Merge staging-next into staging

nixos/modules/security/krb5/default.nix

@@ -77,8 +77,22 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
-    environment = {
+  config = {
+    assertions = mkIf (cfg.enable || config.services.kerberos_server.enable) [(let
+      implementation = cfg.package.passthru.implementation or "<NOT SET>";
+    in {
+      assertion = lib.elem implementation [ "krb5" "heimdal" ];
+      message = ''
+        `security.krb5.package` must be one of:
+
+          - krb5
+          - heimdal
+
+        Currently chosen implementation: ${implementation}
+      '';
+    })];
+
+    environment = mkIf cfg.enable {
       systemPackages = [ cfg.package ];
       etc."krb5.conf".source = format.generate "krb5.conf" cfg.settings;
     };

nixos/modules/security/krb5/krb5-conf-format.nix

@@ -7,17 +7,61 @@
 let
   inherit (lib) boolToString concatMapStringsSep concatStringsSep filter
     isAttrs isBool isList mapAttrsToList mkOption singleton splitString;
-  inherit (lib.types) attrsOf bool coercedTo either int listOf oneOf path
-    str submodule;
+  inherit (lib.types) attrsOf bool coercedTo either enum int listOf oneOf
+    path str submodule;
 in
-{ }: {
-  type = let
-    section = attrsOf relation;
-    relation = either (attrsOf value) value;
+{
+  enableKdcACLEntries ? false
+}: rec {
+  sectionType = let
+    relation = oneOf [
+      (listOf (attrsOf value))
+      (attrsOf value)
+      value
+    ];
     value = either (listOf atom) atom;
     atom = oneOf [int str bool];
+  in attrsOf relation;
+
+  type = let
+    aclEntry = submodule {
+      options = {
+        principal = mkOption {
+          type = str;
+          description = "Which principal the rule applies to";
+        };
+        access = mkOption {
+          type = either
+            (listOf (enum ["add" "cpw" "delete" "get" "list" "modify"]))
+            (enum ["all"]);
+          default = "all";
+          description = "The changes the principal is allowed to make.";
+        };
+        target = mkOption {
+          type = str;
+          default = "*";
+          description = "The principals that 'access' applies to.";
+        };
+      };
+    };
+
+    realm = submodule ({ name, ... }: {
+      freeformType = sectionType;
+      options = {
+        acl = mkOption {
+          type = listOf aclEntry;
+          default = [
+            { principal = "*/admin"; access = "all"; }
+            { principal = "admin"; access = "all"; }
+          ];
+          description = ''
+            The privileges granted to a user.
+          '';
+        };
+      };
+    });
   in submodule {
-    freeformType = attrsOf section;
+    freeformType = attrsOf sectionType;
     options = {
       include = mkOption {
         default = [ ];
@@ -40,7 +84,17 @@ in
         '';
         type = coercedTo path singleton (listOf path);
       };
+
+    }
+    //
+    (lib.optionalAttrs enableKdcACLEntries {
+      realms = mkOption {
+        type = attrsOf realm;
+        description = ''
+          The realm(s) to serve keys for.
+        '';
       };
+    });
   };
 
   generate = let
@@ -71,6 +125,9 @@ in
         ${name} = {
         ${indent (concatStringsSep "\n" (mapAttrsToList formatValue relation))}
         }''
+      else if isList relation
+      then
+        concatMapStringsSep "\n" (formatRelation name) relation
       else formatValue name relation;
 
     formatValue = name: value:

nixos/modules/services/system/kerberos/default.nix

@@ -1,75 +1,59 @@
-{config, lib, ...}:
+{ config, pkgs, lib, ... }:
 
 let
-  inherit (lib) mkOption mkIf types length attrNames;
+  inherit (lib) mkOption types;
   cfg = config.services.kerberos_server;
-  kerberos = config.security.krb5.package;
+  inherit (config.security.krb5) package;
 
-  aclEntry = {
-    options = {
-      principal = mkOption {
-        type = types.str;
-        description = "Which principal the rule applies to";
-      };
-      access = mkOption {
-        type = types.either
-          (types.listOf (types.enum ["add" "cpw" "delete" "get" "list" "modify"]))
-          (types.enum ["all"]);
-        default = "all";
-        description = "The changes the principal is allowed to make.";
-      };
-      target = mkOption {
-        type = types.str;
-        default = "*";
-        description = "The principals that 'access' applies to.";
-      };
-    };
-  };
-
-  realm = {
-    options = {
-      acl = mkOption {
-        type = types.listOf (types.submodule aclEntry);
-        default = [
-          { principal = "*/admin"; access = "all"; }
-          { principal = "admin"; access = "all"; }
-        ];
-        description = ''
-          The privileges granted to a user.
-        '';
-      };
-    };
-  };
+  format = import ../../../security/krb5/krb5-conf-format.nix { inherit pkgs lib; } { enableKdcACLEntries = true; };
 in
 
 {
   imports = [
+    (lib.mkRenamedOptionModule [ "services" "kerberos_server" "realms" ] [ "services" "kerberos_server" "settings" "realms" ])
+
     ./mit.nix
     ./heimdal.nix
   ];
 
-  ###### interface
   options = {
     services.kerberos_server = {
       enable = lib.mkEnableOption "the kerberos authentication server";
 
-      realms = mkOption {
-        type = types.attrsOf (types.submodule realm);
+      settings = mkOption {
+        type = format.type;
         description = ''
-          The realm(s) to serve keys for.
+          Settings for the kerberos server of choice.
+
+          See the following documentation:
+          - Heimdal: {manpage}`kdc.conf(5)`
+          - MIT Kerberos: <https://web.mit.edu/kerberos/krb5-1.21/doc/admin/conf_files/kdc_conf.html>
         '';
+        default = { };
       };
     };
   };
 
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ kerberos ];
-    assertions = [{
-      assertion = length (attrNames cfg.realms) <= 1;
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ package ];
+    assertions = [
+      {
+        assertion = cfg.settings.realms != { };
+        message = "The server needs at least one realm";
+      }
+      {
+        assertion = lib.length (lib.attrNames cfg.settings.realms) <= 1;
         message = "Only one realm per server is currently supported.";
-    }];
+      }
+    ];
+
+    systemd.slices.system-kerberos-server = { };
+    systemd.targets.kerberos-server = {
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  meta = {
+    doc = ./kerberos-server.md;
   };
 }

nixos/modules/services/system/kerberos/heimdal.nix

@@ -1,68 +1,87 @@
 { pkgs, config, lib, ... } :
 
 let
-  inherit (lib) mkIf concatStringsSep concatMapStrings toList mapAttrs
-    mapAttrsToList;
+  inherit (lib)  mapAttrs;
   cfg = config.services.kerberos_server;
-  kerberos = config.security.krb5.package;
-  stateDir = "/var/heimdal";
-  aclFiles = mapAttrs
-    (name: {acl, ...}: pkgs.writeText "${name}.acl" (concatMapStrings ((
-      {principal, access, target, ...} :
-      "${principal}\t${concatStringsSep "," (toList access)}\t${target}\n"
-    )) acl)) cfg.realms;
+  package = config.security.krb5.package;
 
-  kdcConfigs = mapAttrsToList (name: value: ''
-    database = {
-      dbname = ${stateDir}/heimdal
-      acl_file = ${value}
+  aclConfigs = lib.pipe cfg.settings.realms [
+    (mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
+      { principal, access, target, ... }:
+      "${principal}\t${lib.concatStringsSep "," (lib.toList access)}\t${target}"
+    ) acl))
+    (lib.mapAttrsToList (name: text:
+      {
+        dbname = "/var/lib/heimdal/heimdal";
+        acl_file = pkgs.writeText "${name}.acl" text;
       }
-  '') aclFiles;
-  kdcConfFile = pkgs.writeText "kdc.conf" ''
-    [kdc]
-    ${concatStringsSep "\n" kdcConfigs}
-  '';
+    ))
+  ];
+
+  finalConfig = cfg.settings // {
+    realms = mapAttrs (_: v: removeAttrs v [ "acl" ]) (cfg.settings.realms or { });
+    kdc = (cfg.settings.kdc or { }) // {
+      database = aclConfigs;
+    };
+  };
+
+  format = import ../../../security/krb5/krb5-conf-format.nix { inherit pkgs lib; } { enableKdcACLEntries = true; };
+
+  kdcConfFile = format.generate "kdc.conf" finalConfig;
 in
 
