Merge staging-next into staging

nixos/doc/manual/installation/installing.chapter.md

@@ -272,6 +272,9 @@ update /etc/fstab.
     # parted /dev/sda -- mkpart ESP fat32 1MB 512MB
     # parted /dev/sda -- set 3 esp on
     ```
+    ::: {.note}
+    In case you decided to not create a swap partition, replace `3` by `2`. To be sure of the id number of ESP, run `parted --list`.
+    :::
 
 Once complete, you can follow with
 [](#sec-installation-manual-partitioning-formatting).

nixos/modules/services/networking/nebula.nix

@@ -10,6 +10,15 @@ let
   format = pkgs.formats.yaml {};
 
   nameToId = netName: "nebula-${netName}";
+
+  resolveFinalPort = netCfg:
+    if netCfg.listen.port == null then
+      if (netCfg.isLighthouse || netCfg.isRelay) then
+        4242
+      else
+        0
+    else
+      netCfg.listen.port;
 in
 {
   # Interface
@@ -95,8 +104,15 @@ in
             };
 
             listen.port = mkOption {
-              type = types.port;
-              default = 4242;
+              type = types.nullOr types.port;
+              default = null;
+              defaultText = lib.literalExpression ''
+                if (config.services.nebula.networks.''${name}.isLighthouse ||
+                    config.services.nebula.networks.''${name}.isRelay) then
+                  4242
+                else
+                  0;
+              '';
               description = lib.mdDoc "Port number to listen on.";
             };
 
@@ -174,7 +190,7 @@ in
           };
           listen = {
             host = netCfg.listen.host;
-            port = netCfg.listen.port;
+            port = resolveFinalPort netCfg;
           };
           tun = {
             disabled = netCfg.tun.disable;
@@ -185,7 +201,15 @@ in
             outbound = netCfg.firewall.outbound;
           };
         } netCfg.settings;
-        configFile = format.generate "nebula-config-${netName}.yml" settings;
+        configFile = format.generate "nebula-config-${netName}.yml" (
+          warnIf
+            ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0)
+            ''
+              Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}.
+              You will likely experience connectivity issues: https://nebula.defined.net/docs/config/listen/#listenport
+            ''
+            settings
+          );
         in
         {
           # Create the systemd service for Nebula.
@@ -229,7 +253,7 @@ in
 
     # Open the chosen ports for UDP.
     networking.firewall.allowedUDPPorts =
-      unique (mapAttrsToList (netName: netCfg: netCfg.listen.port) enabledNetworks);
+      unique (filter (port: port > 0) (mapAttrsToList (netName: netCfg: resolveFinalPort netCfg) enabledNetworks));
 
     # Create the service users and groups.
     users.users = mkMerge (mapAttrsToList (netName: netCfg:

nixos/modules/system/boot/systemd.nix

@@ -97,7 +97,7 @@ let
 
       # Maintaining state across reboots.
       "systemd-random-seed.service"
-      "systemd-boot-random-seed.service"
+      ] ++ (optional cfg.package.withBootloader "systemd-boot-random-seed.service") ++ [
       "systemd-backlight@.service"
       "systemd-rfkill.service"
       "systemd-rfkill.socket"

nixos/tests/nebula.nix

@@ -10,6 +10,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
       environment.systemPackages = [ pkgs.nebula ];
       users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
       services.openssh.enable = true;
+      networking.firewall.enable = true; # Implicitly true, but let's make sure.
       networking.interfaces.eth1.useDHCP = false;
 
       services.nebula.networks.smoke = {
@@ -17,7 +18,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
         ca = "/etc/nebula/ca.crt";
         cert = "/etc/nebula/${name}.crt";
         key = "/etc/nebula/${name}.key";
-        listen = { host = "0.0.0.0"; port = 4242; };
+        listen = {
+          host = "0.0.0.0";
+          port = if (config.services.nebula.networks.smoke.isLighthouse || config.services.nebula.networks.smoke.isRelay) then 4242 else 0;
+        };
       };
     }
     extraConfig

nixos/tests/privoxy.nix

@@ -77,6 +77,11 @@ in
     networking.proxy.httpsProxy = "http://localhost:8118";
   };
 
