Merge remote-tracking branch 'origin/master' into staging-next

.github/labeler.yml

@@ -340,6 +340,15 @@
         - pkgs/os-specific/linux/systemd/**/*
         - nixos/modules/system/boot/systemd*/**/*
 
+"6.topic: tcl":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/tcl.section.md
+        - pkgs/development/interpreters/tcl/*
+        - pkgs/development/tcl-modules/**/*
+        - pkgs/top-level/tcl-packages.nix
+
 "6.topic: TeX":
   - any:
     - changed-files:

.github/workflows/codeowners-v2.yml

@@ -1,17 +1,32 @@
-name: Codeowners
+name: Codeowners v2
 
-# This workflow depends on a GitHub App with the following permissions:
+# This workflow depends on two GitHub Apps with the following permissions:
-# - Repository > Administration: read-only
+# - For checking code owners:
-# - Organization > Members: read-only
+#   - Permissions:
-# - Repository > Pull Requests: read-write
+#     - Repository > Administration: read-only
-# The App needs to be installed on this repository
+#     - Organization > Members: read-only
-# the OWNER_APP_ID repository variable needs to be set
+#   - Install App on this repository, setting these variables:
-# the OWNER_APP_PRIVATE_KEY repository secret needs to be set
+#     - OWNER_RO_APP_ID (variable)
+#     - OWNER_RO_APP_PRIVATE_KEY (secret)
+# - For requesting code owners:
+#   - Permissions:
+#     - Repository > Administration: read-only
+#     - Organization > Members: read-only
+#     - Repository > Pull Requests: read-write
+#   - Install App on this repository, setting these variables:
+#     - OWNER_APP_ID (variable)
+#     - OWNER_APP_PRIVATE_KEY (secret)
+#
+# This split is done because checking code owners requires handling untrusted PR input,
+# while requesting code owners requires PR write access, and those shouldn't be mixed.
 
 on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
+# We don't need any default GitHub token
+permissions: {}
+
 env:
   OWNERS_FILE: ci/OWNERS
   # Don't do anything on draft PRs
@@ -45,8 +60,8 @@ jobs:
     - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
       id: app-token
       with:
-        app-id: ${{ vars.OWNER_APP_ID }}
+        app-id: ${{ vars.OWNER_RO_APP_ID }}
-        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
 
     - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       with:

.github/workflows/editorconfig-v2.yml

@@ -1,6 +1,8 @@
-name: "Checking EditorConfig"
+name: "Checking EditorConfig v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors

.github/workflows/manual-nixos-v2.yml

@@ -1,6 +1,7 @@
-name: "Build NixOS manual"
+name: "Build NixOS manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,6 +1,7 @@
-name: "Build Nixpkgs manual"
+name: "Build Nixpkgs manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:

.github/workflows/nix-parse-v2.yml

@@ -1,6 +1,8 @@
-name: "Check whether nix files are parseable"
+name: "Check whether nix files are parseable v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors

ci/OWNERS

@@ -11,13 +11,13 @@
 # - There is no need for user/team listed here to have write access.
 # - No reviews will be requested for PRs that target the wrong base branch.
 #
-# Processing of this file is implemented in workflows/codeowners.yml
+# Processing of this file is implemented in workflows/codeowners-v2.yml
 
 # CI
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
-/.github/workflows/codeowners.yml @infinisil
+/.github/workflows/codeowners-v2.yml @infinisil
 /ci/OWNERS @infinisil
 /ci @infinisil @philiptaron @NixOS/Security
 
@@ -177,6 +177,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /pkgs/build-support/rust @zowoq @winterqt @figsoda
 /doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
+# Tcl
+/pkgs/development/interpreters/tcl  @fgaz
+/pkgs/development/libraries/tk      @fgaz
+/pkgs/top-level/tcl-packages.nix    @fgaz
+/pkgs/development/tcl-modules       @fgaz
+/doc/languages-frameworks/tcl.section.md @fgaz
+
 # C compilers
 /pkgs/development/compilers/gcc
 /pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm

doc/languages-frameworks/index.md

@@ -93,6 +93,7 @@ ruby.section.md
 rust.section.md
 scheme.section.md
 swift.section.md
+tcl.section.md
 texlive.section.md
 titanium.section.md
 vim.section.md

doc/languages-frameworks/tcl.section.md

@@ -0,0 +1,54 @@
+# Tcl {#sec-language-tcl}
+
+## User guide {#sec-language-tcl-user-guide}
+
+Tcl interpreters are available under the `tcl` and `tcl-X_Y` attributes, where `X_Y` is the Tcl version.
+
+Tcl libraries are available in the `tclPackages` attribute set.
+They are only guaranteed to work with the default Tcl version, but will probably also work with others thanks to the [stubs mechanism](https://wiki.tcl-lang.org/page/Stubs).
+
+## Packaging guide {#sec-language-tcl-packaging}
+
+Tcl packages are typically built with `tclPackages.mkTclDerivation`.
+Tcl dependencies go in `buildInputs`/`nativeBuildInputs`/... like other packages.
+For more complex package definitions, such as packages with mixed languages, use `tcl.tclPackageHook`.
+
+Where possible, make sure to enable stubs for maximum compatibility, usually with the `--enable-stubs` configure flag.
+
+Here is a simple package example to be called with `tclPackages.callPackage`.
+
+```
+{ lib, fetchzip, mkTclDerivation, openssl }:
+
+mkTclDerivation rec {
+  pname = "tcltls";
+  version = "1.7.22";
+
+  src = fetchzip {
+    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${version}.tar.gz";
+    hash = "sha256-TOouWcQc3MNyJtaAGUGbaQoaCWVe6g3BPERct/V65vk=";
+  };
+
+  buildInputs = [ openssl ];
+
+  configureFlags = [
+    "--with-ssl-dir=${openssl.dev}"
+    "--enable-stubs"
+  ];
+
+  meta = {
+    homepage = "https://core.tcl-lang.org/tcltls/index";
+    description = "OpenSSL / RSA-bsafe Tcl extension";
+    maintainers = [ lib.maintainers.agbrooks ];
+    license = lib.licenses.tcltk;
+    platforms = lib.platforms.unix;
+  };
+}
+```
+
+All Tcl libraries are declared in `pkgs/top-level/tcl-packages.nix` and are defined in `pkgs/development/tcl-modules/`.
+If possible, prefer the by-name hierarchy in `pkgs/development/tcl-modules/by-name/`.
+Its use is documented in `pkgs/development/tcl-modules/by-name/README.md`.
+
+All Tcl applications reside elsewhere.
+In case a package is used as both a library and an application (for example `expect`), it should be defined in `tcl-packages.nix`, with an alias elsewhere.

maintainers/maintainer-list.nix

@@ -19727,6 +19727,12 @@
     github = "shhht";
     githubId = 118352823;
   };
+  shift = {
+    name = "Vincent Palmer";
+    email = "shift@someone.section.me";
+    github = "shift";
+    githubId = 1653;
+  };
   shikanime = {
     name = "William Phetsinorath";
     email = "deva.shikanime@protonmail.com";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -393,6 +393,8 @@
   `nodePackages.coc-eslint` and `vimPlugins.coc-eslint` packages offer comparable
   features for `eslint`, which replaced `tslint`.
 
+- Tcl packages have been moved into the `tclPackages` scope.
+
 - `teleport` has been upgraded from major version 15 to major version 16.
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).

nixos/modules/services/networking/avahi-daemon.nix

@@ -317,6 +317,47 @@ in
         Type = "dbus";
         ExecStart = "${cfg.package}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf}";
         ConfigurationDirectory = "avahi/services";
+
+        # Hardening
+        CapabilityBoundingSet = [
+          # https://github.com/avahi/avahi/blob/v0.9-rc1/avahi-daemon/caps.c#L38
+          "CAP_SYS_CHROOT"
+          "CAP_SETUID"
+          "CAP_SETGID"
+        ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = false;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "@chown setgroups setresuid"
+        ];
+        UMask = "0077";
       };
     };
 

