Merge master into staging-next

2024-11-22 06:53:01 +00:00 · 2024-11-12 12:06:14 +00:00 · 2024-11-12 12:06:14 +00:00 · b4d4509dd5
commit b4d4509dd5
parent 00b1e226f7 23bb92fdae
57 changed files with 1249 additions and 605 deletions
--- a/README.md
+++ b/README.md
@ -9,7 +9,7 @@
 </p>

 <p align="center">
-  <a href="https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
+  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>

@ -74,7 +74,7 @@ Community contributions are always welcome through GitHub Issues and
 Pull Requests.

 For more information about contributing to the project, please visit
-the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+the [contributing page](CONTRIBUTING.md).

 # Donations

--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@ -5,6 +5,8 @@
  lib,
  stdenvNoCC,
  callPackage,
+  devmode,
+  mkShellNoCC,
  documentation-highlighter,
  nixos-render-docs,
  nixpkgs ? { },
@ -95,10 +97,14 @@ stdenvNoCC.mkDerivation (

      pythonInterpreterTable = callPackage ./python-interpreter-table.nix { };

-      shell = callPackage ../../pkgs/tools/nix/web-devmode.nix {
-        buildArgs = "./.";
-        open = "/share/doc/nixpkgs/manual.html";
-      };
+      shell =
+        let
+          devmode' = devmode.override {
+            buildArgs = "./.";
+            open = "/share/doc/nixpkgs/manual.html";
+          };
+        in
+        mkShellNoCC { packages = [ devmode' ]; };

      tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
    };
--- a/nixos/doc/manual/shell.nix
+++ b/nixos/doc/manual/shell.nix
@ -6,8 +6,11 @@ let

  common = import ./common.nix;
  inherit (common) outputPath indexPath;
+  devmode = pkgs.devmode.override {
+    buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
+    open = "/${outputPath}/${indexPath}";
+  };
 in
-pkgs.callPackage ../../../pkgs/tools/nix/web-devmode.nix {
-  buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
-  open = "/${outputPath}/${indexPath}";
+pkgs.mkShellNoCC {
+  packages = [ devmode ];
 }
--- a/nixos/modules/services/development/athens.md
+++ b/nixos/modules/services/development/athens.md
@ -37,7 +37,7 @@ If you want to prevent Athens from writing to disk, you can instead configure it
 }
 ```

-To use the local proxy in Go builds, you can set the proxy as environment variable:
+To use the local proxy in Go builds (outside of `nix`), you can set the proxy as environment variable:

 ```nix
 {
@ -47,6 +47,21 @@ To use the local proxy in Go builds, you can set the proxy as environment variab
 }
 ```

-It is currently not possible to use the local proxy for builds done by the Nix daemon. This might be enabled
-by experimental features, specifically [`configurable-impure-env`](https://nixos.org/manual/nix/unstable/contributing/experimental-features#xp-feature-configurable-impure-env),
-in upcoming Nix versions.
+To also use the local proxy for Go builds happening in `nix` (with `buildGoModule`), the nix daemon can be configured to pass the GOPROXY environment variable to the `goModules` fixed-output derivation.
+
+This can either be done via the nix-daemon systemd unit:
+
+```nix
+{
+  systemd.services.nix-daemon.environment.GOPROXY = "http://localhost:3000";
+}
+```
+
+or via the [impure-env experimental feature](https://nix.dev/manual/nix/2.24/command-ref/conf-file#conf-impure-env):
+
+```nix
+{
+  nix.settings.experimental-features = [ "configurable-impure-env" ];
+  nix.settings.impure-env = "GOPROXY=http://localhost:3000";
+}
+```
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -482,6 +482,9 @@ in {

        # so NSS can look up usernames
        "${pkgs.glibc}/lib/libnss_files.so.2"
+
+        # Resolving sysroot symlinks without code exec
+        "${pkgs.chroot-realpath}/bin/chroot-realpath"
      ] ++ optionals cfg.package.withCryptsetup [
        # fido2 support
        "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
@ -522,7 +525,7 @@ in {

        script = /* bash */ ''
          set -uo pipefail
-          export PATH="/bin:${cfg.package.util-linux}/bin"
+          export PATH="/bin:${cfg.package.util-linux}/bin:${pkgs.chroot-realpath}/bin"

          # Figure out what closure to boot
          closure=
@ -543,7 +546,7 @@ in {

          # Resolve symlinks in the init parameter. We need this for some boot loaders
          # (e.g. boot.loader.generationsDir).
-          closure="$(chroot /sysroot ${pkgs.coreutils}/bin/realpath "$closure")"
+          closure="$(chroot-realpath /sysroot "$closure")"

          # Assume the directory containing the init script is the closure.
          closure="$(dirname "$closure")"
@ -578,14 +581,10 @@ in {
      ];

      services.initrd-nixos-activation = {
-        requires = [
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        after = [
-          "initrd-fs.target"
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        requiredBy = [ "initrd.target" ];
+        after = [ "initrd-switch-root.target" ];
+        requiredBy = [ "initrd-switch-root.service" ];
+        before = [ "initrd-switch-root.service" ];
+        unitConfig.DefaultDependencies = false;
        unitConfig = {
          AssertPathExists = "/etc/initrd-release";
          RequiresMountsFor = [
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@ -139,10 +139,10 @@

                closure="$(realpath /nixos-closure)"

-                metadata_image="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-metadata-image")"
+                metadata_image="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-metadata-image")"
                ln -s "/sysroot$metadata_image" /etc-metadata-image

-                basedir="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-basedir")"
+                basedir="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-basedir")"
                ln -s "/sysroot$basedir" /etc-basedir
              '';
            };
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -28,6 +28,8 @@
 , go_1_23
 , buildGo123Module
 , nix-update-script
+, makeBinaryWrapper
+, autoSignDarwinBinariesHook
 }:

 with python3Packages;
@ -85,9 +87,11 @@ buildPythonApplication rec {
    sphinx-inline-tabs
    go_1_23
    fontconfig
+    makeBinaryWrapper
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    imagemagick
    libicns  # For the png2icns tool.
