Merge master into staging-next

README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
+  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
@@ -74,7 +74,7 @@ Community contributions are always welcome through GitHub Issues and
 Pull Requests.
 
 For more information about contributing to the project, please visit
-the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+the [contributing page](CONTRIBUTING.md).
 
 # Donations
 

doc/doc-support/package.nix

@@ -5,6 +5,8 @@
   lib,
   stdenvNoCC,
   callPackage,
+  devmode,
+  mkShellNoCC,
   documentation-highlighter,
   nixos-render-docs,
   nixpkgs ? { },
@@ -95,10 +97,14 @@ stdenvNoCC.mkDerivation (
 
       pythonInterpreterTable = callPackage ./python-interpreter-table.nix { };
 
-      shell = callPackage ../../pkgs/tools/nix/web-devmode.nix {
-        buildArgs = "./.";
-        open = "/share/doc/nixpkgs/manual.html";
-      };
+      shell =
+        let
+          devmode' = devmode.override {
+            buildArgs = "./.";
+            open = "/share/doc/nixpkgs/manual.html";
+          };
+        in
+        mkShellNoCC { packages = [ devmode' ]; };
 
       tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
     };

nixos/doc/manual/shell.nix

@@ -6,8 +6,11 @@ let
 
   common = import ./common.nix;
   inherit (common) outputPath indexPath;
+  devmode = pkgs.devmode.override {
+    buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
+    open = "/${outputPath}/${indexPath}";
+  };
 in
-pkgs.callPackage ../../../pkgs/tools/nix/web-devmode.nix {
-  buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
-  open = "/${outputPath}/${indexPath}";
+pkgs.mkShellNoCC {
+  packages = [ devmode ];
 }

nixos/modules/services/development/athens.md

@@ -37,7 +37,7 @@ If you want to prevent Athens from writing to disk, you can instead configure it
 }
 ```
 
-To use the local proxy in Go builds, you can set the proxy as environment variable:
+To use the local proxy in Go builds (outside of `nix`), you can set the proxy as environment variable:
 
 ```nix
 {
@@ -47,6 +47,21 @@ To use the local proxy in Go builds, you can set the proxy as environment variab
 }
 ```
 
-It is currently not possible to use the local proxy for builds done by the Nix daemon. This might be enabled
-by experimental features, specifically [`configurable-impure-env`](https://nixos.org/manual/nix/unstable/contributing/experimental-features#xp-feature-configurable-impure-env),
-in upcoming Nix versions.
+To also use the local proxy for Go builds happening in `nix` (with `buildGoModule`), the nix daemon can be configured to pass the GOPROXY environment variable to the `goModules` fixed-output derivation.
+
+This can either be done via the nix-daemon systemd unit:
+
+```nix
+{
+  systemd.services.nix-daemon.environment.GOPROXY = "http://localhost:3000";
+}
+```
+
+or via the [impure-env experimental feature](https://nix.dev/manual/nix/2.24/command-ref/conf-file#conf-impure-env):
+
+```nix
+{
+  nix.settings.experimental-features = [ "configurable-impure-env" ];
+  nix.settings.impure-env = "GOPROXY=http://localhost:3000";
+}
+```

nixos/modules/system/boot/systemd/initrd.nix

@@ -482,6 +482,9 @@ in {
 
         # so NSS can look up usernames
         "${pkgs.glibc}/lib/libnss_files.so.2"
+
+        # Resolving sysroot symlinks without code exec
+        "${pkgs.chroot-realpath}/bin/chroot-realpath"
       ] ++ optionals cfg.package.withCryptsetup [
         # fido2 support
         "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
@@ -522,7 +525,7 @@ in {
 
         script = /* bash */ ''
           set -uo pipefail
-          export PATH="/bin:${cfg.package.util-linux}/bin"
+          export PATH="/bin:${cfg.package.util-linux}/bin:${pkgs.chroot-realpath}/bin"
 
           # Figure out what closure to boot
           closure=
@@ -543,7 +546,7 @@ in {
 
           # Resolve symlinks in the init parameter. We need this for some boot loaders
           # (e.g. boot.loader.generationsDir).
-          closure="$(chroot /sysroot ${pkgs.coreutils}/bin/realpath "$closure")"
+          closure="$(chroot-realpath /sysroot "$closure")"
 
           # Assume the directory containing the init script is the closure.
           closure="$(dirname "$closure")"
@@ -578,14 +581,10 @@ in {
       ];
 
       services.initrd-nixos-activation = {
-        requires = [
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        after = [
-          "initrd-fs.target"
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        requiredBy = [ "initrd.target" ];
+        after = [ "initrd-switch-root.target" ];
+        requiredBy = [ "initrd-switch-root.service" ];
+        before = [ "initrd-switch-root.service" ];
+        unitConfig.DefaultDependencies = false;
         unitConfig = {
           AssertPathExists = "/etc/initrd-release";
           RequiresMountsFor = [

nixos/modules/system/etc/etc-activation.nix

@@ -139,10 +139,10 @@
 
                 closure="$(realpath /nixos-closure)"
 
-                metadata_image="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-metadata-image")"
+                metadata_image="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-metadata-image")"
                 ln -s "/sysroot$metadata_image" /etc-metadata-image
 
-                basedir="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-basedir")"
+                basedir="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-basedir")"
                 ln -s "/sysroot$basedir" /etc-basedir
               '';
             };

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -28,6 +28,8 @@
 , go_1_23
 , buildGo123Module
 , nix-update-script
+, makeBinaryWrapper
+, autoSignDarwinBinariesHook
 }:
 
 with python3Packages;
@@ -85,9 +87,11 @@ buildPythonApplication rec {
     sphinx-inline-tabs
     go_1_23
     fontconfig
+    makeBinaryWrapper
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     imagemagick
     libicns  # For the png2icns tool.
