Merge staging-next into staging

.github/CODEOWNERS

@@ -197,6 +197,10 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/databases/postgresql.nix @thoughtpolice
 /nixos/tests/postgresql.nix @thoughtpolice
 
+# Linux kernel
+/pkgs/os-specific/linux/kernel    @raitobezarius
+/pkgs/top-level/linux-kernels.nix @raitobezarius
+
 # Hardened profile & related modules
 /nixos/modules/profiles/hardened.nix @joachifm
 /nixos/modules/security/hidepid.nix @joachifm

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -339,6 +339,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The `hardware.pulseaudio` module now sets permission of pulse user home directory to 755 when running in "systemWide" mode. It fixes [issue 114399](https://github.com/NixOS/nixpkgs/issues/114399).
 
+- The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
+
 - The `btrbk` module now automatically selects and provides required compression
   program depending on the configured `stream_compress` option. Since this
   replaces the need for the `extraPackages` option, this option will be

nixos/maintainers/scripts/lxd/lxd-virtual-machine-image-inner.nix

@@ -13,8 +13,22 @@
       ./lxd.nix
     ];
 
-  networking.useDHCP = false;
+  networking = {
-  networking.interfaces.eth0.useDHCP = true;
+    dhcdpcd.enable = false;
+    useDHCP = false;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."50-eth0" = {
+      matchConfig.Name = "eth0";
+      networkConfig = {
+        DHCP = "ipv4";
+        IPv6AcceptRA = true;
+      };
+      linkConfig.RequiredForOnline = "routable";
+    };
+  };
 
   system.stateVersion = "@stateVersion@"; # Did you read the comment?
 }

nixos/maintainers/scripts/lxd/lxd-virtual-machine-image.nix

@@ -26,6 +26,20 @@
   '';
 
   # Network
-  networking.useDHCP = false;
+  networking = {
-  networking.interfaces.enp5s0.useDHCP = true;
+    dhcdpcd.enable = false;
+    useDHCP = false;
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."50-enp5s0" = {
+      matchConfig.Name = "enp5s0";
+      networkConfig = {
+        DHCP = "ipv4";
+        IPv6AcceptRA = true;
+      };
+      linkConfig.RequiredForOnline = "routable";
+    };
+  };
 }

nixos/modules/module-list.nix

@@ -410,7 +410,6 @@
   ./services/continuous-integration/buildbot/worker.nix
   ./services/continuous-integration/buildkite-agents.nix
   ./services/continuous-integration/gitea-actions-runner.nix
-  ./services/continuous-integration/github-runner.nix
   ./services/continuous-integration/github-runners.nix
   ./services/continuous-integration/gitlab-runner.nix
   ./services/continuous-integration/gocd-agent/default.nix

nixos/modules/services/continuous-integration/github-runner.nix

@@ -1,25 +0,0 @@
-{ config
-, pkgs
-, lib
-, ...
-}@args:
-
-with lib;
-
-let
-  cfg = config.services.github-runner;
-in
-
-{
-  options.services.github-runner = import ./github-runner/options.nix (args // {
-    # Users don't need to specify options.services.github-runner.name; it will default
-    # to the hostname.
-    includeNameDefault = true;
-  });
-
-  config = mkIf cfg.enable {
-    services.github-runners.${cfg.name} = cfg;
-  };
-
-  meta.maintainers = with maintainers; [ veehaitch newam thomasjm ];
-}

nixos/modules/services/continuous-integration/github-runner/options.nix

@@ -1,213 +1,266 @@
-{ config
+{ lib
-, lib
 , pkgs
-, includeNameDefault
 , ...
 }:
 
 with lib;
-
 {
-  enable = mkOption {
+  options.services.github-runners = mkOption {
-    default = false;
-    example = true;
-    description = lib.mdDoc ''
-      Whether to enable GitHub Actions runner.
-
-      Note: GitHub recommends using self-hosted runners with private repositories only. Learn more here:
-      [About self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners).
-    '';
-    type = lib.types.bool;
-  };
-
-  url = mkOption {
-    type = types.str;
-    description = lib.mdDoc ''
-      Repository to add the runner to.
-
-      Changing this option triggers a new runner registration.
-
-      IMPORTANT: If your token is org-wide (not per repository), you need to
-      provide a github org link, not a single repository, so do it like this
-      `https://github.com/nixos`, not like this
-      `https://github.com/nixos/nixpkgs`.
-      Otherwise, you are going to get a `404 NotFound`
-      from `POST https://api.github.com/actions/runner-registration`
-      in the configure script.
-    '';
-    example = "https://github.com/nixos/nixpkgs";
-  };
-
-  tokenFile = mkOption {
-    type = types.path;
-    description = lib.mdDoc ''
-      The full path to a file which contains either
-
-      * a fine-grained personal access token (PAT),
-      * a classic PAT
-      * or a runner registration token
-
-      Changing this option or the `tokenFile`’s content triggers a new runner registration.
-
-      We suggest using the fine-grained PATs. A runner registration token is valid
-      only for 1 hour after creation, so the next time the runner configuration changes
-      this will give you hard-to-debug HTTP 404 errors in the configure step.
-
-      The file should contain exactly one line with the token without any newline.
-      (Use `echo -n '…token…' > …token file…` to make sure no newlines sneak in.)
-
-      If the file contains a PAT, the service creates a new registration token
-      on startup as needed.
-      If a registration token is given, it can be used to re-register a runner of the same
-      name but is time-limited as noted above.
-
-      For fine-grained PATs:
-
-      Give it "Read and Write access to organization/repository self hosted runners",
-      depending on whether it is organization wide or per-repository. You might have to
-      experiment a little, fine-grained PATs are a `beta` Github feature and still subject
-      to change; nonetheless they are the best option at the moment.
-
-      For classic PATs:
-
-      Make sure the PAT has a scope of `admin:org` for organization-wide registrations
-      or a scope of `repo` for a single repository.
-
-      For runner registration tokens:
-
-      Nothing special needs to be done, but updating will break after one hour,
-      so these are not recommended.
-    '';
-    example = "/run/secrets/github-runner/nixos.token";
-  };
-
-  name = let
-    # Same pattern as for `networking.hostName`
-    baseType = types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
-  in mkOption {
-    type = if includeNameDefault then baseType else types.nullOr baseType;
-    description = lib.mdDoc ''
-      Name of the runner to configure. Defaults to the hostname.
-
-      Changing this option triggers a new runner registration.
-    '';
-    example = "nixos";
-  } // (if includeNameDefault then {
-    default = config.networking.hostName;
-    defaultText = literalExpression "config.networking.hostName";
-  } else {
-    default = null;
-  });
-
-  runnerGroup = mkOption {
-    type = types.nullOr types.str;
-    description = lib.mdDoc ''
-      Name of the runner group to add this runner to (defaults to the default runner group).
-
-      Changing this option triggers a new runner registration.
-    '';
-    default = null;
-  };
-
-  extraLabels = mkOption {
-    type = types.listOf types.str;
-    description = lib.mdDoc ''
-      Extra labels in addition to the default (`["self-hosted", "Linux", "X64"]`).
-
-      Changing this option triggers a new runner registration.
-    '';
-    example = literalExpression ''[ "nixos" ]'';
-    default = [ ];
-  };
-
-  replace = mkOption {
-    type = types.bool;
-    description = lib.mdDoc ''
-      Replace any existing runner with the same name.
-
-      Without this flag, registering a new runner with the same name fails.
-    '';
-    default = false;
-  };
-
-  extraPackages = mkOption {
-    type = types.listOf types.package;
-    description = lib.mdDoc ''
-      Extra packages to add to `PATH` of the service to make them available to workflows.
-    '';
-    default = [ ];
-  };
-
-  extraEnvironment = mkOption {
-    type = types.attrs;
-    description = lib.mdDoc ''
-      Extra environment variables to set for the runner, as an attrset.
-    '';
-    example = {
-      GIT_CONFIG = "/path/to/git/config";
-    };
-    default = {};
-  };
-
-  serviceOverrides = mkOption {
-    type = types.attrs;
-    description = lib.mdDoc ''
-      Modify the systemd service. Can be used to, e.g., adjust the sandboxing options.
-      See {manpage}`systemd.exec(5)` for more options.
-    '';
-    example = {
-      ProtectHome = false;
-      RestrictAddressFamilies = [ "AF_PACKET" ];
-    };
-    default = {};
-  };
-
-  package = mkPackageOption pkgs "github-runner" { };
-
-  ephemeral = mkOption {
-    type = types.bool;
-    description = lib.mdDoc ''
-      If enabled, causes the following behavior:
-
-      - Passes the `--ephemeral` flag to the runner configuration script
-      - De-registers and stops the runner with GitHub after it has processed one job
-      - On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
-      - Restarts the service after its successful exit
-      - On start, wipes the state directory and configures a new runner
-
-      You should only enable this option if `tokenFile` points to a file which contains a
-      personal access token (PAT). If you're using the option with a registration token, restarting the
-      service will fail as soon as the registration token expired.
-    '';
-    default = false;
-  };
-
-  user = mkOption {
-    type = types.nullOr types.str;
-    description = lib.mdDoc ''
-      User under which to run the service. If null, will use a systemd dynamic user.
-    '';
-    default = null;
-    defaultText = literalExpression "username";
-  };
-
-  workDir = mkOption {
-    type = with types; nullOr str;
-    description = lib.mdDoc ''
-      Working directory, available as `$GITHUB_WORKSPACE` during workflow runs
-      and used as a default for [repository checkouts](https://github.com/actions/checkout).
-      The service cleans this directory on every service start.
-
-      A value of `null` will default to the systemd `RuntimeDirectory`.
-    '';
-    default = null;
-  };
-
-  nodeRuntimes = mkOption {
-    type = with types; nonEmptyListOf (enum [ "node16" "node20" ]);
-    default = [ "node20" ];
     description = mdDoc ''
-      List of Node.js runtimes the runner should support.
+      Multiple GitHub Runners.
     '';
+    example = {
+      runner1 = {
+        enable = true;
+        url = "https://github.com/owner/repo";
+        name = "runner1";
+        tokenFile = "/secrets/token1";
+      };
+
+      runner2 = {
+        enable = true;
+        url = "https://github.com/owner/repo";
+        name = "runner2";
+        tokenFile = "/secrets/token2";
+      };
+    };
+    default = { };
+    type = types.attrsOf (types.submodule ({ name, ... }: {
+      options = {
+        enable = mkOption {
+          default = false;
+          example = true;
+          description = mdDoc ''
+            Whether to enable GitHub Actions runner.
+
+            Note: GitHub recommends using self-hosted runners with private repositories only. Learn more here:
+            [About self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners).
+          '';
+          type = types.bool;
+        };
+
+        url = mkOption {
+          type = types.str;
+          description = mdDoc ''
+            Repository to add the runner to.
+
+            Changing this option triggers a new runner registration.
+
+            IMPORTANT: If your token is org-wide (not per repository), you need to
+            provide a github org link, not a single repository, so do it like this
+            `https://github.com/nixos`, not like this
+            `https://github.com/nixos/nixpkgs`.
+            Otherwise, you are going to get a `404 NotFound`
+            from `POST https://api.github.com/actions/runner-registration`
+            in the configure script.
+          '';
+          example = "https://github.com/nixos/nixpkgs";
+        };
+
+        tokenFile = mkOption {
+          type = types.path;
+          description = mdDoc ''
+            The full path to a file which contains either
+
+            * a fine-grained personal access token (PAT),
+            * a classic PAT
+            * or a runner registration token
+
+            Changing this option or the `tokenFile`’s content triggers a new runner registration.
+
+            We suggest using the fine-grained PATs. A runner registration token is valid
+            only for 1 hour after creation, so the next time the runner configuration changes
+            this will give you hard-to-debug HTTP 404 errors in the configure step.
+
+            The file should contain exactly one line with the token without any newline.
+            (Use `echo -n '…token…' > …token file…` to make sure no newlines sneak in.)
+
+            If the file contains a PAT, the service creates a new registration token
+            on startup as needed.
+            If a registration token is given, it can be used to re-register a runner of the same
+            name but is time-limited as noted above.
+
+            For fine-grained PATs:
+
+            Give it "Read and Write access to organization/repository self hosted runners",
+            depending on whether it is organization wide or per-repository. You might have to
+            experiment a little, fine-grained PATs are a `beta` Github feature and still subject
+            to change; nonetheless they are the best option at the moment.
+
+            For classic PATs:
+
+            Make sure the PAT has a scope of `admin:org` for organization-wide registrations
+            or a scope of `repo` for a single repository.
+
+            For runner registration tokens:
+
+            Nothing special needs to be done, but updating will break after one hour,
+            so these are not recommended.
+          '';
+          example = "/run/secrets/github-runner/nixos.token";
+        };
+
+        name = mkOption {
+          type = types.nullOr types.str;
+          description = mdDoc ''
+            Name of the runner to configure. If null, defaults to the hostname.
+
+            Changing this option triggers a new runner registration.
+          '';
+          example = "nixos";
+          default = name;
+        };
+
+        runnerGroup = mkOption {
+          type = types.nullOr types.str;
+          description = mdDoc ''
+            Name of the runner group to add this runner to (defaults to the default runner group).
+
+            Changing this option triggers a new runner registration.
+          '';
+          default = null;
+        };
+
+        extraLabels = mkOption {
+          type = types.listOf types.str;
+          description = mdDoc ''
+            Extra labels in addition to the default (unless disabled through the `noDefaultLabels` option).
+
+            Changing this option triggers a new runner registration.
+          '';
+          example = literalExpression ''[ "nixos" ]'';
+          default = [ ];
+        };
+
+        noDefaultLabels = mkOption {
+          type = types.bool;
+          description = mdDoc ''
+            Disables adding the default labels. Also see the `extraLabels` option.
+
+            Changing this option triggers a new runner registration.
+          '';
+          default = false;
+        };
+
+        replace = mkOption {
+          type = types.bool;
+          description = mdDoc ''
+            Replace any existing runner with the same name.
+
+            Without this flag, registering a new runner with the same name fails.
+          '';
+          default = false;
+        };
+
+        extraPackages = mkOption {
+          type = types.listOf types.package;
+          description = mdDoc ''
+            Extra packages to add to `PATH` of the service to make them available to workflows.
+          '';
+          default = [ ];
+        };
+
+        extraEnvironment = mkOption {
+          type = types.attrs;
+          description = mdDoc ''
+            Extra environment variables to set for the runner, as an attrset.
+          '';
+          example = {
+            GIT_CONFIG = "/path/to/git/config";
+          };
+          default = { };
+        };
+
+        serviceOverrides = mkOption {
+          type = types.attrs;
+          description = mdDoc ''
+            Modify the systemd service. Can be used to, e.g., adjust the sandboxing options.
+            See {manpage}`systemd.exec(5)` for more options.
+          '';
+          example = {
+            ProtectHome = false;
+            RestrictAddressFamilies = [ "AF_PACKET" ];
+          };
+          default = { };
+        };
+
+        package = mkPackageOption pkgs "github-runner" { };
+
+        ephemeral = mkOption {
+          type = types.bool;
+          description = mdDoc ''
+            If enabled, causes the following behavior:
+
+            - Passes the `--ephemeral` flag to the runner configuration script
+            - De-registers and stops the runner with GitHub after it has processed one job
+            - On stop, systemd wipes the runtime directory (this always happens, even without using the ephemeral option)
+            - Restarts the service after its successful exit
+            - On start, wipes the state directory and configures a new runner
+
+            You should only enable this option if `tokenFile` points to a file which contains a
+            personal access token (PAT). If you're using the option with a registration token, restarting the
+            service will fail as soon as the registration token expired.
+
+            Changing this option triggers a new runner registration.
+          '';
+          default = false;
+        };
+
+        user = mkOption {
+          type = types.nullOr types.str;
+          description = mdDoc ''
+            User under which to run the service.
+
+            If this option and the `group` option is set to `null`,
+            the service runs as a dynamically allocated user.
+
+            Also see the `group` option for an overview on the effects of the `user` and `group` settings.
+          '';
+          default = null;
+          defaultText = literalExpression "username";
+        };
+
+        group = mkOption {
+          type = types.nullOr types.str;
+          description = mdDoc ''
+            Group under which to run the service.
+
+            The effect of this option depends on the value of the `user` option:
+
+            - `group == null` and `user == null`:
+              The service runs with a dynamically allocated user and group.
+            - `group == null` and `user != null`:
+              The service runs as the given user and its default group.
+            - `group != null` and `user == null`:
+              This configuration is invalid. In this case, the service would use the given group
+              but run as root implicitly. If this is really what you want, set `user = "root"` explicitly.
+          '';
+          default = null;
+          defaultText = literalExpression "groupname";
+        };
+
+        workDir = mkOption {
+          type = with types; nullOr str;
+          description = mdDoc ''
+            Working directory, available as `$GITHUB_WORKSPACE` during workflow runs
+            and used as a default for [repository checkouts](https://github.com/actions/checkout).
+            The service cleans this directory on every service start.
+
+            A value of `null` will default to the systemd `RuntimeDirectory`.
+
+            Changing this option triggers a new runner registration.
+          '';
+          default = null;
+        };
+
+        nodeRuntimes = mkOption {
+          type = with types; nonEmptyListOf (enum [ "node20" ]);
+          default = [ "node20" ];
+          description = mdDoc ''
+            List of Node.js runtimes the runner should support.
+          '';
+        };
+      };
+    }));
   };
 }