+    autoSignDarwinBinariesHook
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
    wayland-scanner
  ];
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -99,8 +99,7 @@ stdenv.mkDerivation rec {
    zlib
  ]
  ++ optionals withGUI [ cmark ]
-  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ]
-  ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ];

  # autoupdate is not needed but it silences a ton of pointless warnings
  postPatch = ''
--- a/pkgs/by-name/ba/baidupcs-go/package.nix
+++ b/pkgs/by-name/ba/baidupcs-go/package.nix
@ -1,22 +1,26 @@
 {
+  fetchFromGitHub,
  buildGo122Module,
  lib,
-  fetchFromGitHub,
  versionCheckHook,
 }:
 buildGo122Module rec {
  pname = "baidupcs-go";
-  version = "3.9.5";
+  version = "3.9.5-unstable-2024-06-23";
  src = fetchFromGitHub {
    owner = "qjfoidnh";
    repo = "BaiduPCS-Go";
-    rev = "v${version}";
-    hash = "sha256-zNodRQzflOOB3hAeq4KbjRFlHQwknVy+4ucipUcoufY=";
+    rev = "5612fc337b9556ed330274987a2f876961639cff";
+    hash = "sha256-4mCJ5gVHjjvR6HNo47NTJvQEu7cdZZMfO8qQA7Kqzqo=";
  };

  vendorHash = "sha256-msTlXtidxLTe3xjxTOWCqx/epFT0XPdwGPantDJUGpc=";
  doCheck = false;

+  ldflags = [
+    "-X main.Version=${version}"
+  ];
+
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
@ -24,10 +28,10 @@ buildGo122Module rec {
  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";

  meta = {
+    mainProgram = "BaiduPCS-Go";
    maintainers = with lib.maintainers; [ xddxdd ];
    description = "Baidu Netdisk commandline client, mimicking Linux shell file handling commands";
    homepage = "https://github.com/qjfoidnh/BaiduPCS-Go";
    license = lib.licenses.asl20;
-    mainProgram = "BaiduPCS-Go";
  };
 }
--- a/pkgs/by-name/ch/chroot-realpath/package.nix
+++ b/pkgs/by-name/ch/chroot-realpath/package.nix
@ -0,0 +1,21 @@
+{
+  lib,
+  rustPlatform,
+}:
+
+let
+  cargo = lib.importTOML ./src/Cargo.toml;
+in
+rustPlatform.buildRustPackage {
+  pname = cargo.package.name;
+  version = cargo.package.version;
+
+  src = ./src;
+
+  cargoLock.lockFile = ./src/Cargo.lock;
+
+  meta = {
+    description = "Output a path's realpath within a chroot.";
+    maintainers = [ lib.maintainers.elvishjerricco ];
+  };
+}
--- a/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock
+++ b/pkgs/by-name/ch/chroot-realpath/src/Cargo.lock
@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "chroot-realpath"
+version = "0.1.0"
--- a/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml
+++ b/pkgs/by-name/ch/chroot-realpath/src/Cargo.toml
@ -0,0 +1,9 @@
+[package]
+name = "chroot-realpath"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+
+[profile.release]
+opt-level = "z"
--- a/pkgs/by-name/ch/chroot-realpath/src/src/main.rs
+++ b/pkgs/by-name/ch/chroot-realpath/src/src/main.rs
@ -0,0 +1,24 @@
+use std::env;
+use std::io::{stdout, Error, ErrorKind, Write};
+use std::os::unix::ffi::OsStrExt;
+use std::os::unix::fs;
+
+fn main() -> std::io::Result<()> {
+    let args: Vec<String> = env::args().collect();
+
+    if args.len() != 3 {
+        return Err(Error::new(
+            ErrorKind::InvalidInput,
+            format!("Usage: {} <chroot> <path>", args[0]),
+        ));
+    }
+
+    fs::chroot(&args[1])?;
+    std::env::set_current_dir("/")?;
+
+    let path = std::fs::canonicalize(&args[2])?;
+
+    stdout().write_all(path.into_os_string().as_bytes())?;
+
+    Ok(())
+}
--- a/pkgs/by-name/cp/cpm-cmake/package.nix
+++ b/pkgs/by-name/cp/cpm-cmake/package.nix
@ -1,6 +1,7 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -14,6 +15,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    hash = "sha256-KIRVztkE72juIgXquZlC6AYo78QKHBD7iCvCa+ri66k=";
  };

+  postPatch = ''
+    substituteInPlace cmake/CPM.cmake \
+      --replace-fail "set(CURRENT_CPM_VERSION 1.0.0-development-version)" "set(CURRENT_CPM_VERSION ${finalAttrs.version})"
+  '';
+
  dontConfigure = true;
  dontBuild = true;

@ -27,7 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/cpm-cmake/CPM.cmake";
    description = "CMake's missing package manager";
    longDescription = ''
@ -36,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      CMake's FetchContent module that adds version control, caching, a
      simple API and more.
    '';
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pandapip1 ];
+    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/de/devmode/package.nix
+++ b/pkgs/by-name/de/devmode/package.nix
@ -1,22 +1,22 @@
 {
  lib,
  findutils,
-  mkShell,
  nodejs_latest,
  parallel,
  rsync,
  watchexec,
  writeShellScriptBin,
  # arguments to `nix-build`, e.g. `"foo.nix -A bar"`
-  buildArgs,
+  buildArgs ? "",
  # what path to open a browser at
-  open,
+  open ? "/index.html",
 }:
 let
  inherit (nodejs_latest.pkgs) live-server;

-  error_page = writeShellScriptBin "error_page" ''
-    echo "<!DOCTYPE html>
+  error-page = writeShellScriptBin "error-page" ''
+    cat << EOF
+    <!DOCTYPE html>
    <html>
    <head>
      <style>
@ -26,7 +26,8 @@ let
      </style>
    </head>
    <body><pre>$1</pre></body>
-    </html>"
+    </html>
+    EOF
  '';

  # The following would have been simpler:
@ -38,7 +39,7 @@ let
  # Using rsync here, instead of `cp`, to get as close to an atomic
  # directory copy operation as possible. `--delay-updates` should
  # also go towards that.
-  build_and_copy = writeShellScriptBin "build_and_copy" ''
+  build-and-copy = writeShellScriptBin "build-and-copy" ''
    set -euxo pipefail

    set +e
@ -49,7 +50,7 @@ let
    if [ $exit_status -eq 0 ];
    then
      # setting permissions to be able to clean up
-      ${lib.getBin rsync}/bin/rsync \
+      ${lib.getExe rsync} \
        --recursive \
        --chmod=u=rwX \
        --delete-before \
@ -58,10 +59,10 @@ let
        $serve/
    else
      set +x
-      ${lib.getBin error_page}/bin/error_page "$stderr" > $error_page_absolute
+      ${lib.getExe error-page} "$stderr" > $error_page_absolute
      set -x

-      ${lib.getBin findutils}/bin/find $serve \
+      ${lib.getExe findutils} $serve \
        -type f \
        ! -name $error_page_relative \
        -delete
@ -72,20 +73,20 @@ let
  watcher = writeShellScriptBin "watcher" ''
    set -euxo pipefail

-    ${lib.getBin watchexec}/bin/watchexec \
+    ${lib.getExe watchexec} \
      --shell=none \
      --restart \
      --print-events \
-      ${lib.getBin build_and_copy}/bin/build_and_copy
+      ${lib.getExe build-and-copy}
  '';

-  # A Rust alternative to live-server exists, but it was not in nixpkgs.
+  # A Rust alternative to live-server exists, but it fails to open the temporary directory.