nixos/modules/services/networking/coturn.nix

@@ -1,41 +1,41 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 let
   cfg = config.services.coturn;
   pidfile = "/run/turnserver/turnserver.pid";
   configFile = pkgs.writeText "turnserver.conf" ''
-listening-port=${toString cfg.listening-port}
+    listening-port=${toString cfg.listening-port}
-tls-listening-port=${toString cfg.tls-listening-port}
+    tls-listening-port=${toString cfg.tls-listening-port}
-alt-listening-port=${toString cfg.alt-listening-port}
+    alt-listening-port=${toString cfg.alt-listening-port}
-alt-tls-listening-port=${toString cfg.alt-tls-listening-port}
+    alt-tls-listening-port=${toString cfg.alt-tls-listening-port}
-${lib.concatStringsSep "\n" (map (x: "listening-ip=${x}") cfg.listening-ips)}
+    ${lib.concatStringsSep "\n" (map (x: "listening-ip=${x}") cfg.listening-ips)}
-${lib.concatStringsSep "\n" (map (x: "relay-ip=${x}") cfg.relay-ips)}
+    ${lib.concatStringsSep "\n" (map (x: "relay-ip=${x}") cfg.relay-ips)}
-min-port=${toString cfg.min-port}
+    min-port=${toString cfg.min-port}
-max-port=${toString cfg.max-port}
+    max-port=${toString cfg.max-port}
-${lib.optionalString cfg.lt-cred-mech "lt-cred-mech"}
+    ${lib.optionalString cfg.lt-cred-mech "lt-cred-mech"}
-${lib.optionalString cfg.no-auth "no-auth"}
+    ${lib.optionalString cfg.no-auth "no-auth"}
-${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
+    ${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
-${lib.optionalString (cfg.static-auth-secret != null) ("static-auth-secret=${cfg.static-auth-secret}")}
+    ${lib.optionalString (cfg.static-auth-secret != null) "static-auth-secret=${cfg.static-auth-secret}"}
-${lib.optionalString (cfg.static-auth-secret-file != null) ("static-auth-secret=#static-auth-secret#")}
+    ${lib.optionalString (cfg.static-auth-secret-file != null) "static-auth-secret=#static-auth-secret#"}
-realm=${cfg.realm}
+    realm=${cfg.realm}
-${lib.optionalString cfg.no-udp "no-udp"}
+    ${lib.optionalString cfg.no-udp "no-udp"}
-${lib.optionalString cfg.no-tcp "no-tcp"}
+    ${lib.optionalString cfg.no-tcp "no-tcp"}
-${lib.optionalString cfg.no-tls "no-tls"}
+    ${lib.optionalString cfg.no-tls "no-tls"}
-${lib.optionalString cfg.no-dtls "no-dtls"}
+    ${lib.optionalString cfg.no-dtls "no-dtls"}
-${lib.optionalString cfg.no-udp-relay "no-udp-relay"}
+    ${lib.optionalString cfg.no-udp-relay "no-udp-relay"}
-${lib.optionalString cfg.no-tcp-relay "no-tcp-relay"}
+    ${lib.optionalString cfg.no-tcp-relay "no-tcp-relay"}
-${lib.optionalString (cfg.cert != null) "cert=${cfg.cert}"}
+    ${lib.optionalString (cfg.cert != null) "cert=${cfg.cert}"}
-${lib.optionalString (cfg.pkey != null) "pkey=${cfg.pkey}"}
+    ${lib.optionalString (cfg.pkey != null) "pkey=${cfg.pkey}"}
-${lib.optionalString (cfg.dh-file != null) ("dh-file=${cfg.dh-file}")}
+    ${lib.optionalString (cfg.dh-file != null) "dh-file=${cfg.dh-file}"}
-no-stdout-log
+    no-stdout-log
-syslog
+    syslog
-pidfile=${pidfile}
+    pidfile=${pidfile}
-${lib.optionalString cfg.secure-stun "secure-stun"}
+    ${lib.optionalString cfg.secure-stun "secure-stun"}
-${lib.optionalString cfg.no-cli "no-cli"}
+    ${lib.optionalString cfg.no-cli "no-cli"}
-cli-ip=${cfg.cli-ip}
+    cli-ip=${cfg.cli-ip}
-cli-port=${toString cfg.cli-port}
+    cli-port=${toString cfg.cli-port}
-${lib.optionalString (cfg.cli-password != null) ("cli-password=${cfg.cli-password}")}
+    ${lib.optionalString (cfg.cli-password != null) "cli-password=${cfg.cli-password}"}
-${cfg.extraConfig}
+    ${cfg.extraConfig}
-'';
+  '';
 in {
   options = {
     services.coturn = {
@@ -301,7 +301,7 @@ in {
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge ([
+  config = lib.mkIf cfg.enable (lib.mkMerge [
     { assertions = [
       { assertion = cfg.static-auth-secret != null -> cfg.static-auth-secret-file == null ;
         message = "static-auth-secret and static-auth-secret-file cannot be set at the same time";
@@ -341,25 +341,66 @@ in {
           '' }
           chmod 640 ${runConfig}
         '';
-        serviceConfig = {
+        serviceConfig = rec {
           Type = "simple";
-          ExecStart = "${pkgs.coturn}/bin/turnserver -c ${runConfig}";
+          ExecStart = utils.escapeSystemdExecArgs [
-          RuntimeDirectory = "turnserver";
+            (lib.getExe' pkgs.coturn "turnserver")
+            "-c"
+            runConfig
+          ];
           User = "turnserver";
           Group = "turnserver";
-          AmbientCapabilities =
+          RuntimeDirectory = [
-            lib.mkIf (
+            "coturn"
-              cfg.listening-port < 1024 ||
+            "turnserver"
-              cfg.alt-listening-port < 1024 ||
+          ];
-              cfg.tls-listening-port < 1024 ||
+          RuntimeDirectoryMode = "0700";
-              cfg.alt-tls-listening-port < 1024 ||
-              cfg.min-port < 1024
-            ) "cap_net_bind_service";
           Restart = "on-abort";
+
+          # Hardening
+          AmbientCapabilities = if
+            cfg.listening-port < 1024 ||
+            cfg.alt-listening-port < 1024 ||
+            cfg.tls-listening-port < 1024 ||
+            cfg.alt-tls-listening-port < 1024 ||
+            cfg.min-port < 1024
+            then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+          CapabilityBoundingSet = AmbientCapabilities;
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ] ++ lib.optionals (cfg.listening-ips == [ ]) [
+            # only used for interface discovery when no listening ips are configured
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0077";
         };
       };
-    systemd.tmpfiles.rules = [
+  }]);
-      "d  /run/coturn 0700 turnserver turnserver - -"
-    ];
-  }]));
 }

nixos/modules/system/boot/systemd.nix

@@ -160,6 +160,7 @@ let
 
       # Misc.
       "systemd-sysctl.service"
+      "systemd-machine-id-commit.service"
     ] ++ optionals cfg.package.withTimedated [
       "dbus-org.freedesktop.timedate1.service"
       "systemd-timedated.service"

nixos/tests/avahi.nix

@@ -75,5 +75,7 @@ import ./make-test-python.nix {
     one.succeed("test `wc -l < out` -gt 0")
     two.succeed("avahi-browse -r -t _ssh._tcp | tee out >&2")
     two.succeed("test `wc -l < out` -gt 0")
+
+    one.log(one.execute("systemd-analyze security avahi-daemon.service | grep -v ✓")[1])
   '';
 } args

nixos/tests/coturn.nix

@@ -30,5 +30,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
           secretsfile.fail("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 127.0.0.1 -DgX -e 127.0.0.1 -n 1 -c -y")
           # allowed-peer-ip, should succeed:
           secretsfile.succeed("${pkgs.coturn}/bin/turnutils_uclient -W some-very-secret-string 192.168.1.2 -DgX -e 192.168.1.2 -n 1 -c -y")
+
+      default.log(default.execute("systemd-analyze security coturn.service | grep -v '✓'")[1])
     '';
 })

nixos/tests/systemd.nix

@@ -85,10 +85,17 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     import re
     import subprocess
 
+    machine.start(allow_reboot=True)
+
     # Will not succeed unless ConditionFirstBoot=yes
     machine.wait_for_unit("first-boot-complete.target")
 
+    # Make sure, a subsequent boot isn't a ConditionFirstBoot=yes.
+    machine.reboot()
     machine.wait_for_x()
+    state = machine.get_unit_info("first-boot-complete.target")['ActiveState']
+    assert state == 'inactive', "Detected first boot despite first-boot-completed.target was already reached on a previous boot."
+
     # wait for user services
     machine.wait_for_unit("default.target", "alice")
 

pkgs/applications/misc/therion/default.nix

@@ -5,10 +5,9 @@
 , pkg-config
 , perl
 , tcl
-, tcllib
+, tclPackages
 , tk
 , expat
-, bwidget
 , python3
 , texliveTeTeX
 , survex
@@ -25,7 +24,6 @@
 , sqlite
 , libtiff
 , curl
-, tkimg
 }:
 
 stdenv.mkDerivation rec {
@@ -59,7 +57,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     expat
-    tkimg
+    tclPackages.tkimg
     proj
     wxGTK32
     vtk
@@ -74,8 +72,8 @@ stdenv.mkDerivation rec {
     curl
     fmt
     tcl
-    tcllib
+    tclPackages.tcllib
-    bwidget
+    tclPackages.bwidget
   ];
 
   fixupPhase = ''

pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.8.1";
+  version = "8.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-0SVz97XjFeXaj56ssqFK2jTUQfL0rSc72HAdK9mikUc=";
+    sha256 = "sha256-gDWfzM5CKWIc0gZ5uzJJZY0BySxzN40+sCp0h2Sp7DE=";
   };
-  vendorHash = "sha256-WI4yg+r8zGLZI10/kNFkdbzXk0hZ6CCXvXLOd8l7AWo=";
+  vendorHash = "sha256-Xcoi9MZPrr0DYOcqziF+EFCQdYLWIqXX3IW6D8k6b+E=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/cluster/kubectl-cnpg/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubectl-cnpg";
-  version = "1.24.0";
+  version = "1.24.1";
 
   src = fetchFromGitHub {
     owner = "cloudnative-pg";
     repo = "cloudnative-pg";
     rev = "v${version}";
-    hash = "sha256-/BUrUksNT6KuVLxJxnBfkU9OEeQU3u7WA6pKqcGnuSU=";
+    hash = "sha256-M33ngnpxR3fQNsAkef4Rs4I3wNpOu5wTxbl48gL88F8=";
   };
 
-  vendorHash = "sha256-s1fKwWfOSgRw6eOPc1aZzf1VzaTVHXBjQWd1132vAS0=";
+  vendorHash = "sha256-nFWMw/FpaALp347z5dO8509fJCVISwS6z57JfQ+p3Dg=";
 
   subPackages = [ "cmd/kubectl-cnpg" ];
 

pkgs/applications/networking/cluster/luigi/default.nix

@@ -12,6 +12,8 @@ python3.pkgs.buildPythonApplication rec {
 
   build-system = [ python3.pkgs.setuptools ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = with python3.pkgs; [ python-dateutil tornado python-daemon tenacity ];
 
   pythonImportsCheck = [ "luigi" ];

pkgs/applications/networking/discordo/default.nix

@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "0-unstable-2024-07-02";
+  version = "0-unstable-2024-10-13";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "31905f3e790e63cd0f2366526afe41fb278c226e";
+    rev = "26b77d9385daa2dc056930fa302a3c06595680ba";
-    hash = "sha256-IhGZGHV/A1m653WlVCwxtb9OZbMolQ3GHOr2fXehjNk=";
+    hash = "sha256-zXqYj8IBDVeDKjm0m8CYEX+tmHLpY2u7A4g38IiDNZk=";
   };
 