 {
-  # No documentation about correct triggers, so guessing at them.
+  config = lib.mkIf (cfg.enable && package.passthru.implementation == "heimdal") {
+    environment.etc."heimdal-kdc/kdc.conf".source = kdcConfFile;
+
+    systemd.tmpfiles.settings."10-heimdal" = let
+      databases = lib.pipe finalConfig.kdc.database [
+        (map (dbAttrs: dbAttrs.dbname or null))
+        (lib.filter (x: x != null))
+        lib.unique
+      ];
+    in lib.genAttrs databases (_: {
+      d = {
+        user = "root";
+        group = "root";
+        mode = "0700";
+      };
+    });
 
-  config = mkIf (cfg.enable && kerberos == pkgs.heimdal) {
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      serviceConfig.ExecStart =
-        "${kerberos}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+      partOf = [ "kerberos-server.target" ];
+      wantedBy = [ "kerberos-server.target" ];
+      serviceConfig = {
+        ExecStart = "${package}/libexec/kadmind --config-file=/etc/heimdal-kdc/kdc.conf";
+        Slice = "system-kerberos-server.slice";
+        StateDirectory = "heimdal";
+      };
       restartTriggers = [ kdcConfFile ];
     };
 
     systemd.services.kdc = {
       description = "Key Distribution Center daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      serviceConfig.ExecStart =
-        "${kerberos}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+      partOf = [ "kerberos-server.target" ];
+      wantedBy = [ "kerberos-server.target" ];
+      serviceConfig = {
+        ExecStart = "${package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+        Slice = "system-kerberos-server.slice";
+        StateDirectory = "heimdal";
+      };
       restartTriggers = [ kdcConfFile ];
     };
 
     systemd.services.kpasswdd = {
       description = "Kerberos Password Changing daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      serviceConfig.ExecStart = "${kerberos}/libexec/kpasswdd";
-      restartTriggers = [ kdcConfFile ];
+      partOf = [ "kerberos-server.target" ];
+      wantedBy = [ "kerberos-server.target" ];
+      serviceConfig = {
+        ExecStart = "${package}/libexec/kpasswdd";
+        Slice = "system-kerberos-server.slice";
+        StateDirectory = "heimdal";
       };
-
-    environment.etc = {
-      # Can be set via the --config-file option to KDC
-      "heimdal-kdc/kdc.conf".source = kdcConfFile;
+      restartTriggers = [ kdcConfFile ];
     };
   };
 }

nixos/modules/services/system/kerberos/kerberos-server.md

@@ -0,0 +1,55 @@
+# kerberos_server {#module-services-kerberos-server}
+
+Kerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
+
+This module provides both the MIT and Heimdal implementations of the a Kerberos server.
+
+## Usage {#module-services-kerberos-server-usage}
+
+To enable a Kerberos server:
+
+```nix
+{
+  security.krb5 = {
+    # Here you can choose between the MIT and Heimdal implementations.
+    package = pkgs.krb5;
+    # package = pkgs.heimdal;
+
+    # Optionally set up a client on the same machine as the server
+    enable = true;
+    settings = {
+      libdefaults.default_realm = "EXAMPLE.COM";
+      realms."EXAMPLE.COM" = {
+        kdc = "kerberos.example.com";
+        admin_server = "kerberos.example.com";
+      };
+    };
+  }
+
+  services.kerberos-server = {
+    enable = true;
+    settings = {
+      realms."EXAMPLE.COM" = {
+        acl = [{ principal = "adminuser"; access=  ["add" "cpw"]; }];
+      };
+    };
+  };
+}
+```
+
+## Notes {#module-services-kerberos-server-notes}
+
+- The Heimdal documentation will sometimes assume that state is stored in `/var/heimdal`, but this module uses `/var/lib/heimdal` instead.
+- Due to the heimdal implementation being chosen through `security.krb5.package`, it is not possible to have a system with one implementation of the client and another of the server.
+- While `services.kerberos_server.settings` has a common freeform type between the two implementations, the actual settings that can be set can vary between the two implementations. To figure out what settings are available, you should consult the upstream documentation for the implementation you are using.
+
+## Upstream Documentation {#module-services-kerberos-server-upstream-documentation}
+
+- MIT Kerberos homepage: https://web.mit.edu/kerberos
+- MIT Kerberos docs: https://web.mit.edu/kerberos/krb5-latest/doc/index.html
+
+- Heimdal Kerberos GitHub wiki: https://github.com/heimdal/heimdal/wiki
+- Heimdal kerberos doc manpages (Debian unstable): https://manpages.debian.org/unstable/heimdal-docs/index.html
+- Heimdal Kerberos kdc manpages (Debian unstable): https://manpages.debian.org/unstable/heimdal-kdc/index.html
+
+Note the version number in the URLs, it may be different for the latest version.

nixos/modules/services/system/kerberos/mit.nix

@@ -1,31 +1,37 @@
 { pkgs, config, lib, ... } :
 
 let
-  inherit (lib) mkIf concatStrings concatStringsSep concatMapStrings toList
-    mapAttrs mapAttrsToList;
+  inherit (lib) mapAttrs;
   cfg = config.services.kerberos_server;
-  kerberos = config.security.krb5.package;
-  stateDir = "/var/lib/krb5kdc";
+  package = config.security.krb5.package;
   PIDFile = "/run/kdc.pid";
+
+  format = import ../../../security/krb5/krb5-conf-format.nix { inherit pkgs lib; } { enableKdcACLEntries = true; };
+
   aclMap = {
     add = "a"; cpw = "c"; delete = "d"; get = "i"; list = "l"; modify = "m";
     all = "*";
   };
-  aclFiles = mapAttrs
-    (name: {acl, ...}: (pkgs.writeText "${name}.acl" (concatMapStrings (
-      {principal, access, target, ...} :
-      let access_code = map (a: aclMap.${a}) (toList access); in
-      "${principal} ${concatStrings access_code} ${target}\n"
-    ) acl))) cfg.realms;
-  kdcConfigs = mapAttrsToList (name: value: ''
+
+  aclConfigs = lib.pipe cfg.settings.realms [
+    (mapAttrs (name: { acl, ... }: lib.concatMapStringsSep "\n" (
+      { principal, access, target, ... }: let
+        access_code = map (a: aclMap.${a}) (lib.toList access);
+      in "${principal} ${lib.concatStrings access_code} ${target}"
+    ) acl))
+
+    (lib.concatMapAttrs (name: text: {
       ${name} = {
-      acl_file = ${value}
-    }
-  '') aclFiles;
-  kdcConfFile = pkgs.writeText "kdc.conf" ''
-    [realms]
-    ${concatStringsSep "\n" kdcConfigs}
-  '';
+        acl_file = pkgs.writeText "${name}.acl" text;
+      };
+    }))
+  ];
+
+  finalConfig = cfg.settings // {
+    realms = mapAttrs (n: v: (removeAttrs v [ "acl" ]) // aclConfigs.${n}) (cfg.settings.realms or { });
+  };
+
+  kdcConfFile = format.generate "kdc.conf" finalConfig;
   env = {
     # What Debian uses, could possibly link directly to Nix store?
     KRB5_KDC_PROFILE = "/etc/krb5kdc/kdc.conf";
@@ -33,36 +39,38 @@ let
 in
 
 {
-  config = mkIf (cfg.enable && kerberos == pkgs.krb5) {
+  config = lib.mkIf (cfg.enable && package.passthru.implementation == "krb5") {
+    environment = {
+      etc."krb5kdc/kdc.conf".source = kdcConfFile;
+      variables = env;
+    };
+
     systemd.services.kadmind = {
       description = "Kerberos Administration Daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
-      serviceConfig.ExecStart = "${kerberos}/bin/kadmind -nofork";
+      partOf = [ "kerberos-server.target" ];
+      wantedBy = [ "kerberos-server.target" ];
+      serviceConfig = {
+        ExecStart = "${package}/bin/kadmind -nofork";
+        Slice = "system-kerberos-server.slice";
+        StateDirectory = "krb5kdc";
+      };
       restartTriggers = [ kdcConfFile ];
       environment = env;
     };
 
     systemd.services.kdc = {
       description = "Key Distribution Center daemon";
-      wantedBy = [ "multi-user.target" ];
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-      '';
+      partOf = [ "kerberos-server.target" ];
+      wantedBy = [ "kerberos-server.target" ];
       serviceConfig = {
         Type = "forking";
         PIDFile = PIDFile;
-        ExecStart = "${kerberos}/bin/krb5kdc -P ${PIDFile}";
+        ExecStart = "${package}/bin/krb5kdc -P ${PIDFile}";
+        Slice = "system-kerberos-server.slice";
+        StateDirectory = "krb5kdc";
       };
       restartTriggers = [ kdcConfFile ];
       environment = env;
     };
-
-    environment.etc = {
-      "krb5kdc/kdc.conf".source = kdcConfFile;
-    };
-    environment.variables = env;
   };
 }

