Merge staging-next into staging

2024-11-22 06:53:01 +00:00 · 2024-10-10 12:06:10 +00:00 · 2024-10-10 12:06:10 +00:00 · 61a438a474
commit 61a438a474
parent 6c3076404a a5883bc172
66 changed files with 2071 additions and 1668 deletions
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -85,7 +85,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).

- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babel.enable).
+- [FRRouting](https://frrouting.org/), a popular suite of Internet routing protocol daemons (BGP, BFD, OSPF, IS-IS, VRRP and others). Available as [services.frr](#opt-services.frr.babeld.enable).

 - [Grafana Mimir](https://grafana.com/oss/mimir/), an open source, horizontally scalable, highly available, multi-tenant, long-term storage for Prometheus. Available as [services.mimir](#opt-services.mimir.enable).

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -114,7 +114,7 @@

 - [ddns-updater](https://github.com/qdm12/ddns-updater), a service to update DNS records periodically with WebUI for many DNS providers. Available as [services.ddns-updater](#opt-services.ddns-updater.enable).

- [Immersed VR](https://immersed.com/), a closed-source coworking platform. Available as [programs.immersed-vr](#opt-programs.immersed-vr.enable).
+- [Immersed](https://immersed.com/), a closed-source coworking platform. Available as [programs.immersed](#opt-programs.immersed.enable).

 - [HomeBox](https://github.com/sysadminsmedia/homebox): the inventory and organization system built for the Home User. Available as [services.homebox](#opt-services.homebox.enable).

@ -527,6 +527,12 @@

 - `ceph` has been upgraded to v19. See the [Ceph "squid" release notes](https://docs.ceph.com/en/latest/releases/squid/#v19-2-0-squid) for details and recommended upgrade procedure.

+- `services.frr` has been refactored to use upstream service scripts. The per-daemon configurations
+  have been removed in favour of an `integrated-vtysh-config` style config. The daemon submodules
+  now use the daemon name (e.g. `ospfd`) instead of the protocol name (`ospf`). The daemons `zebra`,
+  `mgmtd` and `staticd` are always enabled if a config is present. The `vtyListenAddress` and
+  `vtyListenPort` options have been removed; use `options` or `extraOptions` instead, respectively.
+
 - `opencv2` and `opencv3` have been removed, as they are obsolete and
  were not used by any other package. External users are encouraged to
  migrate to OpenCV 4.
@ -688,6 +694,9 @@

 - ZFS now imports its pools in `postResumeCommands` rather than `postDeviceCommands`. If you had `postDeviceCommands` scripts that depended on ZFS pools being imported, those now need to be in `postResumeCommands`.

+- `services.localtimed.enable = true` will now set `time.timeZone = null`.
+  This is to avoid silently shadowing a user's explicitly defined timezone without recognition on the user's part.
+
 ## Detailed migration information {#sec-release-24.11-migration}

 ### `sound` options removal {#sec-release-24.11-migration-sound}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -215,7 +215,7 @@
  ./programs/iftop.nix
  ./programs/i3lock.nix
  ./programs/iio-hyprland.nix
-  ./programs/immersed-vr.nix
+  ./programs/immersed.nix
  ./programs/iotop.nix
  ./programs/java.nix
  ./programs/joycond-cemuhook.nix
--- a/nixos/modules/programs/immersed-vr.nix
+++ b/nixos/modules/programs/immersed-vr.nix
@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.programs.immersed-vr;
-in
-{
-
-  options = {
-    programs.immersed-vr = {
-      enable = lib.mkEnableOption "immersed-vr";
-
-      package = lib.mkPackageOption pkgs "immersed-vr" {};
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    boot = {
-      kernelModules = [ "v4l2loopback" "snd-aloop" ];
-      extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-      extraModprobeConfig = ''
-        options v4l2loopback exclusive_caps=1 card_label="v4l2loopback Virtual Camera"
-      '';
-    };
-
-    environment.systemPackages = [ cfg.package ];
-  };
-
-  meta.maintainers = pkgs.immersed-vr.meta.maintainers;
-}
--- a/nixos/modules/programs/immersed.nix
+++ b/nixos/modules/programs/immersed.nix
@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.immersed;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [
+        "programs"
+        "immersed-vr"
+      ]
+      [
+        "programs"
+        "immersed"
+      ]
+    )
+  ];
+
+  options = {
+    programs.immersed = {
+      enable = lib.mkEnableOption "immersed";
+
+      package = lib.mkPackageOption pkgs "immersed" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot = {
+      kernelModules = [
+        "v4l2loopback"
+        "snd-aloop"
+      ];
+      extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+      extraModprobeConfig = ''
+        options v4l2loopback exclusive_caps=1 card_label="v4l2loopback Virtual Camera"
+      '';
+    };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = pkgs.immersed.meta.maintainers;
+}
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@ -1,10 +1,55 @@
 { config, lib, pkgs, ... }:
+
 let

  cfg = config.services.frr;

-  services = [
-    "static"
+  daemons = [
+    "bgpd"
+    "ospfd"
+    "ospf6d"
+    "ripd"
+    "ripngd"
+    "isisd"
+    "pimd"
+    "pim6d"
+    "ldpd"
+    "nhrpd"
+    "eigrpd"
+    "babeld"
+    "sharpd"
+    "pbrd"
+    "bfdd"
+    "fabricd"
+    "vrrpd"
+    "pathd"
+  ];
+
+  daemonDefaultOptions = {
+    zebra = "-A 127.0.0.1 -s 90000000";
+    mgmtd = "-A 127.0.0.1";
+    bgpd = "-A 127.0.0.1";
+    ospfd = "-A 127.0.0.1";
+    ospf6d = "-A ::1";
+    ripd = "-A 127.0.0.1";
+    ripngd = "-A ::1";
+    isisd = "-A 127.0.0.1";
+    pimd = "-A 127.0.0.1";
+    pim6d = "-A ::1";
+    ldpd = "-A 127.0.0.1";
+    nhrpd = "-A 127.0.0.1";
+    eigrpd = "-A 127.0.0.1";
+    babeld = "-A 127.0.0.1";
+    sharpd = "-A 127.0.0.1";
+    pbrd = "-A 127.0.0.1";
+    staticd = "-A 127.0.0.1";
+    bfdd = "-A 127.0.0.1";
+    fabricd = "-A 127.0.0.1";
+    vrrpd = "-A 127.0.0.1";
+    pathd = "-A 127.0.0.1";
+  };
+
+  renamedServices = [
    "bgp"
    "ospf"
    "ospf6"
@ -22,210 +67,194 @@ let
    "fabric"
  ];

-  allServices = services ++ [ "zebra" "mgmt" ];
+  obsoleteServices = renamedServices ++ [ "static" "mgmt" "zebra" ];
+
+  allDaemons = builtins.attrNames daemonDefaultOptions;

  isEnabled = service: cfg.${service}.enable;

-  daemonName = service: if service == "zebra" then service else "${service}d";
+  daemonLine = d: "${d}=${if isEnabled d then "yes" else "no"}";

-  configFile = service:
-    let
-      scfg = cfg.${service};
-    in
-      if scfg.configFile != null then scfg.configFile
-      else pkgs.writeText "${daemonName service}.conf"
-        ''
-          ! FRR ${daemonName service} configuration
-          !
-          hostname ${config.networking.hostName}
-          log syslog
-          service password-encryption
-          !
-          ${scfg.config}
-          !
-          end
-        '';
+  configFile =
+    if cfg.configFile != null then
+      cfg.configFile
+    else
+      pkgs.writeText "frr.conf" ''
+        ! FRR configuration
+        !
+        hostname ${config.networking.hostName}
+        log syslog
+        service password-encryption
+        service integrated-vtysh-config
+        !
+        ${cfg.config}
+        !
+        end
+      '';