-  vendorHash = "sha256-5ZsvoIDwxZCGkMRxlCyp2Iv6fcvvpmzG+krz3MZSiTM=";
+  vendorHash = "sha256-68NGcdyKuabSdW6CKAJUaJ0k2dpO0bm3OfNQ7qEVcqk=";
 
   CGO_ENABLED = 0;
 

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20241021-1";
+  version = "20241025";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-fO/GSnmXsB4YVnfBBh1IXai15JeRLcAiihufIouBpxw=";
+    hash = "sha256-ivk7sqTP5kLXrTn+XDrat0VxiK0atA5xI3TzKXvxaV0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/chemistry/openmolcas/default.nix

@@ -15,6 +15,7 @@
 , gsl
 , boost180
 , autoPatchelfHook
+, enableQcmaquis ? false
   # Note that the CASPT2 module is broken with MPI
   # See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
 , enableMpi ? false
@@ -24,14 +25,15 @@
 
 assert blas-ilp64.isILP64;
 assert lib.elem blas-ilp64.passthru.implementation [ "openblas" "mkl" ];
+assert enableQcmaquis -> lib.elem blas-ilp64.passthru.implementation "mkl";
 
 let
   python = python3.withPackages (ps: with ps; [ six pyparsing numpy h5py ]);
   qcmaquisSrc = fetchFromGitHub {
     owner = "qcscine";
     repo = "qcmaquis";
-    rev = "release-3.1.1"; # Must match tag in cmake/custom/qcmaquis.cmake
+    rev = "release-3.1.4"; # Must match tag in cmake/custom/qcmaquis.cmake
-    hash = "sha256-diLDWj/Om6EHrVp+Hd24jsN6R9vV2vRl0y9gqyRWhkI=";
+    hash = "sha256-vhC5k+91IPFxdCi5oYt1NtF9W08RxonJjPpA0ls4I+o=";
   };
   nevtp2Src = fetchFromGitHub {
     owner = "qcscine";
@@ -43,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openmolcas";
-  version = "24.06";
+  version = "24.10";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = "v${version}";
-    hash = "sha256-/y6vEvA1Zf+p7Z0WpcN4P5voLN8MmfbKz1FuthgVQp0=";
+    hash = "sha256-LXxr/xqBHG7a0rOBrb8IMZ4IjZak3NsBw40Qf+z1fic=";
   };
 
   patches = [
@@ -104,8 +106,8 @@ stdenv.mkDerivation rec {
     "-DHDF5=ON"
     "-DFDE=ON"
     "-DEXTERNAL_LIBXC=${lib.getDev libxc}"
-    "-DDMRG=ON"
+    (lib.strings.cmakeBool "DMRG" enableQcmaquis)
-    "-DNEVPT2=ON"
+    (lib.strings.cmakeBool "NEVPT2" enableQcmaquis)
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ] ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
     "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}"

pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch

@@ -22,25 +22,26 @@ index 789739ec8..6c86a7b8c 100644
                      INSTALL_DIR "${PROJECT_BINARY_DIR}/qcmaquis"
                     )
 diff --git a/cmake/custom/qcmaquis.cmake b/cmake/custom/qcmaquis.cmake
-index 176d02761..e160b7bc8 100644
+index 5fd1ef207..8d2957c6e 100644
 --- a/cmake/custom/qcmaquis.cmake
 +++ b/cmake/custom/qcmaquis.cmake
-@@ -78,6 +78,7 @@ list(APPEND QCMaquisCMakeArgs
+@@ -77,6 +77,7 @@ list (APPEND QCMaquisCMakeArgs
-   -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
+       -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
-   -DCMAKE_CXX_FLAGS=${QCM_CMake_CXX_FLAGS}
+       -DCMAKE_CXX_FLAGS=${QCM_CMake_CXX_FLAGS}
-   -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
+       -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
-+  -DCMAKE_SKIP_BUILD_RPATH=ON
++      -DCMAKE_SKIP_BUILD_RPATH=ON
-   )
+ )
- if(HDF5_ROOT)
+ if (HDF5_ROOT)
-   list(APPEND QCMaquisCMakeArgs
+   list (APPEND QCMaquisCMakeArgs
-@@ -278,9 +279,7 @@ set (CMAKE_DISABLE_SOURCE_CHANGES OFF)
+@@ -274,10 +275,7 @@ if (NOT MAQUIS_DMRG_FOUND) # Does the opposite work?
  
-     ExternalProject_Add(${EP_PROJECT}
+   ExternalProject_Add (${EP_PROJECT}
-         PREFIX ${extprojpath}
+                        PREFIX ${extprojpath}
--        GIT_REPOSITORY ${reference_git_repo}
+-                       GIT_REPOSITORY ${reference_git_repo}
--        GIT_TAG ${reference_git_commit}
+-                       GIT_TAG ${reference_git_commit}
--        UPDATE_DISCONNECTED ${EP_SkipUpdate}
+-                       UPDATE_DISCONNECTED ${EP_SkipUpdate}
-+        URL @qcmaquis_src_url@
+-
- 
++                       URL @qcmaquis_src_url@
-         SOURCE_SUBDIR dmrg
+                        SOURCE_SUBDIR dmrg
-         CMAKE_ARGS ${EP_CMAKE_ARGS}
+                        CMAKE_ARGS ${EP_CMAKE_ARGS}
+                        CMAKE_CACHE_ARGS ${EP_CMAKE_CACHE_ARGS}

pkgs/applications/science/electronics/openroad/default.nix

@@ -26,7 +26,7 @@
 , readline
 , spdlog
 , tcl
-, tcllib
+, tclPackages
 , xorg
 , yosys
 , zlib
@@ -72,7 +72,7 @@ mkDerivation rec {
     readline
     spdlog
     tcl
-    tcllib
+    tclPackages.tcllib
     yosys
     xorg.libX11
     zlib

pkgs/applications/version-management/fossil/default.nix

@@ -12,7 +12,7 @@
 , sqlite
 , ed
 , which
-, tcllib
+, tclPackages
 , withJson ? true
 }:
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   # required for build time tool `./tools/translate.c`
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ installShellFiles tcl tcllib ];
+  nativeBuildInputs = [ installShellFiles tcl tclPackages.tcllib ];
 
   buildInputs = [ zlib openssl readline which ed ]
     ++ lib.optional stdenv.hostPlatform.isDarwin libiconv

pkgs/applications/version-management/gitoxide/default.nix

@@ -19,16 +19,16 @@ let
   ein = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/ein";
 in rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    hash = "sha256-ZnfWIFphIdPHKvpzO0Cn5KCahpvKh56HZun09I1l8Vc=";
+    hash = "sha256-JqWFdZXcmL97w5CochG9kXXH7cN2KMarkNUvfQXbYU0=";
   };
 
-  cargoHash = "sha256-oKcCodoMUaduxXXgUV+z7zlg5mc783PSsgoECdW/Uug=";
+  cargoHash = "sha256-EGPx4NNvgGe+LJ8Gn0ne8O4lCA+9p+E9J7OOhLQDWX0=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles ];
 

pkgs/build-support/fetchurl/builder.sh

@@ -19,8 +19,7 @@ curl=(
     --user-agent "curl/$curlVersion Nixpkgs/$nixpkgsVersion"
 )
 
-# Default fallback value defined in pkgs/build-support/fetchurl/default.nix
+if ! [ -f "$SSL_CERT_FILE" ]; then
-if [ "$SSL_CERT_FILE" == "/no-cert-file.crt" ]; then
     curl+=(--insecure)
 fi
 

pkgs/build-support/fetchurl/default.nix

@@ -220,26 +220,20 @@ stdenvNoCC.mkDerivation (
     # New-style output content requirements.
     inherit (hash_) outputHashAlgo outputHash;
 