nixos/tests/kerberos/heimdal.nix

@@ -4,7 +4,7 @@ import ../make-test-python.nix ({pkgs, ...}: {
   nodes.machine = { config, libs, pkgs, ...}:
   { services.kerberos_server =
     { enable = true;
-      realms = {
+      settings.realms = {
         "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
       };
     };

nixos/tests/kerberos/mit.nix

@@ -4,7 +4,7 @@ import ../make-test-python.nix ({pkgs, ...}: {
   nodes.machine = { config, libs, pkgs, ...}:
   { services.kerberos_server =
     { enable = true;
-      realms = {
+      settings.realms = {
         "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
       };
     };

nixos/tests/kubo/default.nix

@@ -1,7 +1,5 @@
 { recurseIntoAttrs, runTest }:
 recurseIntoAttrs {
   kubo = runTest ./kubo.nix;
-  # The FUSE functionality is completely broken since Kubo v0.24.0
-  # See https://github.com/ipfs/kubo/issues/10242
-  # kubo-fuse = runTest ./kubo-fuse.nix;
+  kubo-fuse = runTest ./kubo-fuse.nix;
 }

nixos/tests/kubo/kubo-fuse.nix

@@ -23,7 +23,7 @@
 
     with subtest("FUSE mountpoint"):
         machine.fail("echo a | su bob -l -c 'ipfs add --quieter'")
-        # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
+        # The FUSE mount functionality is broken as of v0.13.0. This is still the case with v0.29.0.
         # See https://github.com/ipfs/kubo/issues/9044.
         # Workaround: using CID Version 1 avoids that.
         ipfs_hash = machine.succeed(

pkgs/applications/blockchains/trezor-suite/default.nix

@@ -8,7 +8,7 @@
 
 let
   pname = "trezor-suite";
-  version = "24.5.3";
+  version = "24.5.4";
   name = "${pname}-${version}";
 
   suffix = {
@@ -19,8 +19,8 @@ let
   src = fetchurl {
     url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
     hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-      aarch64-linux = "sha512-CFkL7vVYz6cS3iHyfG026+c4T3h9y3yDhNkwMKhbrt7hK33Yj1yLQUBw826DUmUNOgwomRwubz5jigCl2724bw==";
-      x86_64-linux  = "sha512-JgcnCiq/ozrYDMH7zIns5c6x7TwtpJ6VVg6PUkcoDDgmr9ngIJmAdb+/v9mJUv98WNAPKmhCt0/H9DY2qWJ2Bg==";
+      aarch64-linux = "sha512-gkN6e4Ndc96FT6vaCmSxuViTKuOc5vnCqptPN8IRno9Nv8L0k6hB7O+0g5E+9hd+3o5WASXKefYIOZAnPI3RZA==";
+      x86_64-linux  = "sha512-uHMI0fm02XdOyt6mAXEZuTZkNlNykTQbJNeGATBrlLLR98cxrOj8DQ1S7gPd5dkQCJzdmR7ydylj/XPOHsV2Ug==";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1ypxzk3p1acv6g9418bchbwi82imnvljgn8h6mjqwqzbf3khf5kd";
-    x86_64-darwin = "0nm3765mzqlagbilb01s0zy9zww8rmf8bjlqq0vwvrxxfl7vbyl3";
-    aarch64-linux = "0f0cwihiwvpck625s91hc838hzyiylbir3m23r4ncjws298ckyg5";
-    aarch64-darwin = "1h7cldjwb8hyx7vq2almplwxl667cc8dw3iv2mqigrx3ibk6sss6";
-    armv7l-linux = "0a0iy109qjwj1ri23xmmfa3j3mngz72ljw2m0czaf8rkcaglxa1v";
+    x86_64-linux = "039yb1v4vcgsyp3gfvsfm7pxivf20ycyvidhrk26jfm54ghbbnlz";
+    x86_64-darwin = "1nkwww12yalkxja8vdln45kzrbybhrca8q0zxj8kk9s8bdzsvr5d";
+    aarch64-linux = "0pz8qji6n7j0vrm4l84vxw2sad6q3swz7jda4zyw1n13y7p9kpcj";
+    aarch64-darwin = "1a1b233f28x0v7rb7295jdivzxqvp812x585vacxx1qfmpn6mabl";
+    armv7l-linux = "12569045nzz5zsmaqd4xvq5lmajcl7w3qdv0n9m5rh2g6s32585c";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.90.0";
+    version = "1.90.1";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "89de5a8d4d6205e5b11647eb6a74844ca23d2573";
+    rev = "611f9bfce64f25108829dd295f54a6894e87339d";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "0rwdvbig0a6mzgcn0zb08caaxyx5rk0741f8an3y0vavzgi5k38f";
+        sha256 = "1j4fd3281jsm10ngq9lzwph3nil0xwbypc180sh5wifb66bmprf6";
       };
     };
 

pkgs/applications/editors/xed-editor/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.6.1";
+  version = "3.6.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    sha256 = "sha256-RFauTXwiaSd+J8zoJQmib4bKNR4NC/LSCCqCHv8Hdr8=";
+    sha256 = "sha256-+yY+vzDMeS4AMMAklzADD4/LAQgav3clM2CCK6xh47Q=";
   };
 
   patches = [

pkgs/applications/misc/calcure/default.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "calcure";
-  version = "3.0.1";
+  version = "3.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anufrievroman";
     repo = "calcure";
     rev = "refs/tags/${version}";
-    hash = "sha256-rs3TCZjMndeh2N7e+U62baLs+XqWK1Mk7KVnypSnWPg=";
+    hash = "sha256-2yWg/9NQxFIwoSLj1e0y1+tgKer8GtOmjzwlTRX/Q+c=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/applications/misc/sticky/default.nix

@@ -15,17 +15,16 @@
 
 stdenv.mkDerivation rec {
   pname = "sticky";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-nvnft62vZ9ivijYnQGULW7ff2aAVJiIx9xq09My2NxE=";
+    hash = "sha256-HzTXaJgDu72pWM0mGNNBy2yFB0u0rqATFK9JzyOw8oE=";
   };
 
   postPatch = ''
-    sed -i -e "s|/usr/bin|$out/bin|" data/org.x.sticky.service
     sed -i -e "s|/usr/lib|$out/lib|" usr/bin/sticky
     sed -i -e "s|/usr/share|$out/share|" usr/lib/sticky/*.py
   '';
@@ -51,20 +50,11 @@ stdenv.mkDerivation rec {
     xapp
   ];
 
-  postInstall = ''
-    # https://github.com/linuxmint/sticky/pull/118
-    cp -r ../etc $out
-    cp -r ../usr/* $out
-
-    glib-compile-schemas $out/share/glib-2.0/schemas
-  '';
-
   dontWrapGApps = true;
 
   preFixup = ''
     buildPythonPath "$out $pythonPath"
 
-    chmod +x $out/bin/sticky
     wrapProgram $out/bin/sticky \
       --prefix PYTHONPATH : "$program_PYTHONPATH" \
       ''${gappsWrapperArgs[@]}

pkgs/applications/networking/cluster/cilium/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.9";
+  version = "0.16.10";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-aER0VLYkHV0mPM4uBaKLPVmQ+Re5KUm8/01l87wMnF8=";
+    hash = "sha256-SgAqq9tT4Rtg1AvoUsDvR5cCLIOuHwNUFN2NOheciYw=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/jx/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.10.146";
+  version = "3.10.150";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-cbf/prSKHiu4I6w08j/HLD8c7Lrgt3eTC5QRVvuhS5w=";
+    sha256 = "sha256-Zck06wbe+hLbecFnfY/udi1s712ilt7j0EdoumohOEI=";
   };
 
   vendorHash = "sha256-AIaZVkWdNj1Vsrv2k4B5lLE0lOFuiTD7lwS/DikmC14=";

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "neomutt";
     homepage    = "https://www.neomutt.org";
     license     = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ erikryb vrthra ma27 raitobezarius ];
+    maintainers = with lib.maintainers; [ erikryb vrthra raitobezarius ];
     platforms   = lib.platforms.unix;
   };
 })

pkgs/applications/networking/testssl/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "testssl.sh";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchFromGitHub {
     owner = "drwetter";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gkDtJlAC7woM2HyYDXntD1+bEuqHTEipqrn2EZjxnH8=";
+    sha256 = "sha256-MZNQ7oOJD/vjOwDiPOZr3k+Mn0XXVdkP7cC/0mnWLic=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/office/treesheets/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "0-unstable-2024-06-05";
+  version = "0-unstable-2024-06-09";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "1ad0ec1ad235dd00bbd6bfdb27e24f3dcd610da4";
-    hash = "sha256-1Xb4Jdw04E2xTg/93zsGse3Yao8h51kDcJpbvx41yp0=";
+    rev = "c753ce40686c3044eb7fb653bb913d1610096cd1";
+    hash = "sha256-WpbG2RY7z71GBSDjv/VjcFsGcb/YK7P4oMVEydsYpuw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/version-management/git-interactive-rebase-tool/default.nix