  # `--no-css-inject`: without this it seems that only CSS is auto-reloaded.
  # https://www.npmjs.com/package/live-server
  server = writeShellScriptBin "server" ''
    set -euxo pipefail

-    ${lib.getBin live-server}/bin/live-server \
+    ${lib.getExe' live-server "live-server"} \
      --host=127.0.0.1 \
      --verbose \
      --no-css-inject \
@ -93,34 +94,29 @@ let
      --open=${open} \
      $serve
  '';
-
-  devmode = writeShellScriptBin "devmode" ''
-    set -euxo pipefail
-
-    function handle_exit {
-      rm -rf "$tmpdir"
-    }
-
-    tmpdir=$(mktemp -d)
-    trap handle_exit EXIT
-
-    export out_link="$tmpdir/result"
-    export serve="$tmpdir/serve"
-    mkdir $serve
-    export error_page_relative=error.html
-    export error_page_absolute=$serve/$error_page_relative
-    ${lib.getBin error_page}/bin/error_page "building …" > $error_page_absolute
-
-    ${lib.getBin parallel}/bin/parallel \
-      --will-cite \
-      --line-buffer \
-      --tagstr '{/}' \
-      ::: \
-      "${lib.getBin watcher}/bin/watcher" \
-      "${lib.getBin server}/bin/server"
-  '';
 in
-mkShell {
-  name = "web-devmode";
-  packages = [ devmode ];
-}
+writeShellScriptBin "devmode" ''
+  set -euxo pipefail
+
+  function handle_exit {
+    rm -rf "$tmpdir"
+  }
+
+  tmpdir=$(mktemp -d)
+  trap handle_exit EXIT
+
+  export out_link="$tmpdir/result"
+  export serve="$tmpdir/serve"
+  mkdir $serve
+  export error_page_relative=error.html
+  export error_page_absolute=$serve/$error_page_relative
+  ${lib.getExe error-page} "building …" > $error_page_absolute
+
+  ${lib.getExe parallel} \
+    --will-cite \
+    --line-buffer \
+    --tagstr '{/}' \
+    ::: \
+    "${lib.getExe watcher}" \
+    "${lib.getExe server}"
+''
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "distribution";
-  version = "3.0.0-beta.1";
+  version = "3.0.0-rc.1";

  src = fetchFromGitHub {
    owner = "distribution";
    repo = "distribution";
    rev = "v${version}";
-    hash = "sha256-tiTwrcRtOEIs1sCkzHXY1TPYw0TOdDvM2Y8YdgQjEmI=";
+    hash = "sha256-dfy3P8zAFlni2heQcz61+sjivHE97Syh/ICreTgxUAM=";
  };

  vendorHash = null;
@ -45,7 +45,7 @@ buildGoModule rec {
    homepage = "https://distribution.github.io/distribution/";
    changelog = "https://github.com/distribution/distribution/releases/tag/v${version}";
    license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ katexochen ];
    mainProgram = "registry";
    platforms = platforms.unix;
  };
--- a/pkgs/by-name/fa/fava/package.nix
+++ b/pkgs/by-name/fa/fava/package.nix
@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "fava";
-  version = "1.28";
+  version = "1.29";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-sWHVkR0/0VMGzH5OMxOCK4usf7G0odzMtr82ESRQhrk=";
+    hash = "sha256-UZZ142FchYXqPtHb6EWnKjV+xtJ0Gvu+SovTH6+kVn8=";
  };

  postPatch = ''
--- a/pkgs/by-name/go/go-ios/package.nix
+++ b/pkgs/by-name/go/go-ios/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "go-ios";
-  version = "1.0.150";
+  version = "1.0.155";

  src = fetchFromGitHub {
    owner = "danielpaulus";
    repo = "go-ios";
    rev = "v${version}";
-    sha256 = "sha256-xa2/qshZ4k+Df5l817BXlotR6L/CX6Lw2+tWDYnr96I=";
+    sha256 = "sha256-cIB03BSdhOgXaw/Pjvh40S02egE7P53gf0TmwhqbbZY=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/ha/hatsu/package.nix
+++ b/pkgs/by-name/ha/hatsu/package.nix
@ -1,28 +1,21 @@
-{ cmake
-, fetchFromGitHub
-, gitUpdater
-, lib
-, openssl
-, pkg-config
-, rustPlatform
+{
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  rustPlatform,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "hatsu";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "importantimport";
    repo = "hatsu";
-    rev = "v${version}";
-    hash = "sha256-iQrwqv5q002rJMcvUhlsLVN3O7mHyL5zmLGjegZDVG0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-K+8X/bNPdjxBSJdlFIXUUOXlTq7Cgol3fFToj5KzbeE=";
  };

-  cargoHash = "sha256-LkGkifmHy7cEGrPg0WCf1nCGfcW60AGWQSB0Zb01mk0=";
-
-  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ openssl ];
-
-  env = { OPENSSL_NO_VENDOR = true; };
+  cargoHash = "sha256-+fNFy3WnQKtDjpNU3veoR2JrBNHj6/Wz2MQP38SR23I=";

  passthru.updateScript = gitUpdater {
    rev-prefix = "v";
@ -32,6 +25,7 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "Self-hosted and fully-automated ActivityPub bridge for static sites";
    homepage = "https://github.com/importantimport/hatsu";
+    changelog = "https://github.com/importantimport/hatsu/releases/tag/v${version}";
    license = lib.licenses.agpl3Only;
    mainProgram = "hatsu";
    maintainers = with lib.maintainers; [ kwaa ];
--- a/pkgs/by-name/hc/hcxtools/package.nix
+++ b/pkgs/by-name/hc/hcxtools/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "hcxtools";
-  version = "6.3.4";
+  version = "6.3.5";

  src = fetchFromGitHub {
    owner = "ZerBea";
    repo = pname;
    rev = version;
-    sha256 = "sha256-03NPzSThmUPAEg5dBr2QkwaXPgGeu/lEe9nqhY8EkyA=";
+    sha256 = "sha256-8VfGiIXl/F2wgCMuS3+lt9sT/re9YgoRKwzgSHCir04=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/ka/kangaru/package.nix
+++ b/pkgs/by-name/ka/kangaru/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kangaru";
+  version = "4.3.2";
+
+  src = fetchFromGitHub {
+    owner = "gracicot";
+    repo = "kangaru";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-30gmNo68cDGmGjS75KySyORC6s1NBI925QuZyOv3Kag=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Inversion of control container for C++11, C++14 and later";
+    homepage = "https://github.com/gracicot/kangaru";
+    maintainers = with lib.maintainers; [ l33tname ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+  };
+})
--- a/pkgs/by-name/ld/ldeep/package.nix
+++ b/pkgs/by-name/ld/ldeep/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "ldeep";
-  version = "1.0.72";
+  version = "1.0.73";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "franc-pentest";
    repo = "ldeep";
    rev = "refs/tags/${version}";
-    hash = "sha256-WfrQd0P1TegeIwxQVycgx2n+IxqnKLRF1wxzNnjHaEo=";
+    hash = "sha256-rFcl7Zf8Q6eugcEL79xpKIvXuhDdI6iEyAPDtqGX6xw=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/li/libtoxcore/package.nix
+++ b/pkgs/by-name/li/libtoxcore/package.nix
@ -14,14 +14,14 @@
 let buildToxAV = !stdenv.hostPlatform.isAarch32;
 in stdenv.mkDerivation rec {
  pname = "libtoxcore";
-  version = "0.2.19";
+  version = "0.2.20";