-  serviceOptions = service:
+  serviceOptions =
+    service:
    {
-      enable = lib.mkEnableOption "the FRR ${lib.toUpper service} routing protocol";
-
-      configFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        default = null;
-        example = "/etc/frr/${daemonName service}.conf";
+      options = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ daemonDefaultOptions.${service} ];
        description = ''
-          Configuration file to use for FRR ${daemonName service}.
-          By default the NixOS generated files are used.
+          Options for the FRR ${service} daemon.
        '';
      };
-
-      config = lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        example =
-          let
-            examples = {
-              rip = ''
-                router rip
-                  network 10.0.0.0/8
-              '';
-
-              ospf = ''
-                router ospf
-                  network 10.0.0.0/8 area 0
-              '';
-
-              bgp = ''
-                router bgp 65001
-                  neighbor 10.0.0.1 remote-as 65001
-              '';
-            };
-          in
-            examples.${service} or "";
-        description = ''
-          ${daemonName service} configuration statements.
-        '';
-      };
-
-      vtyListenAddress = lib.mkOption {
-        type = lib.types.str;
-        default = "localhost";
-        description = ''
-          Address to bind to for the VTY interface.
-        '';
-      };
-
-      vtyListenPort = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = ''
-          TCP Port to bind to for the VTY interface.
-        '';
-      };
-
      extraOptions = lib.mkOption {
        type = lib.types.listOf lib.types.str;
-        default = [];
+        default = [ ];
        description = ''
-          Extra options for the daemon.
+          Extra options to be appended to the FRR ${service} daemon options.
        '';
      };
-    };
+    }
+    // (if (builtins.elem service daemons) then { enable = lib.mkEnableOption "FRR ${service}"; } else { });

 in

 {

  ###### interface
-  imports = [
-    {
-      options.services.frr = {
-        zebra = (serviceOptions "zebra") // {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = lib.any isEnabled services;
+  imports =
+    [
+      {
+        options.services.frr = {
+          configFile = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+            example = "/etc/frr/frr.conf";
            description = ''
-              Whether to enable the Zebra routing manager.
-
-              The Zebra routing manager is automatically enabled
-              if any routing protocols are configured.
+              Configuration file to use for FRR.
+              By default the NixOS generated files are used.
+            '';
+          };
+          config = lib.mkOption {
+            type = lib.types.lines;
+            default = "";
+            example = ''
+              router rip
+                network 10.0.0.0/8
+              router ospf
+                network 10.0.0.0/8 area 0
+              router bgp 65001
+                neighbor 10.0.0.1 remote-as 65001
+            '';
+            description = ''
+              FRR configuration statements.
+            '';
+          };
+          openFilesLimit = lib.mkOption {
+            type = lib.types.ints.unsigned;
+            default = 1024;
+            description = ''
+              This is the maximum number of FD's that will be available.  Use a
+              reasonable value for your setup if you are expecting a large number
+              of peers in say BGP.
            '';
          };
        };
-        mgmt = (serviceOptions "mgmt") // {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = isEnabled "static";
-            defaultText = lib.literalExpression "config.services.frr.static.enable";
-            description = ''
-              Whether to enable the Configuration management daemon.
-
-              The Configuration management daemon is automatically
-              enabled if needed, at the moment this is when staticd
-              is enabled.
-            '';
-          };
-        };
-      };
-    }
-    { options.services.frr = (lib.genAttrs services serviceOptions); }
-  ];
+      }
+      { options.services.frr = (lib.genAttrs allDaemons serviceOptions); }
+      (lib.mkRemovedOptionModule [ "services" "frr" "zebra" "enable" ] "FRR zebra is always enabled")
+    ]
+    ++ (map (d: lib.mkRenamedOptionModule [ "services" "frr" d "enable" ] [ "services" "frr" "${d}d" "enable" ]) renamedServices)
+    ++ (map (d: lib.mkRenamedOptionModule [ "services" "frr" d "extraOptions" ] [ "services" "frr" "${d}d" "extraOptions" ]) (renamedServices ++ [ "static" "mgmt" ]))
+    ++ (map (d: lib.mkRemovedOptionModule [ "services" "frr" d "enable" ] "FRR ${d}d is always enabled") [ "static" "mgmt" ])
+    ++ (map (d: lib.mkRemovedOptionModule [ "services" "frr" d "config" ] "FRR switched to integrated-vtysh-config, please use services.frr.config") obsoleteServices)
+    ++ (map (d: lib.mkRemovedOptionModule [ "services" "frr" d "configFile" ] "FRR switched to integrated-vtysh-config, please use services.frr.config or services.frr.configFile") obsoleteServices)
+    ++ (map (d: lib.mkRemovedOptionModule [ "services" "frr" d "vtyListenAddress" ] "Please change -A option in services.frr.${d}.options instead") obsoleteServices)
+    ++ (map (d: lib.mkRemovedOptionModule [ "services" "frr" d "vtyListenPort" ] "Please use `-P «vtyListenPort»` option with services.frr.${d}.extraOptions instead, or change services.frr.${d}.options accordingly") obsoleteServices)
+    ;

  ###### implementation

-  config = lib.mkIf (lib.any isEnabled allServices) {
-
-    environment.systemPackages = [
-      pkgs.frr # for the vtysh tool
-    ];
-
-    users.users.frr = {
-      description = "FRR daemon user";
-      isSystemUser = true;
-      group = "frr";
-    };
-
-    users.groups = {
-      frr = {};
-      # Members of the frrvty group can use vtysh to inspect the FRR daemons
-      frrvty = { members = [ "frr" ]; };
-    };
-
-    environment.etc = let
-      mkEtcLink = service: {
-        name = "frr/${daemonName service}.conf";
-        value.source = configFile service;
-      };
+  config =
+    let
+      daemonList = lib.concatStringsSep "\n" (map daemonLine daemons);
+      daemonOptionLine = d: "${d}_options=\"${lib.concatStringsSep " " (cfg.${d}.options ++ cfg.${d}.extraOptions)}\"";
+      daemonOptions = lib.concatStringsSep "\n" (map daemonOptionLine allDaemons);
    in
-      (builtins.listToAttrs
-      (map mkEtcLink (lib.filter isEnabled allServices))) // {
-        "frr/vtysh.conf".text = "";
+    lib.mkIf (lib.any isEnabled daemons || cfg.configFile != null || cfg.config != "") {
+
+      environment.systemPackages = [
+        pkgs.frr # for the vtysh tool
+      ];
+
+      users.users.frr = {
+        description = "FRR daemon user";
+        isSystemUser = true;
+        group = "frr";
      };

-    systemd.tmpfiles.rules = [
-      "d /run/frr 0750 frr frr -"
-    ];
+      users.groups = {
+        frr = { };
+        # Members of the frrvty group can use vtysh to inspect the FRR daemons
+        frrvty = {
+          members = [ "frr" ];
+        };
+      };

-    systemd.services =
-      let
-        frrService = service:
-          let
-            scfg = cfg.${service};
-            daemon = daemonName service;
-          in
-            lib.nameValuePair daemon ({
-              wantedBy = [ "multi-user.target" ];
-              after = [ "network-pre.target" "systemd-sysctl.service" ] ++ lib.optionals (service != "zebra") [ "zebra.service" ];
-              bindsTo = lib.optionals (service != "zebra") [ "zebra.service" ];
-              wants = [ "network.target" ];
+      environment.etc = {
+        "frr/frr.conf".source = configFile;
+        "frr/vtysh.conf".text = ''
+          service integrated-vtysh-config
+        '';
+        "frr/daemons".text = ''
+          # This file tells the frr package which daemons to start.
+          #
+          # The watchfrr, zebra and staticd daemons are always started.
+          #
+          # This part is auto-generated from services.frr.<daemon>.enable config
+          ${daemonList}

-              description = if service == "zebra" then "FRR Zebra routing manager"
-                else "FRR ${lib.toUpper service} routing daemon";
+          # If this option is set the /etc/init.d/frr script automatically loads
+          # the config via "vtysh -b" when the servers are started.
+          #
+          vtysh_enable=yes

-              unitConfig.Documentation = if service == "zebra" then "man:zebra(8)"
-                else "man:${daemon}(8) man:zebra(8)";
+          # This part is auto-generated from services.frr.<daemon>.options or
+          # services.frr.<daemon>.extraOptions
+          ${daemonOptions}
+        '';
+      };