+    autoSignDarwinBinariesHook
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland-scanner
   ];

pkgs/applications/video/mkvtoolnix/default.nix

@@ -99,8 +99,7 @@ stdenv.mkDerivation rec {
     zlib
   ]
   ++ optionals withGUI [ cmark ]
-  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ]
-  ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ];
 
   # autoupdate is not needed but it silences a ton of pointless warnings
   postPatch = ''

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -1,22 +1,26 @@
 {
+  fetchFromGitHub,
   buildGo122Module,
   lib,
-  fetchFromGitHub,
   versionCheckHook,
 }:
 buildGo122Module rec {
   pname = "baidupcs-go";
-  version = "3.9.5";
+  version = "3.9.5-unstable-2024-06-23";
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
-    rev = "v${version}";
-    hash = "sha256-zNodRQzflOOB3hAeq4KbjRFlHQwknVy+4ucipUcoufY=";
+    rev = "5612fc337b9556ed330274987a2f876961639cff";
+    hash = "sha256-4mCJ5gVHjjvR6HNo47NTJvQEu7cdZZMfO8qQA7Kqzqo=";
   };
 
   vendorHash = "sha256-msTlXtidxLTe3xjxTOWCqx/epFT0XPdwGPantDJUGpc=";
   doCheck = false;
 
+  ldflags = [
+    "-X main.Version=${version}"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
@@ -24,10 +28,10 @@ buildGo122Module rec {
   versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
 
   meta = {
+    mainProgram = "BaiduPCS-Go";
     maintainers = with lib.maintainers; [ xddxdd ];
     description = "Baidu Netdisk commandline client, mimicking Linux shell file handling commands";
     homepage = "https://github.com/qjfoidnh/BaiduPCS-Go";
     license = lib.licenses.asl20;
-    mainProgram = "BaiduPCS-Go";
   };
 }

pkgs/by-name/ch/chroot-realpath/package.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  rustPlatform,
+}:
+
+let
+  cargo = lib.importTOML ./src/Cargo.toml;
+in
+rustPlatform.buildRustPackage {
+  pname = cargo.package.name;
+  version = cargo.package.version;
+
+  src = ./src;
+
+  cargoLock.lockFile = ./src/Cargo.lock;
+
+  meta = {
+    description = "Output a path's realpath within a chroot.";
+    maintainers = [ lib.maintainers.elvishjerricco ];
+  };
+}

pkgs/by-name/ch/chroot-realpath/src/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "chroot-realpath"
+version = "0.1.0"

pkgs/by-name/ch/chroot-realpath/src/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "chroot-realpath"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+
+[profile.release]
+opt-level = "z"

pkgs/by-name/ch/chroot-realpath/src/src/main.rs

@@ -0,0 +1,24 @@
+use std::env;
+use std::io::{stdout, Error, ErrorKind, Write};
+use std::os::unix::ffi::OsStrExt;
+use std::os::unix::fs;
+
+fn main() -> std::io::Result<()> {
+    let args: Vec<String> = env::args().collect();
+
+    if args.len() != 3 {
+        return Err(Error::new(
+            ErrorKind::InvalidInput,
+            format!("Usage: {} <chroot> <path>", args[0]),
+        ));
+    }
+
+    fs::chroot(&args[1])?;
+    std::env::set_current_dir("/")?;
+
+    let path = std::fs::canonicalize(&args[2])?;
+
+    stdout().write_all(path.into_os_string().as_bytes())?;
+
+    Ok(())
+}

pkgs/by-name/cp/cpm-cmake/package.nix

@@ -1,6 +1,7 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -14,6 +15,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-KIRVztkE72juIgXquZlC6AYo78QKHBD7iCvCa+ri66k=";
   };
 
+  postPatch = ''
+    substituteInPlace cmake/CPM.cmake \
+      --replace-fail "set(CURRENT_CPM_VERSION 1.0.0-development-version)" "set(CURRENT_CPM_VERSION ${finalAttrs.version})"
+  '';
+
   dontConfigure = true;
   dontBuild = true;
 
@@ -27,7 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/cpm-cmake/CPM.cmake";
     description = "CMake's missing package manager";
     longDescription = ''
@@ -36,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       CMake's FetchContent module that adds version control, caching, a
       simple API and more.
     '';
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pandapip1 ];
+    platforms = lib.platforms.all;
   };
 })

pkgs/by-name/de/devmode/package.nix

@@ -1,22 +1,22 @@
 {
   lib,
   findutils,
-  mkShell,
   nodejs_latest,
   parallel,
   rsync,
   watchexec,
   writeShellScriptBin,
   # arguments to `nix-build`, e.g. `"foo.nix -A bar"`
-  buildArgs,
+  buildArgs ? "",
   # what path to open a browser at
-  open,
+  open ? "/index.html",
 }:
 let
   inherit (nodejs_latest.pkgs) live-server;
 
-  error_page = writeShellScriptBin "error_page" ''
-    echo "<!DOCTYPE html>
+  error-page = writeShellScriptBin "error-page" ''
+    cat << EOF
+    <!DOCTYPE html>
     <html>
     <head>
       <style>
@@ -26,7 +26,8 @@ let
       </style>
     </head>
     <body><pre>$1</pre></body>
-    </html>"
+    </html>
+    EOF
   '';
 
   # The following would have been simpler:
@@ -38,7 +39,7 @@ let
   # Using rsync here, instead of `cp`, to get as close to an atomic
   # directory copy operation as possible. `--delay-updates` should
   # also go towards that.
-  build_and_copy = writeShellScriptBin "build_and_copy" ''
+  build-and-copy = writeShellScriptBin "build-and-copy" ''
     set -euxo pipefail
 
     set +e
@@ -49,7 +50,7 @@ let
     if [ $exit_status -eq 0 ];
     then
       # setting permissions to be able to clean up
-      ${lib.getBin rsync}/bin/rsync \
+      ${lib.getExe rsync} \
         --recursive \
         --chmod=u=rwX \
         --delete-before \
@@ -58,10 +59,10 @@ let
         $serve/
     else
       set +x
-      ${lib.getBin error_page}/bin/error_page "$stderr" > $error_page_absolute
+      ${lib.getExe error-page} "$stderr" > $error_page_absolute
       set -x
 
-      ${lib.getBin findutils}/bin/find $serve \
+      ${lib.getExe findutils} $serve \
         -type f \
         ! -name $error_page_relative \
         -delete
@@ -72,20 +73,20 @@ let
   watcher = writeShellScriptBin "watcher" ''
     set -euxo pipefail
 
-    ${lib.getBin watchexec}/bin/watchexec \
+    ${lib.getExe watchexec} \
       --shell=none \
       --restart \
       --print-events \
-      ${lib.getBin build_and_copy}/bin/build_and_copy
+      ${lib.getExe build-and-copy}
   '';
 
-  # A Rust alternative to live-server exists, but it was not in nixpkgs.
