Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -10030,12 +10030,6 @@
     githubId = 5352661;
     name = "James Cleverley-Prance";
   };
-  jqqqqqqqqqq = {
-    email = "jqqqqqqqqqq@gmail.com";
-    github = "jqqqqqqqqqq";
-    githubId = 12872927;
-    name = "Curtis Jiang";
-  };
   jqueiroz = {
     email = "nixos@johnjq.com";
     github = "jqueiroz";
@@ -17623,6 +17617,12 @@
     githubId = 19433256;
     name = "Radoslaw Sniezek";
   };
+  rsrohitsingh682 = {
+    email = "rsrohitsingh682@gmail.com";
+    github = "rsrohitsingh682";
+    githubId = 45477585;
+    name = "Rohit Singh";
+  };
   rster2002 = {
     name = "Bjørn";
     github = "rster2002";

nixos/modules/services/cluster/k3s/default.nix

@@ -359,6 +359,53 @@ in
         by the k3s agent. This option only makes sense on nodes with an enabled agent.
       '';
     };
+
+    gracefulNodeShutdown = {
+      enable = lib.mkEnableOption ''
+        graceful node shutdowns where the kubelet attempts to detect
+        node system shutdown and terminates pods running on the node. See the
+        [documentation](https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/#graceful-node-shutdown)
+        for further information.
+      '';
+
+      shutdownGracePeriod = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "30s";
+        example = "1m30s";
+        description = ''
+          Specifies the total duration that the node should delay the shutdown by. This is the total
+          grace period for pod termination for both regular and critical pods.
+        '';
+      };
+
+      shutdownGracePeriodCriticalPods = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "10s";
+        example = "15s";
+        description = ''
+          Specifies the duration used to terminate critical pods during a node shutdown. This should be
+          less than `shutdownGracePeriod`.
+        '';
+      };
+    };
+
+    extraKubeletConfig = lib.mkOption {
+      type = with lib.types; attrsOf anything;
+      default = { };
+      example = {
+        podsPerCore = 3;
+        memoryThrottlingFactor = 0.69;
+        containerLogMaxSize = "5Mi";
+      };
+      description = ''
+        Extra configuration to add to the kubelet's configuration file. The subset of the kubelet's
+        configuration that can be configured via a file is defined by the
+        [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/)
+        struct. See the
+        [documentation](https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/)
+        for further information.
+      '';
+    };
   };
 
   # implementation
@@ -397,43 +444,59 @@ in
 
     environment.systemPackages = [ config.services.k3s.package ];
 
-    systemd.services.k3s = {
-      description = "k3s service";
-      after = [
-        "firewall.service"
-        "network-online.target"
-      ];
-      wants = [
-        "firewall.service"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      path = optional config.boot.zfs.enabled config.boot.zfs.package;
-      serviceConfig = {
-        # See: https://github.com/rancher/k3s/blob/dddbd16305284ae4bd14c0aade892412310d7edc/install.sh#L197
-        Type = if cfg.role == "agent" then "exec" else "notify";
-        KillMode = "process";
-        Delegate = "yes";
-        Restart = "always";
-        RestartSec = "5s";
-        LimitNOFILE = 1048576;
-        LimitNPROC = "infinity";
-        LimitCORE = "infinity";
-        TasksMax = "infinity";
-        EnvironmentFile = cfg.environmentFile;
-        ExecStartPre = activateK3sContent;
-        ExecStart = concatStringsSep " \\\n " (
-          [ "${cfg.package}/bin/k3s ${cfg.role}" ]
-          ++ (optional cfg.clusterInit "--cluster-init")
-          ++ (optional cfg.disableAgent "--disable-agent")
-          ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
-          ++ (optional (cfg.token != "") "--token ${cfg.token}")
-          ++ (optional (cfg.tokenFile != null) "--token-file ${cfg.tokenFile}")
-          ++ (optional (cfg.configPath != null) "--config ${cfg.configPath}")
-          ++ (lib.flatten cfg.extraFlags)
+    systemd.services.k3s =
+      let
+        kubeletParams =
+          (lib.optionalAttrs (cfg.gracefulNodeShutdown.enable) {
+            inherit (cfg.gracefulNodeShutdown) shutdownGracePeriod shutdownGracePeriodCriticalPods;
+          })
+          // cfg.extraKubeletConfig;
+        kubeletConfig = (pkgs.formats.yaml { }).generate "k3s-kubelet-config" (
+          {
+            apiVersion = "kubelet.config.k8s.io/v1beta1";
+            kind = "KubeletConfiguration";
+          }
+          // kubeletParams
         );
+      in
+      {
+        description = "k3s service";
+        after = [
+          "firewall.service"
+          "network-online.target"
+        ];
+        wants = [
+          "firewall.service"
+          "network-online.target"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        path = optional config.boot.zfs.enabled config.boot.zfs.package;
+        serviceConfig = {
+          # See: https://github.com/rancher/k3s/blob/dddbd16305284ae4bd14c0aade892412310d7edc/install.sh#L197
+          Type = if cfg.role == "agent" then "exec" else "notify";
+          KillMode = "process";
+          Delegate = "yes";
+          Restart = "always";
+          RestartSec = "5s";
+          LimitNOFILE = 1048576;
+          LimitNPROC = "infinity";
+          LimitCORE = "infinity";
+          TasksMax = "infinity";
+          EnvironmentFile = cfg.environmentFile;
+          ExecStartPre = activateK3sContent;
+          ExecStart = concatStringsSep " \\\n " (
+            [ "${cfg.package}/bin/k3s ${cfg.role}" ]
+            ++ (optional cfg.clusterInit "--cluster-init")
+            ++ (optional cfg.disableAgent "--disable-agent")
+            ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
+            ++ (optional (cfg.token != "") "--token ${cfg.token}")
+            ++ (optional (cfg.tokenFile != null) "--token-file ${cfg.tokenFile}")
+            ++ (optional (cfg.configPath != null) "--config ${cfg.configPath}")
+            ++ (optional (kubeletParams != { }) "--kubelet-arg=config=${kubeletConfig}")
+            ++ (lib.flatten cfg.extraFlags)
+          );
+        };
       };
-    };
   };
 