+  nodes.machine_socks4  = { ... }: { services.privoxy = { enable = true; settings.forward-socks4  = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks4a = { ... }: { services.privoxy = { enable = true; settings.forward-socks4a = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks5  = { ... }: { services.privoxy = { enable = true; settings.forward-socks5  = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks5t = { ... }: { services.privoxy = { enable = true; settings.forward-socks5t = "/ 127.0.0.1:9050 ."; }; };
+
   testScript =
     ''
       with subtest("Privoxy is running"):
@@ -109,5 +114,13 @@ in
           machine.systemctl("start systemd-tmpfiles-clean")
           # ...and count again
           machine.succeed("test $(ls /run/privoxy/certs | wc -l) -eq 0")
+
+      with subtest("Privoxy supports socks upstream proxies"):
+          for m in [machine_socks4, machine_socks4a, machine_socks5, machine_socks5t]:
+              m.wait_for_unit("privoxy")
+              m.wait_for_open_port(8118)
+              # We expect a 503 error because the dummy upstream proxy is not reachable.
+              # In issue #265654, instead privoxy segfaulted causing curl to exit with "Empty reply from server".
+              m.succeed("http_proxy=http://localhost:8118 curl -v http://does-not-exist/ 2>&1 | grep 'HTTP/1.1 503'")
     '';
 })

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.5";
+  version = "1.16.6";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-pxF5X3fCBeWFLQj8S0xYDcQNRs375RJIrl62nGjZZr0=";
+    hash = "sha256-vn04bNkg0De46kLcyuaWt9watBXFIGI+4X8SBW3XNyg=";
   };
 
-  vendorHash = "sha256-kbbgEnpqev7b4Sycmhs8xbu+yO4oMELh9xDmw7YyWYU=";
+  vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";
 
   subPackages = [ "projects/gloo/cli/cmd" ];
 

pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix

@@ -36,16 +36,16 @@ let
 in
 buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.44.0";
+  version = "1.44.1";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-EHMKk5V77b+wTf72K9FUclrUzmAm51l4uv3vhOrCloA=";
+    hash = "sha256-fL+9oPQ5dAgvQREZ7A+hKo2MnZKeVvadQDvDPsDNbnQ=";
   };
 
-  npmDepsHash = "sha256-nuhOrgHXKK01EirWYmGF17V+aYhZipwmhnAuNqwSQ/c=";
+  npmDepsHash = "sha256-rUxJLDsAfp+brecTThYTdHIVIfVkKwZ/W5sHV0hHHIk=";
 
   postPatch = ''
     test \

pkgs/applications/networking/wgcf/default.nix

@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "wgcf";
-  version = "2.2.21";
+  version = "2.2.22";
 
   src = fetchFromGitHub {
     owner = "ViRb3";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FzzPDTRmDCBS7EZOgj4ckytbtlRPqPdHpyn3nF0yHdc=";
+    hash = "sha256-NzXIzOMc6rVX65FJe/S8rkYJbWNPWRz+mH7vP7Ch9Kw=";
   };
 
   subPackages = ".";
 
-  vendorHash = "sha256-cGtm+rUgYppwwL/BizWikPUyFExHzLucL2o2g9PgGNw=";
+  vendorHash = "sha256-GinKmXHXWEGmCz83AU3z5JBmPnWJ9Q2EqEPgaTUiDgs=";
 
   meta = with lib; {
     description = "Cross-platform, unofficial CLI for Cloudflare Warp";

pkgs/by-name/me/mev-boost/package.nix

@@ -6,12 +6,12 @@
 
 buildGoModule rec {
   pname = "mev-boost";
-  version = "1.7";
+  version = "1.7.1";
   src = fetchFromGitHub {
       owner = "flashbots";
       repo = "mev-boost";
       rev = "v${version}";
-      hash = "sha256-Z5B+PRYb6eWssgyaXpXoHOVRoMZoSAwun7s6Fh1DrfM=";
+      hash = "sha256-4Vxs1Jo7rkw9l0pXfi+J7YmzQawt7tc19I1MdHQgjBA=";
   };
 