+    # Disable TLS verification only when we know the hash and no credentials are
+    # needed to access the resource
     SSL_CERT_FILE =
-      let
+      if
-        nixSSLCertFile = builtins.getEnv "NIX_SSL_CERT_FILE";
-      in
-      if nixSSLCertFile != "" then
-        nixSSLCertFile
-      else if
         (
           hash_.outputHash == ""
           || hash_.outputHash == lib.fakeSha256
           || hash_.outputHash == lib.fakeSha512
           || hash_.outputHash == lib.fakeHash
-          # Make sure we always enforce TLS verification when credentials
-          # are needed to access the resource
           || netrcPhase != null
         )
       then
         "${cacert}/etc/ssl/certs/ca-bundle.crt"
       else
-        # Fallback to stdenv default, see pkgs/stdenv/generic/setup.sh
         "/no-cert-file.crt";
 
     outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";

pkgs/by-name/_1/_1password/package.nix

@@ -1,8 +1,19 @@
-{ lib, stdenv, fetchurl, fetchzip, autoPatchelfHook, installShellFiles, cpio, xar, _1password, testers }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchzip,
+  autoPatchelfHook,
+  installShellFiles,
+  cpio,
+  xar,
+  versionCheckHook,
+}:
 
 let
   inherit (stdenv.hostPlatform) system;
-  fetch = srcPlatform: hash: extension:
+  fetch =
+    srcPlatform: hash: extension:
     let
       args = {
         url = "https://cache.agilebits.com/dist/1P/op2/pkg/v${version}/op_${srcPlatform}_v${version}.${extension}";
@@ -12,12 +23,14 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.29.0";
+  version = "2.30.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-sBbdkoacGI/gawM4YH+BBCLDhC2B+cE4iKVGHBhwkic=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-KNduqspTzLEHmymSefLnnhIBcIQWx2tshvOc0NwDek0=" "zip";
-    i686-linux = fetch "linux_386" "sha256-TTd5juT0Aqp1+OfunXcuk0KbL6HIHQV31+1Q1e0GYMY=" "zip";
+    i686-linux = fetch "linux_386" "sha256-StdWtD3tz6bKqSem/GFqeRHzkbv4aP7d7dKKtgNhuY8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-Bb6fNoeNxlbDfwt7Jr8BaKCmFUwSdsLQdVoCmQCNmLA=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-bzhRkpR3te1bcBEfP2BR6SECTC9sRFDshl7B+/278Kg=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-/ryklZnGhrgJggDIa8HmuDsHAXkdrWeXKCQGGVwUAAo=" "pkg";
+    aarch64-darwin =
+      fetch "apple_universal" "sha256-L1SZWQWjAJDZydlAttbWLS7igZNAvOmIyaUUdVbvEa8="
+        "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
@@ -32,9 +45,15 @@ stdenv.mkDerivation {
     else
       throw "Source for ${pname} is not available for ${system}";
 
-  nativeBuildInputs = [ installShellFiles ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ] ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ xar cpio ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    xar
+    cpio
+  ];
 
   unpackPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
     xar -xf $src
@@ -59,14 +78,11 @@ stdenv.mkDerivation {
 
   doInstallCheck = true;
 
-  installCheckPhase = ''
+  versionCheckProgram = "${builtins.placeholder "out"}/bin/${mainProgram}";
-    $out/bin/${mainProgram} --version
+  versionCheckProgramArg = [ "--version" ];
-  '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
-
+    updateScript = ./update.sh;
-  passthru.tests.version = testers.testVersion {
-    package = _1password;
   };
 
   meta = with lib; {

pkgs/by-name/_1/_1password/update.sh

@@ -4,7 +4,7 @@
 set -eu
 
 ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/default.nix"
+NIX_DRV="$ROOT/package.nix"
 if [ ! -f "$NIX_DRV" ]; then
   echo "ERROR: cannot find default.nix in $ROOT"
   exit 1

pkgs/by-name/ad/ad-miner/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ad-miner";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kWIareupm0r48HGnESk5S/0IEKjDfHtXWi64ehjdAQ4=";
+    hash = "sha256-/TIG1UUfLct9MxCmahWk7F6KlypNan+zk/02zVpPV+w=";
   };
 
   # All requirements are pinned

pkgs/by-name/an/anytype/package.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "anytype";
-  version = "0.42.8";
+  version = "0.43.1";
   name = "Anytype-${version}";
   src = fetchurl {
     url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
-    hash = "sha256-MIPKfwIZQah6K+WOQZsTpVcOrws+f4oVa7BoW29K5BA=";
+    hash = "sha256-9CjzFJcMiEGods2Ulm4Ow3lIBXc7HPcWMUFM4cG7GuM=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in appimageTools.wrapType2 {

pkgs/by-name/cl/clipcat/0001-fix-build.patch

@@ -1,50 +0,0 @@
-From 9ba11f90c4364529f220c44a3266926bf8f6a4b4 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Tue, 22 Oct 2024 18:43:20 +0800
-Subject: [PATCH] fix build
-
----
- Cargo.toml              | 1 -
- crates/proto/build.rs   | 1 -
- crates/proto/src/lib.rs | 1 -
- 3 files changed, 3 deletions(-)
-
-diff --git a/Cargo.toml b/Cargo.toml
-index 8deae48..214a0e3 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -122,7 +122,6 @@ clipcat-server          = { path = "./crates/server" }
- 
- [workspace.lints.rust]
- async_fn_in_trait = "allow"
--box_pointers      = "allow"
- 
- # TODO: deny `unused_crate_dependencies` after https://github.com/rust-lang/rust/issues/95513 being solved
- unused_crate_dependencies = "allow"
-diff --git a/crates/proto/build.rs b/crates/proto/build.rs
-index 5e38f62..d6ba4be 100644
---- a/crates/proto/build.rs
-+++ b/crates/proto/build.rs
-@@ -6,7 +6,6 @@ fn prost_config() -> Config {
-     config
- }
- 
--#[allow(box_pointers)]
- fn main() -> Result<(), Box<dyn std::error::Error>> {
-     tonic_build::configure().compile_with_config(
-         prost_config(),
-diff --git a/crates/proto/src/lib.rs b/crates/proto/src/lib.rs
-index a7205ab..e4dcd02 100644
---- a/crates/proto/src/lib.rs
-+++ b/crates/proto/src/lib.rs
-@@ -2,7 +2,6 @@ mod utils;
- mod proto {
-     // SAFETY: allow: prost
-     #![allow(
--        box_pointers,
-         unreachable_pub,
-         unused_qualifications,
-         unused_results,
--- 
-2.46.1
-

pkgs/by-name/cl/clipcat/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.18.3";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = "clipcat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-95y/HiLmhqt1DFmAxLg/W7lr/9dfVtce4+tx+vG2Nuw=";
+    hash = "sha256-94xw/E1Jp+bctVNzRZDdVaxxSMF/R87DNlRAzRT3Uvg=";
   };
 
-  cargoHash = "sha256-z2t7kq2ogMHJGF7xQnzc11B42gUZFTVokVkbw35CeY0=";
+  cargoHash = "sha256-qDcUEJSBd8c/ept/Y+GQCrp5b7xkSdX6ktdO9/c3k8o=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.Cocoa
@@ -32,10 +32,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  patches = [
-    ./0001-fix-build.patch
-  ];
-
   checkFlags = [
     # Some test cases interact with X11, skip them
     "--skip=test_x11_clipboard"

pkgs/by-name/em/emacspeak/package.nix

@@ -5,7 +5,7 @@
 , makeWrapper
 , stdenv
 , tcl
-, tclx
+, tclPackages
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     espeak-ng
     tcl
-    tclx
+    tclPackages.tclx
   ];
 
   strictDeps = true;
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     find "$d" -type f -not -executable -execdir chmod 644 {} +
     makeWrapper ${lib.getExe emacs} $out/bin/emacspeak \
         --set DTK_PROGRAM "${placeholder "out"}/share/emacs/site-lisp/emacspeak/servers/espeak" \
-        --set TCLLIBPATH "${tclx}/lib" \
+        --set TCLLIBPATH "${tclPackages.tclx}/lib" \
         --add-flags '-l "${placeholder "out"}/share/emacs/site-lisp/emacspeak/lisp/emacspeak-setup.elc"'
   '';
 

pkgs/by-name/fl/flarectl/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.105.0";
+  version = "0.108.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-xUITOBXBy5Jt0DFRNffX7sRhAtgUPMEJOHa2SbjM1n0=";
+    hash = "sha256-9pPDoXYZCcMnusBfQ1PQ8l/ZFvPNTOA8dRJALXY1Kho=";
   };
 
-  vendorHash = "sha256-KMCwbbDpj4QAgvKLlOPDKSlrDyf+K/tGTMM/GBlvyuc=";
+  vendorHash = "sha256-U6ogqAweU2DZb26Ct4K/1TnCGRn//p11nVkFKzC+tj0=";
 
   subPackages = [ "cmd/flarectl" ];
 

pkgs/by-name/go/go-dnscollector/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "go-dnscollector";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "dmachard";
+    repo = "go-dnscollector";
+    rev = "v${version}";
+    sha256 = "sha256-+EE9miEm1sHxTHcQ+Zmnj5ljSisKtds9L+SLIvgIfb4=";
+  };
+
+  vendorHash = "sha256-Njv8EGPS45NpCs0+poBxVGWLHhH+mSZuI80kIpsijDQ=";
+
+  subPackages = [ "." ];
+
+  meta = with lib; {
+    description = "Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.";
+    homepage = "https://github.com/dmachard/go-dnscollector";
+    license = licenses.mit;
+    maintainers = with maintainers; [ shift ];
+  };
+}

pkgs/by-name/gr/grafana-kiosk/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grafana-kiosk";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-kiosk";
     rev = "v${version}";
-    hash = "sha256-JTz3EaedJFWE3YqsBLjKH4hWI7+dNeMlp0sZ2kW8IR8=";
+    hash = "sha256-M0Gz0+MQNTIOYBxVRaxk5kYZwoJy1nPckGcYF29EzHA=";
   };
 
-  vendorHash = "sha256-8sxfbSj0Jq5f0oJoe8PtP72PDWvLzgOeRiP7I/Pfam4=";
+  vendorHash = "sha256-dnA5Z6VX7+RLpV7+PPuckH+v407dK8nbe0OVJtfG1YE=";
 
   nativeBuildInputs = [ makeWrapper ];
   postFixup = ''

pkgs/by-name/ho/host-spawn/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "host-spawn";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "1player";
+    repo = "host-spawn";
+    rev = "v${version}";
+    hash = "sha256-017o50MSSkehn4zMEdCTPW2o2IQaXbI21z8Z+jfRuDs=";
+  };
+
+  vendorHash = "sha256-Agc3hl+VDTNW7cnh/0g4G8BgzNAX11hKASYQKieBN4M=";
+
+  meta = with lib; {
+    homepage = "https://github.com/1player/host-spawn";
+    description = "Run commands on your host machine from inside your flatpak sandbox, toolbox or distrobox containers";
+    license = licenses.mit0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ garrison ];
+    mainProgram = "host-spawn";
+  };
+}

pkgs/by-name/hw/hwinfo/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwinfo";
-  version = "23.2";
+  version = "23.3";
 
   src = fetchFromGitHub {
     owner = "opensuse";
     repo = "hwinfo";
     rev = finalAttrs.version;
-    hash = "sha256-YAhsnE1DJ5UlYAuhDxS/5IpfIJB6DrhCT3E0YiKENjU=";
+    hash = "sha256-TOW6jD7ZTA32H4oByaVkDAjUSwo9JSID7WSBYj7ZzBs=";
   };
 
   nativeBuildInputs = [
@@ -65,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/bin/udevinfo" "${systemdMinimal}/bin/udevinfo" \
       --replace-fail "/usr/bin/udevadm" "${systemdMinimal}/bin/udevadm"
 