+  # A Rust alternative to live-server exists, but it fails to open the temporary directory.
   # `--no-css-inject`: without this it seems that only CSS is auto-reloaded.
   # https://www.npmjs.com/package/live-server
   server = writeShellScriptBin "server" ''
     set -euxo pipefail
 
-    ${lib.getBin live-server}/bin/live-server \
+    ${lib.getExe' live-server "live-server"} \
       --host=127.0.0.1 \
       --verbose \
       --no-css-inject \
@@ -93,34 +94,29 @@ let
       --open=${open} \
       $serve
   '';
-
-  devmode = writeShellScriptBin "devmode" ''
-    set -euxo pipefail
-
-    function handle_exit {
-      rm -rf "$tmpdir"
-    }
-
-    tmpdir=$(mktemp -d)
-    trap handle_exit EXIT
-
-    export out_link="$tmpdir/result"
-    export serve="$tmpdir/serve"
-    mkdir $serve
-    export error_page_relative=error.html
-    export error_page_absolute=$serve/$error_page_relative
-    ${lib.getBin error_page}/bin/error_page "building …" > $error_page_absolute
-
-    ${lib.getBin parallel}/bin/parallel \
-      --will-cite \
-      --line-buffer \
-      --tagstr '{/}' \
-      ::: \
-      "${lib.getBin watcher}/bin/watcher" \
-      "${lib.getBin server}/bin/server"
-  '';
 in
-mkShell {
-  name = "web-devmode";
-  packages = [ devmode ];
-}
+writeShellScriptBin "devmode" ''
+  set -euxo pipefail
+
+  function handle_exit {
+    rm -rf "$tmpdir"
+  }
+
+  tmpdir=$(mktemp -d)
+  trap handle_exit EXIT
+
+  export out_link="$tmpdir/result"
+  export serve="$tmpdir/serve"
+  mkdir $serve
+  export error_page_relative=error.html
+  export error_page_absolute=$serve/$error_page_relative
+  ${lib.getExe error-page} "building …" > $error_page_absolute
+
+  ${lib.getExe parallel} \
+    --will-cite \
+    --line-buffer \
+    --tagstr '{/}' \
+    ::: \
+    "${lib.getExe watcher}" \
+    "${lib.getExe server}"
+''

pkgs/by-name/di/distribution/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "distribution";
-  version = "3.0.0-beta.1";
+  version = "3.0.0-rc.1";
 
   src = fetchFromGitHub {
     owner = "distribution";
     repo = "distribution";
     rev = "v${version}";
-    hash = "sha256-tiTwrcRtOEIs1sCkzHXY1TPYw0TOdDvM2Y8YdgQjEmI=";
+    hash = "sha256-dfy3P8zAFlni2heQcz61+sjivHE97Syh/ICreTgxUAM=";
   };
 
   vendorHash = null;
@@ -45,7 +45,7 @@ buildGoModule rec {
     homepage = "https://distribution.github.io/distribution/";
     changelog = "https://github.com/distribution/distribution/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ katexochen ];
     mainProgram = "registry";
     platforms = platforms.unix;
   };

pkgs/by-name/fa/fava/package.nix

@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "fava";
-  version = "1.28";
+  version = "1.29";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sWHVkR0/0VMGzH5OMxOCK4usf7G0odzMtr82ESRQhrk=";
+    hash = "sha256-UZZ142FchYXqPtHb6EWnKjV+xtJ0Gvu+SovTH6+kVn8=";
   };
 
   postPatch = ''

pkgs/by-name/go/go-ios/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "go-ios";
-  version = "1.0.150";
+  version = "1.0.155";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${version}";
-    sha256 = "sha256-xa2/qshZ4k+Df5l817BXlotR6L/CX6Lw2+tWDYnr96I=";
+    sha256 = "sha256-cIB03BSdhOgXaw/Pjvh40S02egE7P53gf0TmwhqbbZY=";
   };
 
   proxyVendor = true;

pkgs/by-name/ha/hatsu/package.nix

@@ -1,28 +1,21 @@
-{ cmake
-, fetchFromGitHub
-, gitUpdater
-, lib
-, openssl
-, pkg-config
-, rustPlatform
+{
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  rustPlatform,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "hatsu";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "importantimport";
     repo = "hatsu";
-    rev = "v${version}";
-    hash = "sha256-iQrwqv5q002rJMcvUhlsLVN3O7mHyL5zmLGjegZDVG0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-K+8X/bNPdjxBSJdlFIXUUOXlTq7Cgol3fFToj5KzbeE=";
   };
 
-  cargoHash = "sha256-LkGkifmHy7cEGrPg0WCf1nCGfcW60AGWQSB0Zb01mk0=";
-
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ openssl ];
-
-  env = { OPENSSL_NO_VENDOR = true; };
+  cargoHash = "sha256-+fNFy3WnQKtDjpNU3veoR2JrBNHj6/Wz2MQP38SR23I=";
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
@@ -32,6 +25,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Self-hosted and fully-automated ActivityPub bridge for static sites";
     homepage = "https://github.com/importantimport/hatsu";
+    changelog = "https://github.com/importantimport/hatsu/releases/tag/v${version}";
     license = lib.licenses.agpl3Only;
     mainProgram = "hatsu";
     maintainers = with lib.maintainers; [ kwaa ];

pkgs/by-name/hc/hcxtools/package.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hcxtools";
-  version = "6.3.4";
+  version = "6.3.5";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = pname;
     rev = version;
-    sha256 = "sha256-03NPzSThmUPAEg5dBr2QkwaXPgGeu/lEe9nqhY8EkyA=";
+    sha256 = "sha256-8VfGiIXl/F2wgCMuS3+lt9sT/re9YgoRKwzgSHCir04=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/ka/kangaru/package.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kangaru";
+  version = "4.3.2";
+
+  src = fetchFromGitHub {
+    owner = "gracicot";
+    repo = "kangaru";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-30gmNo68cDGmGjS75KySyORC6s1NBI925QuZyOv3Kag=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Inversion of control container for C++11, C++14 and later";
+    homepage = "https://github.com/gracicot/kangaru";
+    maintainers = with lib.maintainers; [ l33tname ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+  };
+})

pkgs/by-name/ld/ldeep/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ldeep";
-  version = "1.0.72";
+  version = "1.0.73";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "franc-pentest";
     repo = "ldeep";
     rev = "refs/tags/${version}";
-    hash = "sha256-WfrQd0P1TegeIwxQVycgx2n+IxqnKLRF1wxzNnjHaEo=";
+    hash = "sha256-rFcl7Zf8Q6eugcEL79xpKIvXuhDdI6iEyAPDtqGX6xw=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/li/libtoxcore/package.nix

@@ -14,14 +14,14 @@
 let buildToxAV = !stdenv.hostPlatform.isAarch32;
 in stdenv.mkDerivation rec {
   pname = "libtoxcore";
-  version = "0.2.19";
+  version = "0.2.20";
 