   vendorHash = "sha256-yfWDGVfgCfsmzI5oxEmhHXKCUAHe6wWTkaMkBN5kQMw=";

pkgs/by-name/mo/movim/package.nix

@@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , php
+, phpCfg ? null
 , withPgsql ? true # “strongly recommended” according to docs
 , withMysql ? false
 }:
@@ -16,14 +17,16 @@ php.buildComposerProject (finalAttrs: {
     hash = "sha256-9MBe2IRYxvUuCc5m7ajvIlBU7YVm4A3RABlOOIjpKoM=";
   };
 
-  php = php.buildEnv {
+  php = php.buildEnv ({
     extensions = ({ all, enabled }:
       enabled
-      ++ (with all; [ curl dom gd imagick mbstring ])
-      ++ lib.optional withPgsql all.pgsql
-      ++ lib.optional withMysql all.mysqli
+        ++ (with all; [ curl dom gd imagick mbstring pdo simplexml ])
+        ++ lib.optionals withPgsql (with all; [ pdo_pgsql pgsql ])
+        ++ lib.optionals withMysql (with all; [ mysqli mysqlnd pdo_mysql ])
     );
-  };
+  } // lib.optionalAttrs (phpCfg != null) {
+    extraConfig = phpCfg;
+  });
 
   # no listed license
   # pinned commonmark

pkgs/development/compilers/odin/default.nix

@@ -12,13 +12,13 @@ let
   inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
   pname = "odin";
-  version = "dev-2024-02";
+  version = "dev-2024-03";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
     rev = version;
-    hash = "sha256-v9A0+kgREXALhnvFYWtE0+H4L7CYnyje+d2W5+/ZvHA=";
+    hash = "sha256-oK5OcWAZy9NVH19oep6QU4d5qaiO0p+d9FvxDIrzFLU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libdeltachat/Cargo.lock

@@ -627,9 +627,12 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.89"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0ba8f7aaa012f30d5b2861462f6708eccd49c3c39863fe083a308035f63d723"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfb-mode"
@@ -1085,7 +1088,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat"
-version = "1.136.1"
+version = "1.136.3"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1166,7 +1169,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-jsonrpc"
-version = "1.136.1"
+version = "1.136.3"
 dependencies = [
  "anyhow",
  "async-channel 2.2.0",
@@ -1190,7 +1193,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-repl"
-version = "1.136.1"
+version = "1.136.3"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1205,7 +1208,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-rpc-server"
-version = "1.136.1"
+version = "1.136.3"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1234,7 +1237,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat_ffi"
-version = "1.136.1"
+version = "1.136.3"
 dependencies = [
  "anyhow",
  "deltachat",

pkgs/development/libraries/libdeltachat/default.nix

@@ -30,13 +30,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.136.1";
+  version = "1.136.3";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = "v${version}";
-    hash = "sha256-+mwOTm9SWgZjGI0TFHMmLgQJQSXyYMqteqQiubGhFkU=";
+    hash = "sha256-/ZWpPpxnOCLGswrfbEPvfUn1LpdBQeR5LecRAB0PEhI=";
   };
 
   patches = [

pkgs/development/libraries/rapidfuzz-cpp/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "rapidfuzz";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-v/apbqRyv93PZsO397lvyIMtA1JtYrOpbWAVAbMCmP4=";
+    hash = "sha256-4J2j+/0ZVMNlrgLbEQk3me/EX07TZ/rLsT1/5ufxbic=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/s2geometry/default.nix

@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ openssl gtest ];
 