nixos/modules/services/continuous-integration/github-runner/service.nix

@@ -1,269 +1,299 @@
 { config
 , lib
 , pkgs
-
-, cfg ? config.services.github-runner
-, svcName
-
-, systemdDir ? "${svcName}/${cfg.name}"
-  # %t: Runtime directory root (usually /run); see systemd.unit(5)
-, runtimeDir ? "%t/${systemdDir}"
-  # %S: State directory root (usually /var/lib); see systemd.unit(5)
-, stateDir ? "%S/${systemdDir}"
-  # %L: Log directory root (usually /var/log); see systemd.unit(5)
-, logsDir ? "%L/${systemdDir}"
-  # Name of file stored in service state directory
-, currentConfigTokenFilename ? ".current-token"
-
 , ...
 }:
 
 with lib;
-
-let
-  workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
-  # Support old github-runner versions which don't have the `nodeRuntimes` arg yet.
-  package = cfg.package.override (old: optionalAttrs (hasAttr "nodeRuntimes" old) { inherit (cfg) nodeRuntimes; });
-in
 {
-  description = "GitHub Actions runner";
+  config.assertions = flatten (
+    flip mapAttrsToList config.services.github-runners (name: cfg: map (mkIf cfg.enable) [
+      {
+        assertion = !cfg.noDefaultLabels || (cfg.extraLabels != [ ]);
+        message = "`services.github-runners.${name}`: The `extraLabels` option is mandatory if `noDefaultLabels` is set";
+      }
+      {
+        assertion = cfg.group == null || cfg.user != null;
+        message = ''`services.github-runners.${name}`: Setting `group` while leaving `user` unset runs the service as `root`. If this is really what you want, set `user = "root"` explicitly'';
+      }
+    ])
+  );
 
-  wantedBy = [ "multi-user.target" ];
+  config.systemd.services = flip mapAttrs' config.services.github-runners (name: cfg:
-  wants = [ "network-online.target" ];
+    let
-  after = [ "network.target" "network-online.target" ];
+      svcName = "github-runner-${name}";
+      systemdDir = "github-runner/${name}";
 
-  environment = {
+      # %t: Runtime directory root (usually /run); see systemd.unit(5)
-    HOME = workDir;
+      runtimeDir = "%t/${systemdDir}";
-    RUNNER_ROOT = stateDir;
+      # %S: State directory root (usually /var/lib); see systemd.unit(5)
-  } // cfg.extraEnvironment;
+      stateDir = "%S/${systemdDir}";
+      # %L: Log directory root (usually /var/log); see systemd.unit(5)
+      logsDir = "%L/${systemdDir}";
+      # Name of file stored in service state directory
+      currentConfigTokenFilename = ".current-token";
 
-  path = (with pkgs; [
+      workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
-    bash
+      # Support old github-runner versions which don't have the `nodeRuntimes` arg yet.
-    coreutils
+      package = cfg.package.override (old: optionalAttrs (hasAttr "nodeRuntimes" old) { inherit (cfg) nodeRuntimes; });
-    git
+    in
-    gnutar
+    nameValuePair svcName {
-    gzip
+      description = "GitHub Actions runner";
-  ]) ++ [
-    config.nix.package
-  ] ++ cfg.extraPackages;
 
-  serviceConfig = mkMerge [
+      wantedBy = [ "multi-user.target" ];
-    {
+      wants = [ "network-online.target" ];
-      ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
+      after = [ "network.target" "network-online.target" ];
 
-      # Does the following, sequentially:
+      environment = {
-      # - If the module configuration or the token has changed, purge the state directory,
+        HOME = workDir;
-      #   and create the current and the new token file with the contents of the configured
+        RUNNER_ROOT = stateDir;
-      #   token. While both files have the same content, only the later is accessible by
+      } // cfg.extraEnvironment;
-      #   the service user.
-      # - Configure the runner using the new token file. When finished, delete it.
-      # - Set up the directory structure by creating the necessary symlinks.
-      ExecStartPre =
-        let
-          # Wrapper script which expects the full path of the state, working and logs
-          # directory as arguments. Overrides the respective systemd variables to provide
-          # unambiguous directory names. This becomes relevant, for example, if the
-          # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
-          # to contain more than one directory. This causes systemd to set the respective
-          # environment variables with the path of all of the given directories, separated
-          # by a colon.
-          writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
-            set -euo pipefail
 
-            STATE_DIRECTORY="$1"
+      path = (with pkgs; [
-            WORK_DIRECTORY="$2"
+        bash
-            LOGS_DIRECTORY="$3"
+        coreutils
+        git
+        gnutar
+        gzip
+      ]) ++ [
+        config.nix.package
+      ] ++ cfg.extraPackages;
 
-            ${lines}
+      serviceConfig = mkMerge [
-          '';
+        {
-          runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg;
+          ExecStart = "${package}/bin/Runner.Listener run --startuptype service";
-          newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
-          currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
-          newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
-          currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
 
-          runnerCredFiles = [
+          # Does the following, sequentially:
-            ".credentials"
+          # - If the module configuration or the token has changed, purge the state directory,
-            ".credentials_rsaparams"
+          #   and create the current and the new token file with the contents of the configured
-            ".runner"
+          #   token. While both files have the same content, only the later is accessible by
+          #   the service user.
+          # - Configure the runner using the new token file. When finished, delete it.
+          # - Set up the directory structure by creating the necessary symlinks.
+          ExecStartPre =
+            let
+              # Wrapper script which expects the full path of the state, working and logs
+              # directory as arguments. Overrides the respective systemd variables to provide
+              # unambiguous directory names. This becomes relevant, for example, if the
+              # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
+              # to contain more than one directory. This causes systemd to set the respective
+              # environment variables with the path of all of the given directories, separated
+              # by a colon.
+              writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
+                set -euo pipefail
+
+                STATE_DIRECTORY="$1"
+                WORK_DIRECTORY="$2"
+                LOGS_DIRECTORY="$3"
+
+                ${lines}
+              '';
+              runnerRegistrationConfig = getAttrs [
+                "ephemeral"
+                "extraLabels"
+                "name"
+                "noDefaultLabels"
+                "runnerGroup"
+                "tokenFile"
+                "url"
+                "workDir"
+              ]
+                cfg;
+              newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
+              currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
+              newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
+              currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
+
+              runnerCredFiles = [
+                ".credentials"
+                ".credentials_rsaparams"
+                ".runner"
+              ];
+              unconfigureRunner = writeScript "unconfigure" ''
+                copy_tokens() {
+                  # Copy the configured token file to the state dir and allow the service user to read the file
+                  install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
+                  # Also copy current file to allow for a diff on the next start
+                  install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
+                }
+                clean_state() {
+                  find "$STATE_DIRECTORY/" -mindepth 1 -delete
+                  copy_tokens
+                }
+                diff_config() {
+                  changed=0
+                  # Check for module config changes
+                  [[ -f "${currentConfigPath}" ]] \
+                    && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
+                    || changed=1
+                  # Also check the content of the token file
+                  [[ -f "${currentConfigTokenPath}" ]] \
+                    && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
+                    || changed=1
+                  # If the config has changed, remove old state and copy tokens
+                  if [[ "$changed" -eq 1 ]]; then
+                    echo "Config has changed, removing old runner state."
+                    echo "The old runner will still appear in the GitHub Actions UI." \
+                         "You have to remove it manually."
+                    clean_state
+                  fi
+                }
+                if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
+                  # In ephemeral mode, we always want to start with a clean state
+                  clean_state
+                elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
+                  # There are state files from a previous run; diff them to decide if we need a new registration
+                  diff_config
+                else
+                  # The state directory is entirely empty which indicates a first start
+                  copy_tokens
+                fi
+                # Always clean workDir
+                find -H "$WORK_DIRECTORY" -mindepth 1 -delete
+              '';
+              configureRunner = writeScript "configure" ''
+                if [[ -e "${newConfigTokenPath}" ]]; then
+                  echo "Configuring GitHub Actions Runner"
+                  args=(
+                    --unattended
+                    --disableupdate
+                    --work "$WORK_DIRECTORY"
+                    --url ${escapeShellArg cfg.url}
+                    --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
+                    ${optionalString (cfg.name != null ) "--name ${escapeShellArg cfg.name}"}
+                    ${optionalString cfg.replace "--replace"}
+                    ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
+                    ${optionalString cfg.ephemeral "--ephemeral"}
+                    ${optionalString cfg.noDefaultLabels "--no-default-labels"}
+                  )
+                  # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
+                  # if it is not a PAT, we assume it contains a registration token and use the --token option
+                  token=$(<"${newConfigTokenPath}")
+                  if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                    args+=(--pat "$token")
+                  else
+                    args+=(--token "$token")
+                  fi
+                  ${package}/bin/Runner.Listener configure "''${args[@]}"
+                  # Move the automatically created _diag dir to the logs dir
+                  mkdir -p  "$STATE_DIRECTORY/_diag"
+                  cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
+                  rm    -rf "$STATE_DIRECTORY/_diag/"
+                  # Cleanup token from config
+                  rm "${newConfigTokenPath}"
+                  # Symlink to new config
+                  ln -s '${newConfigPath}' "${currentConfigPath}"
+                fi
+              '';
+              setupWorkDir = writeScript "setup-work-dirs" ''
+                # Link _diag dir
+                ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag"
+
+                # Link the runner credentials to the work dir
+                ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/"
+              '';
+            in
+            map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [
+              "+${unconfigureRunner}" # runs as root
+              configureRunner
+              setupWorkDir
+            ];
+
+          # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
+          # to trigger a fresh registration.
+          Restart = if cfg.ephemeral then "on-success" else "no";
+          # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service:
+          # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146
+          RestartForceExitStatus = [ 2 ];
+
+          # Contains _diag
+          LogsDirectory = [ systemdDir ];
+          # Default RUNNER_ROOT which contains ephemeral Runner data
+          RuntimeDirectory = [ systemdDir ];
+          # Home of persistent runner data, e.g., credentials
+          StateDirectory = [ systemdDir ];
+          StateDirectoryMode = "0700";
+          WorkingDirectory = workDir;
+
+          InaccessiblePaths = [
+            # Token file path given in the configuration, if visible to the service
+            "-${cfg.tokenFile}"
+            # Token file in the state directory
+            "${stateDir}/${currentConfigTokenFilename}"
           ];
-          unconfigureRunner = writeScript "unconfigure" ''
-            copy_tokens() {
-              # Copy the configured token file to the state dir and allow the service user to read the file
-              install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}"
-              # Also copy current file to allow for a diff on the next start
-              install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}"
-            }
-            clean_state() {
-              find "$STATE_DIRECTORY/" -mindepth 1 -delete
-              copy_tokens
-            }
-            diff_config() {
-              changed=0
-              # Check for module config changes
-              [[ -f "${currentConfigPath}" ]] \
-                && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \
-                || changed=1
-              # Also check the content of the token file
-              [[ -f "${currentConfigTokenPath}" ]] \
-                && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \
-                || changed=1
-              # If the config has changed, remove old state and copy tokens
-              if [[ "$changed" -eq 1 ]]; then
-                echo "Config has changed, removing old runner state."
-                echo "The old runner will still appear in the GitHub Actions UI." \
-                     "You have to remove it manually."
-                clean_state
-              fi
-            }
-            if [[ "${optionalString cfg.ephemeral "1"}" ]]; then
-              # In ephemeral mode, we always want to start with a clean state
-              clean_state
-            elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then
-              # There are state files from a previous run; diff them to decide if we need a new registration
-              diff_config
-            else
-              # The state directory is entirely empty which indicates a first start
-              copy_tokens
-            fi
-            # Always clean workDir
-            find -H "$WORK_DIRECTORY" -mindepth 1 -delete
-          '';
-          configureRunner = writeScript "configure" ''
-            if [[ -e "${newConfigTokenPath}" ]]; then
-              echo "Configuring GitHub Actions Runner"
-              args=(
-                --unattended
-                --disableupdate
-                --work "$WORK_DIRECTORY"
-                --url ${escapeShellArg cfg.url}
-                --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)}
-                --name ${escapeShellArg cfg.name}
-                ${optionalString cfg.replace "--replace"}
-                ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
-                ${optionalString cfg.ephemeral "--ephemeral"}
-              )
-              # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
-              # if it is not a PAT, we assume it contains a registration token and use the --token option
-              token=$(<"${newConfigTokenPath}")
-              if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
-                args+=(--pat "$token")
-              else
-                args+=(--token "$token")
-              fi
-              ${package}/bin/Runner.Listener configure "''${args[@]}"
-              # Move the automatically created _diag dir to the logs dir
-              mkdir -p  "$STATE_DIRECTORY/_diag"
-              cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
-              rm    -rf "$STATE_DIRECTORY/_diag/"
-              # Cleanup token from config
-              rm "${newConfigTokenPath}"
-              # Symlink to new config
-              ln -s '${newConfigPath}' "${currentConfigPath}"
-            fi
-          '';
-          setupWorkDir = writeScript "setup-work-dirs" ''
-            # Link _diag dir
-            ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag"
 