   src =
     # We need the prepared sources tarball.
     fetchurl {
       url =
         "https://github.com/TokTok/c-toxcore/releases/download/v${version}/c-toxcore-${version}.tar.gz";
-      hash = "sha256-i0GPZHDbCFz1mpkVaFYTVWVW3yv0JxSPGBS3sRhihZQ=";
+      hash = "sha256-qciaja6nRdU+XXjnqsuZx7R5LEQApaaccSOPRdYWT0w=";
     };
 
   cmakeFlags = [

pkgs/by-name/li/lightworks/package.nix

@@ -93,7 +93,7 @@ let
         $out/lib/lightworks/ntcardvt
 
       wrapProgram $out/lib/lightworks/ntcardvt \
-        --prefix LD_LIBRARY_PATH : ${fullPath}:$out/lib/lightworks \
+        --prefix LD_LIBRARY_PATH : $out/lib/lightworks:${fullPath} \
         --set FONTCONFIG_FILE $out/lib/lightworks/fonts.conf
 
       cp -r usr/share $out/share

pkgs/by-name/mo/mongodb-ce/package.nix

@@ -15,24 +15,24 @@
 }:
 
 let
-  version = "7.0.14";
+  version = "8.0.3";
 
   srcs = version: {
     "x86_64-linux" = {
       url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-${version}.tgz";
-      hash = "sha256-tM+MquEIeFE17Mi4atjtbfXW77hLm5WlDsui/CRs4IQ=";
+      hash = "sha256-AFnfK6ADPMBndL3k068IfY4wyD8Aa0/UZhY2g+jS31M=";
     };
     "aarch64-linux" = {
       url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2204-${version}.tgz";
-      hash = "sha256-4XiHv6JKopZ/3xrXwT+nvQ2OsbkhL79uwBCnOOMaNlc=";
+      hash = "sha256-7FGzHMdr8+1Bkx+3QFmDf/DGw5DxfDFEuzU6yICtOBo=";
     };
     "x86_64-darwin" = {
       url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${version}.tgz";
-      hash = "sha256-mw9w/qz3xBVC7n0JBeL4CQsJ1bhBPwyQeUBsCa/XosA=";
+      hash = "sha256-GUIFG7F/KNyoPu9HGMs0UVw/HyK5T7jwTrSGY55/UUE=";
     };
     "aarch64-darwin" = {
       url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${version}.tgz";
-      hash = "sha256-iAX4szgBzQe5ARjCXlB7DeIcatQms3X75J6Jb/xXXQ4=";
+      hash = "sha256-erTgU4XQ9Jh1ltPKbyyW6zf3hRHAcopGuHCRFw/AH5g=";
     };
   };
 in
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
           text =
             ''
               # Get latest version string from Github
-              NEW_VERSION=$(curl -s "https://api.github.com/repos/mongodb/mongo/tags?per_page=1000" | jq -r 'first(.[] | .name | select(startswith("r7.0")) | select(contains("rc") | not) | .[1:])')
+              NEW_VERSION=$(curl -s "https://api.github.com/repos/mongodb/mongo/tags?per_page=1000" | jq -r 'first(.[] | .name | select(startswith("r8.0")) | select(contains("rc") | not) | .[1:])')
 
               # Check if the new version is available for download, if not, exit
               curl -s https://www.mongodb.com/try/download/community-edition/releases | pup 'h3:not([id]) text{}' | grep "$NEW_VERSION"
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://www.mongodb.com/docs/upcoming/release-notes/7.0/";
+    changelog = "https://www.mongodb.com/docs/upcoming/release-notes/8.0/";
     description = "MongoDB is a general purpose, document-based, distributed database.";
     homepage = "https://www.mongodb.com/";
     license = with lib.licenses; [ sspl ];

pkgs/by-name/pi/picom/package.nix

@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "picom";
-  version = "12.3";
+  version = "12.4";
 
   src = fetchFromGitHub {
     owner = "yshui";
     repo = "picom";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FwjMlHP8xNJikkPpz+8BORrqqKYvRpkqm9GbExCoLAU=";
+    hash = "sha256-5kScnKUHck86fsYrraeV2O2r6fsVFllRMp4GeNT627A=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/pl/planify/package.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.11.4";
+  version = "4.11.6";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-ADNMSXvfeAT53coAtCu3CVCU5XUFhLbvAH3WPFoKJVE=";
+    hash = "sha256-tHn3677bfJgAZnOfDjBJ87DUzr+e9I2lnCke/cN4olE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/pr/process-compose/package.nix

@@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
   pname = "process-compose";
-  version = "1.34.0";
+  version = "1.40.1";
 
   src = fetchFromGitHub {
     owner = "F1bonacc1";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Ymd3X6qvdYENbjb2F0ajjb1j0tuy835W6YWCeuvLoXc=";
+    hash = "sha256-/A/5tdALlb1ultEPTj6+EztjGc7PT9O7VyWey/EyLbQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -43,7 +43,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  vendorHash = "sha256-G4ar+9ARBwR77t/6NswUDXpUw38rYnLy9lIep302mNI=";
+  vendorHash = "sha256-ekNISmU9TVi+YA2f3uJVyMsv8xkT8DmDUBw1ASqIfcY=";
 
   doCheck = false;
 

pkgs/by-name/sf/sfwbar/package.nix

@@ -17,7 +17,7 @@
   wayland-scanner,
 }:
 let
-  version = "1.0_beta15";
+  version = "1.0_beta16";
 in
 stdenv.mkDerivation {
   pname = "sfwbar";
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
     owner = "LBCrion";
     repo = "sfwbar";
     rev = "v${version}";
-    hash = "sha256-nNtnHOM/ArbYx5ZGlnxgMB33YaGAOigxgW4SAywg66Q=";
+    hash = "sha256-jMEbw3Xla2cod/oKFQ4bD3sTHi7DZ0deG0H0Yt0Y7ck=";
   };
 
   buildInputs = [

pkgs/by-name/st/stirling-pdf/package.nix

@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "stirling-pdf";
-  version = "0.29.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "Stirling-Tools";
     repo = "Stirling-PDF";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pdk8TG+wtFjV3Opv42wovlZ0CNWl4jC/PSVYsDyH0Gw=";
+    hash = "sha256-/458O/JJcBlHS66WRVLIUyv9dtuQSW2X3WUpzW1YuFk=";
   };
 
   patches = [

pkgs/by-name/ta/talosctl/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-6WHeiVH/vZHiM4bqq3T5lC0ARldJyZtIErPeDgrZgxc=";