-              restartTriggers = lib.mkIf (service != "mgmt") [
-                (configFile service)
-              ];
-              reloadIfChanged = (service != "mgmt");
+      systemd.tmpfiles.rules = [ "d /run/frr 0750 frr frr -" ];

-              serviceConfig = {
-                PIDFile = "frr/${daemon}.pid";
-                ExecStart = "${pkgs.frr}/libexec/frr/${daemon}"
-                  + lib.optionalString (scfg.vtyListenAddress != "") " -A ${scfg.vtyListenAddress}"
-                  + lib.optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}"
-                  + " " + (lib.concatStringsSep " " scfg.extraOptions);
-                ExecReload = lib.mkIf (service != "mgmt") "${pkgs.python3.interpreter} ${pkgs.frr}/libexec/frr/frr-reload.py --reload --daemon ${daemon} --bindir ${pkgs.frr}/bin --rundir /run/frr /etc/frr/${daemon}.conf";
-                Restart = "on-abnormal";
-              };
-            });
-       in
-         lib.listToAttrs (map frrService (lib.filter isEnabled allServices));
-
-  };
+      systemd.services.frr = {
+        description = "FRRouting";
+        documentation = [ "https://frrouting.readthedocs.io/en/latest/setup.html" ];
+        wants = [ "network.target" ];
+        after = [
+          "network-pre.target"
+          "systemd-sysctl.service"
+        ];
+        before = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        startLimitIntervalSec = 180;
+        reloadIfChanged = true;
+        restartTriggers = [
+          configFile
+          daemonList
+        ];
+        serviceConfig = {
+          Nice = -5;
+          Type = "forking";
+          NotifyAccess = "all";
+          StartLimitBurst = "3";
+          TimeoutSec = 120;
+          WatchdogSec = 60;
+          RestartSec = 5;
+          Restart = "always";
+          LimitNOFILE = cfg.openFilesLimit;
+          PIDFile = "/run/frr/watchfrr.pid";
+          ExecStart = "${pkgs.frr}/libexec/frr/frrinit.sh start";
+          ExecStop = "${pkgs.frr}/libexec/frr/frrinit.sh stop";
+          ExecReload = "${pkgs.frr}/libexec/frr/frrinit.sh reload";
+        };
+      };
+    };

  meta.maintainers = with lib.maintainers; [ woffs ];
-
 }
--- a/nixos/modules/services/networking/shorewall.nix
+++ b/nixos/modules/services/networking/shorewall.nix
@ -58,7 +58,7 @@ in {
        install -D -d -m 750 /var/lib/shorewall
        install -D -d -m 755 /var/lock/subsys
        touch                /var/log/shorewall.log
-        chown 750            /var/log/shorewall.log
+        chmod 750            /var/log/shorewall.log
      '';
    };
    environment = {
--- a/nixos/modules/services/networking/shorewall6.nix
+++ b/nixos/modules/services/networking/shorewall6.nix
@ -58,7 +58,7 @@ in {
        install -D -d -m 750 /var/lib/shorewall6
        install -D -d -m 755 /var/lock/subsys
        touch                /var/log/shorewall6.log
-        chown 750            /var/log/shorewall6.log
+        chmod 750            /var/log/shorewall6.log
      '';
    };
    environment = {
--- a/nixos/modules/services/system/localtimed.nix
+++ b/nixos/modules/services/system/localtimed.nix
@ -16,6 +16,11 @@ in {
          Enable `localtimed`, a simple daemon for keeping the
          system timezone up-to-date based on the current location. It uses
          geoclue2 to determine the current location.
+
+          To avoid silent overriding by the service, if you have explicitly set a
+          timezone, either remove it or ensure that it is set with a lower priority
+          than the default value using `lib.mkDefault` or `lib.mkOverride`. This is
+          to make the choice deliberate. An error will be presented otherwise.
        '';
      };
      package = mkPackageOption pkgs "localtime" { };
@ -24,6 +29,10 @@ in {
  };

  config = mkIf cfg.enable {
+    # This will give users an error if they have set an explicit time
+    # zone, rather than having the service silently override it.
+    time.timeZone = null;
+
    services.geoclue2.appConfig.localtimed = {
      isAllowed = true;
      isSystem = true;
--- a/nixos/modules/virtualisation/ec2-data.nix
+++ b/nixos/modules/virtualisation/ec2-data.nix
@ -34,7 +34,7 @@ with lib;
            if ! [ -e /root/.ssh/authorized_keys ]; then
                echo "obtaining SSH key..."
                mkdir -p /root/.ssh
-                chown 0700 /root/.ssh
+                chmod 0700 /root/.ssh
                if [ -s /etc/ec2-metadata/public-keys-0-openssh-key ]; then
                    (umask 177; cat /etc/ec2-metadata/public-keys-0-openssh-key >> /root/.ssh/authorized_keys)
                    echo "new key added to authorized_keys"
@ -47,7 +47,7 @@ with lib;
            userData=/etc/ec2-metadata/user-data

            mkdir -p /etc/ssh
-            chown 0755 /etc/ssh
+            chmod 0755 /etc/ssh

            if [ -s "$userData" ]; then
              key="$(sed 's/|/\n/g; s/SSH_HOST_DSA_KEY://; t; d' $userData)"
--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
@ -1,6 +1,6 @@
 metaDir=/etc/ec2-metadata
 mkdir -p "$metaDir"
-chown 0755 "$metaDir"
+chmod 0755 "$metaDir"
 rm -f "$metaDir/*"

 get_imds_token() {
--- a/nixos/tests/frr.nix
+++ b/nixos/tests/frr.nix
@ -38,7 +38,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
          { nodes, ... }:
          {
            virtualisation.vlans = [ 1 ];
-            networking.defaultGateway = ifAddr nodes.router1 "eth1";
+            services.frr = {
+              config = ''
+                ip route 192.168.0.0/16 ${ifAddr nodes.router1 "eth1"}
+              '';
+            };
          };

        router1 =
@ -47,13 +51,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
            virtualisation.vlans = [ 1 2 ];
            boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
            networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
-            services.frr.ospf = {
-              enable = true;
+            services.frr = {
+              ospfd.enable = true;
              config = ospfConf1;
            };

            specialisation.ospf.configuration = {
-              services.frr.ospf.config = ospfConf2;
+              services.frr.config = ospfConf2;
            };
          };

@ -63,8 +67,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
            virtualisation.vlans = [ 3 2 ];
            boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
            networking.firewall.extraCommands = "iptables -A nixos-fw -i eth2 -p ospfigp -j ACCEPT";
-            services.frr.ospf = {
-              enable = true;
+            services.frr = {
+              ospfd.enable = true;
              config = ospfConf2;
            };
          };
@ -73,7 +77,11 @@ import ./make-test-python.nix ({ pkgs, ... }:
          { nodes, ... }:
          {
            virtualisation.vlans = [ 3 ];
-            networking.defaultGateway = ifAddr nodes.router2 "eth1";
+            services.frr = {
+              config = ''
+                ip route 192.168.0.0/16 ${ifAddr nodes.router2 "eth1"}
+              '';
+            };
          };
      };

@ -86,10 +94,9 @@ import ./make-test-python.nix ({ pkgs, ... }:
          for machine in client, router1, router2, server:
              machine.wait_for_unit("network.target")

-          with subtest("Wait for Zebra and OSPFD"):
-              for gw in router1, router2:
-                  gw.wait_for_unit("zebra")
-                  gw.wait_for_unit("ospfd")
+          with subtest("Wait for FRR"):
+              for gw in client, router1, router2, server:
+                  gw.wait_for_unit("frr")

          router1.succeed("${nodes.router1.config.system.build.toplevel}/specialisation/ospf/bin/switch-to-configuration test >&2")