-            # Link the runner credentials to the work dir
+          KillSignal = "SIGINT";
-            ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/"
-          '';
-        in
-        map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [
-          "+${unconfigureRunner}" # runs as root
-          configureRunner
-          setupWorkDir
-        ];
 
-      # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
+          # Hardening (may overlap with DynamicUser=)
-      # to trigger a fresh registration.
+          # The following options are only for optimizing:
-      Restart = if cfg.ephemeral then "on-success" else "no";
+          # systemd-analyze security github-runner
-      # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service:
+          AmbientCapabilities = mkBefore [ "" ];
-      # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146
+          CapabilityBoundingSet = mkBefore [ "" ];
-      RestartForceExitStatus = [ 2 ];
+          # ProtectClock= adds DeviceAllow=char-rtc r
+          DeviceAllow = mkBefore [ "" ];
+          NoNewPrivileges = mkDefault true;
+          PrivateDevices = mkDefault true;
+          PrivateMounts = mkDefault true;
+          PrivateTmp = mkDefault true;
+          PrivateUsers = mkDefault true;
+          ProtectClock = mkDefault true;
+          ProtectControlGroups = mkDefault true;
+          ProtectHome = mkDefault true;
+          ProtectHostname = mkDefault true;
+          ProtectKernelLogs = mkDefault true;
+          ProtectKernelModules = mkDefault true;
+          ProtectKernelTunables = mkDefault true;
+          ProtectSystem = mkDefault "strict";
+          RemoveIPC = mkDefault true;
+          RestrictNamespaces = mkDefault true;
+          RestrictRealtime = mkDefault true;
+          RestrictSUIDSGID = mkDefault true;
+          UMask = mkDefault "0066";
+          ProtectProc = mkDefault "invisible";
+          SystemCallFilter = mkBefore [
+            "~@clock"
+            "~@cpu-emulation"
+            "~@module"
+            "~@mount"
+            "~@obsolete"
+            "~@raw-io"
+            "~@reboot"
+            "~capset"
+            "~setdomainname"
+            "~sethostname"
+          ];
+          RestrictAddressFamilies = mkBefore [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
 
-      # Contains _diag
+          BindPaths = lib.optionals (cfg.workDir != null) [ cfg.workDir ];
-      LogsDirectory = [ systemdDir ];
-      # Default RUNNER_ROOT which contains ephemeral Runner data
-      RuntimeDirectory = [ systemdDir ];
-      # Home of persistent runner data, e.g., credentials
-      StateDirectory = [ systemdDir ];
-      StateDirectoryMode = "0700";
-      WorkingDirectory = workDir;
 
-      InaccessiblePaths = [
+          # Needs network access
-        # Token file path given in the configuration, if visible to the service
+          PrivateNetwork = mkDefault false;
-        "-${cfg.tokenFile}"
+          # Cannot be true due to Node
-        # Token file in the state directory
+          MemoryDenyWriteExecute = mkDefault false;
-        "${stateDir}/${currentConfigTokenFilename}"
+
+          # The more restrictive "pid" option makes `nix` commands in CI emit
+          # "GC Warning: Couldn't read /proc/stat"
+          # You may want to set this to "pid" if not using `nix` commands
+          ProcSubset = mkDefault "all";
+          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
+          # ASLR (address space layout randomization) which requires the
+          # `personality` syscall
+          # You may want to set this to `true` if not using coverage tooling on
+          # compiled code
+          LockPersonality = mkDefault false;
+
+          DynamicUser = mkDefault true;
+        }
+        (mkIf (cfg.user != null) {
+          DynamicUser = false;
+          User = cfg.user;
+        })
+        (mkIf (cfg.group != null) {
+          DynamicUser = false;
+          Group = cfg.group;
+        })
+        cfg.serviceOverrides
       ];
-
-      KillSignal = "SIGINT";
-
-      # Hardening (may overlap with DynamicUser=)
-      # The following options are only for optimizing:
-      # systemd-analyze security github-runner
-      AmbientCapabilities = mkBefore [ "" ];
-      CapabilityBoundingSet = mkBefore [ "" ];
-      # ProtectClock= adds DeviceAllow=char-rtc r
-      DeviceAllow = mkBefore [ "" ];
-      NoNewPrivileges = mkDefault true;
-      PrivateDevices = mkDefault true;
-      PrivateMounts = mkDefault true;
-      PrivateTmp = mkDefault true;
-      PrivateUsers = mkDefault true;
-      ProtectClock = mkDefault true;
-      ProtectControlGroups = mkDefault true;
-      ProtectHome = mkDefault true;
-      ProtectHostname = mkDefault true;
-      ProtectKernelLogs = mkDefault true;
-      ProtectKernelModules = mkDefault true;
-      ProtectKernelTunables = mkDefault true;
-      ProtectSystem = mkDefault "strict";
-      RemoveIPC = mkDefault true;
-      RestrictNamespaces = mkDefault true;
-      RestrictRealtime = mkDefault true;
-      RestrictSUIDSGID = mkDefault true;
-      UMask = mkDefault "0066";
-      ProtectProc = mkDefault "invisible";
-      SystemCallFilter = mkBefore [
-        "~@clock"
-        "~@cpu-emulation"
-        "~@module"
-        "~@mount"
-        "~@obsolete"
-        "~@raw-io"
-        "~@reboot"
-        "~capset"
-        "~setdomainname"
-        "~sethostname"
-      ];
-      RestrictAddressFamilies = mkBefore [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
-
-      BindPaths = lib.optionals (cfg.workDir != null) [ cfg.workDir ];
-
-      # Needs network access
-      PrivateNetwork = mkDefault false;
-      # Cannot be true due to Node
-      MemoryDenyWriteExecute = mkDefault false;
-
-      # The more restrictive "pid" option makes `nix` commands in CI emit
-      # "GC Warning: Couldn't read /proc/stat"
-      # You may want to set this to "pid" if not using `nix` commands
-      ProcSubset = mkDefault "all";
-      # Coverage programs for compiled code such as `cargo-tarpaulin` disable
-      # ASLR (address space layout randomization) which requires the
-      # `personality` syscall
-      # You may want to set this to `true` if not using coverage tooling on
-      # compiled code
-      LockPersonality = mkDefault false;
-
-      # Note that this has some interactions with the User setting; so you may
-      # want to consult the systemd docs if using both.
-      DynamicUser = mkDefault true;
     }
-    (mkIf (cfg.user != null) { User = cfg.user; })
+  );
-    cfg.serviceOverrides
-  ];
 }

nixos/modules/services/continuous-integration/github-runners.nix

@@ -1,58 +1,10 @@
-{ config
+{ lib, ... }:
-, pkgs
-, lib
-, ...
-}@args:
-
-with lib;
-
-let
-  cfg = config.services.github-runners;
-
-in
-
 {
-  options.services.github-runners = mkOption {
+  imports = [
-    default = {};
+    (lib.mkRemovedOptionModule [ "services" "github-runner" ] "Use `services.github-runners.*` instead")
-    type = with types; attrsOf (submodule { options = import ./github-runner/options.nix (args // {
+    ./github-runner/options.nix
-      # services.github-runners.${name}.name doesn't have a default; it falls back to ${name} below.
+    ./github-runner/service.nix
-      includeNameDefault = false;
+  ];
-    }); });
-    example = {
-      runner1 = {
-        enable = true;
-        url = "https://github.com/owner/repo";
-        name = "runner1";
-        tokenFile = "/secrets/token1";
-      };
 
-      runner2 = {
+  meta.maintainers = with lib.maintainers; [ veehaitch newam ];
-        enable = true;
-        url = "https://github.com/owner/repo";
-        name = "runner2";
-        tokenFile = "/secrets/token2";
-      };
-    };
-    description = lib.mdDoc ''
-      Multiple GitHub Runners.
-    '';
-  };
-
-  config = {
-    systemd.services = flip mapAttrs' cfg (n: v:
-      let
-        svcName = "github-runner-${n}";
-      in
-        nameValuePair svcName
-        (import ./github-runner/service.nix (args // {
-          inherit svcName;
-          cfg = v // {
-            name = if v.name != null then v.name else n;
-          };
-          systemdDir = "github-runner/${n}";
-        }))
-    );
-  };
-
-  meta.maintainers = with maintainers; [ veehaitch newam ];
 }

nixos/modules/services/misc/gitea.nix

@@ -681,6 +681,11 @@ in
       optional (cfg.database.password != "") "config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead." ++
       optional (cfg.extraConfig != null) ''
         services.gitea.`extraConfig` is deprecated, please use services.gitea.`settings`.
+      '' ++
+      optional (lib.getName cfg.package == "forgejo") ''
+        Running forgejo via services.gitea.package is no longer supported.
+        Please use services.forgejo instead.
+        See https://nixos.org/manual/nixos/unstable/#module-forgejo for migration instructions.
       '';
 
     # Create database passwordFile default when password is configured.

pkgs/applications/audio/monkeys-audio/default.nix

@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.48";
+  version = "10.49";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-ZVJ6Czn2PNumMoWQwhJD0tjOJp9a0GxuD8LUMC47aNw=";
+    hash = "sha256-OhTqBFNwmReMT1U11CIB7XCTohiILdd2nDFp+9nfObs=";
     stripRoot = false;
   };
   nativeBuildInputs = [

pkgs/applications/audio/stone-phaser/default.nix

@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
   postPatch = ''
     patch -d dpf -p 1 -i "$src/resources/patch/DPF-bypass.patch"
     patchShebangs ./dpf/utils/generate-ttl.sh
+
+    # Fix gcc-13 build failure due to missing includes
+    sed -e '1i #include <cstdint>' -i plugins/stone-phaser/ui/Color.h
   '';
 
   installFlags = [ "PREFIX=$(out)" ];

pkgs/applications/blockchains/polkadot/default.nix

@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-v${version}";
-    hash = "sha256-myQ1TIkytEGdaR3KZOMXK7JK83/Qx46UVhp2GFG7LiA=";
+    hash = "sha256-YjA69i1cnnMlH/3U40s/qUi+u1IKFvlGUjsDVJuBgBE=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.
@@ -41,10 +41,8 @@ rustPlatform.buildRustPackage rec {
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "amcl-0.3.0" = "sha256-EWXQddOskhc07ufRDihn91YRk1fdrLw20N/IoppiWyo=";
       "ark-secret-scalar-0.0.2" = "sha256-91sODxaj0psMw0WqigMCGO5a7+NenAsRj5ZmW6C7lvc=";
       "common-0.1.0" = "sha256-LHz2dK1p8GwyMimlR7AxHLz1tjTYolPwdjP7pxork1o=";
-      "ethabi-decode-1.4.0" = "sha256-4sDCsr7OPaaDTs2phA5fdGKqSReYf2HD2IUUh7B43GU=";
       "fflonk-0.1.0" = "sha256-+BvZ03AhYNP0D8Wq9EMsP+lSgPA6BBlnWkoxTffVLwo=";
       "simple-mermaid-0.1.0" = "sha256-IekTldxYq+uoXwGvbpkVTXv2xrcZ0TQfyyE2i2zH+6w=";
       "sp-ark-bls12-381-0.4.2" = "sha256-nNr0amKhSvvI9BlsoP+8v6Xppx/s7zkf0l9Lm3DW8w8=";

pkgs/applications/editors/vim/plugins/generated.nix

@@ -10569,6 +10569,18 @@ final: prev:
     meta.homepage = "https://github.com/kaarmu/typst.vim/";
   };
 