+  # Default of C++11 is too low for gtest.
+  # In newer versions of s2geometry this can be done with cmakeFlags.
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace "CMAKE_CXX_STANDARD 11" "CMAKE_CXX_STANDARD 14"
+  '';
+
   meta = with lib; {
     description = "Computational geometry and spatial indexing on the sphere";
     homepage = "http://s2geometry.io/";

pkgs/development/python-modules/ipykernel/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "ipykernel";
-  version = "6.29.2";
+  version = "6.29.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O63igATj/2JO1Xl0lIEWZwYErF9nbRIzlpPzFCF20/A=";
+    hash = "sha256-4UwlDR+eo5iUkCJcwaVCeBsJWhihlEf88rXq99CsW9I=";
   };
 
   # debugpy is optional, see https://github.com/ipython/ipykernel/pull/767

pkgs/development/python-modules/ipyvuetify/default.nix

@@ -2,20 +2,44 @@
 , buildPythonPackage
 , fetchPypi
   # Python Inputs
+, jupyter-packaging
+, jupyterlab
+, setuptools
+, wheel
 , ipyvue
 }:
 
 buildPythonPackage rec {
   pname = "ipyvuetify";
-  version = "1.8.10";
-  format = "setuptools";
+  version = "1.9.0";
+  pyproject = true;
 
   # GitHub version tries to run npm (Node JS)
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-m6RCeUefM/XLg69AaqgTBQ7pYgGVXCy6CH/SOoQ9W04=";
+    hash = "sha256-nFN+IYKZ3jIZSx2pSda5a//mwA82u2A1QJ8khf64gec=";
   };
 
+  # drop pynpm which tries to install node_modules
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "jupyter_packaging~=0.7.9" "jupyter_packaging" \
+      --replace-fail "jupyterlab~=3.0" "jupyterlab" \
+      --replace-fail '"pynpm"' ""
+
+    substituteInPlace setup.py \
+      --replace-fail "from pynpm import NPMPackage" "" \
+      --replace-fail "from generate_source import generate_source" "" \
+      --replace-fail 'setup(cmdclass={"egg_info": js_prerelease(egg_info)})' 'setup()'
+  '';
+
+  nativeBuildInputs = [
+    jupyter-packaging
+    jupyterlab
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = [ ipyvue ];
 
   doCheck = false;  # no tests on PyPi/GitHub

pkgs/development/python-modules/jupyter-lsp/default.nix

@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "jupyter-lsp";
-  version = "2.2.2";
+  version = "2.2.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JW0kYgVCrku6BKUPwfb/4ggJOgfY5pf+oKjRuMobfls=";
+    hash = "sha256-M9vLxd8kI3/1yLaWsE/0aJ/NMWy41JV9Yg/lUE19LD8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/jupyterlab-server/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab-server";
-  version = "2.25.2";
+  version = "2.25.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "jupyterlab_server";
     inherit version;
-    hash = "sha256-vQ7HqZ687ci8/5Oe+G5Sw3jkTCcH4FP82B0EbOl57mM=";
+    hash = "sha256-hG8SWooZZWYR31sD5ZEsg5POppAIWbqmT6UV62So3EA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/nbconvert/default.nix

@@ -33,14 +33,14 @@ let
   };
 in buildPythonPackage rec {
   pname = "nbconvert";
-  version = "7.16.0";
+  version = "7.16.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gT5lU3ljYkia5XLjm6G/+XhTYZL7UY4QgmsOjK3wPsg=";
+    hash = "sha256-555qB09Juj7SlCjthkh79RUJ2aq2E72FIqwI9tKP1/0=";
   };
 
   # Add $out/share/jupyter to the list of paths that are used to search for

pkgs/development/python-modules/notebook-shim/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "notebook-shim";
-  version = "0.2.3";
+  version = "0.2.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jupyter";
     repo = "notebook_shim";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eAYZuNYqOMKC6joDbbKk4Q4nrfdbO7b+yZeSvMdWWrI=";
+    hash = "sha256-CWnXOKE1xvr+a/qWNY6XCTB5+G/fg2O/glgeLzYD+Zc=";
   };
 
   nativeBuildInputs = [ hatchling ];