   meta.maintainers = lib.teams.k3s.members;

nixos/modules/system/boot/loader/generations-dir/generations-dir.nix

@@ -42,7 +42,7 @@ in
         default = false;
         type = types.bool;
         description = ''
-          Whether copy the necessary boot files into /boot, so
+          Whether to copy the necessary boot files into /boot, so
           /nix/store is not needed by the boot loader.
         '';
       };

nixos/tests/k3s/default.nix

@@ -15,6 +15,9 @@ in
       inherit (pkgs) etcd;
     }
   ) allK3s;
-  single-node = lib.mapAttrs (_: k3s: import ./single-node.nix { inherit system pkgs k3s; }) allK3s;
+  kubelet-config = lib.mapAttrs (
+    _: k3s: import ./kubelet-config.nix { inherit system pkgs k3s; }
+  ) allK3s;
   multi-node = lib.mapAttrs (_: k3s: import ./multi-node.nix { inherit system pkgs k3s; }) allK3s;
+  single-node = lib.mapAttrs (_: k3s: import ./single-node.nix { inherit system pkgs k3s; }) allK3s;
 }

nixos/tests/k3s/kubelet-config.nix

@@ -0,0 +1,80 @@
+# A test that sets extra kubelet configuration and enables graceful node shutdown
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    k3s,
+    ...
+  }:
+  let
+    nodeName = "test";
+    shutdownGracePeriod = "1m13s";
+    shutdownGracePeriodCriticalPods = "13s";
+    podsPerCore = 3;
+    memoryThrottlingFactor = 0.69;
+    containerLogMaxSize = "5Mi";
+  in
+  {
+    name = "${k3s.name}-kubelet-config";
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
+
+        # k3s uses enough resources the default vm fails.
+        virtualisation.memorySize = 1536;
+        virtualisation.diskSize = 4096;
+
+        services.k3s = {
+          enable = true;
+          package = k3s;
+          # Slightly reduce resource usage
+          extraFlags = [
+            "--disable coredns"
+            "--disable local-storage"
+            "--disable metrics-server"
+            "--disable servicelb"
+            "--disable traefik"
+            "--node-name ${nodeName}"
+          ];
+          gracefulNodeShutdown = {
+            enable = true;
+            inherit shutdownGracePeriod shutdownGracePeriodCriticalPods;
+          };
+          extraKubeletConfig = {
+            inherit podsPerCore memoryThrottlingFactor containerLogMaxSize;
+          };
+        };
+      };
+
+    testScript = ''
+      import json
+
+      start_all()
+      machine.wait_for_unit("k3s")
+      # wait until the node is ready
+      machine.wait_until_succeeds(r"""kubectl wait --for='jsonpath={.status.conditions[?(@.type=="Ready")].status}=True' nodes/${nodeName}""")
+      # test whether the kubelet registered an inhibitor lock
+      machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
+      # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
+      machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
+      machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
+      # get the kubeletconfig
+      kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
+
+      with subtest("Kubelet config values are set correctly"):
+        assert kubelet_config["shutdownGracePeriod"] == "${shutdownGracePeriod}", \
+          f"unexpected value for shutdownGracePeriod: {kubelet_config["shutdownGracePeriod"]}"
+        assert kubelet_config["shutdownGracePeriodCriticalPods"] == "${shutdownGracePeriodCriticalPods}", \
+          f"unexpected value for shutdownGracePeriodCriticalPods: {kubelet_config["shutdownGracePeriodCriticalPods"]}"
+        assert kubelet_config["podsPerCore"] == ${toString podsPerCore}, \
+          f"unexpected value for podsPerCore: {kubelet_config["podsPerCore"]}"
+        assert kubelet_config["memoryThrottlingFactor"] == ${toString memoryThrottlingFactor}, \
+          f"unexpected value for memoryThrottlingFactor: {kubelet_config["memoryThrottlingFactor"]}"
+        assert kubelet_config["containerLogMaxSize"] == "${containerLogMaxSize}", \
+          f"unexpected value for containerLogMaxSize: {kubelet_config["containerLogMaxSize"]}"
+    '';
+
+    meta.maintainers = lib.teams.k3s.members;
+  }
+)

pkgs/applications/editors/jetbrains/plugins/plugins.json

@@ -40,6 +40,16 @@
       },
       "name": "python"
     },
+    "1347": {
+      "compatible": [
+        "idea-community",
+        "idea-ultimate"
+      ],
+      "builds": {
+        "241.18034.62": "https://plugins.jetbrains.com/files/1347/560035/scala-intellij-bin-2024.1.24.zip"
+      },
+      "name": "scala"
+    },
     "2162": {
       "compatible": [
         "clion",
@@ -691,6 +701,7 @@
     "https://plugins.jetbrains.com/files/12559/508216/keymap-eclipse-241.14494.150.zip": "sha256-/hEx0gIFvUXD799tRmMHAt9Z5ziFgaQs1RX0zQwTJIA=",
     "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip": "sha256-Nb2tSxL+mAY1qJ3waipgV8ep+0R/BaYnzz7zfwtLHmk=",
     "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip": "sha256-tNgt0vIkdCB/LcaSj58mT6cNlw4lytRo0cZSt7sIERU=",
+    "https://plugins.jetbrains.com/files/1347/560035/scala-intellij-bin-2024.1.24.zip": "sha256-lXAZCaCTxyVqV6SPJeSZ7EJmDf5SA+eby64kIsC9sVY=",
     "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar": "sha256-eXInfAqY3yEZRXCAuv3KGldM1pNKEioNwPB0rIGgJFw=",
     "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip": "sha256-cltbHY5OOvf29otDNsF9Q2shJHDdW6UMbzDdZ6OATtI=",
     "https://plugins.jetbrains.com/files/164/546759/IdeaVim-2.12.0-signed.zip": "sha256-6ibo1vdwO4olQTCWpWAefT3QCwgtzTo1ojilDes8Rvg=",

