replace "-lrt" "-framework IOKit"
-    done
   '';
 
   postInstall = ''

pkgs/tools/inputmethods/libinput-gestures/default.nix

@@ -1,17 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper,
+{
-  libinput, wmctrl, python3,
+  lib,
-  coreutils, xdotool ? null,
+  stdenv,
-  extraUtilsPath ? lib.optional (xdotool != null) xdotool
+  fetchFromGitHub,
+  makeWrapper,
+  libinput,
+  wmctrl,
+  python3,
+  coreutils,
+  xdotool ? null,
+  extraUtilsPath ? lib.optional (xdotool != null) xdotool,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libinput-gestures";
-  version = "2.76";
+  version = "2.77";
 
   src = fetchFromGitHub {
     owner = "bulletmark";
     repo = "libinput-gestures";
-    rev = version;
+    rev = "ref/tags/${finalAttrs.version}";
-    sha256 = "sha256-Tb/gQ/2Ul4JzEiLEUPJBj9T6ZAqzMSPdgiofdnDj73Q=";
+    hash = "sha256-eMXNlSgQSuN+/5SXJQjsylC1ygHS87sIEmnVGFk3pzA=";
   };
   patches = [
     ./0001-hardcode-name.patch
@@ -21,36 +28,35 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ python3 ];
 
-  postPatch =
+  postPatch = ''
-    ''
+    substituteInPlace libinput-gestures-setup --replace-fail /usr/ /
-      substituteInPlace libinput-gestures-setup --replace /usr/ /
 
-      substituteInPlace libinput-gestures \
+    substituteInPlace libinput-gestures \
-        --replace      /etc     "$out/etc" \
+      --replace-fail      /etc     "$out/etc" \
-        --subst-var-by libinput "${libinput}/bin/libinput" \
+      --subst-var-by libinput "${libinput}/bin/libinput" \
-        --subst-var-by wmctrl   "${wmctrl}/bin/wmctrl"
+      --subst-var-by wmctrl   "${wmctrl}/bin/wmctrl"
-    '';
+  '';
-  installPhase =
+  installPhase = ''
-    ''
+    runHook preInstall
-      runHook preInstall
+    ${stdenv.shell} libinput-gestures-setup -d "$out" install
-      ${stdenv.shell} libinput-gestures-setup -d "$out" install
+    runHook postInstall
-      runHook postInstall
+  '';
-    '';
+  postFixup = ''
-  postFixup =
+    rm "$out/bin/libinput-gestures-setup"
-    ''
+    substituteInPlace "$out/share/systemd/user/libinput-gestures.service" --replace "/usr" "$out"
-      rm "$out/bin/libinput-gestures-setup"
+    substituteInPlace "$out/share/applications/libinput-gestures.desktop" --replace "/usr" "$out"
-      substituteInPlace "$out/share/systemd/user/libinput-gestures.service" --replace "/usr" "$out"
+    chmod +x "$out/share/applications/libinput-gestures.desktop"
-      substituteInPlace "$out/share/applications/libinput-gestures.desktop" --replace "/usr" "$out"
+    wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${
-      chmod +x "$out/share/applications/libinput-gestures.desktop"
+      lib.makeBinPath ([ coreutils ] ++ extraUtilsPath)
-      wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${lib.makeBinPath ([coreutils] ++ extraUtilsPath)}"
+    }"
-    '';
+  '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/bulletmark/libinput-gestures";
     description = "Gesture mapper for libinput";
     mainProgram = "libinput-gestures";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
-    maintainers = with maintainers; [ teozkr ];
+    maintainers = with lib.maintainers; [ teozkr ];
   };
-}
+})

pkgs/tools/misc/svtplay-dl/default.nix

@@ -21,7 +21,7 @@ let
     requests-mock
     ;
 
-  version = "4.97.1";
+  version = "4.101";
 
 in
 
@@ -34,7 +34,7 @@ buildPythonApplication {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-9h3hHRRL7DKeCpEXL5w72hYi1nTS+a+x5e9ArMmVgYQ=";
+    hash = "sha256-bHUrpkGBguI8oZB1h1ToFkFsGiMeyV7TyDtgJ8+2TzI=";
   };
 
   build-system = [ setuptools ];

pkgs/tools/networking/i2pd/default.nix

@@ -3,7 +3,6 @@
 , boost, zlib, openssl
 , upnpSupport ? true, miniupnpc
 , aesniSupport ? stdenv.hostPlatform.aesSupport
-, avxSupport   ? stdenv.hostPlatform.avxSupport
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +26,6 @@ stdenv.mkDerivation rec {
   makeFlags =
     let ynf = a: b: a + "=" + (if b then "yes" else "no"); in
     [ (ynf "USE_AESNI" aesniSupport)
-      (ynf "USE_AVX"   avxSupport)
       (ynf "USE_UPNP"  upnpSupport)
     ];
 