pkgs/development/python-modules/pytest-jupyter/default.nix

@@ -22,14 +22,14 @@
 
 let self = buildPythonPackage rec {
   pname = "pytest-jupyter";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pytest-jupyter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ND51UpPsvZGH6LdEaNFXaBLoCMB4n7caPoo1/Go9fNs=";
+    hash = "sha256-8pQNtzMylW9b3vk0kp7NcJnXAJKYeoFsHy/lyQFCNzc=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/rapidfuzz/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.6.1";
+  version = "3.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,12 +27,12 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QJVRT+d/IIGxkWfSNoXFSmbW017+8CTKuWD4W+TzvBs=";
+    hash = "sha256-rezyw0v1VijMe78ip3U+Jd+NQExW+gQXjs8qkcPNcUk=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "Cython==3.0.3" "Cython"
+      --replace-fail "Cython >=3.0.9, <3.1.0" "Cython"
   '';
 
   nativeBuildInputs = [

pkgs/development/python-modules/safety-schemas/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, hatchling
+, pythonRelaxDepsHook
+, dparse
+, packaging
+, pydantic
+, ruamel-yaml
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "safety-schemas";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "safety_schemas";
+    inherit version;
+    hash = "sha256-fRsEDsBkgPBc/2tF6nqT4JyJQt+GT7DQHd62fDI8+ow=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "dparse"
+  ];
+
+  propagatedBuildInputs = [
+    dparse
+    packaging
+    pydantic
+    ruamel-yaml
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "safety_schemas" ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Schemas for Safety CLI";
+    homepage = "https://pypi.org/project/safety-schemas/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/safety/default.nix

@@ -5,33 +5,46 @@
 , pythonRelaxDepsHook
 , setuptools
 , click
+, urllib3
 , requests
 , packaging
 , dparse
 , ruamel-yaml
+, jinja2
+, marshmallow
+, authlib
+, jwt
+, rich
+, typer
+, pydantic
+, safety-schemas
+, typing-extensions
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "safety";
-  version = "2.3.5";
+  version = "3.0.1";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pgwR+JUvQSy7Fl1wyx9nOjtDorqak84R+X5qTeg0qjo=";
+    hash = "sha256-HyAA8DZS86C/xn+P0emLxXI8y3bhXLG91oVFw9gD3wE=";
   };
 
   postPatch = ''
     substituteInPlace safety/safety.py \
-      --replace "telemetry=True" "telemetry=False"
+      --replace-fail "telemetry=True" "telemetry=False"
     substituteInPlace safety/util.py \
-      --replace "telemetry=True" "telemetry=False"
+      --replace-fail "telemetry = True" "telemetry = False"
     substituteInPlace safety/cli.py \
-      --replace "telemetry', default=True" "telemetry', default=False"
+      --replace-fail "disable-optional-telemetry', default=False" \
+                     "disable-optional-telemetry', default=True"
+    substituteInPlace safety/scan/finder/handlers.py \
+      --replace-fail "telemetry=True" "telemetry=False"
   '';
 
   nativeBuildInputs = [
@@ -41,15 +54,28 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "packaging"
+    "dparse"
+    "authlib"
+    "pydantic"
   ];
 
   propagatedBuildInputs = [
     setuptools
     click
+    urllib3
     requests
     packaging
     dparse
     ruamel-yaml
+    jinja2
+    marshmallow
+    authlib
+    jwt
+    rich
+    typer
+    pydantic
+    safety-schemas
+    typing-extensions
   ];
 
   nativeCheckInputs = [
@@ -61,9 +87,8 @@ buildPythonPackage rec {
     "test_announcements_if_is_not_tty"
     "test_check_live"
     "test_check_live_cached"
-    "test_check_vulnerabilities"
-    "test_license"
-    "test_chained_review"
+    "test_get_packages_licenses_without_api_key"
+    "test_validate_with_policy_file_using_invalid_keyword"
   ];
 
   preCheck = ''