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -77,14 +77,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.8";
+  version = "3.34.9";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-UeyGx+C7szXv++hXFV006Xk4oSKfSj4teJIwaD4ODVk=";
+    hash = "sha256-4ZgCvg3VSa1LJQ8yr45nY4ZI7tyVVdW7WPK/jwBI+HU=";
   };
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -78,14 +78,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.38.0";
+  version = "3.38.1";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-vL9Go8Kn6VFOeztD/LZi5QHpZVPFfOFarTsCLTf4D2s=";
+    hash = "sha256-8fwLn77CK8w4srJNUilfJumDt2wCcQLs9D5/4tzpzPA=";
   };
 
   passthru = {

pkgs/by-name/au/authentik/package.nix

@@ -2,6 +2,7 @@
 , stdenvNoCC
 , callPackages
 , fetchFromGitHub
+, fetchpatch
 , fetchzip
 , buildNpmPackage
 , buildGoModule
@@ -178,6 +179,40 @@ let
         pyproject = true;
       };
 
+      # Use 3.14.0 until https://github.com/encode/django-rest-framework/issues/9358 is fixed.
+      # Otherwise applying blueprints/default/default-brand.yaml fails with:
+      #   authentik.flows.models.RelatedObjectDoesNotExist: FlowStageBinding has no target.
+      djangorestframework = prev.buildPythonPackage rec {
+        pname = "djangorestframework";
+        version = "3.14.0";
+        format = "setuptools";
+
+        src = fetchFromGitHub {
+          owner = "encode";
+          repo = "django-rest-framework";
+          rev = version;
+          hash = "sha256-Fnj0n3NS3SetOlwSmGkLE979vNJnYE6i6xwVBslpNz4=";
+        };
+
+        propagatedBuildInputs = with final; [
+          django
+          pytz
+        ];
+
+        nativeCheckInputs = with final; [
+          pytest-django
+          pytest7CheckHook
+
+          # optional tests
+          coreapi
+          django-guardian
+          pyyaml
+          uritemplate
+        ];
+
+        pythonImportsCheck = [ "rest_framework" ];
+      };
+
       tenant-schemas-celery = prev.buildPythonPackage rec {
         pname = "tenant-schemas-celery";
         version = "3.0.0";
@@ -225,16 +260,23 @@ let
         inherit version src meta;
         pyproject = true;
 
+        patches = [
+          (fetchpatch {
+            name = "scim-schema-load.patch";
+            url = "https://github.com/goauthentik/authentik/commit/f3640bd3c0ee2f43efcfd506bb71d2b7b6761017.patch";
+            hash = "sha256-4AC7Dc4TM7ok964ztc+XdHvoU/DKyi9yJoz5u1dljEM=";
+          })
+        ];
+
         postPatch = ''
           rm lifecycle/system_migrations/tenant_files.py
           substituteInPlace authentik/root/settings.py \
-            --replace-fail 'Path(__file__).absolute().parent.parent.parent' "\"$out\""
+            --replace-fail 'Path(__file__).absolute().parent.parent.parent' "Path(\"$out\")"
           substituteInPlace authentik/lib/default.yml \
             --replace-fail '/blueprints' "$out/blueprints" \
             --replace-fail './media' '/var/lib/authentik/media'
           substituteInPlace pyproject.toml \
             --replace-fail 'dumb-init = "*"' "" \
-            --replace-fail 'djangorestframework = "3.14.0"' 'djangorestframework = "*"' \
             --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
           substituteInPlace authentik/stages/email/utils.py \
             --replace-fail 'web/' '${webui}/'
@@ -306,9 +348,9 @@ let
           wsproto
           xmlsec
           zxcvbn
-        ] ++ [
-          codespell
-        ];
+        ]
+        ++ uvicorn.optional-dependencies.standard
+        ++ [ codespell ];
 
         postInstall = ''
           mkdir -p $out/web $out/website
@@ -316,6 +358,7 @@ let
           cp -r blueprints $out/
           cp -r ${webui}/dist ${webui}/authentik $out/web/
           cp -r ${website} $out/website/help
+          ln -s $out/${prev.python.sitePackages}/authentik $out/authentik
           ln -s $out/${prev.python.sitePackages}/lifecycle $out/lifecycle
         '';
       };

pkgs/by-name/ho/home-manager/package.nix

@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2024-07-11";
+  version = "0-unstable-2024-07-24";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "90ae324e2c56af10f20549ab72014804a3064c7f";
-    hash = "sha256-neWQ8eNtLTd+YMesb7WjKl1SVCbDyCm46LUgP/g/hdo=";
+    rev = "304a011325b7ac7b8c9950333cd215a7aa146b0e";
+    hash = "sha256-JH8N5uoqoVA6erV4O40VtKKHsnfmhvMGbxMNDLtim5o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ra/rabbit/package.nix

@@ -5,17 +5,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "rabbit";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "natarajan-chidambaram";
     repo = "RABBIT";
     rev = "refs/tags/${version}";
-    hash = "sha256-cAWLVB7KpLsfXcxAbSXkE3O6N0V1mw3z9UdMeH0IkpI=";
+    hash = "sha256-l5k5wPEd6/x7xHc+GlnoyTry7GRTnzNiTLxrLAZFVzQ=";
   };
 
-  pythonRelaxDeps = true;
+  pythonRelaxDeps = [
+    "numpy"
+    "scipy"
+  ];
 
   build-system = [
     python3.pkgs.setuptools
@@ -25,7 +28,6 @@ python3.pkgs.buildPythonApplication rec {
   dependencies = with python3.pkgs; [
     numpy
     pandas
-    pip
     python-dateutil
     requests
     scikit-learn

pkgs/by-name/sp/sploitscan/package.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sploitscan";
-  version = "0.10.3";
+  version = "0.10.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xaitax";
     repo = "SploitScan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-86+qX0agtDsEGYaMpP4Rb6OTPZj4KJVDCP8bbiA6K9c=";
+    hash = "sha256-6bC8mGzM6P0otzIG0+h0Koe9c+QI97HkEZh0HwfVviY=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/vc/vcluster/package.nix