+  ultimate-autopair = buildVimPlugin {
+    pname = "ultimate-autopair.nvim";
+    version = "2024-02-10";
+    src = fetchFromGitHub {
+      owner = "altermo";
+      repo = "ultimate-autopair.nvim";
+      rev = "25c13e0ce167db0255456cac10158b27d2be30c0";
+      sha256 = "16aizsf86cg5l131y2lszlfkdz1b998js89fja8yk25mwa79lsaf";
+    };
+    meta.homepage = "https://github.com/altermo/ultimate-autopair.nvim.git";
+  };
+
   ultisnips = buildVimPlugin {
     pname = "ultisnips";
     version = "2023-10-17";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -573,6 +573,7 @@ https://github.com/MunifTanjim/nui.nvim/,main,
 https://github.com/jose-elias-alvarez/null-ls.nvim/,,
 https://github.com/nacro90/numb.nvim/,,
 https://github.com/nvchad/nvchad/,HEAD,
+https://github.com/altermo/ultimate-autopair.nvim.git,HEAD,
 https://github.com/ChristianChiarulli/nvcode-color-schemes.vim/,,
 https://github.com/catppuccin/nvim/,,catppuccin-nvim
 https://github.com/AckslD/nvim-FeMaco.lua/,HEAD,

pkgs/applications/misc/gImageReader/default.nix

@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gImageReader";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner= "manisandro";
     repo = "gImageReader";
     rev = "v${version}";
-    sha256 = "sha256-vW4FbviMHBiJ3rwJY/yS7JDOoCT72nGV6jEeo+k6ylU=";
+    sha256 = "sha256-yBkVeufRRoSAc20/8mV39widBPloHFz12K7B4Y9xiWg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/syncthingtray/default.nix

@@ -34,14 +34,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.4.12";
+  version = "1.4.13";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-KfJ/MEgQdvzAM+rnKGMsjnRrbFeFu6F8Or+rgFNLgFI=";
+    sha256 = "sha256-RysX2IAzhGz/L65nDEL2UQLXIjdkQRmMs7bqNQIR+eA=";
   };
 
   buildInputs = [

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "32.5.2";
+  version = "33.0.0";
 
   src = fetchzip {
     urls = [
@@ -27,9 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
       "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
     ];
     hash = if withGTK3 then
-      "sha256-DPGRcgZTPBeMkA7KpL47wE4fQt33qw4f84HuAy2lkY8="
+      "sha256-qZX23dsKNg5AOIaBAAmTWT6VDEl3OGz3kb3idtvJElw="
     else
-      "sha256-/tZj1b+IxUJOpKQToQ8iF/A+KL8W1nt9Tdc5VrwoPbs=";
+      "sha256-Lz1+5I8Rj0GrBUBTJoRsatpyzkqVHZuWbKARkuWFs5U=";
   };
 
   preferLocalBuild = true;

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -64,14 +64,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.14.13";
+  version = "4.14.15";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-JcW/gXSgtzxv/37V13brHsa4XcVyB5ZCiPj4slMFdro=";
+    hash = "sha256-706FAtXS541D7H/Qc86eC1FLUWu1/tZuCq3GgJ0L/Ds=";
   };
 
   patches = [

pkgs/applications/networking/p2p/retroshare/default.nix

@@ -1,4 +1,6 @@
-{ lib, mkDerivation, fetchFromGitHub, qmake, cmake, pkg-config, miniupnpc, bzip2
+{ lib, mkDerivation, fetchFromGitHub
+, fetchpatch
+, qmake, cmake, pkg-config, miniupnpc, bzip2
 , speex, libmicrohttpd, libxml2, libxslt, sqlcipher, rapidjson, libXScrnSaver
 , qtbase, qtx11extras, qtmultimedia, libgnome-keyring3
 }:
@@ -20,6 +22,13 @@ mkDerivation rec {
     # but we already have them checked out
     ./no-submodules.patch
     ./cpp-filesystem.patch
+
+    # Fix gcc-13 build failure
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/RetroShare/RetroShare/commit/e1934fd9b03cd52c556eb06d94fb5d68b649592e.patch";
+      hash = "sha256-oqxQAsD4fmkWAH2kSVmmed/q0LzTW/iqUU1SgYNdFyk=";
+    })
   ];
 
   nativeBuildInputs = [ pkg-config qmake cmake ];

pkgs/applications/networking/remote/putty/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, cmake, perl, pkg-config
-, gtk3, ncurses, darwin
+, gtk3, ncurses, darwin, copyDesktopItems, makeDesktopItem
 }:
 
 stdenv.mkDerivation rec {
@@ -14,12 +14,31 @@ stdenv.mkDerivation rec {
     hash = "sha256-IBPIOnIbF1NSnpCQ98ODDo/kyAoHDMznZFObrbP2cIE=";
   };
 
-  nativeBuildInputs = [ cmake perl pkg-config ];
+  nativeBuildInputs = [ cmake perl pkg-config copyDesktopItems ];
   buildInputs = lib.optionals stdenv.hostPlatform.isUnix [
     gtk3 ncurses
   ] ++ lib.optional stdenv.isDarwin darwin.apple_sdk.libs.utmp;
   enableParallelBuilding = true;
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "PuTTY SSH Client";
+      exec = "putty";
+      icon = "putty";
+      desktopName = "PuTTY";
+      comment = "Connect to an SSH server with PuTTY";
+      categories = [ "GTK" "Network" ];
+    })
+    (makeDesktopItem {
+      name = "PuTTY Terminal Emulator";
+      exec = "pterm";
+      icon = "pterm";
+      desktopName = "Pterm";
+      comment = "Start a PuTTY terminal session";
+      categories = [ "GTK" "System" "Utility" "TerminalEmulator" ];
+    })
+  ];
+
   meta = with lib; {
     description = "A Free Telnet/SSH Client";
     longDescription = ''

pkgs/applications/radio/qlog/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-tNTPT5AIQhKDyB+Pss+VdNeORcsHa+OSr15wLqID8PA=";
+    hash = "sha256-GU4TdGtVh7CgiPYQJp0D6X9G1ge4Lzp/AaqbtyOWGtw=";
     fetchSubmodules = true;
   };
 

pkgs/applications/science/biology/dcm2niix/default.nix

@@ -15,21 +15,21 @@ let
   cloudflareZlib = fetchFromGitHub {
     owner = "ningfei";
     repo = "zlib";
-    # HEAD revision of the gcc.amd64 branch on 2022-04-14. Reminder to update
+    # HEAD revision of the gcc.amd64 branch on 2023-03-28. Reminder to update
     # whenever bumping package version.
-    rev = "fda61188d1d4dcd21545c34c2a2f5cc9b0f5db4b";
+    rev = "f49b13c3380cf9677ae9a93641ebc6f770899def";
-    sha256 = "sha256-qySFwY0VI2BQLO2XoCZeYshXEDnHh6SmJ3MvcBUROWU=";
+    sha256 = "sha256-8HNFUGx2uuEb8UrGUiqkN+uVDX83YIisT2uO1Z7GCxc=";
   };
 in
 stdenv.mkDerivation rec {
-  version = "1.0.20211006";
+  version = "1.0.20230411";
   pname = "dcm2niix";
 
   src = fetchFromGitHub {
     owner = "rordenlab";
     repo = "dcm2niix";
     rev = "v${version}";
-    sha256 = "sha256-fQAVOzynMdSLDfhcYWcaXkFW/mnv4zySGLVJNE7ql/c=";
+    sha256 = "sha256-kOVEoqrk4l6sH8iDVx1QmOYP5tCufxsWnCnn9BibZ08=";
   };
 
   patches = lib.optionals withCloudflareZlib [

pkgs/applications/science/biology/dcm2niix/dont-fetch-external-libs.patch

@@ -6,7 +6,7 @@ index 9f064eb..fe74df5 100644
 -set(CLOUDFLARE_BRANCH gcc.amd64) # Cloudflare zlib branch
 -
  ExternalProject_Add(zlib
--    GIT_REPOSITORY "${git_protocol}://github.com/ningfei/zlib.git"
+-    GIT_REPOSITORY "https://github.com/ningfei/zlib.git"
 -    GIT_TAG "${CLOUDFLARE_BRANCH}"
 +    URL file://@cloudflareZlib@
      SOURCE_DIR cloudflare-zlib
@@ -16,21 +16,10 @@ diff --git a/SuperBuild/SuperBuild.cmake b/SuperBuild/SuperBuild.cmake
 index 2a0a956..81354a7 100644
 --- a/SuperBuild/SuperBuild.cmake
 +++ b/SuperBuild/SuperBuild.cmake
-@@ -1,17 +1,3 @@
+@@ -1,6 +1,1 @@
 -# Check if git exists
 -find_package(Git)
 -if(NOT GIT_FOUND)
 -    message(FATAL_ERROR "Cannot find Git. Git is required for Superbuild")
 -endif()
--
+ 
--# Use git protocol or not
--option(USE_GIT_PROTOCOL "If behind a firewall turn this off to use http instead." ON)
--if(USE_GIT_PROTOCOL)
--    set(git_protocol "git")
--else()
--    set(git_protocol "https")
--endif()
--
- # Basic CMake build settings
- if(NOT CMAKE_BUILD_TYPE)
-     set(CMAKE_BUILD_TYPE "Release" CACHE STRING

pkgs/applications/science/machine-learning/vowpal-wabbit/default.nix

@@ -18,6 +18,15 @@ stdenv.mkDerivation rec {
       url = "https://github.com/VowpalWabbit/vowpal_wabbit/commit/0cb410dfc885ca1ecafd1f8a962b481574fb3b82.patch";
       sha256 = "sha256-bX3eJ+vMTEMAo3EiESQTDryBP0h2GtnMa/Fz0rTeaNY=";
     })
+
+    # Fix gcc-13 build:
+    #   https://github.com/VowpalWabbit/vowpal_wabbit/pull/4657
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/VowpalWabbit/vowpal_wabbit/commit/a541d85a66088d2b74fa2562d32fecb68af33c58.patch";
+      includes = [ "vowpalwabbit/core/include/vw/core/named_labels.h" ];
+      hash = "sha256-JAuLDe5JtlE7/043RSIKM20Qr77rmuE0rVg/DGc95MY=";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/video/kodi/addons/sponsorblock/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildKodiAddon, fetchFromGitHub, six, requests }:
+buildKodiAddon rec {
+  pname = "sponsorblock";
+  namespace = "script.service.sponsorblock";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "siku2";
+    repo = namespace;
+    rev = "v${version}";
+    hash = "sha256-IBgh2kdPgCy+HHrR7UZxTgjF1LR77ABGlUp3PgaobNM=";
+  };
+
+  propagatedBuildInputs = [
+    six
+    requests
+  ];
+
+  passthru = {
+    pythonPath = "resources/lib";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/siku2/script.service.sponsorblock";
+    description = "A Port of SponsorBlock for Invidious and YouTube Plugin";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}

pkgs/applications/virtualization/nixpacks/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-S7Kgp1KNp8GTGp+Go7pUdRJTZLxFsOYfmgcaRBQfeHA=";
+    sha256 = "sha256-7mW/75Bkss7mtYXfnwKH0YHASv6YAxuM8Ww4ur7VwpU=";
   };
 
-  cargoHash = "sha256-5Q5ZUSPI+BQj/2nIx6RsshJQPPoZO4EX07b1rzvXlyU=";
+  cargoHash = "sha256-uo9cMVBRv9HEgICIpJomRKRInDXqnDaGCqnKIsBImBM=";
 
   # skip test due FHS dependency
   doCheck = false;

pkgs/by-name/ay/ayatana-indicator-datetime/package.nix

@@ -27,6 +27,9 @@
 , wrapGAppsHook
 }:
 