--- a/nixos/tests/nebula.nix
+++ b/nixos/tests/nebula.nix
@ -136,9 +136,9 @@ in
      ${name}.start()
      ${name}.succeed(
          "mkdir -p /root/.ssh",
-          "chown 700 /root/.ssh",
+          "chmod 700 /root/.ssh",
          "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
-          "chown 600 /root/.ssh/id_snakeoil",
+          "chmod 600 /root/.ssh/id_snakeoil",
          "mkdir -p /root"
      )
    '';
--- a/nixos/tests/tmate-ssh-server.nix
+++ b/nixos/tests/tmate-ssh-server.nix
@ -6,9 +6,9 @@ let
  setUpPrivateKey = name: ''
    ${name}.succeed(
        "mkdir -p /root/.ssh",
-        "chown 700 /root/.ssh",
+        "chmod 700 /root/.ssh",
        "cat '${snakeOilPrivateKey}' > /root/.ssh/id_snakeoil",
-        "chown 600 /root/.ssh/id_snakeoil",
+        "chmod 600 /root/.ssh/id_snakeoil",
    )
    ${name}.wait_for_file("/root/.ssh/id_snakeoil")
  '';
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -149,6 +149,7 @@ in
      exec = executableName + " --open-url %U";
      icon = "vs${executableName}";
      startupNotify = true;
+      startupWMClass = shortName;
      categories = [ "Utility" "TextEditor" "Development" "IDE" ];
      mimeTypes = [ "x-scheme-handler/vs${executableName}" ];
      keywords = [ "vscode" ];
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0wx0jjckyz2hxas3108m9l2nm8vlgxh8rc9g673g9a43zzg98prf";
-    x86_64-darwin = "1s56qd9ycqnm4fxg4c75cfjxy0hpn762f84l4gg2054yic7c3s2v";
-    aarch64-linux = "070wj6h5riv9vp73np9k9qk85y26wj22626jafvss0zjkdjrrhgh";
-    aarch64-darwin = "09pl31zplrixi828yxqyl1khyxp3mw4d3gsfrj1dz62rxbnahmq6";
-    armv7l-linux = "1sqidmzdyrxgskylhyi1xav7apq0f8ca9qz0g7svcy5jn1wk855f";
+    x86_64-linux = "0hq2w9rc54qy6234njx6xfh3m1p3d206lr22sdxxa3snnrh4vrs8";
+    x86_64-darwin = "0knkn4i6vvszxqzsv9564bbassqgszr8bfa4l7hsqy25ki37k5ln";
+    aarch64-linux = "1k9qvymc7yfq8ihlbx8676gsjyfhg41acc5p4lrw9ci0a3sqanz9";
+    aarch64-darwin = "029sdf0h9fcviv6qdphzlgb1qhy24vj79h465mf559gdih21xlp4";
+    armv7l-linux = "16lwgagg2i6mwqm3p2z97di571wgl2hj255pnxqhcz6x9vq26l8p";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.hostPlatform.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.94.0.24282";
+    version = "1.94.1.24283";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@ -31,25 +31,25 @@ let

  flatlaf = fetchurl {
    name = "flatlaf-2.4.jar";
-    url = "https://repo1.maven.org/maven2/com/formdev/flatlaf/2.4/flatlaf-2.4.jar";
+    url = "mirror://maven/com/formdev/flatlaf/2.4/flatlaf-2.4.jar";
    sha256 = "NVMYiCd+koNCJ6X3EiRx1Aj+T5uAMSJ9juMmB5Os+zc=";
  };

  lsp4j = fetchurl {
    name = "org.eclipse.lsp4j-0.19.0.jar";
-    url = "https://repo1.maven.org/maven2/org/eclipse/lsp4j/org.eclipse.lsp4j/0.19.0/org.eclipse.lsp4j-0.19.0.jar";
+    url = "mirror://maven/org/eclipse/lsp4j/org.eclipse.lsp4j/0.19.0/org.eclipse.lsp4j-0.19.0.jar";
    sha256 = "sha256-1DI5D9KW+GL4gT1qjwVZveOl5KVOEjt6uXDwsFzi8Sg=";
  };

  lsp4j-jsonrpc = fetchurl {
    name = "org.eclipse.lsp4j.jsonrpc-0.19.0.jar";
-    url = "https://repo1.maven.org/maven2/org/eclipse/lsp4j/org.eclipse.lsp4j.jsonrpc/0.19.0/org.eclipse.lsp4j.jsonrpc-0.19.0.jar";
+    url = "mirror://maven/org/eclipse/lsp4j/org.eclipse.lsp4j.jsonrpc/0.19.0/org.eclipse.lsp4j.jsonrpc-0.19.0.jar";
    sha256 = "sha256-ozYTkvv7k0psCeX/PbSM3/Bl17qT3upX3trt65lmM9I=";
  };

  gson = fetchurl {
    name = "gson-2.9.1.jar";
-    url = "https://repo1.maven.org/maven2/com/google/code/gson/gson/2.9.1/gson-2.9.1.jar";
+    url = "mirror://maven/com/google/code/gson/gson/2.9.1/gson-2.9.1.jar";
    sha256 = "sha256-N4U04znm5tULFzb7Ort28cFdG+P0wTzsbVNkEuI9pgM=";
  };

--- a/pkgs/applications/misc/subsurface/default.nix
+++ b/pkgs/applications/misc/subsurface/default.nix
@ -25,16 +25,17 @@
 , qtwebengine
 , libXcomposite
 , bluez
+, writeScript
 }:

 let
-  version = "5.0.10";
+  version = "6.0.5231";

  subsurfaceSrc = (fetchFromGitHub {
    owner = "Subsurface";
    repo = "subsurface";
-    rev = "v${version}";
-    hash = "sha256-KzUBhFGvocaS1VrVT2stvKrj3uVxYka+dyYZUfkIoNs=";
+    rev = "38a0050ac33566dfd34bf94cf1d7ac66034e4118";
+    hash = "sha256-6fNcBF/Ep2xs2z83ZQ09XNb/ZkhK1nUNLChV1x8qh0Y=";
    fetchSubmodules = true;
  });

@ -136,7 +137,25 @@ stdenv.mkDerivation {
    "-DNO_PRINTING=OFF"
  ];

-  passthru = { inherit version libdc googlemaps; };
+  passthru = {
+    inherit version libdc googlemaps;
+    updateScript = writeScript "update-subsurface" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p git common-updater-scripts
+
+      set -eu -o pipefail
+      tmpdir=$(mktemp -d)
+      pushd $tmpdir
+      git clone -b current https://github.com/subsurface/subsurface.git
+      cd subsurface
+      # this returns 6.0.????-local
+      new_version=$(./scripts/get-version.sh | cut -d '-' -f 1)
+      new_rev=$(git rev-list -1 HEAD)
+      popd
+      update-source-version subsurface "$new_version" --rev="$new_rev"
+      rm -rf $tmpdir
+    '';
+  };

  meta = with lib; {
    description = "Divelog program";
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -27,11 +27,11 @@
        version = "2024-08-19";
      };
      ungoogled-patches = {
-        hash = "sha256-fKMa/TxQRzteLIYMy+gn5fDvxLyrqtSwXHWxle0bhsE=";
-        rev = "129.0.6668.89-1";
+        hash = "sha256-kvpLE6SbXFur5xi1C8Ukvm4OoU5YB8PQCJdiakhFSAM=";
+        rev = "129.0.6668.100-1";
      };
    };
-    hash = "sha256-+n9LjRLFvVB/pYkSrRCxln/Xn2paFyoY+mJGD73NtII=";
-    version = "129.0.6668.89";
+    hash = "sha256-LOZ9EPw7VgBNEV7Wxb8H5WfSYTTWOL8EDP91uCrZAsA=";
+    version = "129.0.6668.100";
  };
 }
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@ -9,7 +9,7 @@
 (
  (buildMozillaMach rec {
    pname = "floorp";
-    packageVersion = "11.19.0";
+    packageVersion = "11.19.1";
    applicationName = "Floorp";
    binaryName = "floorp";
    branding = "browser/branding/official";
@ -17,14 +17,14 @@
    allowAddonSideload = true;