@@ -1,14 +1,23 @@
-{ lib, go, buildGoModule, fetchFromGitHub, installShellFiles, testers, vcluster }:
+{
+  buildGoModule,
+  fetchFromGitHub,
+  go,
+  installShellFiles,
+  lib,
+  nix-update-script,
+  testers,
+  vcluster,
+}:
 
 buildGoModule rec {
   pname = "vcluster";
-  version = "0.19.6";
+  version = "0.19.7";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "vcluster";
     rev = "v${version}";
-    hash = "sha256-yW+GaMEfgkeBEGHG7heo8gZcFQuAXmn3rlBPBrlbyvM=";
+    hash = "sha256-sO/kpbzoAy4ohmLZ3Q7+HzoC0NoK2y0qkJ6Ib8TlEns=";
   };
 
   vendorHash = null;
@@ -16,7 +25,8 @@ buildGoModule rec {
   subPackages = [ "cmd/vclusterctl" ];
 
   ldflags = [
-    "-s" "-w"
+    "-s"
+    "-w"
     "-X main.version=${version}"
     "-X main.goVersion=${lib.getVersion go}"
   ];
@@ -45,6 +55,8 @@ buildGoModule rec {
     command = "vcluster --version";
   };
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/loft-sh/vcluster/releases/tag/v${version}";
     description = "Create fully functional virtual Kubernetes clusters";
@@ -52,6 +64,11 @@ buildGoModule rec {
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
     mainProgram = "vcluster";
-    maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
+    maintainers = with lib.maintainers; [
+      berryp
+      peterromfeldhk
+      qjoly
+      superherointj
+    ];
   };
 }

pkgs/by-name/xe/xemu/package.nix

@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.7.128";
+  version = "0.7.131";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-gJ5Da7bn4I7EOK12zqjekOJn+299v8WqH8e68GYUKpQ=";
+    hash = "sha256-xupCEqTovrEA7qEEr9nBjO7iIbTeXv59cg99W6Nc/54=";
   };
 
   nativeBuildInputs =

pkgs/development/libraries/intel-media-driver/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "24.2.1";
+  version = "24.2.5";
 
   outputs = [ "out" "dev" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    hash = "sha256-75NNxcWQUx0Qs7TWZMxu1TMm22/wCsmQPZXKGKFHEh0=";
+    hash = "sha256-nnaKfGMRNMZzrgMv7OgXj+11RaZSFijrxunnbGSWQlw=";
   };
 
   patches = [

pkgs/development/libraries/quarto/default.nix

@@ -19,10 +19,10 @@
 
 stdenv.mkDerivation (final: {
   pname = "quarto";
-  version = "1.5.54";
+  version = "1.5.55";
   src = fetchurl {
     url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${final.version}/quarto-${final.version}-linux-amd64.tar.gz";
-    sha256 = "sha256-QkqMWaa5fLrKmgr5ix08FX1Efdrj78oDQKuLtl2QB0k=";
+    sha256 = "sha256-1HqjMENJ1H5RBaKIRZoUDGrdSEQOhhIiRLIQFqnkFlk=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/bc-detect-secrets/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.12";
+  version = "1.5.15";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     rev = "refs/tags/${version}";
-    hash = "sha256-njTVA1H0QM0PHIHe/Vc4IJtbgTyWdytqPv0RRnTY6cw=";
+    hash = "sha256-D4TJnaxaCCJWgDPbGvbxkW6yg/Ph1jaIT9QBjxFcxAw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/bpylist2/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage {
+  pname = "bpylist2";
+  version = "4.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "parabolala";
+    repo = "bpylist2";
+    rev = "ddb89e0b0301c6b298de6469221d99b5fe127b58";
+    hash = "sha256-OBwDQZL5++LZgpQM96tmplAh1Pjme3KGSNFTKqKUn00=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonImportsCheck = [ "bpylist2" ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "--pycodestyle" "" \
+      --replace-fail "--pylint --pylint-rcfile=pylint.rc" "" \
+      --replace-fail "--mypy" ""
+  '';
+
+  meta = {
+    description = "Parse and Generate binary plists and NSKeyedArchiver archives";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/parabolala/bpylist2";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+}

pkgs/development/python-modules/deltalake/default.nix

@@ -13,21 +13,22 @@
 , pytest-benchmark
 , pytest-cov
 , pandas
+, azure-storage-blob
 }:
 
 buildPythonPackage rec {
   pname = "deltalake";
-  version = "0.18.1";
+  version = "0.18.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qkmCKk1VnROK7luuPlKbIx3S3C8fzGJy8yhTyZWXyGc=";
+    hash = "sha256-xvmtaHNkE6bXwVJtYJBc30qutZuMlcx4JmElCRdxmu8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-Dj2vm0l4b/E6tbXgs5iPvbDAsxNW0iPUSRPzT5KaA3Y=";
+    hash = "sha256-/2K8/hsMIeidfviCKK+ffWPB51svWZa+9eZoK9erBaY=";
   };
 
   env.OPENSSL_NO_VENDOR = 1;
@@ -59,6 +60,7 @@ buildPythonPackage rec {
     pandas
     pytest-benchmark
     pytest-cov
+    azure-storage-blob
   ];
 
   preCheck = ''

pkgs/development/python-modules/discordpy/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "discord.py";
-  version = "2.3.2";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Rapptz";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bZoYdDpk34x+Vw1pAZ3EcTFp2JJ/Ow0Jfof/XjqeRmY=";
+    hash = "sha256-GIwXx7bRCH2+G3zlilJ/Tb8el50SDbxGGX2/1bqL3+U=";
   };
 
   propagatedBuildInputs =

pkgs/development/python-modules/georss-qld-bushfire-alert-client/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "georss-qld-bushfire-alert-client";
-  version = "0.7";
+  version = "0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,12 +19,12 @@ buildPythonPackage rec {
     owner = "exxamalte";
     repo = "python-georss-qld-bushfire-alert-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ajCw1m7Qm1kZE/hOsBzFXPWAxl/pFD8pOOQo6qvachE=";
+    hash = "sha256-/MyjYLu29PANe17KxJCkmHPjvjlPfswn7ZBAKFSwohc=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ georss-client ];
+  dependencies = [ georss-client ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

pkgs/development/python-modules/govee-ble/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "govee-ble";
-  version = "0.33.1";
+  version = "0.40.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "govee-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nGTf8QjnoEQCSya2mPlUB+cDD3ewGYiihIV2S6HRr9o=";
+    hash = "sha256-w21paR1VTV/ZFnl9SKkJmFFDZMPgA3d7P6blceVvnVk=";
   };
 