pkgs/development/python-modules/types-docutils/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.20.0.20240308";
+  version = "0.20.0.20240309";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-djDh9+aBlyJOaDSvrVEuhmGOB55zeAoVr4PZCjhO/JA=";
+    hash = "sha256-zVFHAoE7pBPJATT+2tlBayy46viAFot2mnB9b80VnwU=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ytmusicapi/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.5.4";
+  version = "1.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sigma67";
     repo = "ytmusicapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-Bg2Ikxkaq+dJkX842GCdIevgxULYSfE7s61YviqUln8=";
+    hash = "sha256-DqTcdWVivE2R51qm3XQ7cDnD1a90AocmX9TG+M5reto=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/algolia-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "algolia-cli";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "algolia";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-XcsVU/yV6c6jzuJdZvqs+kAu6XwR8ygVcJ6KEI04x9I=";
+    hash = "sha256-xRGWPJx4AVdUT9f7L2B5SHEOneuIlscFTHIk7XtPzS8=";
   };
 
   vendorHash = "sha256-cNuBTH7L2K4TgD0H9FZ9CjhE5AGXADaniGLD9Lhrtrk=";

pkgs/development/tools/profiling/pprof/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pprof";
-  version = "unstable-2023-07-05";
+  version = "unstable-2024-02-27";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "pprof";
-    rev = "200ffdc848b879f8aff937ffeba601c186916257";
-    hash = "sha256-/Y1Tj9z+2MNe+b2vzd4F+PwHGSbCYP7HpbaDUL9ZzKQ=";
+    rev = "401108e1b7e7e113ef887df16b6227698eb5bb0f";
+    hash = "sha256-TD285HHXkePQA2J9W/dEciK5tOLmvbDPr54KNXeE1b4=";
   };
 
-  vendorHash = "sha256-MuejFoK49VMmLt7xsiX/4Av7TijPwM9/mewXlfdufd8=";
+  vendorHash = "sha256-XOcOt+pe1lZj4XHafxROLslhyJk4mTC72yn7R1k2JCk=";
 
   meta = with lib; {
     description = "A tool for visualization and analysis of profiling data";

pkgs/development/tools/rust/cargo-binstall/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-DevAkIzgt39V5vp+a15TBCMeYbny/TkJzyub425N7/o=";
+    hash = "sha256-xG2eLKqGv+wqpSGBUMoYGSQ22lrMHDpQzrSyxyHMHoc=";
   };
 
-  cargoHash = "sha256-gcYCTKa+i2v/T1C0j89rJjD73tmiUow11E+59oiR7sk=";
+  cargoHash = "sha256-xNTSvJZWX19kmaFoLLHNKIrcsTFYWwN+7Ubym0hCwTA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/sentry-cli/default.nix

@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.29.1";
+  version = "2.30.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-hSAd+fGEVpCAyG2HzrF0W09yk6ghxX/lwdPQNuGsZW0=";
+    sha256 = "sha256-pICQBV8tIGeNoQF694uaVGx1eFN0iLACv1ztKXucKlM=";
   };
   doCheck = false;
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
-  cargoHash = "sha256-g+rGWS/wZncyq9zPOOI+Zq1WEsQarMK2TkccVohJTUs=";
+  cargoHash = "sha256-sYPmVum1xY4p7imR1iZdXugM5je4ncNoEf0Q8dvWM4c=";
 
   postInstall = ''
     installShellCompletion --cmd sentry-cli \

pkgs/os-specific/linux/systemd/default.nix

@@ -856,8 +856,8 @@ stdenv.mkDerivation (finalAttrs: {
     # needed - and therefore `interfaceVersion` should be incremented.
     interfaceVersion = 2;
 
-    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled
-      withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+    inherit withBootloader withCryptsetup withHostnamed withImportd withKmod
+      withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
 
     tests = {
       inherit (nixosTests)

pkgs/servers/monitoring/grafana-agent/default.nix

@@ -2,10 +2,11 @@
 , buildGoModule
 , fetchFromGitHub
 , fetchYarnDeps
-, prefetch-yarn-deps
 , grafana-agent
+, nix-update-script
 , nixosTests
 , nodejs
+, prefetch-yarn-deps
 , stdenv
 , systemd
 , testers
@@ -14,21 +15,21 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.39.2";
+  version = "0.40.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-KwXkCTKnoXHL2RFpJjjwtIolEpqCM6te5wMk9xQNOqE=";
+    hash = "sha256-muSgFBg+/XWx2f9EGYYLQ0wUzZ7AxEC2F19A5Qs5cgw=";
   };
 