  src =
    # We need the prepared sources tarball.
    fetchurl {
      url =
        "https://github.com/TokTok/c-toxcore/releases/download/v${version}/c-toxcore-${version}.tar.gz";
-      hash = "sha256-i0GPZHDbCFz1mpkVaFYTVWVW3yv0JxSPGBS3sRhihZQ=";
+      hash = "sha256-qciaja6nRdU+XXjnqsuZx7R5LEQApaaccSOPRdYWT0w=";
    };

  cmakeFlags = [
--- a/pkgs/by-name/li/lightworks/package.nix
+++ b/pkgs/by-name/li/lightworks/package.nix
@ -93,7 +93,7 @@ let
        $out/lib/lightworks/ntcardvt

      wrapProgram $out/lib/lightworks/ntcardvt \
-        --prefix LD_LIBRARY_PATH : ${fullPath}:$out/lib/lightworks \
+        --prefix LD_LIBRARY_PATH : $out/lib/lightworks:${fullPath} \
        --set FONTCONFIG_FILE $out/lib/lightworks/fonts.conf

      cp -r usr/share $out/share
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@ -15,24 +15,24 @@
 }:

 let
-  version = "7.0.14";
+  version = "8.0.3";

  srcs = version: {
    "x86_64-linux" = {
      url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-${version}.tgz";
-      hash = "sha256-tM+MquEIeFE17Mi4atjtbfXW77hLm5WlDsui/CRs4IQ=";
+      hash = "sha256-AFnfK6ADPMBndL3k068IfY4wyD8Aa0/UZhY2g+jS31M=";
    };
    "aarch64-linux" = {
      url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2204-${version}.tgz";
-      hash = "sha256-4XiHv6JKopZ/3xrXwT+nvQ2OsbkhL79uwBCnOOMaNlc=";
+      hash = "sha256-7FGzHMdr8+1Bkx+3QFmDf/DGw5DxfDFEuzU6yICtOBo=";
    };
    "x86_64-darwin" = {
      url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${version}.tgz";
-      hash = "sha256-mw9w/qz3xBVC7n0JBeL4CQsJ1bhBPwyQeUBsCa/XosA=";
+      hash = "sha256-GUIFG7F/KNyoPu9HGMs0UVw/HyK5T7jwTrSGY55/UUE=";
    };
    "aarch64-darwin" = {
      url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${version}.tgz";
-      hash = "sha256-iAX4szgBzQe5ARjCXlB7DeIcatQms3X75J6Jb/xXXQ4=";
+      hash = "sha256-erTgU4XQ9Jh1ltPKbyyW6zf3hRHAcopGuHCRFw/AH5g=";
    };
  };
 in
@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
          text =
            ''
              # Get latest version string from Github
-              NEW_VERSION=$(curl -s "https://api.github.com/repos/mongodb/mongo/tags?per_page=1000" | jq -r 'first(.[] | .name | select(startswith("r7.0")) | select(contains("rc") | not) | .[1:])')
+              NEW_VERSION=$(curl -s "https://api.github.com/repos/mongodb/mongo/tags?per_page=1000" | jq -r 'first(.[] | .name | select(startswith("r8.0")) | select(contains("rc") | not) | .[1:])')

              # Check if the new version is available for download, if not, exit
              curl -s https://www.mongodb.com/try/download/community-edition/releases | pup 'h3:not([id]) text{}' | grep "$NEW_VERSION"
@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
-    changelog = "https://www.mongodb.com/docs/upcoming/release-notes/7.0/";
+    changelog = "https://www.mongodb.com/docs/upcoming/release-notes/8.0/";
    description = "MongoDB is a general purpose, document-based, distributed database.";
    homepage = "https://www.mongodb.com/";
    license = with lib.licenses; [ sspl ];
--- a/pkgs/by-name/pi/picom/package.nix
+++ b/pkgs/by-name/pi/picom/package.nix
@ -33,13 +33,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "picom";
-  version = "12.3";
+  version = "12.4";

  src = fetchFromGitHub {
    owner = "yshui";
    repo = "picom";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-FwjMlHP8xNJikkPpz+8BORrqqKYvRpkqm9GbExCoLAU=";
+    hash = "sha256-5kScnKUHck86fsYrraeV2O2r6fsVFllRMp4GeNT627A=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/pl/planify/package.nix
+++ b/pkgs/by-name/pl/planify/package.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "planify";
-  version = "4.11.4";
+  version = "4.11.6";

  src = fetchFromGitHub {
    owner = "alainm23";
    repo = "planify";
    rev = version;
-    hash = "sha256-ADNMSXvfeAT53coAtCu3CVCU5XUFhLbvAH3WPFoKJVE=";
+    hash = "sha256-tHn3677bfJgAZnOfDjBJ87DUzr+e9I2lnCke/cN4olE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/process-compose/package.nix
+++ b/pkgs/by-name/pr/process-compose/package.nix
@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "1.34.0";
+  version = "1.40.1";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Ymd3X6qvdYENbjb2F0ajjb1j0tuy835W6YWCeuvLoXc=";
+    hash = "sha256-/A/5tdALlb1ultEPTj6+EztjGc7PT9O7VyWey/EyLbQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -43,7 +43,7 @@ buildGoModule rec {
    installShellFiles
  ];

-  vendorHash = "sha256-G4ar+9ARBwR77t/6NswUDXpUw38rYnLy9lIep302mNI=";
+  vendorHash = "sha256-ekNISmU9TVi+YA2f3uJVyMsv8xkT8DmDUBw1ASqIfcY=";

  doCheck = false;

--- a/pkgs/by-name/sf/sfwbar/package.nix
+++ b/pkgs/by-name/sf/sfwbar/package.nix
@ -17,7 +17,7 @@
  wayland-scanner,
 }:
 let
-  version = "1.0_beta15";
+  version = "1.0_beta16";
 in
 stdenv.mkDerivation {
  pname = "sfwbar";
@ -27,7 +27,7 @@ stdenv.mkDerivation {
    owner = "LBCrion";
    repo = "sfwbar";
    rev = "v${version}";
-    hash = "sha256-nNtnHOM/ArbYx5ZGlnxgMB33YaGAOigxgW4SAywg66Q=";
+    hash = "sha256-jMEbw3Xla2cod/oKFQ4bD3sTHi7DZ0deG0H0Yt0Y7ck=";
  };

  buildInputs = [
--- a/pkgs/by-name/st/stirling-pdf/deps.json
+++ b/pkgs/by-name/st/stirling-pdf/deps.json
--- a/pkgs/by-name/st/stirling-pdf/package.nix
+++ b/pkgs/by-name/st/stirling-pdf/package.nix
@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "stirling-pdf";
-  version = "0.29.0";
+  version = "0.30.1";

  src = fetchFromGitHub {
    owner = "Stirling-Tools";
    repo = "Stirling-PDF";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-pdk8TG+wtFjV3Opv42wovlZ0CNWl4jC/PSVYsDyH0Gw=";
+    hash = "sha256-/458O/JJcBlHS66WRVLIUyv9dtuQSW2X3WUpzW1YuFk=";
  };

  patches = [
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.8.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    hash = "sha256-6WHeiVH/vZHiM4bqq3T5lC0ARldJyZtIErPeDgrZgxc=";