   postPatch = ''

pkgs/development/python-modules/highdicom/default.nix

@@ -10,6 +10,7 @@
   pydicom,
   pylibjpeg,
   pylibjpeg-libjpeg,
+  pylibjpeg-openjpeg,
 }:
 
 let
@@ -45,7 +46,7 @@ buildPythonPackage rec {
     libjpeg = [
       pylibjpeg
       pylibjpeg-libjpeg
-      #pylibjpeg-openjpeg  # not in nixpkgs yet
+      #pylibjpeg-openjpeg  # broken on aarch64-linux
     ];
   };
 

pkgs/development/python-modules/nethsm/default.nix

@@ -12,7 +12,7 @@
 
 let
   pname = "nethsm";
-  version = "1.1.0";
+  version = "1.2.0";
 in
 
 buildPythonPackage {
@@ -21,7 +21,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CQhheHQ0BlfznKjoOSRvbDtnlTvv/SLtl0GWd7LUSt8=";
+    hash = "sha256-BFdnRHHe/UIusZn1JdV3Fc6W5TtJAMk4e8masEYrqdQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/osxphotos/default.nix

@@ -0,0 +1,112 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+
+  bitmath,
+  bpylist2,
+  click,
+  mako,
+  more-itertools,
+  objexplore,
+  packaging,
+  pathvalidate,
+  pip,
+  ptpython,
+  pytimeparse2,
+  pyyaml,
+  requests,
+  rich-theme-manager,
+  rich,
+  shortuuid,
+  strpdatetime,
+  tenacity,
+  textx,
+  toml,
+  wrapt,
+  wurlitzer,
+  xdg-base-dirs,
+
+  pytestCheckHook,
+  pytest-mock,
+}:
+
+buildPythonPackage rec {
+  pname = "osxphotos";
+  version = "0.68.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "RhetTbull";
+    repo = "osxphotos";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-iPeidbPoF0AG6TJDWloXwpwzJ4oWEglKVLp2yywnyZs=";
+  };
+
+  build-system = [ setuptools ];
+  dependencies = [
+    bitmath
+    bpylist2
+    click
+    mako
+    more-itertools
+    objexplore
+    packaging
+    pathvalidate
+    pip
+    ptpython
+    pytimeparse2
+    pyyaml
+    requests
+    rich-theme-manager
+    rich
+    shortuuid
+    strpdatetime
+    tenacity
+    textx
+    toml
+    wrapt
+    wurlitzer
+    xdg-base-dirs
+  ];
+
+  pythonRelaxDeps = [
+    "mako"
+    "more-itertools"
+    "objexplore"
+    "textx"
+  ];
+
+  pythonImportsCheck = [ "osxphotos" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mock
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTestPaths = [ "tests/test_comments.py" ];
+  disabledTests = [
+    "test_iphoto_info"
+    "test_from_to_date_tz"
+    "test_function_url"
+    "test_get_local_tz"
+    "test_datetime_naive_to_local"
+    "test_from_to_date_tz"
+    "test_query_from_to_date_alt_location"
+    "test_query_function_url"
+  ];
+
+  meta = {
+    description = "Export photos from Apple's macOS Photos app and query the Photos library database to access metadata about images";
+    homepage = "https://github.com/RhetTbull/osxphotos";
+    changelog = "https://github.com/RhetTbull/osxphotos/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sigmanificient ];
+    broken = stdenv.isDarwin;
+  };
+}

pkgs/development/python-modules/py-serializable/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "py-serializable";
-  version = "1.0.3";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "madpah";
     repo = "serializable";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oVjb7/9RWvQd5L6xQBrspfblPzMaRvnZHDuojTuq+zE=";
+    hash = "sha256-8rGsFQzZbWJydzGhdobeN/L2LH2BEpC7O9D/h8zoXcM=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/pylibjpeg-data/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  flit-core,
+}:
+
+buildPythonPackage rec {
+  pname = "pylibjpeg-data";
+  version = "unstable-2024-03-28";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "pydicom";
+    repo = "pylibjpeg-data";
+    rev = "8253566715800a7fc3d4d949abab102c8172bca0";
+    hash = "sha256-TzhiZ4LCFZX75h3YRrEFO5kRVc5VwTOJd+1VFW3LsaQ=";
+  };
+
+  build-system = [ flit-core ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "ljdata"
+    "ljdata.ds"
+    "ljdata.jpg"
+  ];
+
+  meta = {
+    description = "JPEG and DICOM data used for testing pylibjpeg";
+    homepage = "https://github.com/pydicom/pylibjpeg-data";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.bcdarwin ];
+  };
+}

pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix

@@ -0,0 +1,76 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  cmake,
+  cython,
+  poetry-core,
+  setuptools,
+  numpy,
+  openjpeg,
+  pytestCheckHook,
+  pydicom,
+  pylibjpeg,
+  pylibjpeg-data,
+}:
+
+buildPythonPackage rec {
+  pname = "pylibjpeg-openjpeg";
+  version = "2.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "pydicom";
+    repo = "pylibjpeg-openjpeg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cCDnARElNn+uY+HQ39OnGJRz2vTz0I8s0Oe+qGvqM1o=";
+  };
+
+  # don't use vendored openjpeg submodule:
+  # (note build writes into openjpeg source dir, so we have to make it writable)
+  postPatch = ''
+    rmdir lib/openjpeg
+    cp -r ${openjpeg.src} lib/openjpeg
+    chmod +rwX -R lib/openjpeg
+  '';
+
+  dontUseCmakeConfigure = true;
+
+  build-system = [
+    cmake
+    cython
+    poetry-core
+    setuptools
+  ];
+
+  dependencies = [ numpy ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pydicom
+    pylibjpeg-data
+    pylibjpeg
+  ];
+  disabledTestPaths = [
+    # ignore a few Python test files (e.g. performance tests) in openjpeg itself:
+    "lib/openjpeg"
+  ];
+
+  pytestFlagsArray = [ "openjpeg/tests" ];
+
+  pythonImportsCheck = [ "openjpeg" ];
+
+  meta = {
+    description = "A J2K and JP2 plugin for pylibjpeg";
+    homepage = "https://github.com/pydicom/pylibjpeg-openjpeg";
+    license = [ lib.licenses.mit ];
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    # x86-linux: test_encode.py::TestEncodeBuffer failures
+    # darwin: numerous test failures, seemingly due to issues setting up test data
+    broken = (stdenv.isAarch64 && stdenv.isLinux) || stdenv.isDarwin;
+  };
+}

pkgs/development/python-modules/pylibjpeg/default.nix

@@ -8,28 +8,10 @@
   setuptools,
   numpy,
   pydicom,
+  pylibjpeg-data,
   pylibjpeg-libjpeg,
 }:
 