+let
+  edsDataDir = "${evolution-data-server}/share";
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-datetime";
   version = "23.10.1";
@@ -34,36 +37,37 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-datetime";
-    # Release wasn't tagged?
+    rev = finalAttrs.version;
-    # https://github.com/AyatanaIndicators/ayatana-indicator-datetime/issues/121
-    rev = "d8debd706fe92de09e5c654c4ea2cc5dd5ce0529";
     hash = "sha256-cm1zhG9TODGe79n/fGuyVnWL/sjxUc3ZCu9FhqA1NLE=";
   };
 
   patches = [
     # Fix test-menus building & running
-    # Remove when https://github.com/AyatanaIndicators/ayatana-indicator-datetime/pull/122 merged & in release
+    # Remove when version > 23.10.1
     (fetchpatch {
-      name = "0001-ayatana-indicator-datetime-tests-test-menu-Fix-build.patch";
+      name = "0001-ayatana-indicator-datetime-Fix-test-menus-tests.patch";
-      url = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/commit/a6527e90d855d43f43e1ff9bccda2fa22d3c60ab.patch";
+      url = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/commit/ddabb4a61a496da14603573b700c5961a3e5b834.patch";
-      hash = "sha256-RZY51UnrMcXbZbwyuCHSxY6toGByaObSEntVnIMz7+w=";
+      hash = "sha256-vf8aVXonCoTWMuAQZG6FuklWR2IaGY4hecFtoyNCGg8=";
     })
+
+    # Fix EDS-related tests
+    # Remove when version > 23.10.1
     (fetchpatch {
-      name = "0002-ayatana-indicator-datetime-tests-Fix-show_alarms-tests.patch";
+      name = "0002-ayatana-indicator-datetime-Fix-EDS-colour-tests.patch";
-      url = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/commit/5186b51c004ec25e8a44fe5918bceb3d45abb108.patch";
+      url = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/commit/6d67f7b458911833e72e0b4a162b1d823609d6f8.patch";
-      hash = "sha256-goVcpN0MNOic8mpdJdhjgS9LHQLVEZT6ZEg1PqLvmsE=";
+      hash = "sha256-VUdMJuma6rmsjUOeyO0W8UNKADODiM+wDVfj6aDhqgw=";
     })
   ];
 
   postPatch = ''
     # Queries systemd user unit dir via pkg_get_variable, can't override prefix
     substituteInPlace data/CMakeLists.txt \
-      --replace 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_DIR ''${CMAKE_INSTALL_PREFIX}/lib/systemd/user)' \
+      --replace-fail 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_DIR ''${CMAKE_INSTALL_PREFIX}/lib/systemd/user)' \
-      --replace '/etc' "\''${CMAKE_INSTALL_SYSCONFDIR}"
+      --replace-fail '/etc' "\''${CMAKE_INSTALL_FULL_SYSCONFDIR}"
 
     # Looking for Lomiri schemas for code generation
     substituteInPlace src/CMakeLists.txt \
-      --replace '/usr/share/accountsservice' '${lomiri.lomiri-schemas}/share/accountsservice'
+      --replace-fail '/usr/share/accountsservice' '${lomiri.lomiri-schemas}/share/accountsservice'
   '';
 
   strictDeps = true;
@@ -116,15 +120,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "ENABLE_LOMIRI_FEATURES" true)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
-      # Exclude tests
-      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
-        # evolution-data-server tests have been silently failing on upstream CI for awhile,
-        # 23.10.0 release has fixed the silentness but left the tests broken.
-        # https://github.com/AyatanaIndicators/ayatana-indicator-datetime/commit/3e65062b5bb0957b5bb683ff04cb658d9d530477
-        "^test-eds-ics"
-      ]})")
-    ]))
   ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
@@ -132,7 +127,20 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelChecking = false;
 
   preCheck = ''
-    export XDG_DATA_DIRS=${glib.passthru.getSchemaDataDirPath libayatana-common}
+    export XDG_DATA_DIRS=${lib.strings.concatStringsSep ":" [
+      # org.ayatana.common schema
+      (glib.passthru.getSchemaDataDirPath libayatana-common)
+
+      # loading EDS engines to handle ICS-loading
+      edsDataDir
+    ]}
+  '';
+
+  preFixup = ''
+    # schema is already added automatically by wrapper, EDS needs to be added explicitly
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${edsDataDir}"
+    )
   '';
 
   passthru = {
@@ -142,8 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit (nixosTests) ayatana-indicators;
     };
-    # Latest release wasn't tagged, Don't try to bump down
+    updateScript = gitUpdater { };
-    #updateScript = gitUpdater { };
   };
 
   meta = with lib; {
@@ -153,9 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
       event management tool.
     '';
     homepage = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime";
-    # Latest release wasn't tagged
+    changelog = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/blob/${finalAttrs.version}/ChangeLog";
-    # changelog = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/blob/${finalAttrs.version}/ChangeLog";
-    changelog = "https://github.com/AyatanaIndicators/ayatana-indicator-datetime/blob/${finalAttrs.finalPackage.src.rev}/ChangeLog";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.linux;

pkgs/by-name/bo/boxed-cpp/package.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (final: {
   pname = "boxed-cpp";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "contour-terminal";
     repo = "boxed-cpp";
     rev = "v${final.version}";
-    hash = "sha256-/zC9DV2nFY1ipqsM1p/WMdSf/nZkhlqJ2Ce/FzGWGGI=";
+    hash = "sha256-o+qAEpP2inGQVXJ1i3HBee0fXQYR2HCyBY4Urk8ohMI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/co/cockpit/package.nix

@@ -44,13 +44,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "308";
+  version = "310.2";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     rev = "refs/tags/${version}";
-    hash = "sha256-0IJRd4QoUBcJDERWHkaR7ehCLhICnjGb7pYla18DMkk=";
+    hash = "sha256-VaH34UT8kXKZbRPTNvL1afeONb3n6vK0UB1UgWeNRWY=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/gh/ghfetch/package.nix

@@ -0,0 +1,26 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "ghfetch";
+  version = "0.0.19";
+
+  src = fetchFromGitHub {
+    owner = "orangekame3";
+    repo = "ghfetch";
+    rev = "v${version}";
+    hash = "sha256-Cmyd/wrobHPyG9ExUSfSsTwFUfbo9iuvmAr0uqunWWw=";
+  };
+
+  vendorHash = "sha256-CPh9j5PJOSNvqgq/S9w+Kx3c5yIMHjc1AaqLwz9efeY=";
+
+  meta = with lib; {
+    description = "A CLI tool to fetch GitHub user information and show like neofetch";
+    homepage = "https://github.com/orangekame3/ghfetch";
+    license = licenses.mit;
+    mainProgram = "ghfetch";
+    maintainers = with maintainers; [ aleksana ];
+  };
+}

pkgs/by-name/ht/htcondor/package.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "htcondor";
     repo = "htcondor";
 
-    rev = "v23.4.0";
+    rev = "v${version}";
     hash = "sha256-+WfNVxP7qsEpn8zPretLnOEAnPq0GylyxCbcQI8o0L0=";
   };
 
@@ -58,5 +58,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.asl20;
     maintainers = with maintainers; [ evey ];
+    # cannot find -lpthread: No such file or directory
+    broken = stdenv.isAarch64;
   };
 }

pkgs/by-name/ob/obs-do/package.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "obs-do";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "jonhoo";
     repo = "obs-do";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MlBtnRMovnek4dkfO7ocafSgAwIXB5p1FmhNeqfSspA=";
+    hash = "sha256-Wqz+oR/FIShSgF4xbXMMCxFUscOnoQr1aHQBCCacJgo=";
   };
 
-  cargoHash = "sha256-5EqiDibeWrN45guneN2bxKDXfSz3wDxBNHdl0Km/lpA=";
+  cargoHash = "sha256-J1bj4TQzEB8qoR6cNyW/fK9Vi0l+wRZlP/2smzbYhVg=";
 
   meta = with lib; {
     description = "CLI for common OBS operations while streaming using WebSocket";

pkgs/by-name/pi/pinecone/package.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule {
+  pname = "pinecone";
+  version = "0.11.0-unstable-2023-08-10";
+
+  src = fetchFromGitHub {
+    owner = "matrix-org";
+    repo = "pinecone";
+    rev = "ea4c33717fd74ef7d6f49490625a0fa10e3f5bbc";
+    hash = "sha256-q4EFWXSkQJ2n+xAWuBxdP7nrtv3eFql9LoavWo10dfs=";
+  };
+
+  vendorHash = "sha256-+P10K7G0UwkbCGEi6sYTQSqO7LzIf/xmaHIr7v110Ao=";
+
+  meta = with lib; {
+    description = "Peer-to-peer overlay routing for the Matrix ecosystem";
+    homepage = "https://matrix-org.github.io/pinecone/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ networkexception ];
+    mainProgram = "pinecone";
+  };
+}

pkgs/by-name/po/popcorntime/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "popcorntime";
-  version = "0.4.9";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "https://github.com/popcorn-official/popcorn-desktop/releases/download/v${version}/Popcorn-Time-${version}-linux64.zip";
-    sha256 = "sha256-cbKL5bgweZD/yfi/8KS0L7Raha8PTHqIm4qSPFidjUc=";
+    hash = "sha256-A5G66KkCQ1AiOOO02dZFAVz6dqvComrd5lXQ4Wc1S0s=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/st/sttr/package.nix

@@ -0,0 +1,43 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "sttr";
+  version = "0.2.18";
+
+  src = fetchFromGitHub {
+    owner = "abhimanyu003";
+    repo = "sttr";
+    rev = "v${version}";
+    hash = "sha256-zZ9zrKUbrRaYQrlUtjOZLfEuiaqp/yyXpOlDspBJbSQ=";
+  };
+
+  vendorHash = "sha256-io56WqF3cAyNK7Auhdq2iB26B6wjcVnq9cr3NS/4Z0w=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd sttr \
+      --bash <($out/bin/sttr completion bash) \
+      --fish <($out/bin/sttr completion fish) \
+      --zsh <($out/bin/sttr completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Cross-platform cli tool to perform various operations on string";
+    homepage = "https://github.com/abhimanyu003/sttr";
+    changelog = "https://github.com/abhimanyu003/sttr/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Ligthiago ];
+    mainProgram = "sttr";
+  };
+}

pkgs/by-name/vc/vcpkg-tool/package.nix

@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcpkg-tool";
-  version = "2024-02-05";
+  version = "2024-02-07";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg-tool";
     rev = finalAttrs.version;
-    hash = "sha256-MTlRa7uyJqU98nhADsAwJ3BjlMvijAWIcTJO8GO+6tY=";
+    hash = "sha256-JzErV6Eyoz4fI84Zq5+v8eZEttYyYXGf5tK290J25tQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/yo/youtrack/package.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "youtrack";
-  version = "2023.3.23390";
+  version = "2023.3.24329";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
-    hash = "sha256-p3ZjClVku7EjQSd9wwx0iJ+5DqooaKragdNzj0f8OO8=";
+    hash = "sha256-YIqRTCON8S/emj2AChrxhY4dfwtCnXtbiAQCTQ9k54Q=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/data/themes/whitesur/default.nix

@@ -13,9 +13,12 @@
 , colorVariants ? [] # default: all
 , opacityVariants ? [] # default: all
 , themeVariants ? [] # default: default (BigSur-like theme)
+, iconVariant ? null # default: standard (Apple logo)
+, nautilusStyle ? null # default: stable (BigSur-like style)
 , nautilusSize ? null # default: 200px
 , panelOpacity ? null # default: 15%
 , panelSize ? null # default: 32px
+, roundedMaxWindow ? false # default: false
 }:
 
 let
@@ -24,9 +27,11 @@ let
 
 in
 lib.checkListOfEnum "${pname}: alt variants" [ "normal" "alt" "all" ] altVariants
-lib.checkListOfEnum "${pname}: color variants" [ "light" "dark" ] colorVariants
+lib.checkListOfEnum "${pname}: color variants" [ "Light" "Dark" ] colorVariants
 lib.checkListOfEnum "${pname}: opacity variants" [ "normal" "solid" ] opacityVariants
 lib.checkListOfEnum "${pname}: theme variants" [ "default" "blue" "purple" "pink" "red" "orange" "yellow" "green" "grey" "all" ] themeVariants
+lib.checkListOfEnum "${pname}: Activities icon variants" [ "standard" "simple" "gnome" "ubuntu" "tux" "arch" "manjaro" "fedora" "debian" "void" "opensuse" "popos" "mxlinux" "zorin" ] (single iconVariant)
+lib.checkListOfEnum "${pname}: nautilus style" [ "stable" "normal" "mojave" "glassy" ] (single nautilusStyle)
 lib.checkListOfEnum "${pname}: nautilus sidebar minimum width" [ "default" "180" "220" "240" "260" "280" ] (single nautilusSize)
 lib.checkListOfEnum "${pname}: panel opacity" [ "default" "30" "45" "60" "75" ] (single panelOpacity)
 lib.checkListOfEnum "${pname}: panel size" [ "default" "smaller" "bigger" ] (single panelSize)
@@ -79,9 +84,12 @@ stdenv.mkDerivation rec {
       ${toString (map (x: "--color " + x) colorVariants)} \
       ${toString (map (x: "--opacity " + x) opacityVariants)} \
       ${toString (map (x: "--theme " + x) themeVariants)} \
+      ${lib.optionalString (iconVariant != null) ("--icon " + iconVariant)} \
+      ${lib.optionalString (nautilusStyle != null) ("--nautilus-style " + nautilusStyle)} \
       ${lib.optionalString (nautilusSize != null) ("--size " + nautilusSize)} \
       ${lib.optionalString (panelOpacity != null) ("--panel-opacity " + panelOpacity)} \
       ${lib.optionalString (panelSize != null) ("--panel-size " + panelSize)} \
+      ${lib.optionalString (roundedMaxWindow == true) "--roundedmaxwindow"} \
       --dest $out/share/themes
 
     jdupes --quiet --link-soft --recurse $out/share

pkgs/development/interpreters/lua-5/build-luarocks-package.nix

@@ -57,8 +57,6 @@
 
 # relative to srcRoot, path to the rockspec to use when using rocks
 , rockspecFilename ? null
-# relative to srcRoot, path to folder that contains the expected rockspec
-, rockspecDir ?  "."
 