+    hash = "sha256-sD/Nn1ZLM6JIZdWQsBioKyhrAvhz749LL4xWleQ80xY=";
  };

-  vendorHash = "sha256-aTtvVpL979BUvSBwBqRqCWSWIBBmmty9vBD97Q5P4+E=";
+  vendorHash = "sha256-pWG8DbZ9N57p2Q9w/IzETcvwaSfzaUvJgcz7Th/Oi9c=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/vi/vitess/package.nix
+++ b/pkgs/by-name/vi/vitess/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "vitess";
-  version = "20.0.2";
+  version = "21.0.0";

  src = fetchFromGitHub {
    owner = "vitessio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-I+pz8bz/H1mg7cQnPiJZxYr1gyzajMLVqg8yHbBXYLc=";
+    hash = "sha256-F+iL1mvGH2B6Bp+wHpsoqJb3FcFdtaGZd6liVx1+A3g=";
  };

-  vendorHash = "sha256-ZDPDL7vJoPv5pIS5xhHAgLiZsiF2B85KNnqGQJPk1SQ=";
+  vendorHash = "sha256-ash8IzT3mw7cpbkX/TU+lnIS7pSjaiFXuLbloZhuCBg=";

  buildInputs = [ sqlite ];

--- a/pkgs/by-name/ya/yaru-theme/package.nix
+++ b/pkgs/by-name/ya/yaru-theme/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "yaru";
-  version = "24.04.3";
+  version = "24.10.4";

  src = fetchFromGitHub {
    owner = "ubuntu";
    repo = "yaru";
    rev = version;
-    hash = "sha256-Z0qW3hW5Sije5Hn6OB9f5M6xnmMmRnP76p0kjiQZznw=";
+    hash = "sha256-ioBni/prc2HzrXd6zBgZQQsfQDWxlfWOphtY0o/8uM0=";
  };

  nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@ -6,7 +6,7 @@

 # assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
  pname = "libiconv";
  version = "1.17";

@ -87,4 +87,7 @@ stdenv.mkDerivation rec {
    # This library is not needed on GNU platforms.
    hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd;
  };
-}
+} // lib.optionalAttrs (stdenv.hostPlatform.libc == "bionic") {
+  # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
+  hardeningDisable = [ "fortify" ];
+})
--- a/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving_yojson/default.nix
@ -1,14 +1,17 @@
-{ lib, buildDunePackage, fetchFromGitHub, ocaml, ppxlib, ounit
-, ppx_deriving, yojson
+{ lib, buildDunePackage, fetchFromGitHub, ocaml, ppxlib, ounit, ounit2
+, ppx_deriving, result, yojson
 }:

 let param =
-  if lib.versionAtLeast ppxlib.version "0.26" then {
-    version = "3.7.0";
-    sha256 = "sha256-niKxn1fX0mL1MhlZvbN1wgRed9AHh+z9s6l++k1VX9k=";
+  if lib.versionAtLeast ppxlib.version "0.30" then {
+    version = "3.9.0";
+    sha256 = "sha256-0d6YcBkeFoHXffCYjLIIvruw8B9ZB6NbUijhTv9uyN8=";
+    checkInputs = [ ounit2 ];
  }  else {
    version = "3.6.1";
    sha256 = "1icz5h6p3pfj7my5gi7wxpflrb8c902dqa17f9w424njilnpyrbk";
+    checkInputs = [ ounit ];
+    propagatedBuildInputs = [ result ];
  }
 ; in

@ -25,10 +28,11 @@ buildDunePackage rec {
    inherit (param) sha256;
  };

-  propagatedBuildInputs = [ ppxlib ppx_deriving yojson ];
+  propagatedBuildInputs = [ ppxlib ppx_deriving yojson ]
+  ++ param.propagatedBuildInputs or [];

  doCheck = lib.versionAtLeast ocaml.version "4.08";
-  checkInputs = [ ounit ];
+  inherit (param) checkInputs;

  meta = {
    description = "Yojson codec generator for OCaml >= 4.04";
--- a/pkgs/development/python-modules/aioslimproto/default.nix
+++ b/pkgs/development/python-modules/aioslimproto/default.nix
@ -14,7 +14,7 @@ buildPythonPackage rec {
  version = "3.1.0";
  pyproject = true;

-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
@ -25,12 +25,12 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "--cov" ""
+      --replace-fail 'version = "0.0.0"' 'version = "${version}"'
  '';

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    async-timeout
    pillow
@ -45,7 +45,7 @@ buildPythonPackage rec {
    description = "Module to control Squeezebox players";
    homepage = "https://github.com/home-assistant-libs/aioslimproto";
    changelog = "https://github.com/home-assistant-libs/aioslimproto/releases/tag/${version}";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/django-cms/default.nix
+++ b/pkgs/development/python-modules/django-cms/default.nix
@ -0,0 +1,101 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pythonOlder,
+  setuptools,
+  django-classy-tags,
+  django-formtools,
+  django-treebeard,
+  django-sekizai,
+  djangocms-admin-style,
+  python,
+  dj-database-url,
+  djangocms-text-ckeditor,
+  fetchpatch,
+  django-cms,
+  gettext,
+  iptools,
+}:
+
+buildPythonPackage rec {
+  pname = "django-cms";
+  version = "4.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "django-cms";
+    repo = "django-cms";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ucGxc6f2UYdmSLuyxVV2nIcl35qoeQMlk1paN6XeBFY=";
+  };
+
+  patches = [
+    # Removed django-app-manage dependency by updating ./manage.py
+    # https://github.com/django-cms/django-cms/pull/8061
+    (fetchpatch {
+      url = "https://github.com/django-cms/django-cms/commit/3270edb72f6a736b5cb448864ce2eaf68f061740.patch";
+      hash = "sha256-DkgAfE/QGAXwKMNvgcYxtO0yAc7oAaAAui2My8ml1Vk=";
+      name = "remove_django_app_manage_dependency.patch";
+    })
+    (fetchpatch {
+      url = "https://github.com/django-cms/django-cms/pull/8061/commits/04005ff693e775db645c62fefbb62367822e66f9.patch";
+      hash = "sha256-4M/VKEv7pnqCk6fDyA6FurSCCu/k9tNnz16wT4Tr0Rw=";
+      name = "manage_py_update_dj_database_url.patch";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    django-classy-tags
+    django-formtools
+    django-treebeard
+    django-sekizai
+    djangocms-admin-style
+  ];
+
+  nativeCheckInputs = [ gettext ];
+
+  checkInputs = [
+    dj-database-url
+    djangocms-text-ckeditor
+    iptools
+  ];
+
+  preCheck = ''
+    # Disable ruff formatter test
+    rm cms/tests/test_static_analysis.py
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} manage.py test
+    runHook postCheck
+  '';
+
+  # Tests depend on djangocms-text-ckeditor and djangocms-admin-style,
+  # which depends on this package.