-let
-  pylibjpeg-data = buildPythonPackage {
-    pname = "pylibjpeg-data";
-    version = "1.0.0dev0";
-    pyproject = true;
-
-    nativeBuildInputs = [ setuptools ];
-
-    src = fetchFromGitHub {
-      owner = "pydicom";
-      repo = "pylibjpeg-data";
-      rev = "2ab4b8a65b070656eca2582bd23197a3d01cdccd";
-      hash = "sha256-cFE1XjrqyGqwHCYGRucXK+q4k7ftUIbYwBw4WwIFtEc=";
-    };
-
-    doCheck = false;
-  };
-in
-
 buildPythonPackage rec {
   pname = "pylibjpeg";
   version = "2.0.0";
@@ -44,9 +26,9 @@ buildPythonPackage rec {
     hash = "sha256-qGtrphsBBVieGS/8rdymbsjLMU/QEd7zFNAANN8bD+k=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [ numpy ];
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [
     pytestCheckHook

pkgs/development/python-modules/rich-theme-manager/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  rich,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "rich-theme-manager";
+  version = "0.11.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "RhetTbull";
+    repo = "rich_theme_manager";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nSNG+lWOPmh66I9EmPvWqbeceY/cu+zBpgVlDTNuHc0=";
+  };
+
+  build-system = [ poetry-core ];
+  dependencies = [ rich ];
+
+  pythonImportsCheck = [ "rich_theme_manager" ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Define custom styles and themes for use with rich";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/RhetTbull/rich_theme_manager";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+}

pkgs/development/python-modules/std-uritemplate/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "std-uritemplate";
-  version = "1.0.3";
+  version = "1.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "std_uritemplate";
     inherit version;
-    hash = "sha256-RMNQRjnP+tTrEU9j3zxmOx/C5cdqwYlD514noZiwtzQ=";
+    hash = "sha256-bqMecvlqsrVNk8d03iF1zlNQqDP798AkuzcYo6U59gU=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/strpdatetime/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  textx,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "strpdatetime";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "RhetTbull";
+    repo = "strpdatetime";
+    rev = "v${version}";
+    hash = "sha256-eb3KJCFRkEt9KEP1gMQYuP50qXqItrexJhKvtJDHl9o=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ textx ];
+  pythonRelaxDeps = [ "textx" ];
+
+  patches = [ ./fix-locale.patch ];
+
+  pythonImportsCheck = [ "strpdatetime" ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Parse strings into Python datetime objects";
+    license = lib.licenses.psfl;
+    changelog = "https://github.com/RhetTbull/strpdatetime/blob/${src.rev}/CHANGELOG.md";
+    homepage = "https://github.com/RhetTbull/strpdatetime";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+}

pkgs/development/python-modules/strpdatetime/fix-locale.patch

@@ -0,0 +1,10 @@
+diff --git a/tests/test_strpdatetime.py b/tests/test_strpdatetime.py
+index 6c371d6..a3d0232 100644
+--- a/tests/test_strpdatetime.py
++++ b/tests/test_strpdatetime.py
+@@ -44,5 +44,4 @@ TEST_DATA = [
+ @pytest.mark.parametrize("string, format, expected", TEST_DATA)
+ def test_datetime_strptime(string, format, expected):
+     """Test datetime_strptime"""
+-    locale.setlocale(locale.LC_ALL, "en_US.UTF-8")
+     assert strpdatetime(string, format) == expected

pkgs/development/python-modules/textual/default.nix

@@ -12,6 +12,7 @@
   syrupy,
   time-machine,
   tree-sitter,
+  tree-sitter-languages,
   typing-extensions,
 }:
 
@@ -40,7 +41,7 @@ buildPythonPackage rec {
   optional-dependencies = {
     syntax = [
       tree-sitter
-      # tree-sitter-languages
+      tree-sitter-languages
     ];
   };
 
@@ -50,19 +51,18 @@ buildPythonPackage rec {
     pytestCheckHook
     syrupy
     time-machine
-  ] ++ optional-dependencies.syntax;
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   disabledTestPaths = [
-    # snapshot tests require syrupy<4
+    # Snapshot tests require syrupy<4
     "tests/snapshot_tests/test_snapshots.py"
   ];
 
   disabledTests = [
     # Assertion issues
     "test_textual_env_var"
-    "test_softbreak_split_links_rendered_correctly"
 
-    # requires tree-sitter-languages which is not packaged in nixpkgs
+    # Requirements for tests are not quite ready
     "test_register_language"
     "test_language_binary_missing"
   ];

pkgs/development/tools/analysis/checkov/default.nix

@@ -47,9 +47,6 @@ python3.pkgs.buildPythonApplication rec {
     setuptools-scm
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
-  ];
-
   dependencies = with python3.pkgs; [
     aiodns
     aiohttp

pkgs/development/tools/bearer/default.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.45.1";
+  version = "1.45.2";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-EYBX5w17CesqVWfPD5djbO5U96il8VC8crh1fQGhGoQ=";
+    hash = "sha256-eOeXNfBm0bDWS04pPkQODkX2Gm0i2TIgztcMEd4+HOI=";
   };
 
   vendorHash = "sha256-+PwkjmelmPEba7T6OJwuDdTr8Umw1GmNBIGDTSkWCeE=";