 # must be set for packages that don't have a rock
 , knownRockspec ? null
@@ -87,7 +85,7 @@ let
     LUAROCKS_CONFIG = self.configFile;
   } // attrs.env or {};
 
-  generatedRockspecFilename = "${rockspecDir}/${pname}-${rockspecVersion}.rockspec";
+  generatedRockspecFilename = "./${self.pname}-${self.rockspecVersion}.rockspec";
 
   nativeBuildInputs = [
     wrapLua

pkgs/development/libraries/c-blosc/1.nix

@@ -0,0 +1,69 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, testers
+
+, static ? stdenv.hostPlatform.isStatic
+
+, lz4
+, zlib
+, zstd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "c-blosc";
+  version = "1.21.5";
+
+  src = fetchFromGitHub {
+    owner = "Blosc";
+    repo = "c-blosc";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-bz922lWiap3vMy8qS9dmXa8zUg5NJlg0bx3+/xz7QAk=";
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    sed -i -E \
+      -e '/^libdir[=]/clibdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      -e '/^includedir[=]/cincludedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@' \
+      blosc.pc.in
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    lz4
+    zlib
+    zstd
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_STATIC=${if static then "ON" else "OFF"}"
+    "-DBUILD_SHARED=${if static then "OFF" else "ON"}"
+
+    "-DPREFER_EXTERNAL_LZ4=ON"
+    "-DPREFER_EXTERNAL_ZLIB=ON"
+    "-DPREFER_EXTERNAL_ZSTD=ON"
+
+    "-DBUILD_EXAMPLES=OFF"
+    "-DBUILD_BENCHMARKS=OFF"
+    "-DBUILD_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
+  ];
+
+  doCheck = !static;
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = with lib; {
+    description = "A blocking, shuffling and loss-less compression library";
+    homepage = "https://www.blosc.org";
+    changelog = "https://github.com/Blosc/c-blosc/releases/tag/v${version}";
+    pkgConfigModules = [
+      "blosc"
+    ];
+    license = licenses.bsd3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ris ];
+  };
+})

pkgs/development/libraries/c-blosc/2.nix

@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, testers
+
+, static ? stdenv.hostPlatform.isStatic
+
+, lz4
+, zlib-ng
+, zstd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "c-blosc2";
+  version = "2.13.2";
+
+  src = fetchFromGitHub {
+    owner = "Blosc";
+    repo = "c-blosc2";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-RNIvg6p/+brW7oboTDH0bbRfIQDaZwtZbbWFbftfWTk=";
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    sed -i -E \
+      -e '/^libdir[=]/clibdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      -e '/^includedir[=]/cincludedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@' \
+      blosc2.pc.in
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    lz4
+    zlib-ng
+    zstd
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_STATIC=${if static then "ON" else "OFF"}"
+    "-DBUILD_SHARED=${if static then "OFF" else "ON"}"
+
+    "-DPREFER_EXTERNAL_LZ4=ON"
+    "-DPREFER_EXTERNAL_ZLIB=ON"
+    "-DPREFER_EXTERNAL_ZSTD=ON"
+
+    "-DBUILD_EXAMPLES=OFF"
+    "-DBUILD_BENCHMARKS=OFF"
+    "-DBUILD_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
+  ];
+
+  doCheck = !static;
+  # possibly https://github.com/Blosc/c-blosc2/issues/432
+  enableParallelChecking = false;
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = with lib; {
+    description = "A fast, compressed, persistent binary data store library for C";
+    homepage = "https://www.blosc.org";
+    changelog = "https://github.com/Blosc/c-blosc2/releases/tag/v${version}";
+    pkgConfigModules = [
+      "blosc2"
+    ];
+    license = licenses.bsd3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ris ];
+  };
+})

pkgs/development/libraries/c-blosc/default.nix

@@ -1,69 +1,4 @@
-{ lib
+{ callPackage }: {
-, stdenv
+  c-blosc = callPackage ./1.nix {};
-, fetchFromGitHub
+  c-blosc2 = callPackage ./2.nix {};
-, cmake
+}
-, testers
-
-, static ? stdenv.hostPlatform.isStatic
-
-, lz4
-, zlib
-, zstd
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "c-blosc";
-  version = "1.21.5";
-
-  src = fetchFromGitHub {
-    owner = "Blosc";
-    repo = "c-blosc";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-bz922lWiap3vMy8qS9dmXa8zUg5NJlg0bx3+/xz7QAk=";
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/144170
-  postPatch = ''
-    sed -i -E \
-      -e '/^libdir[=]/clibdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
-      -e '/^includedir[=]/cincludedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@' \
-      blosc.pc.in
-  '';
-
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [
-    lz4
-    zlib
-    zstd
-  ];
-
-  cmakeFlags = [
-    "-DBUILD_STATIC=${if static then "ON" else "OFF"}"
-    "-DBUILD_SHARED=${if static then "OFF" else "ON"}"
-
-    "-DPREFER_EXTERNAL_LZ4=ON"
-    "-DPREFER_EXTERNAL_ZLIB=ON"
-    "-DPREFER_EXTERNAL_ZSTD=ON"
-
-    "-DBUILD_EXAMPLES=OFF"
-    "-DBUILD_BENCHMARKS=OFF"
-    "-DBUILD_TESTS=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}"
-  ];
-
-  doCheck = !static;
-
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
-  meta = with lib; {
-    description = "A blocking, shuffling and loss-less compression library";
-    homepage = "https://www.blosc.org";
-    changelog = "https://github.com/Blosc/c-blosc/releases/tag/v${version}";
-    pkgConfigModules = [
-      "blosc"
-    ];
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ ris ];
-  };
-})

pkgs/development/libraries/cpp-utilities/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpp-utilities";
-  version = "5.24.5";
+  version = "5.24.6";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "cpp-utilities";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-bU1rVEwM+VDMviuTOsX4V9/BdZTPqzwW7b/KjPmlPeE=";
+    sha256 = "sha256-Lzt/lINfYvzabBbEUdNbF4Ta767WgMre2dxBkMbQnp0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/spglib/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spglib";
-  version = "2.3.0"; # N.B: if you change this, please update: pythonPackages.spglib
+  version = "2.3.1"; # N.B: if you change this, please update: pythonPackages.spglib
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "spglib";
     rev = "v${version}";
-    hash = "sha256-S/i0sIg7VwgpnB2Uo0d4FdVcSIb5tcGJ+0URmkNkxe8=";
+    hash = "sha256-MOre1LGf7Li+tAqtzpuEvAX6q/P0ueDlMXhhmtiE+jw=";
   };
 
   nativeBuildInputs = [ cmake gfortran gtest ];

pkgs/development/libraries/sptk/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , cmake
 , fetchFromGitHub
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +16,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-lIyOcN2AR3ilUZ9stpicjbwlredbwgGPwmMICxZEijU=";
   };
 
+  patches = [
+    # Fix gcc-13 build failure:
+    #   https://github.com/sp-nitech/SPTK/pull/57
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/sp-nitech/SPTK/commit/060bc2ad7a753c1f9f9114a70d4c4337b91cb7e0.patch";
+      hash = "sha256-QfzpIS63LZyTHAaMGUZh974XLRNZLQG3om7ZJJ4RlgE=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];

pkgs/development/lua-modules/nfd/default.nix

@@ -20,7 +20,7 @@ buildLuarocksPackage {
       inherit zenity;
     })
   ];
-  rockspecDir = "lua";
+  knownRockspec = "lua/nfd-scm-1.rockspec";
 
   extraVariables.LUA_LIBDIR = "${lua}/lib";
   nativeBuildInputs = [ pkg-config ];
@@ -31,13 +31,12 @@ buildLuarocksPackage {
     find $out -name nfd_zenity.so -execdir mv {} nfd.so \;
   '';
 
-  disabled = with lua; (luaversion != "5.1");
-
   meta = {
     description =
       "A tiny, neat lua library that portably invokes native file open and save dialogs.";
     homepage = "https://github.com/Alloyed/nativefiledialog/tree/master/lua";
     license = lib.licenses.zlib;
     maintainers = [ lib.maintainers.scoder12 ];
+    broken = lua.luaversion != "5.1";
   };
 }

pkgs/development/node-packages/main-programs.nix

@@ -60,5 +60,6 @@
   vscode-css-languageserver-bin = "css-languageserver";
   vscode-html-languageserver-bin = "html-languageserver";
   vscode-json-languageserver-bin = "json-languageserver";
+  vscode-json-languageserver = "vscode-json-languageserver";
   webtorrent-cli = "webtorrent";
 }

pkgs/development/python-modules/blosc2/default.nix

@@ -7,10 +7,14 @@
 , cython_3
 , ninja
 , oldest-supported-numpy
+, pkg-config
 , scikit-build
 , setuptools
 , wheel
 
+# c library
+, c-blosc2
+
 # propagates
 , msgpack
 , ndindex
@@ -26,15 +30,14 @@
 
 buildPythonPackage rec {
   pname = "blosc2";
-  version = "2.3.2";
+  version = "2.5.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Blosc";
     repo = "python-blosc2";
     rev = "refs/tags/v${version}";
-    fetchSubmodules = true;
+    hash = "sha256-yBgnNJU1q+FktIkpQn74LuRP19Ta/fNC60Z8TxzlWPk=";
-    hash = "sha256-tRcyntJlmLPbqnX7nzdBQ/50uXy0fVLb2YGVOIwJjxU=";
   };
 
   postPatch = ''
@@ -47,12 +50,16 @@ buildPythonPackage rec {
     cython_3
     ninja
     oldest-supported-numpy
+    pkg-config
     scikit-build
     setuptools
     wheel
   ];
 
+  buildInputs = [ c-blosc2 ];
+
   dontUseCmakeConfigure = true;
+  env.CMAKE_ARGS = "-DUSE_SYSTEM_BLOSC2:BOOL=YES";
 
   propagatedBuildInputs = [
     msgpack
@@ -68,11 +75,13 @@ buildPythonPackage rec {
     torch
   ];
 
+  passthru.c-blosc2 = c-blosc2;
+
   meta = with lib; {
     description = "Python wrapper for the extremely fast Blosc2 compression library";
     homepage = "https://github.com/Blosc/python-blosc2";
     changelog = "https://github.com/Blosc/python-blosc2/releases/tag/v${version}";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ ris ];
   };
 }

pkgs/development/python-modules/google-cloud-os-config/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.17.0";
+  version = "1.17.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SrLT/0pYAjGpp+6Pi4d/ICCJoUsbXYe0Wht63s4UwOE=";
+    hash = "sha256-0DXo2h2gqO1z5quUyWI1Qb/CNaqyy1SNinyaPyRWuR0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/h5io/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, numpy
+, h5py
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "h5io";
+  version = "0.2.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "h5io";
+    repo = "h5io";
+    rev = "refs/tags/h5io-${version}";
+    hash = "sha256-3mrHIkfaXq06mMzUwudRO81DWTk0TO/e15IQA5fxxNc=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml  \
+      --replace "--cov-report=" ""  \
+      --replace "--cov-branch" ""  \
+      --replace "--cov=h5io" ""
+  '';
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    numpy
+    h5py
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "h5io" ];
+
+  meta = with lib; {
+    description = "Read and write simple Python objects using HDF5";
+    homepage = "https://github.com/h5io/h5io";
+    changelog = "https://github.com/h5io/h5io/releases/tag/${src.rev}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}

pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix

@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, babel
 , gitpython
 , mkdocs
 , pytz
@@ -24,6 +25,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
+    babel
     gitpython
     mkdocs
     pytz

pkgs/development/python-modules/mne-python/default.nix

@@ -1,66 +1,84 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
+, setuptools-scm
 , numpy
 , scipy
 , pytestCheckHook
 , pytest-timeout
-, h5py
+, pytest-harvest
 , matplotlib
-, nibabel
-, pandas
-, scikit-learn
 , decorator
 , jinja2
 , pooch
 , tqdm
-, setuptools
+, packaging
+, importlib-resources
+, lazy-loader
+, h5io
+, pymatreader
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "mne-python";
-  version = "1.6.0";
+  version = "1.6.1";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mne-tools";
-    repo = pname;
+    repo = "mne-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OoaXNHGL2svOpNL5GHcVRfQc9GxIRpZRhpZ5Hi1JTzM=";
+    hash = "sha256-U1aMqcUZ3BcwqwOYh/qfG5PhacwBVioAgNc52uaoJL0";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
-    decorator
+    substituteInPlace pyproject.toml  \
-    jinja2
+      --replace "--cov-report=" ""  \
-    matplotlib
+      --replace "--cov-branch" ""
-    numpy
+  '';
-    pooch
+
-    scipy
+  nativeBuildInputs = [
     setuptools
-    tqdm
+    setuptools-scm
   ];
 
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    matplotlib
+    tqdm
+    pooch
+    decorator
+    packaging
+    jinja2
+    lazy-loader
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
+
+  passthru.optional-dependencies = {
+    hdf5 = [
+      h5io
+      pymatreader
+    ];
+  };
+
   nativeCheckInputs = [
-    h5py
-    nibabel
-    pandas
     pytestCheckHook
-    scikit-learn
     pytest-timeout
-  ];
+    pytest-harvest
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   preCheck = ''
-    export HOME=$TMP
+    export HOME=$(mktemp -d)
     export MNE_SKIP_TESTING_DATASET_TESTS=true
     export MNE_SKIP_NETWORK_TESTS=1
   '';
 