+    # Replace /usr/bin/perl
+    patchShebangs src/ids/convert_hd
   '';
 
   # The pci/usb ids in hwinfo are ancient. We can get a more up-to-date list simply by copying from systemd

pkgs/by-name/hy/hyprcursor/package.nix

@@ -1,31 +1,28 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchFromGitHub
+  stdenv,
-, cmake
+  fetchFromGitHub,
-, pkg-config
+  cmake,
-, cairo
+  pkg-config,
-, hyprlang
+  cairo,
-, librsvg
+  hyprlang,
-, libzip
+  librsvg,
-, tomlplusplus
+  libzip,
-, nix-update-script
+  xcur2png,
+  tomlplusplus,
+  nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprcursor";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprcursor";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-FIN1wMoyePBTtibCbaeJaoKNLuAYIGwLCWAYC1DJanw=";
+    hash = "sha256-NqihN/x8T4+wumSP1orwCCdEmD2xWgLR5QzfY+kAtuU=";
   };
 
-  patches = [
-    # fix icon directories system search path
-    "${finalAttrs.src}/nix/dirs.patch"
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -36,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     hyprlang
     librsvg
     libzip
+    xcur2png
     tomlplusplus
   ];
 

pkgs/by-name/ja/jasp-desktop/package.nix

@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "jasp-stats";
     repo = "jasp-desktop";
     rev = "v${version}";
-    hash = "sha256-G84bmR+40W9RV+OIXYuMmwdEFE0iPMp/wEOcRHYUoj8=";
+    hash = "sha256-SACGyNVxa6rFjloRQrEVtUgujEEF7WYL8Qhw6ZqLwdQ=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ke/keep-sorted/package.nix

@@ -7,13 +7,13 @@
 
 buildGo123Module rec {
   pname = "keep-sorted";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "keep-sorted";
     rev = "v${version}";
-    hash = "sha256-jqSb/lcdeQMa1XpzaopDBbkKymp+HubLeAx3d6x5pns=";
+    hash = "sha256-xvSEREEOiwft3fPN+xtdMCh+z3PknjJ962Nb+pw715U=";
   };
 
   vendorHash = "sha256-HTE9vfjRmi5GpMue7lUfd0jmssPgSOljbfPbya4uGsc=";
@@ -22,10 +22,10 @@ buildGo123Module rec {
 
   ldflags = [ "-s" ];
 
-  checkFlags = [
+  preCheck = ''
-    # Test tries to find files using git
+    # Test tries to find files using git in init func.
-    "-skip=^TestGoldens"
+    rm goldens/*_test.go
-  ];
+  '';
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ke/keydb/package.nix

@@ -12,7 +12,7 @@
   jemalloc,
   which,
   tcl,
-  tcltls,
+  tclPackages,
   ps,
   getconf,
   nixosTests,
@@ -60,11 +60,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   # darwin currently lacks a pure `pgrep` which is extensively used here
   doCheck = !stdenv.hostPlatform.isDarwin;
-  nativeCheckInputs = [
+  nativeCheckInputs =
-    which
+    [
-    tcl
+      which
-    ps
+      tcl
-  ] ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ] ++ lib.optionals tlsSupport [ tcltls ];
+      ps
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isStatic [ getconf ]
+    ++ lib.optionals tlsSupport [ tclPackages.tcltls ];
   checkPhase = ''
     runHook preCheck
 

pkgs/by-name/li/livekit/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-z3xXvs31SMEq0Wfhm/v+7iznCsz/kNqwhQsMueQmEhw=";
+    hash = "sha256-KfUhpA5bhomPU5OC4aCQ5WQIC4ICkaLxQO0tunpkIPI=";
   };
 
-  vendorHash = "sha256-aVKCDDlCkFlFa88H1UAR98Hai5junVWVxVZPK5i+nM8=";
+  vendorHash = "sha256-z5h/r2xC/nEeHk2PLIN+oaGHa8l/xjws79OaDZh9jqE=";
 
   subPackages = [ "cmd/server" ];
 

pkgs/by-name/mi/mise/package.nix

@@ -7,9 +7,10 @@
   stdenv,
   coreutils,
   bash,
+  direnv,
+  git,
   pkg-config,
   openssl,
-  direnv,
   Security,
   SystemConfiguration,
   usage,
@@ -19,22 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.9.0";
+  version = "2024.10.8";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-q515JEpws1UnZm1b8zgGxPvudH846XV+Ct4qKN2mNMQ=";
+    hash = "sha256-58y7jx7gmWlccezZXP5hSzrvnq8hlZ1QakF+FMgbwcc=";
-
-    # registry is not needed for compilation nor for tests.
-    # contains files with the same name but different case, which cause problems with hash on darwin
-    postFetch = ''
-      rm -rf $out/registry
-    '';
   };
 
-  cargoHash = "sha256-jGqaGbue+AEK0YjhHMlm84XBgA20p8Um03TjctjXVz0=";
+  cargoHash = "sha256-m2Eiqyh/rGgwRgRArs3fPWoqzi1EidZd5i66yi4SuFo=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -52,27 +47,30 @@ rustPlatform.buildRustPackage rec {
       ./test/data/plugins/**/bin/* \
       ./src/fake_asdf.rs \
       ./src/cli/generate/git_pre_commit.rs \
-      ./src/cli/generate/snapshots/*.snap \
+      ./src/cli/generate/snapshots/*.snap
-      ./src/cli/reshim.rs \
-      ./test/cwd/.mise/tasks/filetask
 
     substituteInPlace ./src/test.rs \
-      --replace-fail '/usr/bin/env bash' '${bash}/bin/bash'
+      --replace-fail '/usr/bin/env bash' '${lib.getExe bash}' \
+      --replace-fail '"git"' '"${lib.getExe git}"'
+
+    substituteInPlace ./src/git.rs \
+      --replace-fail '"git"' '"${lib.getExe git}"'
 
     substituteInPlace ./src/env_diff.rs \
-      --replace-fail '"bash"' '"${bash}/bin/bash"'
+      --replace-fail '"bash"' '"${lib.getExe bash}"'
 
     substituteInPlace ./src/cli/direnv/exec.rs \
-      --replace-fail '"env"' '"${coreutils}/bin/env"' \
+      --replace-fail '"env"' '"${lib.getExe' coreutils "env"}"' \
-      --replace-fail 'cmd!("direnv"' 'cmd!("${direnv}/bin/direnv"'
+      --replace-fail 'cmd!("direnv"' 'cmd!("${lib.getExe direnv}"'
   '';
 
   checkFlags = [
-    # Requires .git directory to be present
+    # last_modified will always be different in nix
-    "--skip=cli::plugins::ls::tests::test_plugin_list_urls"
+    "--skip=tera::tests::test_last_modified"
-    "--skip=cli::generate::git_pre_commit::tests::test_git_pre_commit"
+    # requires https://github.com/rbenv/ruby-build
-    "--skip=cli::generate::github_action::tests::test_github_action"
+    "--skip=plugins::core::ruby::tests::test_list_versions_matching"
   ];
+
   cargoTestFlags = [ "--all-features" ];
   # some tests access the same folders, don't test in parallel to avoid race conditions
   dontUseCargoParallelTests = true;
@@ -81,8 +79,8 @@ rustPlatform.buildRustPackage rec {
     installManPage ./man/man1/mise.1
 
     substituteInPlace ./completions/{mise.bash,mise.fish,_mise}  \
-      --replace-fail '-v usage' '-v ${usage}/bin/usage' \
+      --replace-fail '-v usage' '-v ${lib.getExe usage}' \
-      --replace-fail 'usage complete-word' '${usage}/bin/usage complete-word'
+      --replace-fail 'usage complete-word' '${lib.getExe usage} complete-word'
 
     installShellCompletion \
       --bash ./completions/mise.bash \

pkgs/by-name/of/offat/package.nix

@@ -18,7 +18,10 @@ python3.pkgs.buildPythonApplication rec {
 
   sourceRoot = "${src.name}/src";
 
-  pythonRelaxDeps = [ "setuptools" ];
+  pythonRelaxDeps = [
+    "setuptools"
+    "tenacity"
+  ];
 
   build-system = with python3.pkgs; [ poetry-core ];
 

pkgs/by-name/op/openapi-python-client/package.nix

@@ -5,7 +5,6 @@
   python3Packages,
   fetchFromGitHub,
   installShellFiles,
-  ruff,
   testers,
   openapi-python-client,
 }:
@@ -35,22 +34,24 @@ python3Packages.buildPythonApplication rec {
     hatchling
   ];
 