+  # To avoid infinite recursion, we only enable tests when building passthru.tests.
+  doCheck = false;
+
+  passthru.tests = {
+    runTests = django-cms.overridePythonAttrs (_: {
+      doCheck = true;
+    });
+  };
+
+  pythonImportCheck = [ "cms" ];
+
+  meta = {
+    description = "Lean enterprise content management powered by Django";
+    homepage = "https://django-cms.org";
+    changelog = "https://github.com/django-cms/django-cms/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}
--- a/pkgs/development/python-modules/djangocms-admin-style/default.nix
+++ b/pkgs/development/python-modules/djangocms-admin-style/default.nix
@ -0,0 +1,73 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
+  pytest-django,
+  django-cms,
+  djangocms-admin-style,
+}:
+
+buildPythonPackage rec {
+  pname = "djangocms-admin-style";
+  version = "3.3.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "django-cms";
+    repo = "djangocms-admin-style";
+    rev = "refs/tags/${version}";
+    hash = "sha256-cDbmC7IJTT3NuVXBnbUVqC7dUfusMdntDGu2tSvxIdQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  checkInputs = [ django-cms ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="tests.settings"
+  '';
+
+  disabledTests = [
+    # django.template.exceptions.TemplateDoesNotExist: admin/inc/cms_upgrade_notification.html
+    "test_render_update_notification"
+    # AssertionError: 'my site' != 'example.com'
+    "test_current_site_name"
+    # django.core.exceptions.ImproperlyConfigured: settings.DATABASES is improperly configured
+    "test_render_update_notification"
+    "test_current_site_name"
+    "test_for_missing_migrations"
+  ];
+
+  # Tests depend on django-cms which depends on this package.
+  # To avoid infinite recursion, we only enable tests when building passthru.tests.
+  doCheck = false;
+
+  passthru.tests = {
+    runTests = djangocms-admin-style.overridePythonAttrs (_: {
+      doCheck = true;
+    });
+  };
+
+  pythonImportCheck = [ "djangocms_admin_style" ];
+
+  meta = {
+    description = "Django Theme tailored to the needs of django CMS";
+    homepage = "https://django-cms.org";
+    changelog = "https://github.com/django-cms/djangocms-admin-style/releases/tag/${version}";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}
--- a/pkgs/development/python-modules/djangocms-text-ckeditor/default.nix
+++ b/pkgs/development/python-modules/djangocms-text-ckeditor/default.nix
@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  pytestCheckHook,
+  setuptools,
+  html5lib,
+  pillow,
+  django-cms,
+  pytest-django,
+}:
+
+buildPythonPackage rec {
+  pname = "djangocms-text-ckeditor";
+  version = "5.1.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "djangocms_text_ckeditor";
+    hash = "sha256-ow2S4FJkO037QUkAf3FheVl2O4BaLw1PSSCVRBhlRX0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django-cms
+    html5lib
+    pillow
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="tests.settings"
+  '';
+
+  # Tests require module "djangocms-helper" which is not yet packaged
+  doCheck = false;
+
+  pythonImportCheck = [ "djangocms_text_ckeditor" ];
+
+  meta = {
+    description = "Text Plugin for django CMS using CKEditor 4";
+    homepage = "https://github.com/django-cms/djangocms-text-ckeditor";
+    changelog = "https://github.com/django-cms/djangocms-text-ckeditor/blob/${version}/CHANGELOG.rst";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
+  };
+}
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@ -70,14 +70,14 @@

 buildPythonPackage rec {
  pname = "mlflow";
-  version = "2.16.2";
+  version = "2.17.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mlflow";
    repo = "mlflow";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7W1gpVgJSN/iXoW987eCHfcOeE3D/ZJ2W/eilDdzOww=";
+    hash = "sha256-s3t6RAJh129d5XJKtMNxS0wgGO4mKbAfMCXDBXEKBxM=";
  };