@@ -46,5 +44,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ edwtjo ];
     platforms = platforms.unix;
     mainProgram = "i2pd";
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/tools/system/fakeroot/default.nix

@@ -13,7 +13,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.32.2";
+  version = "1.36";
   pname = "fakeroot";
 
   src = fetchFromGitLab {
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "fakeroot";
     rev = "upstream/${finalAttrs.version}";
     domain = "salsa.debian.org";
-    hash = "sha256-j1qSMPNCtAxClqYqWkRNQmtxkitYi7g/9KtQ5XqcX3w=";
+    hash = "sha256-QNScrkX2Vffsj/I5EJO8qs5AHQ9b5s6nHLHQKUdRzLE=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isLinux [
@@ -29,22 +29,11 @@ stdenv.mkDerivation (finalAttrs: {
 
     # patches needed for musl libc, borrowed from alpine packaging.
     # it is applied regardless of the environment to prevent patchrot
-    (fetchpatch {
-      name = "do-not-redefine-id_t.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/fakeroot/do-not-redefine-id_t.patch?id=f68c541324ad07cc5b7f5228501b5f2ce4b36158";
-      sha256 = "sha256-i9PoWriSrQ7kLZzbvZT3Kq1oXzK9mTyBqq808BGepOw=";
-    })
     (fetchpatch {
       name = "fakeroot-no64.patch";
       url = "https://git.alpinelinux.org/aports/plain/main/fakeroot/fakeroot-no64.patch?id=f68c541324ad07cc5b7f5228501b5f2ce4b36158";
       sha256 = "sha256-NCDaB4nK71gvz8iQxlfaQTazsG0SBUQ/RAnN+FqwKkY=";
     })
-  ] ++ [
-    (fetchpatch {
-      name = "addendum-charset-conversion.patch";
-      url = "https://salsa.debian.org/clint/fakeroot/-/commit/b769fb19fd89d696a5e0fd70b974f833f6a0655a.patch";
-      hash = "sha256-3z1g+xzlyTpa055kpsoumP/E8srDlZss6B7Fv5A0QkU=";
-    })
   ];
 
   nativeBuildInputs = [ autoreconfHook po4a ];

pkgs/top-level/aliases.nix

@@ -60,6 +60,9 @@ mapAliases {
   forceSystem = system: _:
     (import self.path { localSystem = { inherit system; }; });
 
+  ### _ ###
+  _1password = lib.warn "_1password has been renamed to _1password-cli to better follow upstream name usage" _1password-cli; # Added 2024-10-24
+
   ### A ###
 
   AusweisApp2 = ausweisapp; # Added 2023-11-08

pkgs/top-level/all-packages.nix

@@ -15316,11 +15316,14 @@ with pkgs;
 
   muonlang = callPackage ../development/compilers/muonlang { };
 
-  inherit (callPackages ../development/compilers/nim
-                        { inherit (darwin) Security;  }
-          ) nim-unwrapped-1 nim-unwrapped-2 nim1 nim2;
   nim = nim2;
-  buildNimPackage = callPackage ../development/compilers/nim/build-nim-package.nix { };
+  nim1 = nim-1_0;
+  nim2 = nim-2_2;
+  nim-unwrapped = nim-unwrapped-2_2;
+  nim-unwrapped-1 = nim-unwrapped-1_0;
+  nim-unwrapped-2 = nim-unwrapped-2_2;
+
+  buildNimPackage = callPackage ../build-support/build-nim-package.nix { };
   nimOverrides = callPackage ./nim-overrides.nix { };
 
   neko = callPackage ../development/compilers/neko { };

pkgs/top-level/ocaml-packages.nix

@@ -913,6 +913,8 @@ let
 
     kcas = callPackage ../development/ocaml-modules/kcas { };
 
+    kdf = callPackage ../development/ocaml-modules/kdf { };
+
     ke = callPackage ../development/ocaml-modules/ke { };
 
     kicadsch = callPackage ../development/ocaml-modules/kicadsch { };

pkgs/top-level/ruby-packages.nix

@@ -2796,10 +2796,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i2vaww6qcazj0ywva1plmjnj6rk23b01szswc5jhcq7s2cikd1y";
+      sha256 = "sha256-JKRkXABoEdg/JIAFfR9UqW52J7a5DhyZsmC53GMOtD4=";
       type = "gem";
     };
-    version = "6.4.2";
+    version = "6.4.3";
   };
   pwntools = {
     dependencies = ["crabstone" "dentaku" "elftools" "keystone-engine" "method_source" "one_gadget" "rainbow" "ruby2ruby" "rubyserial"];