-  dependencies =
+  dependencies = (
-    (with python3Packages; [
+    with python3Packages;
+    [
       attrs
       httpx
       jinja2
       pydantic
       python-dateutil
       ruamel-yaml
+      ruff
       shellingham
       typer
       typing-extensions
-    ])
+    ]
-    ++ [ ruff ];
+  );
-
+  # openapi-python-client defines upper bounds to the dependencies, ruff python library is
-  # ruff is not packaged as a python module in nixpkgs
+  # just a simple wrapper to locate the binary. We'll remove the upper bound
-  pythonRemoveDeps = [ "ruff" ];
+  pythonRelaxDeps = [ "ruff" ];
 
   postInstall = ''
     # see: https://github.com/fastapi/typer/blob/5889cf82f4ed925f92e6b0750bf1b1ed9ee672f3/typer/completion.py#L54

pkgs/by-name/pr/prometheus/package.nix

@@ -31,10 +31,10 @@
 }:
 
 let
-  version = "2.54.1";
+  version = "2.55.0";
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${version}/prometheus-web-ui-${version}.tar.gz";
-    hash = "sha256-asum4ND7dHIIP6f1ofIb/xboCPZEIhes7lXqRUhUDJk=";
+    hash = "sha256-iSiK6JKm78AMANfBydfCQu+aUpw6B1sZ5fGPa0KL7Fs=";
   };
 in
 buildGoModule rec {
@@ -47,10 +47,10 @@ buildGoModule rec {
     owner = "prometheus";
     repo = "prometheus";
     rev = "v${version}";
-    hash = "sha256-SF9A/xyjQwwIcMZtuLeJiwkBZvvEyU5EKu0WXTQAT/A=";
+    hash = "sha256-yzAp/YxLCWlpkj5z2aUdsokDaFvRwVnT6ViwL3hivdI=";
   };
 
-  vendorHash = "sha256-y91c5qPND3wbFlX5rV6bcSlXAKn1eomylI6EdZQvkh0=";
+  vendorHash = "sha256-p2PjhFT8KOido+MMmKc7eHPkE175my3VfTp1G8bBZcA=";
 
   excludedPackages = [ "documentation/prometheus-mixin" ];
 

pkgs/by-name/re/remind/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   tk,
-  tcllib,
+  tclPackages,
   tcl,
   tkremind ? null,
   withGui ?
@@ -23,7 +23,7 @@ tcl.mkTclDerivation rec {
   };
 
   propagatedBuildInputs = lib.optionals withGui [
-    tcllib
+    tclPackages.tcllib
     tk
   ];
 

pkgs/by-name/sl/slint-lsp/package.nix

@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.5.1";
+  version = "1.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-wqAcHBHWtYavAakHLhHHCI+Yercgdtzo1EAOilsZOK0=";
+    hash = "sha256-Shgcjr0mlUNAobMAarZ7dFnXgPGzBHXs2KnUDT/8I2A=";
   };
 
-  cargoHash = "sha256-XjVXhXoGEhxWc+LZa0EsPiw3Gq2pg03YjKONTptSQvA=";
+  cargoHash = "sha256-wyzrFg3hwsJ7SV8KGLKo+gNHzLFpnMx9/jgMalGkufY=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
@@ -46,6 +46,9 @@ rustPlatform.buildRustPackage rec {
     OpenGL
   ];
 
+  # Tests requires `i_slint_backend_testing` which is only a dev dependency
+  doCheck = false;
+
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux  ''
     patchelf --set-rpath ${lib.makeLibraryPath rpathLibs} $out/bin/slint-lsp
   '';

pkgs/by-name/st/step-ca/package.nix

@@ -5,24 +5,24 @@
   buildGoModule,
   coreutils,
   pcsclite,
-  PCSC,
   pkg-config,
   hsmSupport ? true,
   nixosTests,
+  darwin,
 }:
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.27.2";
+  version = "0.27.5";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "certificates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-byVWNab6Q3yryluhMomzLkRNfXQ/68pAq+YGFjbvX1o=";
+    hash = "sha256-0KIAO9KPP9Lrrw9IIaRdlmmfJ0mwQK0ne//Zofu3TfE=";
   };
 
-  vendorHash = "sha256-gQEGCbVgtKIaUgBkfpVwLXoUg1EUhaQFn9JZvV5Rjhc=";
+  vendorHash = "sha256-yi4mbuCaT6ydnZwhqqhqMI7bF6IwHm0UqfR5JM81/Ik=";
 
   ldflags = [
     "-w"
@@ -33,9 +33,9 @@ buildGoModule rec {
 
   buildInputs =
     lib.optionals (hsmSupport && stdenv.hostPlatform.isLinux) [ pcsclite ]
-    ++ lib.optionals (hsmSupport && stdenv.hostPlatform.isDarwin) [ PCSC ];
+    ++ lib.optionals (hsmSupport && stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.PCSC ];
-
   postPatch = ''
+    substituteInPlace authority/http_client_test.go --replace-fail 't.Run("SystemCertPool", func(t *testing.T) {' 't.Skip("SystemCertPool", func(t *testing.T) {'
     substituteInPlace systemd/step-ca.service --replace "/bin/kill" "${coreutils}/bin/kill"
   '';
 

pkgs/by-name/to/tomlplusplus/package.nix

@@ -0,0 +1,68 @@
+{
+  cmake,
+  fetchFromGitHub,
+  fetchpatch2,
+  glibcLocales,
+  lib,
+  meson,
+  ninja,
+  nix-update-script,
+  pkg-config,
+  stdenv,
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tomlplusplus";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "marzer";
+    repo = "tomlplusplus";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-h5tbO0Rv2tZezY58yUbyRVpsfRjY3i+5TPkkxr6La8M=";
+  };
+
+  patches = [
+    # TODO: Remove this patch at the next update
+    # https://github.com/marzer/tomlplusplus/pull/233
+    (fetchpatch2 {
+      name = "tomlplusplus-install-example-programs.patch";
+      url = "https://github.com/marzer/tomlplusplus/commit/8128eb632325d1820f4d17dd8250dcda6ab07743.patch";
+      hash = "sha256-7m2P+e1/OASHrzm9LSy6RnayS/kGxFC82xOyGBGXeG0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    cmake
+    ninja
+    pkg-config
+  ];
+
+  checkInputs = [
+    glibcLocales
+  ];
+
+  doCheck = true;
+  mesonFlags = [
+    "-Dbuild_tests=${lib.boolToString finalAttrs.doCheck}"
+    "-Dbuild_examples=true"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/marzer/tomlplusplus";
+    description = "Header-only TOML config file parser and serializer for C++17";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scrumplex ];
+    pkgConfigModules = [ "tomlplusplus" ];
+    platforms = platforms.unix;
+  };
+})

pkgs/by-name/wa/waycheck/package.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZNUORCSeU+AGQoiIIfPpgW2o1ElX+j5Pcn2X/8pSpRI=";
+    hash = "sha256-wawz7QCzpeQgdxwFQaZ/yV//AepEE+FLNG7ho/lHtFE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wh/whatsie/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "whatsie";
-  version = "4.16.1";
+  version = "4.16.2";
 
   src = fetchFromGitHub {
     owner = "keshavbhatt";
     repo = "whatsie";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-9G+2yYc5Lcmw5NvLnn7jVZ4Fw79L29KbhiE2CYh6SLM=";
+    hash = "sha256-4Ur/FNg4jqtyWGB0lW4Uw2XlfMclz080LDRNO+RnkrM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";

pkgs/by-name/xf/xfs-undelete/package.nix

@@ -4,7 +4,7 @@
 , makeWrapper
 , coreutils
 , tcl-8_6
-, tcllib
+, tclPackages
 , installShellFiles
 }:
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     hash = "sha256-ENa/r3+o7abW8iun6V/2LhTVmFVSwVM6v46KXBcKJ1g=";
   };
 
-  buildInputs = [ tcl-8_6 tcllib coreutils ];
+  buildInputs = [ tcl-8_6 tclPackages.tcllib coreutils ];
   nativeBuildInputs = [ makeWrapper tcl-8_6.tclPackageHook installShellFiles ];
 
   tclWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath [ tcl-8_6 ]) ];

pkgs/by-name/yo/your_spotify/package.nix

@@ -9,22 +9,23 @@
   makeWrapper,
   callPackage,
   nixosTests,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "your_spotify_server";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "Yooooomi";
     repo = "your_spotify";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-e82j2blGxQLWAlBNuAnFvlD9vwMk4/mRI0Vf7vuaPA0=";
+    hash = "sha256-BytHkvm0gfMnsKe2gDTARWYIHBpfAfIisf2p4bmrpMA=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+    hash = "sha256-D7rL3hxidLaChCwn5umQAnWr4cTVQ1iwDs5+gIDgBGI=";
   };
 
   nativeBuildInputs = [
@@ -62,11 +63,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     client = callPackage ./client.nix {
-      inherit (finalAttrs) src version offlineCache meta;
+      inherit (finalAttrs)
+        src
+        version
+        offlineCache
+        meta
+        ;
     };
     tests = {
       inherit (nixosTests) your_spotify;
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {

pkgs/by-name/zi/zincsearch/package.nix

@@ -1,16 +1,17 @@
-{ lib
+{
-, buildGoModule
+  lib,
-, fetchFromGitHub
+  buildGo122Module,
-, buildNpmPackage
+  fetchFromGitHub,
+  buildNpmPackage,
 }:
 
 let
-  version = "0.4.10";
+  version = "0.4.10-unstable-2024-10-25";
   src = fetchFromGitHub {
     owner = "zinclabs";
     repo = "zincsearch";
-    rev = "v${version}";
+    rev = "0652db6d39badc753f28ee1122dcbc0e5da1c35e";
-    hash = "sha256-lScwnmu4hM78Va7Yi5HA0E5f2WQXrZaeqjRYJYxnQ5E=";
+    hash = "sha256-Py4fiZJ2fMwPe2afd19brR+62PGVoU67nMDMPlUFhKQ=";
   };
 
   webui = buildNpmPackage {
@@ -32,7 +33,7 @@ let
   };
 in
 
-buildGoModule rec {
+buildGo122Module rec {
   pname = "zincsearch";
   inherit src version;
 