@@ -2,41 +2,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-interactive-rebase-tool";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "MitMaro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tMeA2LsNCXxI086y8S+STYwjClWMPaBheP0s0oZ5I5c=";
+    hash = "sha256-xwvL6QX+eMbxCouE1i86j/PRCxTJVAQnRVeK6fYQo/M=";
   };
 
-  postPatch = ''
-    # error: lint `unused_tuple_struct_fields` has been renamed to `dead_code`
-    substituteInPlace scripts/data/lints.rs src/main.rs src/{config,core,display,git,input,runtime,testutils,todo_file,view}/src/lib.rs \
-      --replace-fail "unused_tuple_struct_fields," ""
-  '';
-
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "claim-0.5.0" = "sha256-quVV5PnWW1cYK+iSOM/Y0gLu2gPOrZ1ytJif0D5v9g0=";
-    };
-  };
+  cargoHash = "sha256-RDGbsmOBVMxInstTrRZK0G5eZR79ZoFK5UlkCj3zpoY=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
   # Compilation during tests fails if this env var is not set.
   preCheck = "export GIRT_BUILD_GIT_HASH=${version}";
   postCheck = "unset GIRT_BUILD_GIT_HASH";
-  cargoTestFlags = [
-    "--workspace"
-    # build everything except for doctests which are currently broken because
-    # `config::lib` expects the sourcetree to be a git repo.
-    "--tests"
-    "--lib"
-    "--bins"
-  ];
 
   meta = with lib; {
     homepage = "https://github.com/MitMaro/git-interactive-rebase-tool";

pkgs/applications/version-management/git-town/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "14.2.1";
+  version = "14.2.2";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     rev = "v${version}";
-    hash = "sha256-7wsN95I8Xa5CXh1Mg3Wv4gyTSRzZMqJ06ALLsud3l2k=";
+    hash = "sha256-bYCE3Ik0UbbjlZV8EY6pVRZzrTBp2uiZLJjO4UxfGE8=";
   };
 
   vendorHash = null;

pkgs/applications/virtualization/ddev/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddev";
-  version = "1.23.1";
+  version = "1.23.2";
 
   src = fetchFromGitHub {
     owner = "ddev";
     repo = "ddev";
     rev = "v${version}";
-    hash = "sha256-qGuYH2xYmd3CYoYobjoum+zUImcsiaG5No36FG0H0bA=";
+    hash = "sha256-pzBSyCIA2r/4zYIYEmKF6c0gryudSKZebSXSpmJUbsQ=";
   };
 
   vendorHash = null;

pkgs/by-name/ca/cargo-xwin/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.16.4";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-nJgy9KoqrCD4NGFOJMN9f1XDyIrZ0a5WHTRX6G/+tnU=";
+    hash = "sha256-3vQ7pM7Ui0H6qWFWOCW4LzDLJq8bcoFEJrpoa4Tzk9g=";
   };
 
-  cargoHash = "sha256-JCCL/QV1DjmXTY3UChZ4BfA9VSyOTQLIfh6DSF/kIuA=";
+  cargoHash = "sha256-4uWPbwntcD4YKdjTlWfMGqM+rddKzaXH1YTX9qLrWrY=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security

pkgs/by-name/co/commitlint-rs/package.nix

@@ -0,0 +1,41 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  rustPlatform,
+  testers,
+  commitlint-rs,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "commitlint-rs";
+  version = "0.1.11";
+
+  src = fetchFromGitHub {
+    owner = "KeisukeYamashita";
+    repo = "commitlint-rs";
+    rev = "v${version}";
+    hash = "sha256-FrYXEh75H0u1rE1YNDL/B1gMYMG43jPDJGUMv9y5/3g=";
+  };
+  cargoHash = "sha256-W6HkLCUoylgQQc2fFprmJeLH8KtpVUD4+BXWbNECVZ4=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = commitlint-rs; };
+  };
+
+  meta = with lib; {
+    description = "Lint commit messages with conventional commit messages";
+    homepage = "https://keisukeyamashita.github.io/commitlint-rs";
+    changelog = "https://github.com/KeisukeYamashita/commitlint-rs/releases/tag/${src.rev}";
+    license = with licenses; [
+      mit
+      asl20
+    ];
+    mainProgram = "commitlint";
+    platforms = with platforms; unix ++ windows;
+    maintainers = with maintainers; [
+      croissong
+      getchoo
+    ];
+  };
+}

pkgs/by-name/do/doppler/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.68.0";
+  version = "3.69.0";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-IKfLoCFJOGE200Mef660CQNMukEmpgIWo6ngOYvX5Hw=";
+    sha256 = "sha256-lijVKNmqTcmjgIzlcMdm/DUrBA+0xV6Wge9dt5xdWFY=";
   };
 
   vendorHash = "sha256-NUHWKPszQH/pvnA+j65+bJ6t+C0FDRRbTviqkYztpE4=";

pkgs/by-name/ha/hacompanion/package.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hacompanion";
-  version = "1.0.12";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${version}";
-    hash = "sha256-3uPn139e8TyP0rE9hfRKw192YyexG+f3KmlHMmgCN7A=";
+    hash = "sha256-FR2IowbaHXr9x/eMt+NCuGusMwX2iVxPOuWEkhH2GFM=";
   };
 
   vendorHash = "sha256-ZZ8nxN+zUeFhSXyoHLMgzeFllnIkKdoVnbVK5KjrLEQ=";

pkgs/by-name/ho/home-manager/package.nix

@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2024-06-04";
+  version = "0-unstable-2024-06-13";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "a7117efb3725e6197dd95424136f79147aa35e5b";
-    hash = "sha256-5z2422pzWnPXHgq2ms8lcCfttM0dz+hg+x1pCcNkAws=";
+    rev = "8d5e27b4807d25308dfe369d5a923d87e7dbfda3";
+    hash = "sha256-abBpj2VU8p6qlRzTU8o22q68MmOaZ4v8zZ4UlYl5YRU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/id/ida-free/package.nix

@@ -50,8 +50,11 @@ stdenv.mkDerivation rec {
     desktopName = "IDA Free";
     genericName = "Interactive Disassembler";
     categories = [ "Development" ];
+    startupWMClass = "IDA";
   };
 
+  desktopItems = [ desktopItem ];
+
   nativeBuildInputs = [ makeWrapper copyDesktopItems autoPatchelfHook libsForQt5.wrapQtAppsHook ];
 
   # We just get a runfile in $src, so no need to unpack it.

pkgs/by-name/im/impala/package.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "impala";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "pythops";
+    repo = "impala";
+    rev = "v${version}";
+    hash = "sha256-r/aWzSn/Dci69oS/yopG6Ro34U8hniHVanctyM7RvDw=";
+  };
+
+  cargoHash = "sha256-IV1ftsRyM0CUlQMVmLip1FiqnouT5TsKASpF/KLARqY=";
+
+  meta = {
+    description = "TUI for managing wifi";
+    homepage = "https://github.com/pythops/impala";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.nydragon ];
+  };
+}

pkgs/by-name/ki/kitex/package.nix

@@ -0,0 +1,42 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, testers
+, kitex
+}:
+
+buildGoModule rec {
+  pname = "kitex";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "cloudwego";
+    repo = "kitex";
+    rev = "v${version}";
+    hash = "sha256-U61n+zaTnABujDSTPcKr4zfMmPVQwxQAotBXZaOVZSo=";
+  };
+
+  vendorHash = "sha256-luZH7ynFni5J3CmLRM3jJPshs/u3zahkS1qS2phopLc=";
+
+  subPackages = [ "tool/cmd/kitex" ];
+
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    ln -s $out/bin/kitex $out/bin/protoc-gen-kitex
+    ln -s $out/bin/kitex $out/bin/thrift-gen-kitex
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = kitex;
+    version = "v${version}";
+  };
+
+  meta = with lib;  {
+    description = "A high-performance and strong-extensibility Golang RPC framework";
+    homepage = "https://github.com/cloudwego/kitex";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ aaronjheng ];
+    mainProgram = "kitex";
+  };
+}

pkgs/by-name/ku/kubo/package.nix

@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.28.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.29.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "15"; # Also update kubo-migrator when changing the repo version
@@ -15,7 +15,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-nq9NpbK9Fql0o1TG8p9lIlnKUnxvMMimz8AYKVozkwY=";
+    hash = "sha256-udCVyA3NN3RCmVtdIjccfy/RymvrsGJoxlF8DiapP4g=";
   };
 