+    hash = "sha256-sD/Nn1ZLM6JIZdWQsBioKyhrAvhz749LL4xWleQ80xY=";
   };
 
-  vendorHash = "sha256-aTtvVpL979BUvSBwBqRqCWSWIBBmmty9vBD97Q5P4+E=";
+  vendorHash = "sha256-pWG8DbZ9N57p2Q9w/IzETcvwaSfzaUvJgcz7Th/Oi9c=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/by-name/vi/vitess/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "20.0.2";
+  version = "21.0.0";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-I+pz8bz/H1mg7cQnPiJZxYr1gyzajMLVqg8yHbBXYLc=";
+    hash = "sha256-F+iL1mvGH2B6Bp+wHpsoqJb3FcFdtaGZd6liVx1+A3g=";
   };
 
-  vendorHash = "sha256-ZDPDL7vJoPv5pIS5xhHAgLiZsiF2B85KNnqGQJPk1SQ=";
+  vendorHash = "sha256-ash8IzT3mw7cpbkX/TU+lnIS7pSjaiFXuLbloZhuCBg=";
 
   buildInputs = [ sqlite ];
 

pkgs/by-name/ya/yaru-theme/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yaru";
-  version = "24.04.3";
+  version = "24.10.4";
 
   src = fetchFromGitHub {
     owner = "ubuntu";
     repo = "yaru";
     rev = version;
-    hash = "sha256-Z0qW3hW5Sije5Hn6OB9f5M6xnmMmRnP76p0kjiQZznw=";
+    hash = "sha256-ioBni/prc2HzrXd6zBgZQQsfQDWxlfWOphtY0o/8uM0=";
   };
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];

pkgs/development/libraries/libiconv/default.nix

@@ -6,7 +6,7 @@
 
 # assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
   pname = "libiconv";
   version = "1.17";
 
@@ -87,4 +87,7 @@ stdenv.mkDerivation rec {
     # This library is not needed on GNU platforms.
     hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd;
   };
-}
+} // lib.optionalAttrs (stdenv.hostPlatform.libc == "bionic") {
+  # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
+  hardeningDisable = [ "fortify" ];
+})

pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix

@@ -1,14 +1,17 @@
-{ lib, buildDunePackage, fetchFromGitHub, ocaml, ppxlib, ounit
-, ppx_deriving, yojson
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, ppxlib, ounit, ounit2
+, ppx_deriving, result, yojson
 }:
 
 let param =
-  if lib.versionAtLeast ppxlib.version "0.26" then {
-    version = "3.7.0";
-    sha256 = "sha256-niKxn1fX0mL1MhlZvbN1wgRed9AHh+z9s6l++k1VX9k=";
+  if lib.versionAtLeast ppxlib.version "0.30" then {
+    version = "3.9.0";
+    sha256 = "sha256-0d6YcBkeFoHXffCYjLIIvruw8B9ZB6NbUijhTv9uyN8=";
+    checkInputs = [ ounit2 ];
   }  else {
     version = "3.6.1";
     sha256 = "1icz5h6p3pfj7my5gi7wxpflrb8c902dqa17f9w424njilnpyrbk";
+    checkInputs = [ ounit ];
+    propagatedBuildInputs = [ result ];
   }
 ; in
 
@@ -25,10 +28,11 @@ buildDunePackage rec {
     inherit (param) sha256;
   };
 
-  propagatedBuildInputs = [ ppxlib ppx_deriving yojson ];
+  propagatedBuildInputs = [ ppxlib ppx_deriving yojson ]
+  ++ param.propagatedBuildInputs or [];
 
   doCheck = lib.versionAtLeast ocaml.version "4.08";
-  checkInputs = [ ounit ];
+  inherit (param) checkInputs;
 
   meta = {
     description = "Yojson codec generator for OCaml >= 4.04";

pkgs/development/python-modules/aioslimproto/default.nix

@@ -14,7 +14,7 @@ buildPythonPackage rec {
   version = "3.1.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
@@ -25,12 +25,12 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "--cov" ""
+      --replace-fail 'version = "0.0.0"' 'version = "${version}"'
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
     pillow
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     description = "Module to control Squeezebox players";
     homepage = "https://github.com/home-assistant-libs/aioslimproto";
     changelog = "https://github.com/home-assistant-libs/aioslimproto/releases/tag/${version}";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/django-cms/default.nix

@@ -0,0 +1,101 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pythonOlder,
+  setuptools,
+  django-classy-tags,
+  django-formtools,
+  django-treebeard,
+  django-sekizai,
+  djangocms-admin-style,
+  python,
+  dj-database-url,
+  djangocms-text-ckeditor,
+  fetchpatch,
+  django-cms,
+  gettext,
+  iptools,
+}:
+
+buildPythonPackage rec {
+  pname = "django-cms";
+  version = "4.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "django-cms";
+    repo = "django-cms";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ucGxc6f2UYdmSLuyxVV2nIcl35qoeQMlk1paN6XeBFY=";
+  };
+
+  patches = [
+    # Removed django-app-manage dependency by updating ./manage.py
+    # https://github.com/django-cms/django-cms/pull/8061
+    (fetchpatch {
+      url = "https://github.com/django-cms/django-cms/commit/3270edb72f6a736b5cb448864ce2eaf68f061740.patch";
+      hash = "sha256-DkgAfE/QGAXwKMNvgcYxtO0yAc7oAaAAui2My8ml1Vk=";
+      name = "remove_django_app_manage_dependency.patch";
+    })
+    (fetchpatch {
+      url = "https://github.com/django-cms/django-cms/pull/8061/commits/04005ff693e775db645c62fefbb62367822e66f9.patch";
+      hash = "sha256-4M/VKEv7pnqCk6fDyA6FurSCCu/k9tNnz16wT4Tr0Rw=";
+      name = "manage_py_update_dj_database_url.patch";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    django-classy-tags
+    django-formtools
+    django-treebeard
+    django-sekizai
+    djangocms-admin-style
+  ];
+
+  nativeCheckInputs = [ gettext ];
+
+  checkInputs = [
+    dj-database-url
+    djangocms-text-ckeditor
+    iptools
+  ];
+
+  preCheck = ''
+    # Disable ruff formatter test
+    rm cms/tests/test_static_analysis.py
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} manage.py test
+    runHook postCheck
+  '';
+
+  # Tests depend on djangocms-text-ckeditor and djangocms-admin-style,
+  # which depends on this package.