-  # All tests pass, but Pytest hangs afterwards - probably some thread hasn't terminated
-  doCheck = false;
-
   pythonImportsCheck = [
     "mne"
   ];
@@ -68,7 +86,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Magnetoencephelography and electroencephalography in Python";
     homepage = "https://mne.tools";
+    changelog = "https://mne.tools/stable/changes/v${version}.html";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ bcdarwin ];
+    maintainers = with maintainers; [ bcdarwin mbalatsko ];
   };
 }

pkgs/development/python-modules/plantuml-markdown/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "plantuml-markdown";
-  version = "3.9.2";
+  version = "3.9.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mikitex70";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-k4Xs1w/26QAfNdJY6P1gpJkBzg/tWi7vDFKZi7naVHo=";
+    hash = "sha256-2nZV/bYRN1SKI6OmpOhK7KUuBwmwhTt/ErTYqVQ9Dps=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/polars/default.nix

@@ -13,12 +13,12 @@
 }:
 let
   pname = "polars";
-  version = "0.19.12";
+  version = "0.20.7";
   rootSource = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
     rev = "refs/tags/py-${version}";
-    hash = "sha256-6tn3Q6oZfMjgQ5l5xCFnGimLSDLOjTWCW5uEbi6yFZY=";
+    hash = "sha256-R3by/e28HE+1xq+HQd9wYy/iK+fDM6/IfKuc563atX4=";
   };
   rust-jemalloc-sys' = rust-jemalloc-sys.override {
     jemalloc = jemalloc.override {
@@ -48,7 +48,7 @@ buildPythonPackage {
     };
   };
 
-  sourceRoot = "source/py-polars";
+  buildAndTestSubdir = "py-polars";
 
   # Revisit this whenever package or Rust is upgraded
   RUSTC_BOOTSTRAP = 1;
@@ -57,6 +57,10 @@ buildPythonPackage {
     typing-extensions
   ];
 
+  # trick taken from the polars repo since there seems to be a problem
+  # with simd enabled with our stable rust (instead of nightly).
+  maturinBuildFlags = [ "--no-default-features" "--features=all" ];
+
   dontUseCmakeConfigure = true;
 
   nativeBuildInputs = [

pkgs/development/python-modules/pymatreader/default.nix

@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitLab
+, setuptools
+, h5py
+, numpy
+, scipy
+, xmltodict
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pymatreader";
+  version = "0.0.31";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "obob";
+    repo = "pymatreader";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pYObmvqA49sHjpZcwXkN828R/N5CSpmr0OyyxzDiodQ=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    h5py
+    numpy
+    scipy
+    xmltodict
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pymatreader" ];
+
+  meta = with lib; {
+    description = "A python package to read all kinds and all versions of Matlab mat files";
+    homepage = "https://gitlab.com/obob/pymatreader/";
+    changelog = "https://gitlab.com/obob/pymatreader/-/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}

pkgs/development/python-modules/pytest-harvest/default.nix

@@ -0,0 +1,68 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytest-runner
+, pytest
+, decopatch
+, makefun
+, six
+, pytestCheckHook
+, numpy
+, pandas
+, tabulate
+, pytest-cases
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-harvest";
+  version = "1.10.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "smarie";
+    repo = "python-pytest-harvest";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ebzE63d7zt9G9HgbLHaE/USZZpUd3y3vd0kNdT/wWw0=";
+  };
+
+  # create file, that is created by setuptools_scm
+  # we disable this file creation as it touches internet
+  postPatch = ''
+    echo "version = '${version}'" > pytest_harvest/_version.py
+  '';
+
+  nativeBuildInputs = [
+    setuptools-scm
+    pytest-runner
+  ];
+
+  buildInputs = [ pytest ];
+
+  propagatedBuildInputs = [
+    decopatch
+    makefun
+    six
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    numpy
+    pandas
+    tabulate
+    pytest-cases
+  ];
+
+  pythonImportsCheck = [ "pytest_harvest" ];
+
+  meta = with lib; {
+    description = "Store data created during your `pytest` tests execution, and retrieve it at the end of the session, e.g. for applicative benchmarking purposes";
+    homepage = "https://github.com/smarie/python-pytest-harvest";
+    changelog = "https://github.com/smarie/python-pytest-harvest/releases/tag/${src.rev}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ mbalatsko ];
+  };
+}

pkgs/development/python-modules/sv-ttk/default.nix

@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, tkinter
 }:
 
 buildPythonPackage rec {
@@ -20,6 +21,10 @@ buildPythonPackage rec {
   # No tests available
   doCheck = false;
 
+  propagatedBuildInputs = [
+    tkinter
+  ];
+
   pythonImportsCheck = [
     "sv_ttk"
   ];

pkgs/development/python-modules/tables/default.nix

@@ -41,6 +41,7 @@ buildPythonPackage rec {
   buildInputs = [
     bzip2
     c-blosc
+    blosc2.c-blosc2
     hdf5
     lzo
   ];
@@ -75,6 +76,7 @@ buildPythonPackage rec {
     "--lzo=${lib.getDev lzo}"
     "--bzip2=${lib.getDev bzip2}"
     "--blosc=${lib.getDev c-blosc}"
+    "--blosc2=${lib.getDev blosc2.c-blosc2}"
   ];
 
   nativeCheckInputs = [

pkgs/development/python-modules/xarray/default.nix

@@ -8,25 +8,23 @@
 , pythonOlder
 , setuptools
 , setuptools-scm
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "2023.11.0";
+  version = "2024.1.1";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mkXhB0GES1+UjY4edotGDffpBpbRji7/LB1H9dnVAlI=";
+    hash = "sha256-oboth6dIkuITycg/SkYtvN9oISMgpOMbNL14m6emTjU=";
   };
 
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
   ];
 
   propagatedBuildInputs = [

pkgs/development/tools/bacon/default.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bacon";
-  version = "2.14.1";
+  version = "2.14.2";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-fhAKTZk+51KYjEnVWNLwpUWx+Quj3tmvmIvULQTbGf8=";
+    hash = "sha256-hwzj5RUUj3mYN2XUS5Dt2cbQYJ3oKNj4CZabO6qDt74=";
   };
 
-  cargoHash = "sha256-eBWmb6YaGZX31K3jKNKXgTGOOQm/WiSupckkpi49dWI=";
+  cargoHash = "sha256-gUkh9YpmT+FNv30iOhPRcOAhpaqvd1PavSfoycNox7k=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices

pkgs/development/tools/database/sqlcheck/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "sqlcheck";
@@ -12,6 +12,16 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix gcc-13 build failure:
+    #   https://github.com/jarulraj/sqlcheck/pull/62
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/jarulraj/sqlcheck/commit/ca131db13b860cf1d9194a1c7f7112f28f49acca.patch";
+      hash = "sha256-uoF7rYvjdIUu82JCLXq/UGswgwM6JCpmABP4ItWjDe4=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = true;

pkgs/development/tools/kubedock/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubedock";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "joyrex2001";
     repo = "kubedock";
     rev = version;
-    hash = "sha256-EewvlH+Coz/78AfZfj230BNzuPsKvB7pnV0sJtvYGnc=";
+    hash = "sha256-klrjXL6Crqi74uwZTC0Sp/zMn0fHcA1m8jX3ehRKNHU=";
   };
 
-  vendorHash = "sha256-rkn6JzPB1UNpaCon6LyYNUAsV88t3xbppDrtBwjBEHk=";
+  vendorHash = "sha256-me56QyJi77dP3geNecfO19SxFyuM2CqwmJRkwomsG1o=";
 
   # config.Build not defined as it would break r-ryantm
   ldflags = [

pkgs/development/tools/misc/runme/default.nix

@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-CEJsLBfLMWEQV6Q9TMy1Igdmn45v8vV0rxOMmFW/sb8=";
+    hash = "sha256-pbdY0/1ityPWI3bGjpgWZ5pKTIh8wRqquBuK7aCbeHg=";
   };
 
   vendorHash = "sha256-QoZzEq1aC7cjY/RVp5Z5HhSuTFf2BSYQnfg0jSaeTJU=";

pkgs/development/tools/misc/sccache/default.nix

@@ -8,17 +8,17 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.7.6";
+  version = "0.7.7";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-dIUwooXphjXpFMZXpwQMSvXRvVt/y6J5X7oCrBBSvBM=";
+    sha256 = "sha256-nWSMWaz1UvjsA2V7q7WKx44G45VVaoQxteZqrKAlxY8=";
   };
 
-  cargoHash = "sha256-GDODIAyTIZUHw2tUEQfNnnPH2S9pFHIjYEZLpM5E52A=";
+  cargoHash = "sha256-ezub+pOqNjCfH7QgjLBrYtsyYbPM3/SADLpNgPtlG+I=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/tools/misc/stlink/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , libusb1
 , gtk3
@@ -28,13 +27,6 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-hlFI2xpZ4ldMcxZbg/T5/4JuFFdO9THLcU0DQKSFqrw=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/stlink-org/stlink/commit/468b1d2daa853b975c33ab69876c486734f2c6a7.diff";
-      sha256 = "sha256-ueSi/zc7xbOATl0yBtCL4U64IQ/yqu6sMYDOiPl1JBI=";
-    })
-  ];
-
   buildInputs = [
     libusb1'
   ] ++ lib.optionals withGUI [

pkgs/development/tools/ruff/default.nix

@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , stdenv
 , darwin
@@ -10,15 +11,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.1.15";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DzdzMO9PEwf4HmpG8SxRJTmdrmkXuQ8RsIchvsKstH8=";
+    hash = "sha256-VcDDGi6fPGZ75+J7aOSr7S6Gt5bpr0vM2Sk/Utlmf4k=";
   };
 
+  patches = [
+    # TODO: remove at next release
+    (fetchpatch {
+      name = "filter-out-test-rules-in-ruleselector-json-schema";
+      url = "https://github.com/astral-sh/ruff/commit/49c5e715f9c85aa8d0412b2ec9b1dd6f7ae24c5c.patch";
+      hash = "sha256-s0Nv5uW3TKfKgro3V3E8Q0c8uOTgOKZQx9CxXge4YWE=";
+    })
+  ];
+
   # The following specific substitution is not working as the current directory is `/build/source` and thus has no mention of `ruff` in it.
   # https://github.com/astral-sh/ruff/blob/866bea60a5de3c59d2537b0f3a634ae0ac9afd94/crates/ruff/tests/show_settings.rs#L12
   # -> Just patch it so that it expects the actual current directory and not `"[BASEPATH]"`.
@@ -27,7 +37,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"[BASEPATH]"' '"'$PWD'"'
   '';
 
-  cargoHash = "sha256-MpiWdNUs66OGYfOJo1kJQTCqjrk/DAYecaLf6GUUKew=";
+  cargoHash = "sha256-B7AiDNWEN4i/Lz9yczlRNXczQph52SMa3pcxK2AtO2A=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/development/tools/rust/cargo-hack/default.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-hack";
-  version = "0.6.17";
+  version = "0.6.18";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-suZkrbxhKFFGfRJDRw6MEc135Xk5Ace3MpKgN7lRnmc=";
+    hash = "sha256-SHLYS7XRzOC6sTUjaJI5S+a230sV69a9m7cTW5gQkXQ=";
   };
 
-  cargoHash = "sha256-9SQ45f5X3fQeYmemES4t6d4M+2/LEBkgQDYgjuy1J5I=";
+  cargoHash = "sha256-vqgrffgMQWzmjIjGswObLPc63hjqXTOwJ3YrA/KyCck=";
 
   # some necessary files are absent in the crate version
   doCheck = false;

pkgs/development/tools/rye/Cargo.lock

@@ -101,9 +101,9 @@ checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
 
 [[package]]
 name = "anstyle"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
+checksum = "2faccea4cc4ab4a667ce676a30e8ec13922a692c99bb8f5b11f1502c72e04220"
 
 [[package]]
 name = "anyhow"
@@ -328,9 +328,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.4.9"
+version = "4.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df631ae429f6613fcd3a7c1adbdb65f637271e561b03680adaa6573015dfb106"
+checksum = "abb745187d7f4d76267b37485a65e0149edd0e91a4cfcdd3f27524ad86cee9f3"
 dependencies = [
  "clap",
 ]
@@ -464,9 +464,9 @@ dependencies = [
 
 [[package]]
 name = "curl-sys"
-version = "0.4.70+curl-8.5.0"
+version = "0.4.71+curl-8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c0333d8849afe78a4c8102a429a446bfdd055832af071945520e835ae2d841e"
+checksum = "c7b12a7ab780395666cb576203dc3ed6e01513754939a600b85196ccf5356bc5"
 dependencies = [
  "cc",
  "libc",
@@ -942,7 +942,7 @@ dependencies = [
  "serde",
  "serde_derive",
  "thiserror",
- "toml 0.8.8",
+ "toml 0.8.9",
  "unic-langid",
 ]
 
@@ -1019,9 +1019,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.0"
+version = "2.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf2a4f498956c7723dc280afc6a37d0dec50b39a29e232c6187ce4503703e8c2"
+checksum = "824b2ae422412366ba479e8111fd301f7b5faece8149317bb81925979a53f520"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -1125,9 +1125,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.152"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libz-sys"
@@ -1209,9 +1209,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
 dependencies = [
  "adler",
 ]
@@ -1233,7 +1233,7 @@ dependencies = [
  "target-lexicon",
  "tempfile",
  "thiserror",
- "toml 0.8.8",
+ "toml 0.8.9",
  "tracing",
  "unscanny",
  "ureq",
@@ -1270,6 +1270,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "number_prefix"
 version = "0.4.0"
@@ -1305,9 +1311,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-src"
-version = "300.2.1+3.2.0"
+version = "300.2.2+3.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fe476c29791a5ca0d1273c697e96085bbabbbea2ef7afd5617e78a4b40332d3"
+checksum = "8bbfad0063610ac26ee79f7484739e2b07555a75c42453b89263830b5c8103bc"
 dependencies = [
  "cc",
 ]
@@ -1365,11 +1371,11 @@ dependencies = [
 