   # tarball contains multiple files/directories
@@ -41,9 +41,9 @@ buildGoModule rec {
 
   postPatch = ''
     substituteInPlace 'misc/systemd/ipfs.service' \
-      --replace '/usr/local/bin/ipfs' "$out/bin/ipfs"
+      --replace-fail '/usr/local/bin/ipfs' "$out/bin/ipfs"
     substituteInPlace 'misc/systemd/ipfs-hardened.service' \
-      --replace '/usr/local/bin/ipfs' "$out/bin/ipfs"
+      --replace-fail '/usr/local/bin/ipfs' "$out/bin/ipfs"
   '';
 
   postInstall = ''

pkgs/by-name/me/melonDS/package.nix

@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "melonDS";
-  version = "0.9.5-unstable-2024-05-15";
+  version = "0.9.5-unstable-2024-06-08";
 
   src = fetchFromGitHub {
     owner = "melonDS-emu";
     repo = "melonDS";
-    rev = "a72b79a55ad2d61811af11b1b911f6af863f66c2";
-    hash = "sha256-cdKfJ316iuRajdrRESt68oR8vkHISFRdHXxVuvGSUqE=";
+    rev = "8e9b88d01da0d21c3c35db051d7e44d8ee0c7715";
+    hash = "sha256-zlOK5yhg9rmLMDnCxQ9CDAy+qWZdvKwTaKxzna1zxxk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/my/myks/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     rev = "refs/tags/v${version}";
-    hash = "sha256-keXtMO5EhCaG5lNoCf5vmnhidH4+sDQ2na4f76jELnw=";
+    hash = "sha256-98JkyRszWls2fWS3JxlYa8MRHKpC2ViiDoH8VEk6r3Q=";
   };
 
-  vendorHash = "sha256-0Xk7B0rfngld9tfgMmq2EiuUym7LE89TvJVSdDo4HD4=";
+  vendorHash = "sha256-blx/Q787h1eBUmg45VFydqH8hmrCpcobJwIWvTUNDEo=";
 
   subPackages = ".";
 

pkgs/by-name/ne/netclient/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "netclient";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${version}";
-    hash = "sha256-oS0DqrlOyab0MS7qSEquEIixcOYnlGuCYtCBmfEURm0=";
+    hash = "sha256-7+r2fuFNVvOC0Zl1kqAiAh9C3qqhg7KGrbnOp4Jk+Is=";
   };
 
-  vendorHash = "sha256-09pRwsB2ycB/MK3isXZLBZDpga95SHYkNPjWWYtUuoU=";
+  vendorHash = "sha256-eTiNBs8xcfrth/E44URhD8uSgdoXZT1+MD3H24dzI1A=";
 
   buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     ++ lib.optional stdenv.isLinux libX11;

pkgs/by-name/r0/r0vm/package.nix

@@ -10,12 +10,12 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "r0vm";
-  version = "0.21.0";
+  version = "1.0.1";
   src = fetchFromGitHub {
     owner = "risc0";
     repo = "risc0";
     rev = "v${version}";
-    sha256 = "sha256-BIQd6yX453v4w8aU+2awcngOE6t4oIf7BseVLgPG4Bw=";
+    sha256 = "sha256-0Y7+Z2TEm5ZbEkbO8nSOZulGuZAgl9FdyEVNmqV7S8U=";
   };
 
   buildAndTestSubdir = "risc0/r0vm";
@@ -33,16 +33,16 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false;
 
-  cargoHash = "sha256-OsxCIFgJiHfx52nRYRNLTB501RGKSBPQs2MQAs/BFfc=";
+  cargoHash = "sha256-3DwrWkjPCE4f/FHjzWyRGAXJPv30B4Ce8fh2oKDhpMM=";
 
   postPatch =
     let
-      # see https://github.com/risc0/risc0/blob/v0.21.0/risc0/circuit/recursion/build.rs
-      sha256Hash = "3504a2542626acb974dea1ae5542c90c032c4ef42f230977f40f245442a1ec23";
+      # see https://github.com/risc0/risc0/blob/v1.0.1/risc0/circuit/recursion/build.rs
+      sha256Hash = "4e8496469e1efa00efb3630d261abf345e6b2905fb64b4f3a297be88ebdf83d2";
       recursionZkr = fetchurl {
         name = "recursion_zkr.zip";
         url = "https://risc0-artifacts.s3.us-west-2.amazonaws.com/zkr/${sha256Hash}.zip";
-        sha256 = "sha256:08zcl515890gyivhj8rgyi72q0qcr515bbm1vrsbkb164raa411m";
+        sha256 = "sha256-ToSWRp4e+gDvs2MNJhq/NF5rKQX7ZLTzope+iOvfg9I=";
       };
     in
     ''

pkgs/by-name/rc/rcp/package.nix

@@ -7,20 +7,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rcp";
-  version = "0.9.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "wykurz";
     repo = "rcp";
     rev = "v${version}";
-    hash = "sha256-e6m3E1R7o4X9cPEy/ayUIsK0xhRaVsAFDAwObJrDJPA=";
+    hash = "sha256-nNMcZyJAvqxVSoytmfSqsfk1yVzzZ5aIOj72L+jFAAM=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     IOKit
   ]);
 
-  cargoHash = "sha256-croFSe37yQa9LijaNxKHrZlcJdExz9SweOoG21PPn9E=";
+  cargoHash = "sha256-3+w+pTws8WjrUqIWYGbE2V438mVUUyrjBH9mHI8uRMQ=";
 
   RUSTFLAGS = "--cfg tokio_unstable";
 

pkgs/by-name/re/renode-dts2repl/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2024-06-03";
+  version = "0-unstable-2024-06-11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "f3a5ca54a6642c7e8e539bc5e62e676a4c6aa2a1";
-    hash = "sha256-fi/ihHXCFFNhEPO9EcdxTmNun96TbvXUup3V5lbxN0g=";
+    rev = "7360c07d2ef1e32661a0efa04323e799d400a58e";
+    hash = "sha256-lN3IgLOAeMexWG5zQB9RxRld7Snl3aqNJt3fZV5hdnM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sp/spatial-shell/package.nix

@@ -0,0 +1,37 @@
+{ lib
+, ocamlPackages
+, fetchFromGitHub
+, scdoc
+}:
+
+ocamlPackages.buildDunePackage rec {
+  pname = "spatial-shell";
+  version = "7";
+
+  src = fetchFromGitHub {
+    owner = "lthms";
+    repo = "spatial-shell";
+    rev = version;
+    hash = "sha256-OeNBP/jea1ABh/WpvCP7We+L20WoTfLZH71raH7bKPI=";
+  };
+
+  nativeBuildInputs = [
+    scdoc
+  ];
+
+  buildInputs = with ocamlPackages; [
+    cmdliner
+    ezjsonm-encoding
+    poll
+  ];
+
+  meta = {
+    description = "Implementing a spatial model inspired by Material Shell, for i3 and sway";
+    homepage = "https://spatial-shell.app";
+    changelog = "https://github.com/lthms/spatial-shell/blob/${src.rev}/CHANGES.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "spatial";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/st/stackql/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "stackql";
-  version = "0.5.652";
+  version = "0.5.665";
 
   src = fetchFromGitHub {
     owner = "stackql";
     repo = "stackql";
     rev = "v${version}";
-    hash = "sha256-yE+XMAEsEYj2W3My2gXzZ2QD+YXj62BrzOa/mL+yMCE=";
+    hash = "sha256-oX1WB6XkjEPzbj3qqXoD8urp827LAU7Cc7lLcpTTZJE=";
   };
 