+  # To avoid infinite recursion, we only enable tests when building passthru.tests.
+  doCheck = false;
+
+  passthru.tests = {
+    runTests = django-cms.overridePythonAttrs (_: {
+      doCheck = true;
+    });
+  };
+
+  pythonImportCheck = [ "cms" ];
+
+  meta = {
+    description = "Lean enterprise content management powered by Django";
+    homepage = "https://django-cms.org";
+    changelog = "https://github.com/django-cms/django-cms/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}

pkgs/development/python-modules/djangocms-admin-style/default.nix

@@ -0,0 +1,73 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
+  pytest-django,
+  django-cms,
+  djangocms-admin-style,
+}:
+
+buildPythonPackage rec {
+  pname = "djangocms-admin-style";
+  version = "3.3.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "django-cms";
+    repo = "djangocms-admin-style";
+    rev = "refs/tags/${version}";
+    hash = "sha256-cDbmC7IJTT3NuVXBnbUVqC7dUfusMdntDGu2tSvxIdQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  checkInputs = [ django-cms ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="tests.settings"
+  '';
+
+  disabledTests = [
+    # django.template.exceptions.TemplateDoesNotExist: admin/inc/cms_upgrade_notification.html
+    "test_render_update_notification"
+    # AssertionError: 'my site' != 'example.com'
+    "test_current_site_name"
+    # django.core.exceptions.ImproperlyConfigured: settings.DATABASES is improperly configured
+    "test_render_update_notification"
+    "test_current_site_name"
+    "test_for_missing_migrations"
+  ];
+
+  # Tests depend on django-cms which depends on this package.
+  # To avoid infinite recursion, we only enable tests when building passthru.tests.
+  doCheck = false;
+
+  passthru.tests = {
+    runTests = djangocms-admin-style.overridePythonAttrs (_: {
+      doCheck = true;
+    });
+  };
+
+  pythonImportCheck = [ "djangocms_admin_style" ];
+
+  meta = {
+    description = "Django Theme tailored to the needs of django CMS";
+    homepage = "https://django-cms.org";
+    changelog = "https://github.com/django-cms/djangocms-admin-style/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}

pkgs/development/python-modules/djangocms-text-ckeditor/default.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
+  html5lib,
+  pillow,
+  django-cms,
+  pytest-django,
+}:
+
+buildPythonPackage rec {
+  pname = "djangocms-text-ckeditor";
+  version = "5.1.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "djangocms_text_ckeditor";
+    hash = "sha256-ow2S4FJkO037QUkAf3FheVl2O4BaLw1PSSCVRBhlRX0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django-cms
+    html5lib
+    pillow
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="tests.settings"
+  '';
+
+  # Tests require module "djangocms-helper" which is not yet packaged
+  doCheck = false;
+
+  pythonImportCheck = [ "djangocms_text_ckeditor" ];
+
+  meta = {
+    description = "Text Plugin for django CMS using CKEditor 4";
+    homepage = "https://github.com/django-cms/djangocms-text-ckeditor";
+    changelog = "https://github.com/django-cms/djangocms-text-ckeditor/blob/${version}/CHANGELOG.rst";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}

pkgs/development/python-modules/mlflow/default.nix

@@ -70,14 +70,14 @@
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "2.16.2";
+  version = "2.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mlflow";
     repo = "mlflow";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7W1gpVgJSN/iXoW987eCHfcOeE3D/ZJ2W/eilDdzOww=";
+    hash = "sha256-s3t6RAJh129d5XJKtMNxS0wgGO4mKbAfMCXDBXEKBxM=";
   };
 
   # Remove currently broken dependency `shap`, a model explainability package.

pkgs/development/python-modules/radish-bdd/default.nix

@@ -1,13 +1,11 @@
 {
   lib,
   buildPythonPackage,
-  click,
   colorful,
   docopt,
   fetchFromGitHub,
   freezegun,
   humanize,
-  lark,
   lxml,
   parse-type,
   pysingleton,
@@ -23,7 +21,7 @@ buildPythonPackage rec {
   version = "0.17.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = pname;
@@ -33,14 +31,13 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    click
     colorful
     docopt
     humanize
-    lark
     lxml
     parse-type
     pysingleton
+    pyyaml
     tag-expressions
   ];
 
@@ -48,18 +45,18 @@ buildPythonPackage rec {
     freezegun
     pytest-mock
     pytestCheckHook
-    pyyaml
   ];
 
   pythonImportsCheck = [ "radish" ];
 
-  disabledTests = [ "test_main_cli_calls" ];
-
   meta = with lib; {
     description = "Behaviour-Driven-Development tool for python";
     homepage = "https://radish-bdd.github.io/";
     changelog = "https://github.com/radish-bdd/radish/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
+    maintainers = with maintainers; [
+      kalbasit
+      l33tname
+    ];
   };
 }

pkgs/development/python-modules/webexteamssdk/default.nix

@@ -3,36 +3,31 @@
   buildPythonPackage,
   fetchFromGitHub,
   future,
+  poetry-core,
+  poetry-dynamic-versioning,
   pyjwt,
   pythonOlder,
-  requests,
   requests-toolbelt,
-  setuptools,
-  versioneer,
+  requests,
 }:
 
 buildPythonPackage rec {
   pname = "webexteamssdk";