@@ -40,7 +41,7 @@ buildGoModule rec {
     cp -r ${webui}/share/zinc-ui web/dist
   '';
 
-  vendorHash = "sha256-SZG5/ISGblpcwwR/HOKxFl9SthXpE+IYS0S+4HYtHos=";
+  vendorHash = "sha256-JB6+sfMB7PgpPg1lmN9/0JFRLi1c7VBUMD/d4XmLIPw=";
   subPackages = [ "cmd/zincsearch" ];
 
   ldflags = [
@@ -55,8 +56,5 @@ buildGoModule rec {
     homepage = "https://zincsearch-docs.zinc.dev/";
     license = licenses.asl20;
     maintainers = with maintainers; [ dit7ya ];
-    # Doesn't build with Go version later v1.21 (which is EOL).
-    # Upstream issue: https://github.com/zincsearch/zincsearch/issues/975
-    broken = true;
   };
 }

pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , meson
 , ninja
@@ -33,6 +34,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Cv1Ldvk0+VzNsKnDFwDtLZ5ixUOGV+PWYAqN9KV9g/s=";
   };
 
+  patches = [
+    # Set preferred color theme for mutter
+    # https://github.com/elementary/switchboard-plug-pantheon-shell/pull/413
+    (fetchpatch {
+      url = "https://github.com/elementary/switchboard-plug-pantheon-shell/commit/bdc8c167fabe5a4642efd37b0289e235e5d0a504.patch";
+      hash = "sha256-ueTAwURd8GM0U/qfPmoVLO7OVI/ppazq+ljnVzk0Npk=";
+    })
+  ];
+
   nativeBuildInputs = [
     gettext
     meson

pkgs/development/embedded/edl/default.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonPackage {
   pname = "edl";
-  version = "3.52.1-unstable-2024-08-27";
+  version = "3.52.1-unstable-2024-10-12";
 
   src = fetchFromGitHub {
     owner = "bkerler";
     repo = "edl";
-    rev = "d2c585e4ccc066895b71ca9014c1ebb5af316e07";
+    rev = "cef0076e1d4d29c1887c51786eb588503657b907";
     fetchSubmodules = true;
-    hash = "sha256-hQturda+iDmH5DVP1CjG526wcggdzTSrW2jqrEzLXtY=";
+    hash = "sha256-FOsgmM+i++t2MZiJTKV0Et8KXKDKQoFop67P6DdW1EY=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/development/interpreters/micropython/default.nix

@@ -9,16 +9,16 @@
 
 stdenv.mkDerivation rec {
   pname = "micropython";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "micropython";
     repo = "micropython";
     rev = "v${version}";
-    hash = "sha256-coUFIepbCRuz+766E7VCTQLm0oWB1CTO20ATriC86dc=";
+    hash = "sha256-cFoUa4ZpPy1MldlTeY9ISXi9ilulmhmaH5mapUDBzE8=";
     fetchSubmodules = true;
 
-    # remove unused libaries from rp2 port's SDK. we leave this and the other
+    # remove unused libraries from rp2 port's SDK. we leave this and the other
     # ports around for users who want to override makeFlags flags to build them.
     # https://github.com/micropython/micropython/blob/a61c446c0b34e82aeb54b9770250d267656f2b7f/ports/rp2/CMakeLists.txt#L17-L22
     #

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -8,7 +8,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, libX11 ? null, x11Support ? false
+, tcl ? null, tk ? null, tclPackages, libX11 ? null, x11Support ? false
 , zlib
 , self
 , coreutils
@@ -272,8 +272,8 @@ in with passthru; stdenv.mkDerivation ({
 
     setupHook = python-setup-hook sitePackages;
 
-    postPatch = lib.optionalString (x11Support && (tix != null)) ''
+    postPatch = lib.optionalString (x11Support && ((tclPackages.tix or null) != null)) ''
-          substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+          substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
     '';
 
     postInstall =

pkgs/development/interpreters/python/cpython/default.nix

@@ -35,7 +35,7 @@
 , tzdata
 , withGdbm ? !stdenv.hostPlatform.isWindows, gdbm
 , withReadline ? !stdenv.hostPlatform.isWindows, readline
-, x11Support ? false, tcl, tk, tix, libX11, xorgproto
+, x11Support ? false, tcl, tk, tclPackages, libX11, xorgproto
 
 # splicing/cross
 , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}"
@@ -324,10 +324,10 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   '' + optionalString mimetypesSupport ''
     substituteInPlace Lib/mimetypes.py \
       --replace-fail "@mime-types@" "${mailcap}"
-  '' + optionalString (pythonOlder "3.13" && x11Support && (tix != null)) ''
+  '' + optionalString (pythonOlder "3.13" && x11Support && ((tclPackages.tix or null) != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace-fail \
       "os.environ.get('TIX_LIBRARY')" \
-      "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+      "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
   env = {

pkgs/development/interpreters/python/pypy/default.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, substituteAll, fetchurl
 , zlibSupport ? true, zlib
 , bzip2, pkg-config, libffi, libunwind, Security
-, sqlite, openssl, ncurses, python, expat, tcl, tk, tix, libX11
+, sqlite, openssl, ncurses, python, expat, tcl, tk, tclPackages, libX11
 , gdbm, db, xz, python-setup-hook
 , optimizationLevel ? "jit", boehmgc
 # For the Python package set
@@ -98,7 +98,7 @@ in with passthru; stdenv.mkDerivation rec {
       --replace "multiprocessing.cpu_count()" "$NIX_BUILD_CORES"
 
     substituteInPlace "lib-python/${if isPy3k then "3/tkinter/tix.py" else "2.7/lib-tk/Tix.py"}" \
-      --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+      --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
   buildPhase = ''

pkgs/development/libraries/tomlplusplus/default.nix

@@ -1,29 +0,0 @@
-{ lib
-, stdenv
-, meson
-, cmake
-, ninja
-, fetchFromGitHub
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tomlplusplus";
-  version = "3.4.0";
-
-  src = fetchFromGitHub {
-    owner = "marzer";
-    repo = "tomlplusplus";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-h5tbO0Rv2tZezY58yUbyRVpsfRjY3i+5TPkkxr6La8M=";
-  };
-
-  nativeBuildInputs = [ meson cmake ninja ];
-
-  meta = with lib; {
-    homepage = "https://github.com/marzer/tomlplusplus";
-    description = "Header-only TOML config file parser and serializer for C++17";
-    license = licenses.mit;
-    maintainers = with maintainers; [ Scrumplex ];
-    platforms = platforms.unix;
-  };
-})

pkgs/development/python-modules/aiooui/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiooui";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "aiooui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dsMVKfY9o1krzp100/7JtClgPrpsFTVNwMnYMqOVFIU=";
+    hash = "sha256-vnO3Lh+d/8mES2i4jKTH4RviURUFqb3Vj6u5sxUGf1o=";
   };
 
   postPatch = ''

pkgs/development/python-modules/anitopy/default.nix

@@ -16,7 +16,6 @@ buildPythonPackage rec {
   };
 
   pythonImportsCheck = [ "anitopy" ];
-  doCheck = true;
 
   meta = with lib; {
     description = "Python library for parsing anime video filenames";

pkgs/development/python-modules/apple-weatherkit/default.nix

@@ -11,8 +11,8 @@
 
 buildPythonPackage rec {
   pname = "apple-weatherkit";
-  version = "1.1.2";
+  version = "1.1.3";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.11";
 
@@ -20,12 +20,12 @@ buildPythonPackage rec {
     owner = "tjhorner";
     repo = "python-weatherkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w3KinicaF01I6fIidI7XYHpB8eq52RTUw/BMLrx6Grk=";
+    hash = "sha256-JvN8GmlTxz9VGttIFVG6q//c+BhP2pt1tBOhnJhNwJg=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     aiohttp-retry
     pyjwt

pkgs/development/python-modules/beziers/default.nix

@@ -24,7 +24,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ pyclipper ];
 
-  doCheck = true;
   nativeCheckInputs = [
     dotmap
     matplotlib

pkgs/development/python-modules/coinmetrics-api-client/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2024.10.4.15";
+  version = "2024.10.15.19";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-4Ru614cCTMrAhelkVjDuHo7VcGYqaVeeAfaQkdBZr7k=";
+    hash = "sha256-TNpF8OihU0Z/mAUF/5hxpZgaqIBRUfX7zhwZAKd7OEo=";
   };
 
   pythonRelaxDeps = [ "typer" ];

pkgs/development/python-modules/collidoscope/default.nix

@@ -30,7 +30,6 @@ buildPythonPackage rec {
     uharfbuzz
   ];
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
   unittestFlagsArray = [
     "-s"

pkgs/development/python-modules/commandlines/default.nix

@@ -18,7 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-x3iUeOTAaTKNW5Y5foMPMJcWVxu52uYZoY3Hhe3UvQ4=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {

pkgs/development/python-modules/commitizen/default.nix

@@ -77,8 +77,6 @@ buildPythonPackage rec {
     pytest7CheckHook
   ];
 
-  doCheck = true;
-
   pythonImportsCheck = [ "commitizen" ];
 
   # The tests require a functional git installation

pkgs/development/python-modules/dehinter/default.nix

@@ -21,7 +21,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ fonttools ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {

pkgs/development/python-modules/dissect-jffs/default.nix

@@ -33,9 +33,6 @@ buildPythonPackage rec {
     dissect-util
   ];
 