-  vendorHash = "sha256-Tcfj1A3W07GkF7CECc5Tu9Er8n+OxsDrUgv7eSlu+wA=";
+  vendorHash = "sha256-JCWXs3tfTG+aj4hG0eFhl52FmNFvPiBuWpQG2RC6FTM=";
 
   ldflags = [
     "-s"

pkgs/by-name/up/updatecli/package.nix

@@ -1,9 +1,12 @@
-{ lib
-, go
-, buildGoModule
-, fetchFromGitHub
-, nix-update-script
-, installShellFiles
+{
+  lib,
+  go,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  installShellFiles,
+  testers,
+  updatecli,
 }:
 
 buildGoModule rec {
@@ -12,7 +15,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "updatecli";
-    repo = pname;
+    repo = "updatecli";
     rev = "v${version}";
     hash = "sha256-VpMi+r7QUSD99PRzbTeIxXn1O9GdfHNJM1F0OBzvNmc=";
   };
@@ -32,7 +35,13 @@ buildGoModule rec {
     "-X github.com/updatecli/updatecli/pkg/core/version.Version=${version}"
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = updatecli;
+      command = "updatecli version";
+    };
+  };
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -52,7 +61,7 @@ buildGoModule rec {
       Updatecli is a command-line tool used to define and apply update strategies.
     '';
     homepage = "https://www.updatecli.io";
-    changelog = "https://github.com/updatecli/updatecli/releases/tag/v${version}";
+    changelog = "https://github.com/updatecli/updatecli/releases/tag/${src.rev}";
     license = licenses.asl20;
     mainProgram = "updatecli";
     maintainers = with maintainers; [ croissong ];

pkgs/by-name/vc/vcpkg-tool/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2024-04-23";
+  version = "2024-06-10";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-PqmkQcpxuYJGZJs2qemv0hshvO4KTiKc1ZY0//Gq0pY=";
+    hash = "sha256-TGRTzUd1FtErD+h/ksUsUm1Rhank9/yVy06JbAgEEw0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vp/vpl-gpu-rt/package.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "24.2.2";
+  version = "24.2.3";
 
   outputs = [ "out" "dev" ];
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    sha256 = "sha256-JtvRh4p4wPRnqFfE86tJW+yS9AKMoi3TPZO+LZ2Q7Mo=";
+    sha256 = "sha256-n2lkt7zRlpbPedNxa21EQvFdYyOAPF//TsY4srbGHQE=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/by-name/zf/zfind/package.nix

@@ -0,0 +1,30 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "zfind";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "laktak";
+    repo = "zfind";
+    rev = "v${version}";
+    hash = "sha256-T0cTEjjF9GTe+knixsgnbNfACUvbx92PUbLE+wgZ7sk=";
+  };
+
+  vendorHash = "sha256-mmoJrqWRmJTAR2wkAB52mpYEEj3XD+jHvlVrw51vqys=";
+
+  ldflags = [ "-X" "main.appVersion=${version}" ];
+
+  meta = with lib; {
+    description = "CLI for file search with SQL like syntax.";
+    longDescription = ''
+      zfind allows you to search for files, including inside tar, zip, 7z and rar archives.
+      It makes finding files easy with a filter syntax that is similar to an SQL-WHERE clause.
+    '';
+    homepage = "https://github.com/laktak/zfind";
+    changelog = "https://github.com/laktak/zfind/releases/tag/v${version}";
+    license = licenses.mit;
+    mainProgram = "zfind";
+    maintainers = with maintainers; [ eeedean ];
+  };
+}

pkgs/desktops/cinnamon/warpinator/default.nix

@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "warpinator";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-qtz8/vO6LJ19NcuFf9p3DWNy41kkoBWlgZGChlnTOvI=";
+    hash = "sha256-T1boMqzAGMjUD62ZAlWNOe3xUx5H5ZwpR7MNipy/LKA=";
   };
 
   nativeBuildInputs = [
@@ -78,9 +78,9 @@ stdenv.mkDerivation rec {
     # We make bubblewrap mode always available since
     # landlock mode is not supported in old kernels.
     substituteInPlace src/warpinator-launch.py \
-      --replace '"/bin/python3"' '"${pythonEnv.interpreter}"' \
-      --replace "/bin/bwrap" "${bubblewrap}/bin/bwrap" \
-      --replace 'GLib.find_program_in_path("bwrap")' "True"
+      --replace-fail '"/usr/bin/python3"' '"${pythonEnv.interpreter}"' \
+      --replace-fail "/usr/bin/bwrap" "${bubblewrap}/bin/bwrap" \
+      --replace-fail 'GLib.find_program_in_path("bwrap")' "True"
   '';
 
   passthru.updateScript = gitUpdater {

pkgs/development/libraries/kerberos/heimdal.nix

@@ -89,6 +89,8 @@ stdenv.mkDerivation {
   ];
 
   configureFlags = [
+    "--with-hdbdir=/var/lib/heimdal"
+
     "--with-libedit-include=${libedit.dev}/include"
     "--with-libedit-lib=${libedit}/lib"
     "--with-berkeley-db-include=${db.dev}/include"

pkgs/development/ocaml-modules/ezjsonm-encoding/default.nix

@@ -0,0 +1,20 @@
+{ lib, fetchurl, buildDunePackage, ezjsonm }:
+
+buildDunePackage rec {
+  pname = "ezjsonm-encoding";
+  version = "2.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/lthms/ezjsonm-encoding/releases/download/${version}/ezjsonm-encoding-${version}.tbz";
+    hash = "sha256-e5OPcbbQLr16ANFNZ5i10LjlHgwcRTCYhyvOhVk22yI=";
+  };
+
+  propagatedBuildInputs = [ ezjsonm ];
+
+  meta = {
+    description = "Encoding combinators a la Data_encoding for Ezjsonm";
+    homepage = "https://github.com/lthms/ezjsonmi-encoding";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ fgaz ];
+  };
+}

pkgs/development/php-packages/grumphp/default.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "grumphp";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-STTMqOzWE6c+EXA7PGoJTGVCyB3PtNVj5wSZ6igudro=";
+    hash = "sha256-W4LNzdgWxXDPL46/C8SX99lpRMp/xL5q5v6vX3H80XU=";
   };
 
-  vendorHash = "sha256-CrcDJb5SfTBxVkFPTLq0PSzqNtkZWDPkH0IW7Crr4Pw=";
+  vendorHash = "sha256-bpIG3P1BdsYNI59xANaihmjsT7WDKiss3mhi/brA0Mc=";
 
   meta = {
     changelog = "https://github.com/phpro/grumphp/releases/tag/v${finalAttrs.version}";

pkgs/development/python-modules/aioairzone-cloud/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.5.1";
+  version = "0.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-L5Gb+V0W+9duGV6lRc01jrAfh4U+MS77Y238EeXe0TU=";
+    hash = "sha256-06r6Q+MdEirLiPrx71NDp8oeRJzqgDg8FtXt46vHutE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/anova-wifi/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "anova-wifi";
-  version = "0.12.0";
+  version = "0.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Lash-L";
     repo = "anova_wifi";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0RRnQBLglPnPin9/gqWDKIsfi5V7ydrdDKwm93WEnvk=";
+    hash = "sha256-5BSkUg36k2gNfOrVNkeRwU/4SlfEua3ZU4KTZmKSq4Q=";
   };
 
   postPatch = ''

pkgs/development/python-modules/cyclonedx-python-lib/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cyclonedx-python-lib";
-  version = "7.4.0";
+  version = "7.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cR/E0xVPl2iBgjhX9xv8nftmmTDWjDUqRgvNqcAWzRo=";
+    hash = "sha256-ATeSMS8WaJS/2CaeNQgaK/6zyQBw07+6YYTZdhZPJug=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/mdformat-mkdocs/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat-mkdocs";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "KyleKing";
     repo = "mdformat-mkdocs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vJdkPNUW7d+H6hEgsAV7L0dV09+mq0Nvzih8aKoU8F8=";
+    hash = "sha256-hBkHVYlcHCXfE8Z2gLv6Rt0tQSkx2LYqbEtCncDByrI=";
   };
 
   nativeBuildInputs = [ flit-core ];

pkgs/development/python-modules/neo4j/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.20.0";
+  version = "5.21.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-ebWEtsgVj2NLYAKe8z6ge6TvnPmXh0Mqkx0b+ZcOePY=";
+    hash = "sha256-SGRe5O+6HqLFu4VQc0QC+91KVjqKeqNt5hIBwophvP0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/survey/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "survey";
-  version = "5.3.0";
+  version = "5.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jMTtsrEdt3NPy8NfeNPX4YNwjH2gaQfO89Iag/MBS+A=";
+    hash = "sha256-uNx8Ij28Li9QQjq/S6OP5kft2K8pDu2NyBK6BP/xcw8=";
   };
 
   build-system = [

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1167";
+  version = "3.0.1168";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-GO1iAkIJyuXAa+iAmIIbnARcm90MjTG689P0WEj8VIA=";
+    hash = "sha256-Y9H+PV4PAUXCI2/kCVZhwMCvaIjDN+OThAVMoosQ5u0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/backblaze-b2/default.nix