    # Must match the contents of `browser/config/version.txt` in the source tree
-    version = "128.3.0";
+    version = "128.4.0";

    src = fetchFromGitHub {
      owner = "Floorp-Projects";
      repo = "Floorp";
      fetchSubmodules = true;
      rev = "v${packageVersion}";
-      hash = "sha256-Sk7oMegNr01tLC1BXpUuImg03C6lEEhaVTSjISV9xAE=";
+      hash = "sha256-RFJ3aRbLwCf0qaluqImcF9+6frvJbw8QE3jBpxNxFjE=";
    };

    extraConfigureFlags = [
@ -57,9 +57,6 @@
      maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
      license = lib.licenses.mpl20;
      mainProgram = "floorp";
-      knownVulnerabilities = [
-        "CVE-2024-9680"
-      ];
    };
    tests = [ nixosTests.floorp ];
  }).override
--- a/pkgs/applications/networking/jmeter/default.nix
+++ b/pkgs/applications/networking/jmeter/default.nix
@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
  pname = "jmeter";
  version = "5.6.3";
  src = fetchurl {
-    url = "https://archive.apache.org/dist/jmeter/binaries/apache-${pname}-${version}.tgz";
+    url = "mirror://apache/jmeter/binaries/apache-${pname}-${version}.tgz";
    sha256 = "sha256-9o78F/4GD2mMSKar4lmakzknSGvaKSTb4Ux0iVMY3d4=";
  };

--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@ -20,17 +20,17 @@

 buildGoModule rec {
  pname = "aaaaxy";
-  version = "1.5.202";
+  version = "1.5.208";

  src = fetchFromGitHub {
    owner = "divVerent";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-UR6rcdNXrDotakDhUW7EFYKpGEqGVmAPUUwrEG9Fiqs=";
+    hash = "sha256-VfF8bQP7pFaTezOJpda4N9KbCHr5ST/wCvdNRiojio0=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-rNCzCSVENwoVTWOEcXBCWgVAwiBZtGsbyz3QBT+WUGw=";
+  vendorHash = "sha256-PBwI3S8ZvmVD57/ICALe+HvgtbPQpJKNPfkWo+uUeSo=";

  buildInputs = [
    alsa-lib
@ -71,6 +71,9 @@ buildGoModule rec {
    # To work around this, use environment variables.
    postBuild = ''
      substituteInPlace 'vendor/github.com/hajimehoshi/ebiten/v2/internal/graphicsdriver/opengl/gl/procaddr_linbsd.go' \
+        --replace-fail \
+        'import (' \
+        'import ("os"' \
        --replace-fail \
        '{"libGL.so", "libGL.so.2", "libGL.so.1", "libGL.so.0"}' \
        '{os.Getenv("EBITENGINE_LIBGL")}' \
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
+, directoryListingUpdater
 , fetchurl
-, fetchpatch
 , alsa-lib
 , alsa-plugins
 , gettext
@ -9,6 +9,7 @@
 , ncurses
 , libsamplerate
 , pciutils
+, procps
 , which
 , fftw
 , pipewire
@ -30,23 +31,12 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "alsa-utils";
-  version = "1.2.10";
+  version = "1.2.12";

  src = fetchurl {
    url = "mirror://alsa/utils/alsa-utils-${version}.tar.bz2";
-    hash = "sha256-EEti7H8Cp84WynefSBVhbfHMIZM1A3g6kQe1lE+DBjo=";
+    hash = "sha256-mLxmd9DAB0AGZ5BRgiMkoKsIea6lWKj2i1EXgNMM2SQ=";
  };
-  patches = [
-    # Backport fixes for musl libc. Remove on next release
-    (fetchpatch {
-      url = "https://github.com/alsa-project/alsa-utils/commit/8c229270f6bae83b705a03714c46067a7aa57b02.patch";
-      hash = "sha256-sUaBHY8EHf4805nF6tyNV5jYXcJf3O+r04VXFu4dUCE=";
-    })
-    (fetchpatch {
-      url = "https://github.com/alsa-project/alsa-utils/commit/0925ad7f09b2dc77015784f9ac2f5e34dd0dd5c3.patch";
-      hash = "sha256-bgGU9On82AUbOjo+KN6WfuhqUAWM87OHnKN7plpG284=";
-    })
-  ];

  nativeBuildInputs = [ gettext makeWrapper ];
  buildInputs = [ alsa-lib ncurses libsamplerate fftw ];
@ -57,10 +47,14 @@ stdenv.mkDerivation rec {

  postFixup = ''
    mv $out/bin/alsa-info.sh $out/bin/alsa-info
-    wrapProgram $out/bin/alsa-info --prefix PATH : "${lib.makeBinPath [ which pciutils ]}"
+    wrapProgram $out/bin/alsa-info --prefix PATH : "${lib.makeBinPath [ which pciutils procps ]}"
    wrapProgram $out/bin/aplay --set-default ALSA_PLUGIN_DIR ${plugin-dir}
  '';

+  passthru.updateScript = directoryListingUpdater {
+    url = "https://www.alsa-project.org/files/pub/utils/";
+  };
+
  meta = with lib; {
    homepage = "http://www.alsa-project.org/";
    description = "ALSA, the Advanced Linux Sound Architecture utils";
--- a/pkgs/by-name/at/attic-client/Cargo.lock
+++ b/pkgs/by-name/at/attic-client/Cargo.lock
@ -325,6 +325,7 @@ dependencies = [
 "maybe-owned",
 "rand",
 "regex",
+ "rsa 0.9.6",
 "ryu",
 "sea-orm",
 "sea-orm-migration",
@ -355,6 +356,7 @@ dependencies = [
 "jwt-simple",
 "lazy_static",
 "regex",
+ "rsa 0.9.6",
 "serde",
 "serde_with",
 "tracing",
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "attic";
-  version = "0-unstable-2024-10-04";
+  version = "0-unstable-2024-10-06";

  src = fetchFromGitHub {
    owner = "zhaofengli";
    repo = "attic";
-    rev = "61ebdef2e263c091f24807b07701be5cb8068dea";
-    hash = "sha256-whgxjoDF7aey3xWy2b9Dp+NHsszK6By+raEbygcSU6w=";
+    rev = "1b29816235b7573fca7f964709fd201e1a187024";
+    hash = "sha256-icNt2T1obK3hFNgBOgiiyOoiScUfz9blmRbNp3aOUBE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/codechecker/package.nix
+++ b/pkgs/by-name/co/codechecker/package.nix
@ -0,0 +1,124 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  fetchFromGitHub,
+  clang,
+  clang-tools,
+  cppcheck,
+  gcc,
+  makeWrapper,
+  withClang ? false,
+  withClangTools ? false,
+  withCppcheck ? false,
+  withGcc ? false,
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: rec {
+      # codechecker is incompatible with SQLAlchemy greater than 1.3
+      sqlalchemy = super.sqlalchemy_1_4.overridePythonAttrs (oldAttrs: rec {
+        version = "1.3.23";
+        pname = oldAttrs.pname;
+        src = fetchFromGitHub {
+          owner = "sqlalchemy";
+          repo = "sqlalchemy";
+          rev = "rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
+          hash = "sha256-hWA0/f7rQpEfYTg10i0rBK3qeJbw3p6HW7S59rLnD0Q=";
+        };
+        doCheck = false;
+        # That test does not exist in the 1.3 branch so we get an error for disabling it
+        disabledTestPaths = builtins.filter (
+          testPath: testPath != "test/ext/mypy"
+        ) oldAttrs.disabledTestPaths;
+      });
+      sqlalchemy_1_4 = sqlalchemy;
+
+      # The current alembic version is not compatible with SQLAlchemy 1.3 so we need to downgrade it
+      alembic = super.alembic.overridePythonAttrs (oldAttrs: rec {
+        pname = "alembic";
+        version = "1.5.5";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-3wAowZJ1os/xN+OWF6Oc3NvRFzczuHtr+iV7fAhgITs=";
+        };
+        doCheck = false;
+        dependencies = oldAttrs.dependencies ++ [
+          super.python-dateutil
+          super.python-editor
+        ];
+      });
+    };
+  };
+  python3Packages = python.pkgs;
+in
+python3Packages.buildPythonApplication rec {
+  pname = "codechecker";
+  version = "6.24.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ftZACUf2lAHokcUXj45LRA7/3goOcIy521cGl6qhR98=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    lxml
+    sqlalchemy
+    alembic
+    portalocker
+    psutil
+    multiprocess
+    thrift
+    gitpython
+    types-pyyaml
+    sarif-tools
+    pytest
+    pycodestyle
+    pylint
+    mkdocs
+    coverage
+  ];
+
+  pythonRelaxDeps = [
+    "thrift"
+    "portalocker"
+    "types-pyyaml"
+    "lxml"
+    "psutil"
+    "multiprocess"
+    "gitpython"
+    "sarif-tools"
+    "pyyaml"
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/CodeChecker" --prefix PATH : ${
+      lib.makeBinPath (
+        [ ]
+        ++ lib.optional withClang clang
+        ++ lib.optional withClangTools clang-tools
+        ++ lib.optional withCppcheck cppcheck
+        ++ lib.optional withGcc gcc
+      )
+    }
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/Ericsson/codechecker";
+    changelog = "https://github.com/Ericsson/codechecker/releases/tag/v${version}";
+    description = "Analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy";
+    license = licenses.asl20-llvm;
+    maintainers = with maintainers; [
+      zebreus
+      felixsinger
+    ];
+    mainProgram = "CodeChecker";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/dr/druid/package.nix
+++ b/pkgs/by-name/dr/druid/package.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  mysqlConnector = fetchurl {
-    url = "https://repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.48/mysql-connector-java-5.1.48.jar";
+    url = "mirror://maven/mysql/mysql-connector-java/5.1.48/mysql-connector-java-5.1.48.jar";
    hash = "sha256-VuJsqqOCH1rkr0T5x09mz4uE6gFRatOAPLsOkEm27Kg=";
  };