-  # Test file handling fails
-  doCheck = true;
-
   pythonImportsCheck = [ "dissect.jffs" ];
 
   meta = with lib; {

pkgs/development/python-modules/doorbirdpy/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitLab,
   setuptools,
   aiohttp,
+  tenacity,
   aioresponses,
   pytest-asyncio,
   pytestCheckHook,
@@ -11,19 +12,22 @@
 
 buildPythonPackage rec {
   pname = "doorbirdpy";
-  version = "3.0.3";
+  version = "3.0.5";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "klikini";
     repo = "doorbirdpy";
     rev = "refs/tags/${version}";
-    hash = "sha256-0UvzMFYKM/Sb9B2XwZwl+a9v7lTxAc1H59vR88VwDww=";
+    hash = "sha256-SVkprX9fMy1uGixsxsE7gbUJndvl+V/kle3Rq34S6Hs=";
   };
 
   build-system = [ setuptools ];
 
-  dependencies = [ aiohttp ];
+  dependencies = [
+    aiohttp
+    tenacity
+  ];
 
   nativeCheckInputs = [
     aioresponses
@@ -31,6 +35,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # connection error on mock host
+    "test_info_auth_fails"
+  ];
+
   pythonImportsCheck = [ "doorbirdpy" ];
 
   meta = with lib; {

pkgs/development/python-modules/dropbox/default.nix

@@ -52,8 +52,6 @@ buildPythonPackage rec {
       --replace "'pytest-runner==5.2.0'," ""
   '';
 
-  doCheck = true;
-
   pythonImportsCheck = [ "dropbox" ];
 
   nativeBuildInputs = [

pkgs/development/python-modules/eigenpy/default.nix

@@ -50,7 +50,6 @@ buildPythonPackage rec {
     numpy
   ];
 
-  doCheck = true;
   pythonImportsCheck = [ "eigenpy" ];
 
   meta = with lib; {

pkgs/development/python-modules/font-v/default.nix

@@ -26,7 +26,6 @@ buildPythonPackage rec {
     gitpython
   ];
 
-  doCheck = true;
   nativeCheckInputs = [
     git
     pytestCheckHook

pkgs/development/python-modules/fontfeatures/default.nix

@@ -31,7 +31,6 @@ buildPythonPackage rec {
     youseedee
   ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
   disabledTestPaths = [
     # These tests require babelfont but we have to leave it out and skip them

pkgs/development/python-modules/gardena-bluetooth/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "gardena-bluetooth";
-  version = "1.4.3";
+  version = "1.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "elupus";
     repo = "gardena-bluetooth";
     rev = "refs/tags/${version}";
-    hash = "sha256-H2v96G/mu17puq8jNyk6L9iuWUvRombPd+s6byNQ4Zw=";
+    hash = "sha256-BV4chGkVp9H7gJQGKQZ0e4IiizMjCbDAU5MMf7hS9mE=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/gst-python/default.nix

@@ -53,8 +53,6 @@ buildPythonPackage rec {
     "-Dpython=${python.pythonOnBuildForHost.interpreter}"
   ];
 
-  doCheck = true;
-
   # TODO: Meson setup hook does not like buildPythonPackage
   # https://github.com/NixOS/nixpkgs/issues/47390
   installCheckPhase = "meson test --print-errorlogs";

pkgs/development/python-modules/iwlib/default.nix

@@ -23,7 +23,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [ pytest ];
   pythonImportsCheck = [ "iwlib" ];
 
-  doCheck = true;
   checkInputs = [ pytest ];
   checkPhase = "python iwlib/_iwlib_build.py; pytest -v";
 

pkgs/development/python-modules/kinparse/default.nix

@@ -19,7 +19,6 @@ buildPythonPackage {
     sha256 = "1nrjnybwzy93c79yylcwmb4lvkx7hixavnjwffslz0zwn32l0kx3";
   };
 
-  doCheck = true;
   pythonImportsCheck = [ "kinparse" ];
 
   nativeCheckInputs = [ pytest ];

pkgs/development/python-modules/kurbopy/default.nix

@@ -29,7 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-W0BebCXC1wqwtQP+zHjISxSJjXHD9U6p9eNS12Nfb2Y=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
   preCheck = ''
     # pytestCheckHook puts . at the front of Python's sys.path, due to:

pkgs/development/python-modules/langchain-core/default.nix

@@ -48,6 +48,8 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     jsonpatch
     langsmith

pkgs/development/python-modules/langchain/default.nix

@@ -58,6 +58,8 @@ buildPythonPackage rec {
 
   buildInputs = [ bash ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     aiohttp
     langchain-core

pkgs/development/python-modules/lcov-cobertura/default.nix

@@ -22,7 +22,6 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
   dependencies = [ distutils ];
 
-  doCheck = true;
   pythonImportsCheck = [ "lcov_cobertura" ];
 
   meta = {

pkgs/development/python-modules/linear-garage-door/default.nix

@@ -23,14 +23,10 @@ buildPythonPackage rec {
     hash = "sha256-ibOCqy7krIVC7N75SwEyUII3Tknb60nwA+zGbjOENv4=";
   };
 
-  postPatch = ''
-    sed -i pyproject.toml \
-      -e "/--cov/d" \
-      -e "/--no-cov/d"
-  '';
-
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "tenacity" ];
+
   dependencies = [
     aiohttp
     dnspython

pkgs/development/python-modules/meep/default.nix

@@ -122,7 +122,6 @@ buildPythonPackage rec {
     (calls `sim.run()`), as only then MPI will be initialised and MPI linking
     errors can be caught.
   */
-  doCheck = true;
   nativeCheckInputs = [
     mpiCheckPhaseHook
     openssh

pkgs/development/python-modules/mpi4py/default.nix

@@ -12,16 +12,14 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  # See https://github.com/mpi4py/mpi4py/issues/386 . Part of the changes since
+  version = "4.0.1";
-  # the last release include Python 3.12 fixes.
-  version = "3.1.6-unstable-2024-07-08";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "mpi4py";
     owner = "mpi4py";
-    rev = "e9a59719bbce1b9c351e1e30ecd3be3b459e97cd";
+    rev = version;
-    hash = "sha256-C/nidWGr8xsLV73u7HRtnXoQgYmoRJkD45DFrdXXTPI=";
+    hash = "sha256-pH4z+hyoFOSAUlXv9EKO54/SM5HyLxv7B+18xBidH2Q=";
   };
 
   build-system = [
@@ -40,10 +38,7 @@ buildPythonPackage rec {
     openssh
     mpiCheckPhaseHook
   ];
-  # Most tests pass, (besides `test_spawn.py`), but when reaching ~80% tests
+  doCheck = true;
-  # progress, an orted process hangs and the tests don't finish. This issue is
-  # probably due to the sandbox.
-  doCheck = false;
   disabledTestPaths = [
     # Almost all tests in this file fail (TODO: Report about this upstream..)
     "test/test_spawn.py"

pkgs/development/python-modules/nitrokey/default.nix

@@ -18,12 +18,12 @@
 
 buildPythonPackage rec {
   pname = "nitrokey";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hn/CYvuPRkT9NYzfB8skN3Z732xfmHu6xDTVI/nDbqU=";
+    hash = "sha256-tG6+diyrauJEzpPG33+S5o1ik3n44/443szR7vXH4gE=";
   };
 
   disabled = pythonOlder "3.9";

pkgs/development/python-modules/opentypespec/default.nix

@@ -15,7 +15,6 @@ buildPythonPackage rec {
     hash = "sha256-fOEHmtlCkFhn1jyIA+CsHIfud7x3PPb7UWQsnrVyDqY=";
   };
 
-  doCheck = true;
   nativeCheckInputs = [ unittestCheckHook ];
   unittestFlagsArray = [
     "-s"

pkgs/development/python-modules/osxphotos/default.nix

@@ -77,6 +77,7 @@ buildPythonPackage rec {
     "more-itertools"
     "objexplore"
     "textx"
+    "tenacity"
   ];
 
   pythonImportsCheck = [ "osxphotos" ];

pkgs/development/python-modules/ots-python/default.nix

@@ -32,7 +32,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ opentype-sanitizer ];
   nativeBuildInputs = [ setuptools-scm ];
 
-  doCheck = true;
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {

pkgs/development/python-modules/pid/default.nix

@@ -29,8 +29,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  doCheck = true;
-
   meta = with lib; {
     description = "Pidfile featuring stale detection and file-locking";
     homepage = "https://github.com/trbs/pid/";

pkgs/development/python-modules/py-aosmith/default.nix

@@ -22,9 +22,11 @@ buildPythonPackage rec {
     hash = "sha256-TjBjyWxBPrZEY/o1DZ+GiFTHTW37WwFN0oyJSyGru28=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  pythonRelaxDeps = [ "tenacity" ];
+
+  dependencies = [
     aiohttp
     tenacity
   ];

pkgs/development/python-modules/py3dns/default.nix

@@ -2,24 +2,20 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  flit-core,
 }:
 
 buildPythonPackage rec {
   pname = "py3dns";
-  version = "3.2.1";
+  version = "4.0.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1r25f0ys5p37bhld7m7n4gb0lrysaym3w318w2f8bncq7r3d81qz";
+    hash = "sha256-mGUugOzsFDxg948OazQWMcqadWDt2N3fyGTAKQJhijk=";
   };
 
-  preConfigure = ''
+  build-system = [ flit-core ];
-    sed -i \
-      -e '/import DNS/d' \
-      -e 's/DNS.__version__/"${version}"/g' \
-      setup.py
-  '';
 
   doCheck = false;