  # Remove currently broken dependency `shap`, a model explainability package.
--- a/pkgs/development/python-modules/radish-bdd/default.nix
+++ b/pkgs/development/python-modules/radish-bdd/default.nix
@ -1,13 +1,11 @@
 {
  lib,
  buildPythonPackage,
-  click,
  colorful,
  docopt,
  fetchFromGitHub,
  freezegun,
  humanize,
-  lark,
  lxml,
  parse-type,
  pysingleton,
@ -23,7 +21,7 @@ buildPythonPackage rec {
  version = "0.17.1";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = pname;
@ -33,14 +31,13 @@ buildPythonPackage rec {
  };

  propagatedBuildInputs = [
-    click
    colorful
    docopt
    humanize
-    lark
    lxml
    parse-type
    pysingleton
+    pyyaml
    tag-expressions
  ];

@ -48,18 +45,18 @@ buildPythonPackage rec {
    freezegun
    pytest-mock
    pytestCheckHook
-    pyyaml
  ];

  pythonImportsCheck = [ "radish" ];

-  disabledTests = [ "test_main_cli_calls" ];
-
  meta = with lib; {
    description = "Behaviour-Driven-Development tool for python";
    homepage = "https://radish-bdd.github.io/";
    changelog = "https://github.com/radish-bdd/radish/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
+    maintainers = with maintainers; [
+      kalbasit
+      l33tname
+    ];
  };
 }
--- a/pkgs/development/python-modules/webexteamssdk/default.nix
+++ b/pkgs/development/python-modules/webexteamssdk/default.nix
@ -3,36 +3,31 @@
  buildPythonPackage,
  fetchFromGitHub,
  future,
+  poetry-core,
+  poetry-dynamic-versioning,
  pyjwt,
  pythonOlder,
-  requests,
  requests-toolbelt,
-  setuptools,
-  versioneer,
+  requests,
 }:

 buildPythonPackage rec {
  pname = "webexteamssdk";
-  version = "1.6.1";
+  version = "2.0.1";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "CiscoDevNet";
    repo = "webexteamssdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xlkmXl4tVm48drXmkUijv9GNXzJcDnfSKbOMciPIRRo=";
+    hash = "sha256-ENAUUicVO/Br7k+RFHCGzQ7BIG0CP7jTYM3tzs5EAZQ=";
  };

-  postPatch = ''
-    # Remove vendorized versioneer
-    rm versioneer.py
-  '';
-
  build-system = [
-    setuptools
-    versioneer
+    poetry-core
+    poetry-dynamic-versioning
  ];

  dependencies = [
@ -45,13 +40,13 @@ buildPythonPackage rec {
  # Tests require a Webex Teams test domain
  doCheck = false;

-  pythonImportsCheck = [ "webexteamssdk" ];
+  pythonImportsCheck = [ "webexpythonsdk" ];

  meta = with lib; {
    description = "Python module for Webex Teams APIs";
    homepage = "https://github.com/CiscoDevNet/webexteamssdk";
    changelog = "https://github.com/WebexCommunity/WebexPythonSDK/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@ -2,13 +2,14 @@
  lib,
  buildPythonPackage,
  cheroot,
-  fetchFromGitHub,
-  pytestCheckHook,
-  pythonOlder,
  defusedxml,
+  fetchFromGitHub,
  jinja2,
  json5,
+  lxml,
+  pytestCheckHook,
  python-pam,
+  pythonOlder,
  pyyaml,
  requests,
  setuptools,
@ -37,12 +38,16 @@ buildPythonPackage rec {
    defusedxml
    jinja2
    json5
-    python-pam
+    cheroot
+    lxml
    pyyaml
  ];

+  optional-dependencies = {
+    pam = [ python-pam ];
+  };
+
  nativeCheckInputs = [
-    cheroot
    pytestCheckHook
    requests
    webtest
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.283";
+  version = "3.2.286";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-9izC3O5e6GY/4OLkFLnUOoiFSnxdaS22qPSD3uYXSOE=";
+    hash = "sha256-HW1maTuRqieOzvdpMAxs4h5SpTZ3FyKGmmDof0UItOE=";
  };

  patches = [ ./flake8-compat-5.x.patch ];
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@ -6,11 +6,11 @@ else

 stdenv.mkDerivation rec {
  pname = "dune";
-  version = "3.16.0";
+  version = "3.16.1";

  src = fetchurl {
    url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    hash = "sha256-VIHd55GMoxIeAsNNdDOfc0sy1Yg++4wbgFZHHnT5vaY=";
+    hash = "sha256-t4GuIPh2E8KhG9BxeAngBHDILWFeFSZPmmTgMwUaw94=";
  };

  nativeBuildInputs = [ ocaml findlib ];
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix
@ -5,18 +5,18 @@

 buildNpmPackage rec {
  pname = "universal-remote-card";
-  version = "4.1.3";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "android-tv-card";
    rev = version;
-    hash = "sha256-/O+VOrUKhljhrvQ3WiygtZmdf0HTRFaeeU7bP35U3go=";
+    hash = "sha256-f0t9tSAkCYfJ4y6IMcQu4TfCkBjnSr2x7aZTcgr2klw=";
  };

  patches = [ ./dont-call-git.patch ];

-  npmDepsHash = "sha256-J0aE1wY7VAi8qSzjUyubsSagCsalqrHox2HHAhZoUIE=";
+  npmDepsHash = "sha256-/+MF+9QWiqJi787k3ta7wN8fhElUxVlZY5SLWxy3VTk=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/servers/invidious/shards.nix
+++ b/pkgs/servers/invidious/shards.nix
@ -11,19 +11,24 @@
  };
  backtracer = {
    url = "https://github.com/sija/backtracer.cr.git";
-    rev = "v1.2.1";
-    sha256 = "02r1l7rn2wsljkx495s5s7j04zgn73m2kx0hkzs7620camvlwbqq";
+    rev = "v1.2.2";
+    sha256 = "1rknyylsi14m7i77x7c3138wdw27i4f6sd78m3srw851p47bwr20";
  };
  db = {
    url = "https://github.com/crystal-lang/crystal-db.git";
-    rev = "v0.10.1";
-    sha256 = "03c5h14z6h2mxnx949lihnyqjd19hcj38iasdwq9fp95h8cld376";
+    rev = "v0.13.1";
+    sha256 = "02b79bdv5h460ay0vkpwi5q69b1qrm9z29z02p09xb03hijxskpd";
  };
  exception_page = {
    url = "https://github.com/crystal-loot/exception_page.git";
    rev = "v0.2.2";
    sha256 = "1c8askb9b7621jjz5pjj6b8pdbhw3r1l3dym6swg1saspf5j3jwi";
  };
+  http_proxy = {
+    url = "https://github.com/mamantoha/http_proxy.git";
+    rev = "v0.10.3";
+    sha256 = "1hgghjy611m9bbmq8drvzs30mymkq2s4d18lp19543qls58h80vs";
+  };
  kemal = {
    url = "https://github.com/kemalcr/kemal.git";
    rev = "v1.1.2";
@ -36,8 +41,8 @@
  };
  pg = {
    url = "https://github.com/will/crystal-pg.git";
-    rev = "v0.24.0";
-    sha256 = "07i5bqkv5j6y6f8v5cpqdxc5wzzrvgv3ds24znv4mzv6nc84csn4";
+    rev = "v0.28.0";
+    sha256 = "0g1kdpnz7sr7hpama0y3s70v5xjhi7jm2ypb1w503cfvr30qffpm";
  };
  protodec = {
    url = "https://github.com/iv-org/protodec.git";
@ -51,12 +56,12 @@
  };
  spectator = {
    url = "https://github.com/icy-arctic-fox/spectator.git";
-    rev = "v0.10.4";
-    sha256 = "0rcxq2nbslvwrd8m9ajw6dzaw3hagxmkdy9s8p34cgnr4c9dijdq";
+    rev = "v0.10.6";
+    sha256 = "0w6mv1q44is2m19pyspkyiwm84h55nchsm4pp82gdbb0j9ylhckx";