pkgs/development/tools/misc/hydra/unstable.nix

@@ -122,15 +122,15 @@ let
       ];
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hydra";
-  version = "2024-03-08";
+  version = "2024-07-09";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "8f56209bd6f3b9ec53d50a23812a800dee7a1969";
-    hash = "sha256-mhEj02VruXPmxz3jsKHMov2ERNXk9DwaTAunWEO1iIQ=";
+    rev = "d7986226f0666d5aa0032fdcdb9f38eef6a91dd3";
+    hash = "sha256-9DW0tAiAOfglua76t3viSvIw1gR1EETf0HTAmZklc3I=";
   };
 
   buildInputs = [
@@ -206,19 +206,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [
-    # https://github.com/NixOS/hydra/security/advisories/GHSA-2p75-6g9f-pqgx
-    (fetchpatch2 {
-      name = "CVE-2024-32657.patch";
-      url = "https://github.com/NixOS/hydra/commit/b72528be5074f3e62e9ae2c2ae8ef9c07a0b4dd3.patch";
-      hash = "sha256-+y27N8AIaHj13mj0LwW7dkpzfzZ4xfjN8Ld23c5mzuU=";
-    })
-  ];
-
   postPatch = ''
     # Change 5s timeout for init to 30s
     substituteInPlace t/lib/HydraTestContext.pm \
-      --replace 'expectOkay(5, ("hydra-init"));' 'expectOkay(30, ("hydra-init"));'
+      --replace-fail 'expectOkay(5, ("hydra-init"));' 'expectOkay(30, ("hydra-init"));'
   '';
 
   preCheck = ''
@@ -238,7 +229,7 @@ stdenv.mkDerivation rec {
         wrapProgram $i \
             --prefix PERL5LIB ':' $out/libexec/hydra/lib:$PERL5LIB \
             --prefix PATH ':' $out/bin:$hydraPath \
-            --set-default HYDRA_RELEASE ${version} \
+            --set-default HYDRA_RELEASE ${finalAttrs.version} \
             --set HYDRA_HOME $out/libexec/hydra \
             --set NIX_RELEASE ${nix.name or "unknown"}
     done
@@ -258,4 +249,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ mindavi ] ++ teams.helsinki-systems.members;
   };
-}
+})

pkgs/development/web/nodejs/nodejs.nix

@@ -45,7 +45,13 @@ let
       (builtins.attrNames sharedLibDeps);
 
   extraConfigFlags = lib.optionals (!enableNpm) [ "--without-npm" ];
-  self = stdenv.mkDerivation {
+
+  package = stdenv.mkDerivation (finalAttrs:
+  let
+    /** the final package fixed point, after potential overrides */
+    self = finalAttrs.finalPackage;
+  in
+  {
     inherit pname version;
 
     src = fetchurl {
@@ -295,5 +301,5 @@ let
     };
 
     passthru.python = python; # to ensure nodeEnv uses the same version
-  };
-in self
+  });
+in package

pkgs/servers/klipper/default.nix

@@ -57,6 +57,10 @@ stdenv.mkDerivation rec {
     cp -r $src/docs $out/lib/docs
     cp -r $src/config $out/lib/config
 
+    # Add version information. For the normal procedure see https://www.klipper3d.org/Packaging.html#versioning
+    # This is done like this because scripts/make_version.py is not available when sourceRoot is set to "${src.name}/klippy"
+    echo "${version}-NixOS" > $out/lib/klipper/.version
+
     mkdir -p $out/bin
     chmod 755 $out/lib/klipper/klippy.py
     makeWrapper $out/lib/klipper/klippy.py $out/bin/klippy --chdir $out/lib/klipper

pkgs/servers/monitoring/prometheus/v2ray-exporter.nix

@@ -18,6 +18,6 @@ buildGoModule rec {
     mainProgram = "v2ray-exporter";
     homepage = "https://github.com/wi1dcard/v2ray-exporter";
     license = licenses.mit;
-    maintainers = with maintainers; [ jqqqqqqqqqq ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/tools/filesystems/xfsprogs/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-eLard27r5atS4IhKcPobNjPmSigrHs+ukfXdHZ7F8H0=";
+    hash = "sha256-l1KEeD+z+8ThrmQL2ATXiOQjeoawdYKs7oa25I9lIbc=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ibus-libpinyin";
-  version = "1.15.7";
+  version = "1.15.8";
 
   src = fetchFromGitHub {
     owner = "libpinyin";
     repo = "ibus-libpinyin";
     rev = version;
-    hash = "sha256-Sr0zB6VeEYGDu1gx2kTVoaTm131F4K+/QH/+ibcbMT8=";
+    hash = "sha256-u21avBSSu/78tLoyFI9XGocC7rT/64L5HqQQj3Zg1Mc=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/pistol/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "pistol";
-  version = "0.5";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "doronbehar";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-C0X9LdCgfv+IFHsNLOumH1e/RAh6NycmE/J4SdA6AMs=";
+    sha256 = "sha256-gTiuA42WXRUvmGvuUmE7yvukCBXKSFoPOfnZXhOL1HI=";
   };
 
-  vendorHash = "sha256-3H3XAJ9gNBd+IjxpjfUFl2/3NWN1E+6aey4i4ajOIiY=";
+  vendorHash = "sha256-+Q72DUKLqahgbLCaXOTAYZaMvNfv3XF+SpyqHyB065g=";
 
   doCheck = false;
 

pkgs/tools/misc/tbls/default.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.76.1";
+  version = "1.77.0";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-xSmw3udoTTEpEpfoyU48RAlN8gR/cfqco1DQ8qs5W94=";
+    hash = "sha256-knYAwmxqeHv1XBi/zHf7cOkcLXITGnX0tXlT8/Zs2YQ=";
   };
 
-  vendorHash = "sha256-ALjpU5el6Tmzsw2f5/AizFBuk+zJj9RKe9KHdE0AOrM=";
+  vendorHash = "sha256-m5G0knHmPCz1pZ7LZ4i6Tyq+xSEq32mQFbXEdOY+6ec=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/nix/nixci/default.nix