--- a/pkgs/by-name/fr/freeplane/package.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@ -40,6 +40,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  gradleFlags = [ "-Dorg.gradle.java.home=${jdk}" "-x" "test" ];

+  # share/freeplane/core/org.freeplane.core/META-INF doesn't
+  # always get generated with parallel building enabled
+  enableParallelBuilding = false;
+
  preBuild = "mkdir -p freeplane/build";

  gradleBuildTask = "build";
--- a/pkgs/by-name/ft/ftjam/package.nix
+++ b/pkgs/by-name/ft/ftjam/package.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "2.5.2";

  src = fetchurl {
-    url = "https://downloads.sourceforge.net/project/freetype/ftjam/${finalAttrs.version}/ftjam-${finalAttrs.version}.tar.bz2";
+    url = "mirror://sourceforge/project/freetype/ftjam/${finalAttrs.version}/ftjam-${finalAttrs.version}.tar.bz2";
    hash = "sha256-6JdzUAqSkS3pGOn+v/q+S2vOedaa8ZRDX04DK4ptZqM=";
  };

--- a/pkgs/by-name/im/immersed-vr/darwin.nix
+++ b/pkgs/by-name/im/immersed-vr/darwin.nix
--- a/pkgs/by-name/im/immersed-vr/linux.nix
+++ b/pkgs/by-name/im/immersed-vr/linux.nix
--- a/pkgs/by-name/im/immersed-vr/package.nix
+++ b/pkgs/by-name/im/immersed-vr/package.nix
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, buildGoModule
+, buildGo123Module
 , fetchFromGitHub
 , kclvm_cli
 , kclvm
@ -9,18 +9,18 @@
 , darwin
 ,
 }:
-buildGoModule rec {
+buildGo123Module rec {
  pname = "kcl";
-  version = "0.9.8";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-s8pFnItmw3+l9GKqdqX0Rxsy47h6vO+yUtVNCuyn/m8=";
+    hash = "sha256-0KxT4t77EDB7Vr/cb+P20ARRR+7g5uZiF5QYOArUhgI=";
  };

-  vendorHash = "sha256-DGYYH5sKhpcWHYoUim4NyflzqsXFc4MCOqIw5jIfIiM=";
+  vendorHash = "sha256-9APQDYCBvG38y0ZYuacfyUmjoEV9jGqRg7OZ7mArzIU=";

  # By default, libs and bins are stripped. KCL will crash on darwin if they are.
  dontStrip = stdenv.hostPlatform.isDarwin;
--- a/pkgs/by-name/kc/kclvm/Cargo.lock
+++ b/pkgs/by-name/kc/kclvm/Cargo.lock
--- a/pkgs/by-name/kc/kclvm/package.nix
+++ b/pkgs/by-name/kc/kclvm/package.nix
@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "kclvm";
-  version = "0.9.3";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "kcl";
    rev = "v${version}";
-    hash = "sha256-nk5oJRTBRj0LE2URJqno8AoZ+/342C2tEt8d6k2MAc8=";
+    hash = "sha256-OMPo2cT0ngwHuGghVSfGoDgf+FThj2GsZ3Myb1wSxQM=";
  };

  sourceRoot = "${src.name}/kclvm";
@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
    lockFile = ./Cargo.lock;
    outputHashes = {
      "inkwell-0.2.0" = "sha256-JxSlhShb3JPhsXK8nGFi2uGPp8XqZUSiqniLBrhr+sM=";
-      "protoc-bin-vendored-3.1.0" = "sha256-RRqpPMJygpKGG5NYzD93iy4htpVqFhYMmfPgbRtpUqg=";
+      "protoc-bin-vendored-3.2.0" = "sha256-cYLAjjuYWat+8RS3vtNVS/NAJYw2NGeMADzGBL1L2Ww=";
    };
  };

--- a/pkgs/by-name/kc/kclvm_cli/cargo_lock.patch
+++ b/pkgs/by-name/kc/kclvm_cli/cargo_lock.patch
@ -7,4 +7,4 @@
 +
 +[[package]]
 +name = "kclvm_cli"
-+version = "0.9.3"
+version = "0.10.0"
--- a/pkgs/by-name/kc/kclvm_cli/package.nix
+++ b/pkgs/by-name/kc/kclvm_cli/package.nix
@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
  };

  sourceRoot = "${src.name}/cli";
-  cargoHash = "sha256-hILG2YcwsAzzJPJno+2KzAHM226HYmQPQt9JVVYn9Jk=";
+  cargoHash = "sha256-2694O2q6UbNySgn76aBTjdqt2Hh1GrdRaro064fGBrI=";
  cargoPatches = [ ./cargo_lock.patch ];

  buildInputs = [ kclvm rustc ] ++ (
--- a/pkgs/by-name/no/node-red/package-lock.json
+++ b/pkgs/by-name/no/node-red/package-lock.json
--- a/pkgs/by-name/no/node-red/package.nix
+++ b/pkgs/by-name/no/node-red/package.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "node-red";
-  version = "4.0.3";
+  version = "4.0.4";

  src = fetchFromGitHub {
    owner = "node-red";
    repo = "node-red";
    rev = "refs/tags/${version}";
-    hash = "sha256-AiLGqpEUqvWpI+7cL7ZygT2mSCVt7zCUwEJXvRaiGT8=";
+    hash = "sha256-s+3OrTj/VwjnK6Ml+4aSlLo/GcpC6BWmGmxAaj1SsMI=";
  };

-  npmDepsHash = "sha256-ipUhco5Z+x2FYqLPdgMYJk4eXrIqn1BHidaYXXgujis=";
+  npmDepsHash = "sha256-y3agiGh5qApyjFUkxjgEG+Ztx1FL4IOMaJsS4WwZY/c=";

  postPatch =
    let
--- a/pkgs/by-name/nu/numbat/package.nix
+++ b/pkgs/by-name/nu/numbat/package.nix
@ -2,23 +2,33 @@
 , stdenv
 , testers
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , darwin
 , numbat
+, tzdata
 }:

 rustPlatform.buildRustPackage rec {
  pname = "numbat";
-  version = "1.12.0";
+  version = "1.13.0";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = "numbat";
    rev = "v${version}";
-    hash = "sha256-MYoNziQiyppftLPNM8cqEuNwUA4KCmtotQqDhgyef1E=";
+    hash = "sha256-o3EYhMFBgs/Ni+YCM3+RdUYlwRt+nMaEP/cAkDXMVHc=";
  };