-  version = "1.6.1";
+  version = "2.0.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "CiscoDevNet";
     repo = "webexteamssdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xlkmXl4tVm48drXmkUijv9GNXzJcDnfSKbOMciPIRRo=";
+    hash = "sha256-ENAUUicVO/Br7k+RFHCGzQ7BIG0CP7jTYM3tzs5EAZQ=";
   };
 
-  postPatch = ''
-    # Remove vendorized versioneer
-    rm versioneer.py
-  '';
-
   build-system = [
-    setuptools
-    versioneer
+    poetry-core
+    poetry-dynamic-versioning
   ];
 
   dependencies = [
@@ -45,13 +40,13 @@ buildPythonPackage rec {
   # Tests require a Webex Teams test domain
   doCheck = false;
 
-  pythonImportsCheck = [ "webexteamssdk" ];
+  pythonImportsCheck = [ "webexpythonsdk" ];
 
   meta = with lib; {
     description = "Python module for Webex Teams APIs";
     homepage = "https://github.com/CiscoDevNet/webexteamssdk";
     changelog = "https://github.com/WebexCommunity/WebexPythonSDK/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }

pkgs/development/python-modules/wsgidav/default.nix

@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   cheroot,
-  fetchFromGitHub,
-  pytestCheckHook,
-  pythonOlder,
   defusedxml,
+  fetchFromGitHub,
   jinja2,
   json5,
+  lxml,
+  pytestCheckHook,
   python-pam,
+  pythonOlder,
   pyyaml,
   requests,
   setuptools,
@@ -37,12 +38,16 @@ buildPythonPackage rec {
     defusedxml
     jinja2
     json5
-    python-pam
+    cheroot
+    lxml
     pyyaml
   ];
 
+  optional-dependencies = {
+    pam = [ python-pam ];
+  };
+
   nativeCheckInputs = [
-    cheroot
     pytestCheckHook
     requests
     webtest

pkgs/development/tools/analysis/checkov/default.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.283";
+  version = "3.2.286";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-9izC3O5e6GY/4OLkFLnUOoiFSnxdaS22qPSD3uYXSOE=";
+    hash = "sha256-HW1maTuRqieOzvdpMAxs4h5SpTZ3FyKGmmDof0UItOE=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];

pkgs/development/tools/ocaml/dune/3.nix

@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "3.16.0";
+  version = "3.16.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-VIHd55GMoxIeAsNNdDOfc0sy1Yg++4wbgFZHHnT5vaY=";
+    hash = "sha256-t4GuIPh2E8KhG9BxeAngBHDILWFeFSZPmmTgMwUaw94=";
   };
 
   nativeBuildInputs = [ ocaml findlib ];

pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix

@@ -5,18 +5,18 @@
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-/O+VOrUKhljhrvQ3WiygtZmdf0HTRFaeeU7bP35U3go=";
+    hash = "sha256-f0t9tSAkCYfJ4y6IMcQu4TfCkBjnSr2x7aZTcgr2klw=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-J0aE1wY7VAi8qSzjUyubsSagCsalqrHox2HHAhZoUIE=";
+  npmDepsHash = "sha256-/+MF+9QWiqJi787k3ta7wN8fhElUxVlZY5SLWxy3VTk=";
 
   installPhase = ''
     runHook preInstall

pkgs/servers/invidious/shards.nix

@@ -11,19 +11,24 @@
   };
   backtracer = {
     url = "https://github.com/sija/backtracer.cr.git";
-    rev = "v1.2.1";
-    sha256 = "02r1l7rn2wsljkx495s5s7j04zgn73m2kx0hkzs7620camvlwbqq";
+    rev = "v1.2.2";
+    sha256 = "1rknyylsi14m7i77x7c3138wdw27i4f6sd78m3srw851p47bwr20";
   };
   db = {
     url = "https://github.com/crystal-lang/crystal-db.git";
-    rev = "v0.10.1";
-    sha256 = "03c5h14z6h2mxnx949lihnyqjd19hcj38iasdwq9fp95h8cld376";
+    rev = "v0.13.1";
+    sha256 = "02b79bdv5h460ay0vkpwi5q69b1qrm9z29z02p09xb03hijxskpd";
   };
   exception_page = {
     url = "https://github.com/crystal-loot/exception_page.git";
     rev = "v0.2.2";
     sha256 = "1c8askb9b7621jjz5pjj6b8pdbhw3r1l3dym6swg1saspf5j3jwi";
   };
+  http_proxy = {
+    url = "https://github.com/mamantoha/http_proxy.git";
+    rev = "v0.10.3";
+    sha256 = "1hgghjy611m9bbmq8drvzs30mymkq2s4d18lp19543qls58h80vs";
+  };
   kemal = {
     url = "https://github.com/kemalcr/kemal.git";
     rev = "v1.1.2";
@@ -36,8 +41,8 @@
   };
   pg = {
     url = "https://github.com/will/crystal-pg.git";
-    rev = "v0.24.0";
-    sha256 = "07i5bqkv5j6y6f8v5cpqdxc5wzzrvgv3ds24znv4mzv6nc84csn4";
+    rev = "v0.28.0";
+    sha256 = "0g1kdpnz7sr7hpama0y3s70v5xjhi7jm2ypb1w503cfvr30qffpm";
   };
   protodec = {
     url = "https://github.com/iv-org/protodec.git";
@@ -51,12 +56,12 @@
   };
   spectator = {
     url = "https://github.com/icy-arctic-fox/spectator.git";
-    rev = "v0.10.4";
-    sha256 = "0rcxq2nbslvwrd8m9ajw6dzaw3hagxmkdy9s8p34cgnr4c9dijdq";
+    rev = "v0.10.6";
+    sha256 = "0w6mv1q44is2m19pyspkyiwm84h55nchsm4pp82gdbb0j9ylhckx";
   };
   sqlite3 = {
     url = "https://github.com/crystal-lang/crystal-sqlite3.git";
-    rev = "v0.18.0";
-    sha256 = "03nnvpchhq9f9ywsm3pk2rrj4a3figw7xs96zdziwgr5znkz6x93";
+    rev = "v0.21.0";
+    sha256 = "1mhg59l6qgmf14zjrais0jfn1h5jj9j32fy7fb0gkp9zhpa7x6vs";
   };
 }

pkgs/servers/invidious/versions.json

@@ -1,9 +1,9 @@
 {
   "invidious": {
-    "hash": "sha256-oNkEFATRVgPC8Bhp0v04an3LvqgsSEjLZdeblb7n8TI=",
-    "version": "2.20240825.2",
-    "date": "2024.08.26",
-    "commit": "4782a670"
+    "hash": "sha256-O5Uv5Qat7Is/0gk0HVi8Hr2UPMLXQw7AwYnjOFaaTP8=",
+    "version": "2.20241110.0",
+    "date": "2024.11.10",
+    "commit": "5d2dd40b"
   },
   "videojs": {
     "hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="