-  vendorHash = "sha256-aSHO5SoMem14Fc6DirqtYBVWJQtf5mzCT3T33mMyhkc=";
+  vendorHash = "sha256-ekFl+aSmyUvgv4pkpS86HwPMfqtDaJEaZhWiwHjHp9g=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = src + "/web/ui/yarn.lock";
-    hash = "sha256-rT0UCInISo/p60xzQC7wAJFuKFByIzhNf0RxFFJx+3k=";
+    hash = "sha256-WqbIg18qUNcs9O2wh7DAzwXKb60iEuPL8zFCIgScqI0=";
   };
 
   ldflags = let
@@ -89,13 +90,18 @@ buildGoModule rec {
       $out/bin/grafana-agent
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) grafana-agent;
-    version = testers.testVersion {
-      inherit version;
-      command = "${lib.getExe grafana-agent} --version";
-      package = grafana-agent;
+  passthru = {
+    tests = {
+      inherit (nixosTests) grafana-agent;
+      version = testers.testVersion {
+        inherit version;
+        command = "${lib.getExe grafana-agent} --version";
+        package = grafana-agent;
+      };
     };
+    updateScript = nix-update-script { };
+    # alias for nix-update to be able to find and update this attribute
+    offlineCache = frontendYarnOfflineCache;
   };
 
   meta = {

pkgs/servers/monitoring/prometheus/smokeping-prober.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "0.7.1";
+  version = "0.7.2";
 
   ldflags = let
     setVars = rec {
@@ -20,9 +20,9 @@ buildGoModule rec {
     owner = "SuperQ";
     repo = "smokeping_prober";
     rev = "v${version}";
-    sha256 = "sha256-kpg4oUDv1C5NQuxfFNLmRIMkc8hbMkjiKL16HkYrUyU=";
+    sha256 = "sha256-Z+K3cRMD885V9aJwu3N/vP6aqtzD3LfMrxJ8DSCa5Xo=";
   };
-  vendorHash = "sha256-TgieqjE23gwyKLuKSqc5pkxRpou8lg+yVnVoINZDkGU=";
+  vendorHash = "sha256-39/0reEt4Rfe7DfysS4BROUgBUg+x95z6DU3IjC6m5U=";
 
   doCheck = true;
 

pkgs/shells/fish/plugins/default.nix

@@ -56,6 +56,8 @@ lib.makeScope newScope (self: with self; {
 
   tide = callPackage ./tide.nix { };
 
+  transient-fish = callPackage ./transient-fish.nix { };
+
   wakatime-fish = callPackage ./wakatime-fish.nix { };
 
   z = callPackage ./z.nix { };

pkgs/shells/fish/plugins/transient-fish.nix

@@ -0,0 +1,22 @@
+{ lib
+, buildFishPlugin
+, fetchFromGitHub
+}:
+buildFishPlugin {
+  pname = "transient-fish";
+  version = "0-unstable-2024-03-10";
+
+  src = fetchFromGitHub {
+    owner = "zzhaolei";
+    repo = "transient.fish";
+    rev = "be0093f1799462a93953e69896496dee4d063fd6";
+    hash = "sha256-rEkCimnkxcydKRI2y4DxEM7FD7F2/cGTZJN2Edq/Acc=";
+  };
+
+  meta = with lib; {
+    description = "Fish plugin to enable a transient prompt";
+    homepage = "https://github.com/zzhaolei/transient.fish";
+    license = licenses.mit;
+    maintainers = with maintainers; [ iynaix ];
+  };
+}

pkgs/tools/misc/mmctl/0001-module-replace-public.patch

@@ -1,8 +0,0 @@
---- a/go.mod
-+++ b/go.mod
-@@ -218,3 +218,5 @@ exclude (
- 	github.com/dyatlov/go-opengraph v0.0.0-20210112100619-dae8665a5b09
- 	github.com/willf/bitset v1.2.0
- )
-+
-+replace github.com/mattermost/mattermost/server/public => ./public

pkgs/tools/misc/mmctl/default.nix

@@ -1,43 +1,12 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
+{ mattermost
 }:
 