-  cargoHash = "sha256-t6vxJ0UIQJILCGv4PO5V4/QF5de/wtMQDkb8gPtE70E=";
+  cargoHash = "sha256-rK9RPd/hww2F87l/dd14pB4izE58NuqaewYaqMimV1M=";
+
+  patches = [
+    # https://github.com/sharkdp/numbat/pull/562
+    (fetchpatch {
+      url = "https://github.com/sharkdp/numbat/commit/4756a1989ecdab35fd05ca18c721ed15d8cde2b1.patch";
+      hash = "sha256-22+yePjy+MxJQ60EdvgaTw/IVV0d/wS2Iqza1p1xmfk=";
+    })
+  ];

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.Security
@ -31,6 +41,13 @@ rustPlatform.buildRustPackage rec {
    cp -r $src/numbat/modules $out/share/numbat/
  '';

+  preCheck = ''
+    # The datetime library used by Numbat, "jiff", always attempts to use the
+    # system TZDIR on Unix and doesn't fall back to the embedded tzdb when not
+    # present.
+    export TZDIR=${tzdata}/share/zoneinfo
+  '';
+
  passthru.tests.version = testers.testVersion {
    package = numbat;
  };
@ -46,5 +63,7 @@ rustPlatform.buildRustPackage rec {
    license = with licenses; [ asl20 mit ];
    mainProgram = "numbat";
    maintainers = with maintainers; [ giomf atemu ];
+    # Failing tests on Darwin.
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/by-name/op/openctm/package.nix
+++ b/pkgs/by-name/op/openctm/package.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.0.3";

  src = fetchurl {
-    url = "https://downloads.sourceforge.net/project/openctm/OpenCTM-${finalAttrs.version}/OpenCTM-${finalAttrs.version}-src.tar.bz2";
+    url = "mirror://sourceforge/project/openctm/OpenCTM-${finalAttrs.version}/OpenCTM-${finalAttrs.version}-src.tar.bz2";
    hash = "sha256-So0mCNlzZPfuxWt8Y3xWuTCK6YKGs+kNu3QTyQ6UPx0=";
  };

--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@ -25,7 +25,7 @@ let
      };
      x86_64-linux = fetchurl {
        url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-G7+Mr0Zd/p8XUVU5aG7KywvLD2hz2N37kEbm5rlghEw=";
+        hash = "sha256-PAbLw/IVJHe/y7YSyrTK9wJVcN3VIZYhrgDoHzYtjS8=";
      };
    }
    .${stdenv.system} or (throw "osu-lazer-bin: ${stdenv.system} is unsupported.");
--- a/pkgs/development/compilers/scala/bare.nix
+++ b/pkgs/development/compilers/scala/bare.nix
@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://scala-lang.org/";
    license = licenses.asl20;
    platforms = platforms.all;
+    mainProgram = "scala";
    maintainers = with maintainers; [
      karolchmist
      virusdave
--- a/pkgs/development/libraries/hunspell/dictionaries.nix
+++ b/pkgs/development/libraries/hunspell/dictionaries.nix
@ -980,7 +980,7 @@ rec {
    readmeFile = "README";

    src = fetchurl {
-      url = "https://downloads.sourceforge.net/rospell/${fileName}";
+      url = "mirror://sourceforge/rospell/${fileName}";
      hash = "sha256-fxKNZOoGyeZxHDCxGMCv7vsBTY8zyS2szfRVq6LQRRk=";
    };

--- a/pkgs/development/libraries/java/lucene/default.nix
+++ b/pkgs/development/libraries/java/lucene/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "1.4.3";

  src = fetchurl {
-    url = "https://archive.apache.org/dist/jakarta/lucene/lucene-${version}.tar.gz";
+    url = "mirror://apache/jakarta/lucene/lucene-${version}.tar.gz";
    sha256 = "1mxaxg65f7v8n60irjwm24v7hcisbl0srmpvcy1l4scs6rjj1awh";
  };

--- a/pkgs/development/libraries/libkrunfw/default.nix
+++ b/pkgs/development/libraries/libkrunfw/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  kernelSrc = fetchurl {
-    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.52.tar.xz";
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.6.52.tar.xz";
    hash = "sha256-FZGrNIOZ1KpTEhFYUlBWppyM8P4OkJNbAJXppY43tLg=";
  };

--- a/pkgs/development/libraries/libmysqlconnectorcpp/default.nix
+++ b/pkgs/development/libraries/libmysqlconnectorcpp/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
  version = "9.0.0";

  src = fetchurl {
-    url = "https://cdn.mysql.com/Downloads/Connector-C++/mysql-connector-c++-${version}-src.tar.gz";
+    url = "mirror://mysql/Connector-C++/mysql-connector-c++-${version}-src.tar.gz";
    hash = "sha256-7XEbT3sf/fyadgSOGVr/KH4tFd3evgvKhRsJ4UFCKzA=";
  };

--- a/pkgs/development/libraries/psqlodbc/default.nix
+++ b/pkgs/development/libraries/psqlodbc/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
  version = "16.00.0000";

  src = fetchurl {
-    url = "https://ftp.postgresql.org/pub/odbc/versions.old/src/${pname}-${version}.tar.gz";
+    url = "mirror://postgresql/odbc/versions.old/src/${pname}-${version}.tar.gz";
    hash = "sha256-r9iS+J0uzujT87IxTxvVvy0CIBhyxuNDHlwxCW7KTIs=";
  };

--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -246,7 +246,7 @@ in
    if luaAtLeast "5.1" && luaOlder "5.2" then {
      version = "20120430.51-1";
      knownRockspec = (fetchurl {
-        url = "https://luarocks.org/lmathx-20120430.51-1.rockspec";
+        url = "mirror://luarocks/lmathx-20120430.51-1.rockspec";
        sha256 = "148vbv2g3z5si2db7rqg5bdily7m4sjyh9w6r3jnx3csvfaxyhp0";
      }).outPath;
      src = fetchurl {
@ -257,7 +257,7 @@ in
      if luaAtLeast "5.2" && luaOlder "5.3" then {
        version = "20120430.52-1";
        knownRockspec = (fetchurl {
-          url = "https://luarocks.org/lmathx-20120430.52-1.rockspec";
+          url = "mirror://luarocks/lmathx-20120430.52-1.rockspec";
          sha256 = "14rd625sipakm72wg6xqsbbglaxyjba9nsajsfyvhg0sz8qjgdya";
        }).outPath;
        src = fetchurl {
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-redis/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-redis/default.nix
@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  opentelemetry-api,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  wrapt,
+  redis,
+  opentelemetry-test-utils,
+  pythonOlder,
+  pytestCheckHook,
+  fakeredis,
+}:
+
+buildPythonPackage rec {
+  inherit (opentelemetry-instrumentation) version src;
+  pname = "opentelemetry-instrumentation-redis";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  sourceRoot = "${opentelemetry-instrumentation.src.name}/instrumentation/opentelemetry-instrumentation-redis";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+    wrapt
+  ];
+
+  nativeCheckInputs = [
+    fakeredis
+    opentelemetry-test-utils
+    pytestCheckHook
+  ];
+
+  optional-dependencies = {
+    instruments = [ redis ];
+  };
+
+  pythonImportsCheck = [ "opentelemetry.instrumentation.redis" ];
+
+  meta = opentelemetry-instrumentation.meta // {
+    homepage = "https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/instrumentation/opentelemetry-instrumentation-redis";
+    description = "Redis instrumentation for OpenTelemetry";
+  };
+}
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  version = "14.0.1";

  src = fetchurl {
-    url = "https://download.qt.io/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
+    url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
    hash = "sha256-lZXS5sZbuRjng3YxQ0HcK+9JHDIApcbVzm8wVQmwsos=";
  };

--- a/pkgs/games/hex-a-hop/default.nix
+++ b/pkgs/games/hex-a-hop/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "1.1.0";

  src = fetchzip {
-    url = "https://downloads.sourceforge.net/project/hexahop/${version}/hex-a-hop-${version}.tar.gz";
+    url = "mirror://sourceforge/project/hexahop/${version}/hex-a-hop-${version}.tar.gz";
    sha256 = "sha256-fBSvNtgNR0aNofbvoYpM1e8ww4ARlXIvrQUvJqVGLlY=";
  };

--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@ -238,7 +238,7 @@ in rec {
      description = "Fuzzy find your text with fzf instead of selecting it by hand ";
      license = lib.licenses.mit;
      platforms = lib.platforms.unix;
-      maintainers = with lib.maintainers; [ kidd ];
+      maintainers = with lib.maintainers; [ kidd fnune ];
    };
  };