@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "3.19.1";
+  version = "4.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "B2_Command_Line_Tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/P1cgAC+a2YCcvbsysYdD+fEwibo+GyE0XY4A0+gMh4=";
+    hash = "sha256-rZUWPSI7CrKOdEKdsSpekwBerbIMf2iiVrWkV8WrqSc=";
   };
 
   nativeBuildInputs = with python3Packages; [

pkgs/development/tools/pqrs/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pqrs";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "pqrs";
     rev = "v${version}";
-    sha256 = "sha256-t6Y6gpMEpccCoyhG66FZEKHVNCbHblaqYZY1iJUZVUA=";
+    sha256 = "sha256-0oSSoGZga0OGAKUNsLmKkUl8N1l0pVi4KIqrKJbeVVU=";
   };
 
-  cargoHash = "sha256-fnoYVWpBn5Dil2o+u2MKQqd8dEKFE2i29Qz7cJae+gE=";
+  cargoHash = "sha256-w0WD+EtVGFMGpS4a2DJrLdbunwF2yiONKQwdcQG2EB0=";
 
   meta = with lib; {
     description = "CLI tool to inspect Parquet files";

pkgs/development/web/flyctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.2.66";
+  version = "0.2.69";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-vdiTlUzrldbxWo5LoYnWTGq/P/QA+Qybk78pqxDoUlQ=";
+    hash = "sha256-6SPJt+az+C0amCnRScp85JqUfnWswHdS1OtOMa40Haw=";
   };
 
-  vendorHash = "sha256-VdOBAxIaQzld4uX42RPYg4+p5F6mnBnI5efV8X48Eh8=";
+  vendorHash = "sha256-O5lUw0XzQUoy3mAmSpeW6WfBgg0FLxXkk7hCUAS2+o8=";
 
   subPackages = [ "." ];
 

pkgs/misc/drivers/epkowa/default.nix

@@ -251,6 +251,38 @@ let plugins = {
 
     meta = common_meta // { description = "iscan esci s80 plugin for " + passthru.hw; };
   };
+  s600 = stdenv.mkDerivation rec {
+    name = "iscan-gt-s600-bundle";
+    version = "2.30.4";
+
+    src = fetchurl {
+      urls = [
+        "https://download2.ebz.epson.net/iscan/plugin/gt-s600/rpm/x64/iscan-gt-s600-bundle-${version}.x64.rpm.tar.gz"
+        "https://web.archive.org/web/20240614120113/https://download2.ebz.epson.net/iscan/plugin/gt-s600/rpm/x64/iscan-gt-s600-bundle-${version}.x64.rpm.tar.gz"
+      ];
+      sha256 = "fe1356b1d5c40bc5ac985a5693166efb9e5049a78b412f49c385eb503eadf2c6";
+    };
+
+    nativeBuildInputs = [ autoPatchelfHook rpm ];
+
+    installPhase = ''
+      cd plugins
+      ${rpm}/bin/rpm2cpio iscan-plugin-gt-s600-*.x86_64.rpm | ${cpio}/bin/cpio -idmv
+      mkdir $out
+      cp -r usr/share $out
+      cp -r usr/lib64 $out/lib
+      mv $out/share/iscan $out/share/esci
+      mv $out/lib/iscan $out/lib/esci
+    '';
+
+    passthru = {
+      registrationCommand = ''
+        $registry --add interpreter usb 0x04b8 0x012d "$plugin/lib/esci/libesint66 $plugin/share/esci/esfw66.bin"
+      '';
+      hw = "GT-F650, GT-S600, Perfection V10, Perfection V100 Photo";
+    };
+    meta = common_meta // { description = "iscan gt-s600 plugin for " + passthru.hw; };
+  };
   s650 = stdenv.mkDerivation rec {
     name = "iscan-gt-s650-bundle";
     version = "2.30.4";

pkgs/misc/drivers/epson-escpr2/default.nix

@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchurl {
     # To find new versions, visit
     # http://download.ebz.epson.net/dsc/search/01/search/?OSC=LX and search for
     # some printer like for instance "WF-7210" to get to the most recent
     # version.
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/15/33/94/3bf10a30a1f8b5b91ddbafa4571c073878ec476b/epson-inkjet-printer-escpr2-1.2.9-1.src.rpm";
-    sha256 = "sha256-2smNBTMSqoKYsGUoBtIHS3Fwk9ODbiXaP7Dtq69FG9U=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/15/87/52/84d8972472981a5337b96610c39c8c7586256b55/epson-inkjet-printer-escpr2-1.2.10-1.src.rpm";
+    sha256 = "sha256-vrAVarGBp8eI07WMtQSmuNpX5iS26+B2iP/b7U8mJmo=";
   };
 
   unpackPhase = ''

pkgs/servers/mediamtx/default.nix

@@ -1,29 +1,30 @@
-{ lib
-, fetchFromGitHub
-, fetchurl
-, buildGoModule
-, nixosTests
+{
+  lib,
+  fetchFromGitHub,
+  fetchurl,
+  buildGoModule,
+  nixosTests,
 }:
 
 let
   hlsJs = fetchurl {
-    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.8/dist/hls.min.js";
-    hash = "sha256-KG8Cm0dAsFbrBHuMi9c+bMocpSvWWK4c9aWH9LGfDY4=";
+    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.11/dist/hls.min.js";
+    hash = "sha256-N10eCJk75KlKpHVXtwgC7vBDrU5b7ZQng9o/QK93m2w=";
   };
 in
 buildGoModule rec {
   pname = "mediamtx";
   # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hm6rfO9RF7bsSwxP8tKwiVqEpyQpVK4itWWklbOsKzw=";
+    hash = "sha256-/r5N9RSlYH6xM+JyETuTQWu0YTvaShI6APi8ibpP7Zg=";
   };
 
-  vendorHash = "sha256-QsRJ4hCtb29cT4QzPqW19bZxH+wMegufSxwdljXbuqs=";
+  vendorHash = "sha256-/TgSTXA6SOCfm/wtjJBtyIg4Fo0moJyC640zoIOQ4Fo=";
 
   postPatch = ''
     cp ${hlsJs} internal/servers/hls/hls.min.js
@@ -32,16 +33,14 @@ buildGoModule rec {
   # Tests need docker
   doCheck = false;
 
-  ldflags = [
-    "-X github.com/bluenviron/mediamtx/internal/core.version=v${version}"
-  ];
+  ldflags = [ "-X github.com/bluenviron/mediamtx/internal/core.version=v${version}" ];
 
-  passthru.tests = { inherit (nixosTests) mediamtx; };
+  passthru.tests = {
+    inherit (nixosTests) mediamtx;
+  };
 
   meta = with lib; {
-    description =
-      "Ready-to-use RTSP server and RTSP proxy that allows to read and publish video and audio streams"
-    ;
+    description = "Ready-to-use RTSP server and RTSP proxy that allows to read and publish video and audio streams";
     inherit (src.meta) homepage;
     license = licenses.mit;
     mainProgram = "mediamtx";

pkgs/servers/monitoring/prometheus/knot-exporter.nix

@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "3.3.5";
+  version = "3.3.6";
   pyproject = true;
 
   src = fetchPypi {
     pname = "knot_exporter";
     inherit version;
-    hash = "sha256-7r4zXqomiszDrplMedEyw2ZQ2NwDTf54EOwnsLc5RJ0=";
+    hash = "sha256-4Fdbu08RbivZF+Hnk+tI1DW9PyzQTI0TngAbZ60CcO8=";
   };
 
   nativeBuildInputs = [

pkgs/servers/networking/exabgp/default.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "exabgp";
-  version = "4.2.21";
+  version = "4.2.22";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Exa-Networks";
     repo = "exabgp";
     rev = "refs/tags/${version}";
-    hash = "sha256-NlGE3yHUXPdxAMGhSaXMT2P1e7P+4AWg4lReP3f6Zx8=";
+    hash = "sha256-PrdCAmefKCBmbBFp04KiQGSsZZ4KNFk/ZtMedh9oow4=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/tools/audio/mpd-discord-rpc/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mpd-discord-rpc";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "JakeStanger";
     repo = "mpd-discord-rpc";
     rev = "v${version}";
-    hash = "sha256-Sdvrq9ChaSwjQDVjHVzcVLYbzyCHXsta1/Jo9hVkcDw=";
+    hash = "sha256-WiHMXazNKyt5N7WmkftZYEHeQi+l9qoU2yr6jRHfjdE=";
   };
 