@@ -8,21 +8,23 @@
 , Security
 , SystemConfiguration
 , IOKit
+, installShellFiles
+, nix
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nixci";
-  version = "0.5.0";
+  version = "1.0.0";
 
   src = fetchCrate {
     inherit version;
     pname = "nixci";
-    hash = "sha256-XbPXS29zqg+pOs/JRRB2bRPdMTDy/oKLM41UomSZTN0=";
+    hash = "sha256-49I09hXYoVo6vzv1b6mkeiFwzfj6g1SkXTL/tCEdOYc=";
   };
 
-  cargoHash = "sha256-+ed/XsEAwp7bsZOb+bOailpgSFnKvwoHR0QptnGeulk=";
+  cargoHash = "sha256-trmWeYJNev7jYJtGp9XR/emmQiiI94NM0cPFrAuD7m0=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config installShellFiles nix ];
 
   buildInputs = lib.optionals stdenv.isLinux [
     openssl
@@ -32,6 +34,13 @@ rustPlatform.buildRustPackage rec {
     SystemConfiguration
   ];
 
+  postInstall = ''
+    installShellCompletion --cmd nixci \
+      --bash <($out/bin/nixci completion bash) \
+      --fish <($out/bin/nixci completion fish) \
+      --zsh <($out/bin/nixci completion zsh)
+  '';
+
   # The rust program expects an environment (at build time) that points to the
   # devour-flake flake.
   env.DEVOUR_FLAKE = fetchFromGitHub {
@@ -45,7 +54,7 @@ rustPlatform.buildRustPackage rec {
     description = "Define and build CI for Nix projects anywhere";
     homepage = "https://github.com/srid/nixci";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ srid shivaraj-bh ];
+    maintainers = with maintainers; [ srid shivaraj-bh rsrohitsingh682 ];
     mainProgram = "nixci";
   };
 }

pkgs/tools/package-management/nix/default.nix

@@ -186,12 +186,12 @@ in lib.makeExtensible (self: ({
 
   git = (common rec {
     version = "2.24.0";
-    suffix = "pre20240717_${lib.substring 0 8 src.rev}";
+    suffix = "pre20240723_${lib.substring 0 8 src.rev}";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "464e5925cb21150e3c94f31224efabd3c1e74237";
-      hash = "sha256-C9pE0ghVURE3nLZmmgTG6CnGvWQ84g2lcyN7KKGCfN8=";
+      rev = "fb450de20ec8df558f9f7f167d748acf7cabe151";
+      hash = "sha256-xjN65yaPGwmly+Fdo6lVHL67+0IG+Cnxv7hNgYgoTGk=";
     };
     self_attribute_name = "git";
   }).override (lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {

pkgs/tools/security/cfripper/default.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.15.7";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ymuxZwW3Pwx/CyG2iPoY7LP9e+1K6EUBi/TApg0YvkE=";
+    hash = "sha256-2yOATSCXqv28OE+GdF9F9Dhi3AIkxSe/YJ9ILLnd/nw=";
   };
 
   pythonRelaxDeps = [

pkgs/tools/security/kubescape/default.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "3.0.14";
+  version = "3.0.15";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vTbNnQwHU1ALjNrZHE7nNw53DIe4lEifYOqkIeZohVE=";
+    hash = "sha256-97Ik9a7ZLoDuZ2tA1OiBy0ql+nlSuUm5DetBR5WkaUI=";
     fetchSubmodules = true;
   };
 

pkgs/top-level/all-packages.nix

@@ -21092,7 +21092,7 @@ with pkgs;
 
   hwloc = callPackage ../development/libraries/hwloc { };
 
-  hydra_unstable = callPackage ../development/tools/misc/hydra/unstable.nix { nix = nixVersions.nix_2_20; };
+  hydra_unstable = callPackage ../development/tools/misc/hydra/unstable.nix { nix = nixVersions.nix_2_22; };
 
   hydra-cli = callPackage ../development/tools/misc/hydra-cli { };
 
@@ -39516,8 +39516,6 @@ with pkgs;
 
   tewi-font = callPackage ../data/fonts/tewi { };
 
-  vcluster = callPackage ../applications/networking/cluster/vcluster { };
-
   sshportal = callPackage ../servers/sshportal { };
 
   ssh-audit = callPackage ../tools/security/ssh-audit { };

pkgs/top-level/python-packages.nix

@@ -1775,6 +1775,8 @@ self: super: with self; {
 
   bpycv = callPackage ../development/python-modules/bpycv {};
 
+  bpylist2 = callPackage ../development/python-modules/bpylist2 { };
+
   bpython = callPackage ../development/python-modules/bpython { };
 
   bqplot = callPackage ../development/python-modules/bqplot { };
@@ -9601,6 +9603,8 @@ self: super: with self; {
 
   ossfs = callPackage ../development/python-modules/ossfs { };
 
+  osxphotos = callPackage ../development/python-modules/osxphotos { };
+
   ots-python = callPackage ../development/python-modules/ots-python { };
 
   outcome = callPackage ../development/python-modules/outcome { };
@@ -11541,8 +11545,12 @@ self: super: with self; {
 
   pylibjpeg = callPackage ../development/python-modules/pylibjpeg { };
 
+  pylibjpeg-data = callPackage ../development/python-modules/pylibjpeg-data { };
+
   pylibjpeg-libjpeg = callPackage ../development/python-modules/pylibjpeg-libjpeg { };
 
+  pylibjpeg-openjpeg = callPackage ../development/python-modules/pylibjpeg-openjpeg { };
+
   pyliblo = callPackage ../development/python-modules/pyliblo { };
 
   pylibmc = callPackage ../development/python-modules/pylibmc { };
@@ -13595,6 +13603,8 @@ self: super: with self; {
 
   rich-rst = callPackage ../development/python-modules/rich-rst { };
 
+  rich-theme-manager = callPackage ../development/python-modules/rich-theme-manager { };
+
   ring-doorbell = callPackage ../development/python-modules/ring-doorbell { };
 
   rio-tiler = callPackage ../development/python-modules/rio-tiler { };
@@ -14947,6 +14957,8 @@ self: super: with self; {
 
   striprtf = callPackage ../development/python-modules/striprtf { };
 
+  strpdatetime = callPackage ../development/python-modules/strpdatetime { };
+
   structlog = callPackage ../development/python-modules/structlog { };
 
   stubserver = callPackage ../development/python-modules/stubserver { };