pkgs/stdenv/freebsd/bootstrap-files/x86_64-unknown-freebsd.nix

@@ -2,20 +2,20 @@
 # $ ./refresh-tarballs.bash --targets=x86_64-unknown-freebsd
 #
 # Metadata:
-# - nixpkgs revision: 6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2
+# - nixpkgs revision: b92edf1104c47016385e85c87c2d953cf5cd2f98
 # - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.x86_64-unknown-freebsd.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/271214352
-# - instantiated derivation: /nix/store/aahbgs95ani3bd70vxb8kwrvbms0d6ii-build.drv
-# - output directory: /nix/store/ikzxl9ws9yxrl8g8z2kcjwqlq5gfjbhx-build
-# - build time: Sat, 31 Aug 2024 17:18:35 +0000
+# - resolved hydra build: https://hydra.nixos.org/build/276943819
+# - instantiated derivation: /nix/store/npq4w33g3a2gcgh1q535gj4ixd1g5ksl-build.drv
+# - output directory: /nix/store/yy36y5s9i4wl768imwfn112sb7w3pyk8-build
+# - build time: Thu, 31 Oct 2024 20:57:22 +0000
 {
   bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2/bootstrap-tools.tar.xz";
-    hash = "sha256-f7Fqxtpj7/0Sbs+kUgMs7oJ0JmPuh3bqD2YzOBTw2fc=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/b92edf1104c47016385e85c87c2d953cf5cd2f98/bootstrap-tools.tar.xz";
+    hash = "sha256-oHLddpWWwe/ixYuf3hQfmGrGuixF3+G8HCm+B7g3CzY=";
   };
   unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2/unpack.nar.xz";
-    hash = "sha256-3NTRtonoc3ZqnEF3hr1mUPH/aw+04OlwVxGhZmjXlMM=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/b92edf1104c47016385e85c87c2d953cf5cd2f98/unpack.nar.xz";
+    hash = "sha256-aR3lz35Y3ppJBG0/WAT8avsUeDgNMejhGf9LRxTiScI=";
     name = "unpack";
     unpack = true;
   };

pkgs/tools/misc/gaphor/default.nix

@@ -28,12 +28,12 @@
 
 buildPythonApplication rec {
   pname = "gaphor";
-  version = "2.26.0";
+  version = "2.27.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e0K5bfgPqlJh8qrAz40c/w3ANzkfa/6txuqzQDJYXfE=";
+    hash = "sha256-MsbEeOop6Osq2Hn6CkorsXt8/bTY//QHW/uCl0FEUN4=";
   };
 
   pythonRelaxDeps = [ "defusedxml" ];

pkgs/tools/security/metasploit/Gemfile

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.34"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.35"

pkgs/tools/security/metasploit/Gemfile.lock

@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: e9286ec3faffa15e12ef3e267da335cd4afdfaea
-  ref: refs/tags/6.4.34
+  revision: 5c56ef7e53090ba4a2a019269e2a632edbbe1692
+  ref: refs/tags/6.4.35
   specs:
-    metasploit-framework (6.4.34)
+    metasploit-framework (6.4.35)
       aarch64
       abbrev
       actionpack (~> 7.0.0)

pkgs/tools/security/metasploit/default.nix

@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.34";
+  version = "6.4.35";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-2ZYyvASTh1vqBolUCyp8lNLgTPv0tFd7+qZe3KpkDhk=";
+    hash = "sha256-oAz/74dt/Wcm4FX/kvJ0v3vz5ugp0Muu0Tx+w10cVz4=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/metasploit/gemset.nix

@@ -734,12 +734,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "e9286ec3faffa15e12ef3e267da335cd4afdfaea";
-      sha256 = "068fcjmdqpm6z9xmgd7lzd6f1lllghm0nm490vm5p1wk0jy355nr";
+      rev = "5c56ef7e53090ba4a2a019269e2a632edbbe1692";
+      sha256 = "0gjp3ifw6ziws6pcpl19x3kg6yxzfkr95zsmw0k6gzbdhzpzy350";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.34";
+    version = "6.4.35";
   };
   metasploit-model = {
     groups = ["default"];

pkgs/top-level/all-packages.nix

@@ -1616,6 +1616,7 @@ with pkgs;
 
   kitty = darwin.apple_sdk_11_0.callPackage ../applications/terminal-emulators/kitty {
     harfbuzz = harfbuzz.override { withCoreText = stdenv.hostPlatform.isDarwin; };
+    inherit (darwin) autoSignDarwinBinariesHook;
     inherit (darwin.apple_sdk_11_0) Libsystem;
     inherit (darwin.apple_sdk_11_0.frameworks)
       Cocoa
@@ -10514,9 +10515,7 @@ with pkgs;
     inherit (darwin.apple_sdk_11_0.frameworks) AppKit Cocoa Carbon CoreAudio CoreMIDI CoreServices Kernel;
   };
 
-  mkvtoolnix = qt6Packages.callPackage ../applications/video/mkvtoolnix {
-    stdenv = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
-  };
+  mkvtoolnix = qt6Packages.callPackage ../applications/video/mkvtoolnix { };
 
   mkvtoolnix-cli = mkvtoolnix.override {
     withGUI = false;

pkgs/top-level/python-packages.nix

@@ -3319,6 +3319,10 @@ self: super: with self; {
   # Pre-release
   django_5 = callPackage ../development/python-modules/django/5.nix { };
 
+  djangocms-admin-style = callPackage ../development/python-modules/djangocms-admin-style { };
+
+  djangocms-text-ckeditor = callPackage ../development/python-modules/djangocms-text-ckeditor { };
+
   django-admin-datta = callPackage ../development/python-modules/django-admin-datta { };
 
   django-admin-sortable2 = callPackage ../development/python-modules/django-admin-sortable2 { };
@@ -3369,6 +3373,8 @@ self: super: with self; {
 
   django-cleanup = callPackage ../development/python-modules/django-cleanup { };
 
+  django-cms = callPackage ../development/python-modules/django-cms { };
+
   django-colorful = callPackage ../development/python-modules/django-colorful { };
 
   django-compressor = callPackage ../development/python-modules/django-compressor { };