-  cargoHash = "sha256-w3ulSCbQBkDATe4yfgGSl7WMrUk3sYlS08UbgvGY/5s=";
+  cargoHash = "sha256-DnOv9YJpr777p1GVhe8LS5uAUs6Dr/gRLoJarFx5avw=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/tools/games/minecraft/mcaselector/default.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mcaselector";
-  version = "2.4";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "https://github.com/Querz/mcaselector/releases/download/${finalAttrs.version}/mcaselector-${finalAttrs.version}.jar";
-    hash = "sha256-6WQIvDmyVVmxHFOMk2emT1a4PMGVjvtC0aSkryvwARs=";
+    hash = "sha256-4czkp7+akZEPvnYLMFGrqrhBYafDVxDo1iQZYwvaARE=";
   };
 
   dontUnpack = true;

pkgs/tools/misc/fluent-bit/default.nix

@@ -8,30 +8,36 @@
 , postgresql
 , openssl
 , libyaml
+, darwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-o48qnyYAiV2gt81hC8/ja+/JWNFlMb47QsBt6BD7VjA=";
+    hash = "sha256-UoNzgTWPyDoa3hLh9z/aw78lmGcA/ujihUuXnKKqtPc=";
   };
 
+  # optional only to avoid linux rebuild
+  patches = lib.optionals stdenv.isDarwin [ ./macos-11-sdk-compat.patch ];
+
   nativeBuildInputs = [ cmake flex bison ];
 
   buildInputs = [ openssl libyaml postgresql ]
-    ++ lib.optionals stdenv.isLinux [ systemd ];
+    ++ lib.optionals stdenv.isLinux [ systemd ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.IOKit darwin.apple_sdk_11_0.frameworks.Foundation ];
 
   cmakeFlags = [
     "-DFLB_RELEASE=ON"
     "-DFLB_METRICS=ON"
     "-DFLB_HTTP_SERVER=ON"
     "-DFLB_OUT_PGSQL=ON"
-  ];
+  ]
+  ++ lib.optionals stdenv.isDarwin [ "-DCMAKE_OSX_DEPLOYMENT_TARGET=10.13" ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     # Used by the embedded luajit, but is not predefined on older mac SDKs.

pkgs/tools/misc/fluent-bit/macos-11-sdk-compat.patch

@@ -0,0 +1,17 @@
+diff --git i/src/flb_utils.c w/src/flb_utils.c
+index 87637f1331d7..7a0036566438 100644
+--- i/src/flb_utils.c
++++ w/src/flb_utils.c
+@@ -1424,11 +1424,11 @@ int flb_utils_get_machine_id(char **out_id, size_t *out_size)
+         return 0;
+     }
+ #elif defined (FLB_SYSTEM_MACOS)
+     bool bret;
+     CFStringRef serialNumber;
+-    io_service_t platformExpert = IOServiceGetMatchingService(kIOMainPortDefault,
++    io_service_t platformExpert = IOServiceGetMatchingService(kIOMasterPortDefault,
+         IOServiceMatching("IOPlatformExpertDevice"));
+
+     if (platformExpert) {
+         CFTypeRef serialNumberAsCFString =
+             IORegistryEntryCreateCFProperty(platformExpert,

pkgs/tools/misc/tmux/default.nix

@@ -38,10 +38,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-RX3RZ0Mcyda7C7im1r4QgUxTnp95nfpGgQ2HRxr0s64=";
   };
 
-  patches = [(fetchpatch {
+  patches = [
+    (fetchpatch {
       url = "https://github.com/tmux/tmux/commit/2d1afa0e62a24aa7c53ce4fb6f1e35e29d01a904.diff";
       hash = "sha256-mDt5wy570qrUc0clGa3GhZFTKgL0sfnQcWJEJBKAbKs=";
-  })];
+    })
+    # this patch is designed for android but FreeBSD exhibits the same error for the same reason
+    (fetchpatch {
+      url = "https://github.com/tmux/tmux/commit/4f5a944ae3e8f7a230054b6c0b26f423fa738e71.patch";
+      hash = "sha256-HlUeU5ZicPe7Ya8A1HpunxfVOE2BF6jOHq3ZqTuU5RE=";
+    })
+  ];
 
   nativeBuildInputs = [
     pkg-config

pkgs/tools/networking/ddns-go/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.6.1";
+  version = "6.6.2";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dlKglwjQj8o48ao5aFmV9oZEIm3Jdt4+7uFkGclSgOs=";
+    hash = "sha256-rl0J10HuZ7WBnOTylCW0MrNFEoKoBwUicJWy9vcQIew=";
   };
 
-  vendorHash = "sha256-J18JTLUvUaZDp1/65iJJp4oVSNOsENrMghJVP40ITOo=";
+  vendorHash = "sha256-dJXXGoTzgbmpDoAYKfkUgsmQILQQ+zbE14+BiaNEHSs=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/tools/networking/nebula/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nebula";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "slackhq";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-G4v1lCGTEPOfYeHWl8xy2TowloRefKFAc/P17zWB9kk=";
+    hash = "sha256-+RferzOPlx7UuqpckQBY/RDO9gptknhuan+Es0Vf/yM=";
   };
 
   vendorHash = "sha256-4BnFvA0dxsEK7ictDUZ6nol6PtM54kk9dwKPTQbRUR0=";

pkgs/tools/security/step-kms-plugin/default.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.11.1";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EkLLhHXvh10tfEY6AY6o3n3JcmCXwauHsQ8VJRBpnnY=";
+    hash = "sha256-Gl/5AExN2/MEoR2HKpw7mDfuc/1Wj0UGSdXPzHl2JdU=";
   };
 
-  vendorHash = "sha256-kwM5eNeAVtA6DaoFtBhxc7Jnfb7vVkdIGpUxVGjWwC8=";
+  vendorHash = "sha256-O6orQYrupJdJbx23TXCP0qWyvn6Hv2iDeRYvIgLp1NM=";
 
   proxyVendor = true;
 

pkgs/tools/security/vault-ssh-plus/default.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule rec {
   pname = "vault-ssh-plus";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "isometry";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IRmFC5WsLmHfPjS/jW5V7dNF5rNvmsh3YKwW7rGII24=";
+    hash = "sha256-djS50SBR8HTyEd5Ya2I9w5irBrLTqzekEi5ASmkl6yk=";
   };
 
-  vendorHash = "sha256-cuU7rEpJrwrbiXLajdv4h6GePbpZclweyB9qZ3SIjP0=";
+  vendorHash = "sha256-NndIBvW1/EZJ2KwP6HZ6wvhrgtmhTe97l3VxprtWq30=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/tools/security/witness/default.nix

@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "witness";
-  version = "0.4.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "in-toto";
     repo = "witness";
     rev = "v${version}";
-    sha256 = "sha256-QnZZVQZMkh9GH6io19mlE3gHaiX73TgH7ibFT1H5DB4=";
+    sha256 = "sha256-3up10DdW0nMPAghEVlnOrFUbjQd1AuNmraBDjBPdjm8=";
   };
-  vendorHash = "sha256-5q405OP8VPChhxiH2tjh2H+ailQRjGmLZvul7CubjJo=";
+  vendorHash = "sha256-sYWcmQloeZlwuUz0SkucpVGOqkoOpgnsHDsuWyWTBPQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/top-level/ocaml-packages.nix

@@ -480,6 +480,8 @@ let
 
     ezjsonm = callPackage ../development/ocaml-modules/ezjsonm { };
 
+    ezjsonm-encoding = callPackage ../development/ocaml-modules/ezjsonm-encoding { };
+
     ezxmlm = callPackage ../development/ocaml-modules/ezxmlm { };
 
     ### F ###

pkgs/top-level/perl-packages.nix

@@ -586,10 +586,10 @@ with self; {
 
   AnyEventI3 = buildPerlPackage {
     pname = "AnyEvent-I3";
-    version = "0.17";
+    version = "0.19";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MS/MSTPLBG/AnyEvent-I3-0.17.tar.gz";
-      hash = "sha256-U4LJhMnxODlfKfDACvgaoMj0t2VYIFXHPt5LE/BKbWM=";
+      url = "mirror://cpan/authors/id/M/MS/MSTPLBG/AnyEvent-I3-0.19.tar.gz";
+      hash = "sha256-G807YNs9VWAUjeeRNT6K8RciZPWoXncZe5/8BB2sSDo=";
     };
     propagatedBuildInputs = [ AnyEvent JSONXS ];
     meta = {

pkgs/top-level/ruby-packages.nix

@@ -3127,10 +3127,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "sha256-CQioY4HZ+XOCRoDfTgp1QidmJy8DscDknbfnnCPbETU=";
+      sha256 = "0428ady49qssmnmwnafzrjvyba8mzbridsgblv7c7kmd0vqgfn99";
       type = "gem";
     };
-    version = "3.2.8";
+    version = "3.3.0";
   };
   rmagick = {
     dependencies = ["observer" "pkg-config"];