--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@ -154,7 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-user=frr"
    "--enable-vty-group=frrvty"
    "--localstatedir=/run/frr"
-    "--sbindir=$(out)/libexec/frr"
+    "--sbindir=${placeholder "out"}/libexec/frr"
    "--sysconfdir=/etc/frr"
    "--with-clippy=${finalAttrs.clippy-helper}/bin/clippy"
    # general options
@ -198,7 +198,8 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteInPlace tools/frr-reload \
-      --replace /usr/lib/frr/ $out/libexec/frr/
+      --replace-quiet /usr/lib/frr/ $out/libexec/frr/
+    sed -i '/^PATH=/ d' tools/frr.in tools/frrcommon.sh.in
  '';

  doCheck = true;
--- a/pkgs/servers/guacamole-client/default.nix
+++ b/pkgs/servers/guacamole-client/default.nix
@ -8,7 +8,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  version = "1.5.5";

  src = fetchurl {
-    url = "https://archive.apache.org/dist/guacamole/${finalAttrs.version}/binary/guacamole-${finalAttrs.version}.war";
+    url = "mirror://apache/guacamole/${finalAttrs.version}/binary/guacamole-${finalAttrs.version}.war";
    hash = "sha256-QmcwfzYAZjcj8kr5LVlumcg1lCUxUTUFKkLUUflSkgA=";
  };

--- a/pkgs/servers/http/apt-cacher-ng/default.nix
+++ b/pkgs/servers/http/apt-cacher-ng/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  version = "3.7.4";

  src = fetchurl {
-    url = "https://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
+    url = "mirror://debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
    sha256 = "0pwsj9rf6a6q7cnfbpcrfq2gjcy7sylqzqqr49g2zi39lrrh8533";
  };

--- a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix
@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin rec {
+  pname = "marcusolsson-dynamictext-panel";
+  version = "5.4.0";
+  zipHash = "sha256-IgPON60oRqO52W64UvHuwYoa6UG2NfDWIA4S2HfkGQs=";
+  meta = with lib; {
+    description = "Dynamic, data-driven text panel for Grafana";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ herbetom ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/monitoring/grafana/plugins/plugins.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
@ -12,6 +12,7 @@
  grafana-piechart-panel = callPackage ./grafana-piechart-panel { };
  grafana-polystat-panel = callPackage ./grafana-polystat-panel { };
  grafana-worldmap-panel = callPackage ./grafana-worldmap-panel { };
+  marcusolsson-dynamictext-panel = callPackage ./marcusolsson-dynamictext-panel { };
  redis-app = callPackage ./redis-app { };
  redis-datasource = callPackage ./redis-datasource { };
  redis-explorer-app = callPackage ./redis-explorer-app { };
--- a/pkgs/servers/news/leafnode/1.nix
+++ b/pkgs/servers/news/leafnode/1.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.12.0";

  src = fetchurl {
-    url = "https://downloads.sourceforge.net/project/leafnode/leafnode/${finalAttrs.version}/leafnode-${finalAttrs.version}.tar.gz";
+    url = "mirror://sourceforge/project/leafnode/leafnode/${finalAttrs.version}/leafnode-${finalAttrs.version}.tar.gz";
    sha256 = "sha256-tGfOcyH2F6IeglfY00u199eKusnn6HeqD7or3Oz3ed4=";
  };

--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "lego";
-  version = "4.17.4";
+  version = "4.19.2";

  src = fetchFromGitHub {
    owner = "go-acme";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-DF9Bx6CzZLdnyqe8PNWU2I9ym2SBDAjdwG9/zxvSjgs=";
+    hash = "sha256-O4lzOZUiicmahxcbzPsEU2+tPDTCUun2JLeWZjpTZIQ=";
  };

-  vendorHash = "sha256-tX/QpAZLuQEYhm1I1twlg3TefaLqfiEz9cXID+r6EHA=";
+  vendorHash = "sha256-BcE/8pxQdJp9vttLo4wDSUswJnaBhIn/mlt3ZcOf2wA=";

  doCheck = false;

--- a/pkgs/tools/misc/opentsdb/default.nix
+++ b/pkgs/tools/misc/opentsdb/default.nix
@ -55,7 +55,7 @@ let
    ];
    hamcrest = [
      (fetchMavenArtifact {
-        url = "https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar";
+        url = "mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar";
        groupId = "org.hamcrest";
        artifactId = "hamcrest-core";
        version = "1.3";
--- a/pkgs/tools/networking/webalizer/default.nix
+++ b/pkgs/tools/networking/webalizer/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "2.23.08";

  src = fetchurl {
-    url = "https://ftp.debian.org/debian/pool/main/w/webalizer/webalizer_${version}.orig.tar.gz";
+    url = "mirror://debian/pool/main/w/webalizer/webalizer_${version}.orig.tar.gz";
    sha256 = "sha256-7a3bWqQcxKCBoVAOP6lmFdS0G8Eghrzt+ZOAGM557Y0=";
  };

--- a/pkgs/tools/package-management/nixpkgs-review/default.nix
+++ b/pkgs/tools/package-management/nixpkgs-review/default.nix
@ -18,14 +18,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "nixpkgs-review";
-  version = "2.11.0";
+  version = "2.12.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "nixpkgs-review";
    rev = "refs/tags/${version}";
-    hash = "sha256-QK9VTMh31aaY+DXHKVzSETMyzCD4jVw3d4ntBnmlkO8=";
+    hash = "sha256-yNdBqL3tceuoUHx8/j2y5ZTq1zeVDAm37RZtlCbC6rg=";
  };

  build-system = [
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -730,6 +730,7 @@ mapAliases {
  imagemagick7 = imagemagick; # Added 2021-02-22
  imagemagick7_light = imagemagick_light; # Added 2021-02-22
  imlib = throw "imlib has been dropped due to the lack of maintenance from upstream since 2004"; # Added 2023-01-04
+  immersed-vr = lib.warn "'immersed-vr' has been renamed to 'immersed'" immersed; # Added 2024-08-11
  indiepass-desktop = throw "indiepass-desktop has been dropped because it does not work with recent Electron versions"; # Added 2024-03-14
  indigenous-desktop = throw "'indigenous-desktop' has been renamed to/replaced by 'indiepass-desktop'"; # Added 2023-11-08
  input-utils = throw "The input-utils package was dropped since it was unmaintained."; # Added 2024-06-21
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -1165,7 +1165,7 @@ with self; {
    pname = "ArrayUtils";
    version = "0.5";
    src = fetchurl {
-      url = "https://cpan.metacpan.org/authors/id/Z/ZM/ZMIJ/Array/Array-Utils-0.5.tar.gz";
+      url = "mirror://cpan/authors/id/Z/ZM/ZMIJ/Array/Array-Utils-0.5.tar.gz";
      hash = "sha256-id0bf82bQ3lJKjp3SW45/mzTebdz/QOmsWDdJu3mN3A=";
    };
    meta = {
@ -18973,7 +18973,7 @@ with self; {
    version = "0.07";
    buildInputs = [ ModuleBuildTiny ];
    src = fetchurl {
-      url = "https://cpan.metacpan.org/authors/id/A/AB/ABERNDT/Net-MPD-0.07.tar.gz";
+      url = "mirror://cpan/authors/id/A/AB/ABERNDT/Net-MPD-0.07.tar.gz";
      hash = "sha256-M4L7nG9cJd4mKPVhRCn6igB5FSFnjELaBoyZ57KU6VM=";
    };
    meta = {
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -9403,6 +9403,8 @@ self: super: with self; {

  opentelemetry-instrumentation-requests = callPackage ../development/python-modules/opentelemetry-instrumentation-requests { };

+  opentelemetry-instrumentation-redis = callPackage ../development/python-modules/opentelemetry-instrumentation-redis { };
+
  opentelemetry-instrumentation-wsgi = callPackage ../development/python-modules/opentelemetry-instrumentation-wsgi { };

  opentelemetry-proto = callPackage ../development/python-modules/opentelemetry-proto { };