  };
  sqlite3 = {
    url = "https://github.com/crystal-lang/crystal-sqlite3.git";
-    rev = "v0.18.0";
-    sha256 = "03nnvpchhq9f9ywsm3pk2rrj4a3figw7xs96zdziwgr5znkz6x93";
+    rev = "v0.21.0";
+    sha256 = "1mhg59l6qgmf14zjrais0jfn1h5jj9j32fy7fb0gkp9zhpa7x6vs";
  };
 }
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@ -1,9 +1,9 @@
 {
  "invidious": {
-    "hash": "sha256-oNkEFATRVgPC8Bhp0v04an3LvqgsSEjLZdeblb7n8TI=",
-    "version": "2.20240825.2",
-    "date": "2024.08.26",
-    "commit": "4782a670"
+    "hash": "sha256-O5Uv5Qat7Is/0gk0HVi8Hr2UPMLXQw7AwYnjOFaaTP8=",
+    "version": "2.20241110.0",
+    "date": "2024.11.10",
+    "commit": "5d2dd40b"
  },
  "videojs": {
    "hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="
--- a/pkgs/stdenv/freebsd/bootstrap-files/x86_64-unknown-freebsd.nix
+++ b/pkgs/stdenv/freebsd/bootstrap-files/x86_64-unknown-freebsd.nix
@ -2,20 +2,20 @@
 # $ ./refresh-tarballs.bash --targets=x86_64-unknown-freebsd
 #
 # Metadata:
-# - nixpkgs revision: 6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2
+# - nixpkgs revision: b92edf1104c47016385e85c87c2d953cf5cd2f98
 # - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.x86_64-unknown-freebsd.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/271214352
-# - instantiated derivation: /nix/store/aahbgs95ani3bd70vxb8kwrvbms0d6ii-build.drv
-# - output directory: /nix/store/ikzxl9ws9yxrl8g8z2kcjwqlq5gfjbhx-build
-# - build time: Sat, 31 Aug 2024 17:18:35 +0000
+# - resolved hydra build: https://hydra.nixos.org/build/276943819
+# - instantiated derivation: /nix/store/npq4w33g3a2gcgh1q535gj4ixd1g5ksl-build.drv
+# - output directory: /nix/store/yy36y5s9i4wl768imwfn112sb7w3pyk8-build
+# - build time: Thu, 31 Oct 2024 20:57:22 +0000
 {
  bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2/bootstrap-tools.tar.xz";
-    hash = "sha256-f7Fqxtpj7/0Sbs+kUgMs7oJ0JmPuh3bqD2YzOBTw2fc=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/b92edf1104c47016385e85c87c2d953cf5cd2f98/bootstrap-tools.tar.xz";
+    hash = "sha256-oHLddpWWwe/ixYuf3hQfmGrGuixF3+G8HCm+B7g3CzY=";
  };
  unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/6414ef7ca3bf18ec4f9628d09ccc1eb030276ee2/unpack.nar.xz";
-    hash = "sha256-3NTRtonoc3ZqnEF3hr1mUPH/aw+04OlwVxGhZmjXlMM=";
+    url = "http://tarballs.nixos.org/stdenv/x86_64-unknown-freebsd/b92edf1104c47016385e85c87c2d953cf5cd2f98/unpack.nar.xz";
+    hash = "sha256-aR3lz35Y3ppJBG0/WAT8avsUeDgNMejhGf9LRxTiScI=";
    name = "unpack";
    unpack = true;
  };
--- a/pkgs/tools/misc/gaphor/default.nix
+++ b/pkgs/tools/misc/gaphor/default.nix
@ -28,12 +28,12 @@

 buildPythonApplication rec {
  pname = "gaphor";
-  version = "2.26.0";
+  version = "2.27.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-e0K5bfgPqlJh8qrAz40c/w3ANzkfa/6txuqzQDJYXfE=";
+    hash = "sha256-MsbEeOop6Osq2Hn6CkorsXt8/bTY//QHW/uCl0FEUN4=";
  };

  pythonRelaxDeps = [ "defusedxml" ];
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.34"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.35"
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: e9286ec3faffa15e12ef3e267da335cd4afdfaea
-  ref: refs/tags/6.4.34
+  revision: 5c56ef7e53090ba4a2a019269e2a632edbbe1692
+  ref: refs/tags/6.4.35
  specs:
-    metasploit-framework (6.4.34)
+    metasploit-framework (6.4.35)
      aarch64
      abbrev
      actionpack (~> 7.0.0)
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@ -15,13 +15,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "metasploit-framework";
-  version = "6.4.34";
+  version = "6.4.35";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    rev = "refs/tags/${version}";
-    hash = "sha256-2ZYyvASTh1vqBolUCyp8lNLgTPv0tFd7+qZe3KpkDhk=";
+    hash = "sha256-oAz/74dt/Wcm4FX/kvJ0v3vz5ugp0Muu0Tx+w10cVz4=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@ -734,12 +734,12 @@
    platforms = [];
    source = {
      fetchSubmodules = false;
-      rev = "e9286ec3faffa15e12ef3e267da335cd4afdfaea";
-      sha256 = "068fcjmdqpm6z9xmgd7lzd6f1lllghm0nm490vm5p1wk0jy355nr";
+      rev = "5c56ef7e53090ba4a2a019269e2a632edbbe1692";
+      sha256 = "0gjp3ifw6ziws6pcpl19x3kg6yxzfkr95zsmw0k6gzbdhzpzy350";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.4.34";
+    version = "6.4.35";
  };
  metasploit-model = {
    groups = ["default"];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1616,6 +1616,7 @@ with pkgs;

  kitty = darwin.apple_sdk_11_0.callPackage ../applications/terminal-emulators/kitty {
    harfbuzz = harfbuzz.override { withCoreText = stdenv.hostPlatform.isDarwin; };
+    inherit (darwin) autoSignDarwinBinariesHook;
    inherit (darwin.apple_sdk_11_0) Libsystem;
    inherit (darwin.apple_sdk_11_0.frameworks)
      Cocoa
@ -10514,9 +10515,7 @@ with pkgs;
    inherit (darwin.apple_sdk_11_0.frameworks) AppKit Cocoa Carbon CoreAudio CoreMIDI CoreServices Kernel;
  };

-  mkvtoolnix = qt6Packages.callPackage ../applications/video/mkvtoolnix {
-    stdenv = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
-  };
+  mkvtoolnix = qt6Packages.callPackage ../applications/video/mkvtoolnix { };

  mkvtoolnix-cli = mkvtoolnix.override {
    withGUI = false;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3319,6 +3319,10 @@ self: super: with self; {
  # Pre-release
  django_5 = callPackage ../development/python-modules/django/5.nix { };

+  djangocms-admin-style = callPackage ../development/python-modules/djangocms-admin-style { };
+
+  djangocms-text-ckeditor = callPackage ../development/python-modules/djangocms-text-ckeditor { };
+
  django-admin-datta = callPackage ../development/python-modules/django-admin-datta { };

  django-admin-sortable2 = callPackage ../development/python-modules/django-admin-sortable2 { };
@ -3369,6 +3373,8 @@ self: super: with self; {

  django-cleanup = callPackage ../development/python-modules/django-cleanup { };

+  django-cms = callPackage ../development/python-modules/django-cms { };
+
  django-colorful = callPackage ../development/python-modules/django-colorful { };

  django-compressor = callPackage ../development/python-modules/django-compressor { };