-buildGoModule rec {
+mattermost.overrideAttrs (o: {
   pname = "mmctl";
-  version = "9.2.2";
-
-  src = fetchFromGitHub {
-    owner = "mattermost";
-    repo = "mattermost";
-    rev = "v${version}";
-    hash = "sha256-53L2F20vaLLxtQS3DP/u0ZxLtnXHmjfcOMbXd4i+A6Y=";
-  } + "/server";
-
-  vendorHash = "sha256-v8aKZyb4emrwuIgSBDgla5wzwyt6PVGakbXjB9JVaCk=";
-
-  patches = [ ./0001-module-replace-public.patch ];
-
   subPackages = [ "cmd/mmctl" ];
 
-  checkPhase = "go test -tags unit -timeout 30m ./cmd/mmctl/...";
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/mattermost/mattermost/server/public/model.Version=${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildNumber=${version}-nixpkgs"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildDate=1970-01-01"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHash=v${version}"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildHashEnterprise=none"
-    "-X github.com/mattermost/mattermost/server/public/model.BuildEnterpriseReady=false"
-  ];
-
-  meta = with lib; {
+  meta = o.meta // {
     description = "A remote CLI tool for Mattermost";
-    homepage = "https://github.com/mattermost/mmctl";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ppom mgdelacroix ];
     mainProgram = "mmctl";
   };
-}
+})

pkgs/tools/package-management/poetry/plugins/poetry-audit-plugin.nix

@@ -10,17 +10,16 @@
 
 buildPythonPackage rec {
   pname = "poetry-audit-plugin";
-  version = "0.3.0";
+  version = "0.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "opeco17";
     repo = "poetry-audit-plugin";
     rev = "refs/tags/${version}";
-    hash = "sha256-49OnYz3EFiqOe+cLgfynjy14Ve4Ga6OUrLdM8HhZuKQ=";
+    hash = "sha256-kiNtzEup2ygCTk0zk8YV2jxAj6ZzOhP8v0U4FbV15hI=";
   };
 
   nativeBuildInputs = [

pkgs/tools/system/automatic-timezoned/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.4";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-znoQPpnBU3cLxNmnIKvqj/fIuZDGCdmICx2UL1tqAnc=";
+    sha256 = "sha256-uywQshOjdz8Vi/yN6X25LQYVLv/indzTHPmE56BqidI=";
   };
 
-  cargoHash = "sha256-1G81O+WKGVnRLGS6/6iiqsMiY5AaFrzEa9JD1MBDSGY=";
+  cargoHash = "sha256-8ZuJF3hdmOOP4s7FIIPc7xTUAPT5TahH/8Yn5hGEnX0=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";

pkgs/top-level/all-packages.nix

@@ -5971,11 +5971,7 @@ with pkgs;
 
   mlarchive2maildir = callPackage ../applications/networking/mailreaders/mlarchive2maildir { };
 
-  mmctl = callPackage ../tools/misc/mmctl {
-    # mmctl tests currently fail with go1.21. See
-    # https://mattermost.atlassian.net/browse/MM-55465
-    buildGoModule = buildGo120Module;
-  };
+  mmctl = callPackage ../tools/misc/mmctl { };
 
   moar = callPackage ../tools/misc/moar { };
 

pkgs/top-level/python-packages.nix

@@ -13166,6 +13166,8 @@ self: super: with self; {
 
   safety = callPackage ../development/python-modules/safety { };
 
+  safety-schemas = callPackage ../development/python-modules/safety-schemas { };
+
   sagemaker = callPackage ../development/python-modules/sagemaker { };
 
   salmon-mail = callPackage ../development/python-modules/salmon-mail { };