 [[package]]
 name = "pep440_rs"
-version = "0.3.12"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "887f66cc62717ea72caac4f1eb4e6f392224da3ffff3f40ec13ab427802746d6"
+checksum = "e0c29f9c43de378b4e4e0cd7dbcce0e5cfb80443de8c05620368b2948bc936a1"
 dependencies = [
- "lazy_static",
+ "once_cell",
  "regex",
  "serde",
  "unicode-width",
@@ -1377,9 +1383,9 @@ dependencies = [
 
 [[package]]
 name = "pep508_rs"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4516b53d9ea6112ebb38b4af08d5707d30b994fb7f98ff133c5dcf7ed8fa854"
+checksum = "aa9d1320b78f4a5715b3ec914f32b5e85a50287ad923730e3cbf0255259432eb"
 dependencies = [
  "once_cell",
  "pep440_rs",
@@ -1751,9 +1757,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.30"
+version = "0.38.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
 dependencies = [
  "bitflags 2.4.2",
  "errno",
@@ -1786,7 +1792,7 @@ dependencies = [
 
 [[package]]
 name = "rye"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "age",
  "anyhow",
@@ -1824,6 +1830,7 @@ dependencies = [
  "sha2",
  "shlex",
  "slug",
+ "static_vcruntime",
  "sysinfo",
  "tar",
  "tempfile",
@@ -1834,6 +1841,7 @@ dependencies = [
  "which",
  "winapi",
  "winreg",
+ "xattr",
  "zip",
  "zstd 0.13.0",
 ]
@@ -1956,9 +1964,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.112"
+version = "1.0.113"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d1bd37ce2324cf3bf85e5a25f96eb4baf0d5aa6eba43e7ae8958870c4ec48ed"
+checksum = "69801b70b1c3dac963ecb03a364ba0ceda9cf60c71cfe475e99864759c8b8a79"
 dependencies = [
  "itoa",
  "ryu",
@@ -2042,6 +2050,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "static_vcruntime"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "954e3e877803def9dc46075bf4060147c55cd70db97873077232eae0269dc89b"
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@@ -2153,12 +2167,13 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
 dependencies = [
  "deranged",
  "itoa",
+ "num-conv",
  "powerfmt",
  "serde",
  "time-core",
@@ -2173,10 +2188,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 
@@ -2215,9 +2231,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1a195ec8c9da26928f773888e0742ca3ca1040c6cd859c919c9f59c1954ab35"
+checksum = "c6a4b9e8023eb94392d3dca65d717c53abc5dad49c07cb65bb8fcd87115fa325"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -2236,9 +2252,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.21.0"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d34d383cd00a163b4a5b85053df514d45bc330f6de7737edfe0a93311d1eaa03"
+checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
 dependencies = [
  "indexmap",
  "serde",
@@ -2494,9 +2510,9 @@ checksum = "4d91413b1c31d7539ba5ef2451af3f0b833a005eb27a631cec32bc0635a8602b"
 
 [[package]]
 name = "webpki-roots"
-version = "0.25.3"
+version = "0.25.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
 [[package]]
 name = "whattheshell"
@@ -2686,9 +2702,9 @@ checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
 name = "winnow"
-version = "0.5.35"
+version = "0.5.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1931d78a9c73861da0134f453bb1f790ce49b2e30eba8410b4b79bac72b46a2d"
+checksum = "a7cad8365489051ae9f054164e459304af2e7e9bb407c958076c8bf4aef52da5"
 dependencies = [
  "memchr",
 ]

pkgs/development/tools/rye/default.nix

@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rye";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "rye";
     rev = "refs/tags/${version}";
-    hash = "sha256-H41gJNNrelPyCP1EYXIjwEc+1v2lnw9xmm0J+12lENA=";
+    hash = "sha256-gM/Vn/eBPZ39568LqUXyx+ZTTsKAVur30Qrl3GS1ID8=";
   };
 
   cargoLock = {

pkgs/development/tools/semantic-release/default.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "23.0.1";
+  version = "23.0.2";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-syxkKAPlxaVZNoeEErQbPJ/7QHGAd+DlNGWQVafahdI=";
+    hash = "sha256-zwc21Ug/x1jP+litn8ij8eEvqpVmtMSiQT3jN4+RhNc=";
   };
 
-  npmDepsHash = "sha256-hfHFZJcMT/+ZD/Zgpv2B2ng5AbL7tQrzHGA5nFbTc/A=";
+  npmDepsHash = "sha256-8iCb6s9VCuXfgU6Qc/bUHMiLgEgreEa7LU0j+1CYVI0=";
 
   dontNpmBuild = true;
 

pkgs/development/tools/yamlfmt/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yamlfmt";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+xlPXHM/4blnm09OcMSpvVTLJy38U4xkVMd3Ea2scyU=";
+    sha256 = "sha256-7+ui5jEJkjejAZRdM+okoF3Qw8SJSTKJS7LNNnBgz0g=";
   };
 
-  vendorHash = "sha256-qrHrLOfyJhsuU75arDtfOhLaLqP+GWTfX+oyLX3aea8=";
+  vendorHash = "sha256-JiFVc2+LcCgvnEX6W4XBtIgXcILEO2HZT4DTp62eUJU=";
 
   doCheck = false;
 

pkgs/games/the-powder-toy/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -27,6 +28,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-LYohsqFU9LBgTXMaV6cf8/zf3fBvT+s5A1JBpPHekH8=";
   };
 
+  patches = [
+    # Fix gcc-13 build failure:
+    #   https://github.com/The-Powder-Toy/The-Powder-Toy/pull/898
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/The-Powder-Toy/The-Powder-Toy/commit/162bce9a1036e0c233399941410364c4a4370980.patch";
+      hash = "sha256-oQNwKemV3BjMLSUd6zMCKqiClcc3Ouxwn3jagf/Q1/I=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkg-config python3 ];
 
   buildInputs = [ SDL2 bzip2 curl fftwFloat lua luajit zlib jsoncpp libpng ]

pkgs/misc/tmux-plugins/tmux-thumbs/default.nix

@@ -1,17 +1,12 @@
-{ lib, mkTmuxPlugin, fetchFromGitHub, thumbs, substituteAll }:
+{ mkTmuxPlugin, thumbs, substituteAll }:
 
-mkTmuxPlugin rec {
+mkTmuxPlugin {
-  pluginName = "tmux-thumbs";
+
-  version = "0.7.1";
+  inherit (thumbs) version src meta;
+
+  pluginName = thumbs.src.repo;
   rtpFilePath = "tmux-thumbs.tmux";
 
-  src = fetchFromGitHub {
-    owner = "fcsonline";
-    repo = pluginName;
-    rev = version;
-    sha256 = "sha256-PH1nscmVhxJFupS7dlbOb+qEwG/Pa/2P6XFIbR/cfaQ=";
-  };
-
   patches = [
     (substituteAll {
       src = ./fix.patch;
@@ -19,11 +14,4 @@ mkTmuxPlugin rec {
     })
   ];
 
-  meta = with lib; {
-    homepage = "https://github.com/fcsonline/tmux-thumbs";
-    description = "A lightning fast version of tmux-fingers written in Rust for copy pasting with vimium/vimperator like hints.";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ ghostbuster91 ];
-  };
 }

pkgs/misc/tmux-plugins/tmux-thumbs/fix.patch

@@ -1,19 +1,18 @@
-diff --git a/tmux-thumbs.sh b/tmux-thumbs.sh
+diff --git i/tmux-thumbs.sh w/tmux-thumbs.sh
-index 34dd528..8c05d54 100755
+index 7e060e8..e7f0c57 100755
---- a/tmux-thumbs.sh
+--- i/tmux-thumbs.sh
-+++ b/tmux-thumbs.sh
++++ w/tmux-thumbs.sh
-@@ -1,22 +1,8 @@
+@@ -1,22 +1,6 @@
  #!/usr/bin/env bash
  set -Eeu -o pipefail
  
--VERSION=$(grep 'version =' Cargo.toml | grep -oe "[0-9]\+.[0-9]\+.[0-9]\+")
+-# Setup env variables to be compatible with compiled and bundled installations
--
+-CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
- # Setup env variables to be compatible with compiled and bundled installations
- CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 -RELEASE_DIR="${CURRENT_DIR}/target/release"
 -
 -THUMBS_BINARY="${RELEASE_DIR}/thumbs"
 -TMUX_THUMBS_BINARY="${RELEASE_DIR}/tmux-thumbs"
+-VERSION=$(grep 'version =' "${CURRENT_DIR}/Cargo.toml" | grep -o "\".*\"" | sed 's/"//g')
 -
 -if [ ! -f "$THUMBS_BINARY" ]; then
 -  tmux split-window "cd ${CURRENT_DIR} && bash ./tmux-thumbs-install.sh"
@@ -22,10 +21,11 @@ index 34dd528..8c05d54 100755
 -  tmux split-window "cd ${CURRENT_DIR} && bash ./tmux-thumbs-install.sh update"
 -  exit
 -fi
- 
+-
  function get-opt-value() {
    tmux show -vg "@thumbs-${1}" 2> /dev/null
-@@ -36,7 +22,7 @@ function get-opt-arg() {
+ }
+@@ -35,7 +19,7 @@ function get-opt-arg() {
    fi
  }
  
@@ -34,12 +34,9 @@ index 34dd528..8c05d54 100755
  
  function add-param() {
    local type opt arg
-@@ -51,4 +37,4 @@ add-param upcase-command string
+@@ -50,4 +34,4 @@ add-param upcase-command string
  add-param multi-command  string
  add-param osc52          boolean
  
 -"${TMUX_THUMBS_BINARY}" "${PARAMS[@]}" || true
 +@tmuxThumbsDir@/tmux-thumbs "${PARAMS[@]}" || true
-
-
-

pkgs/servers/http/tomcat/tomcat-native.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-vmF8V26SO2B50LdSBtcG2ifdBDzr9Qv7leOpwKodGjU=";
+    hash = "sha256-LFr8ftw4PkdmBkfppwca2B9Y5Rx/dlwS9+evySA7LU0=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";

pkgs/servers/web-apps/pict-rs/default.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pict-rs";
-  version = "0.5.1";
+  version = "0.5.6";
 
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-m0je0SfyjeMDJP/OTx41Goc6mcNavnlSDBZS5Uqw0p0=";
+    sha256 = "sha256-YK31z7tFRxLuf3C8ojDIV+mYHvK0dlV8zLHJoWjPzIU=";
   };
 
-  cargoHash = "sha256-O92m3Va8BAPZyDc4arufSkeHxGC8QpwOPx9FAG0A+TE=";
+  cargoHash = "sha256-W6pDWjalyBBqFmm4uZDDTRvTWiwogdOeXbdazz4uM3s=";
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";

pkgs/servers/web-apps/pixelfed/default.nix

@@ -28,13 +28,13 @@ let
   });
 in package.override rec {
   pname = "pixelfed";
-  version = "0.11.8";
+  version = "0.11.11";
 
   src = fetchFromGitHub {
     owner = "pixelfed";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-du+xwSrMqt4KIzQRUos6EmVBRp+39gHuoLSRsgLe1CQ=";
+    hash = "sha256-ytE1ZCKQvoigC8jKPfQ/17jYA0XYOzospq7wY18o2Nk=";
   };
 
   passthru = {

pkgs/tools/X11/xmousepasteblock/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xmousepasteblock";
-  version = "1.3";
+  version = "1.4";
   src = fetchFromGitHub {
     owner = "milaq";
     repo = "XMousePasteBlock";
-    hash = "sha256-0rpAbYUU0SoeQaVNStmIEuYyiWbRAdTN7Mvm0ySDnhU=";
+    hash = "sha256-uHlHGVnIro6X4kRp79ibtqMmiv2XQT+zgbQagUxdB0c=";
     rev = version;
   };
   makeFlags = [ "PREFIX=$(out)" "CC=${stdenv.cc.targetPrefix}cc" ];

pkgs/tools/admin/balena-cli/default.nix

@@ -18,16 +18,16 @@ let
   };
 in buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "17.5.1";
+  version = "18.0.0";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-DapVJAXfTdGjtVBIKuc+xKZ6yWw1eC2pxTwt5O0QrWk=";
+    hash = "sha256-qXOjuVIBjKvsTp9tHxlvYM2oKHLvfGToBE0tAS/F+Ug=";
   };
 
-  npmDepsHash = "sha256-yAcUGOSrQ+AB2b0eDKCMhZRP/LEKcmJmO5xNhVJcqX4=";
+  npmDepsHash = "sha256-VmhyfhyV6mrF3pM5xQGcPowIaAzXJprOmmf4uSTetOA=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/tools/audio/whisper-ctranslate2/default.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "whisper-ctranslate2";
-  version = "0.3.6";
+  version = "0.3.9";
 in
 python3.pkgs.buildPythonApplication {
   inherit pname version;
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication {
     owner = "Softcatala";
     repo = "whisper-ctranslate2";
     rev = version;
-    hash = "sha256-lKzv33mFuXOmKNSOJJViS9VWCxJ+UQu8GXsswoIgdwE=";
+    hash = "sha256-dm8LPcAVxEvhFDEkZcFXFZLfEZTtKzTqBqWKfXbXn5Q=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/tools/backup/stenc/default.nix

@@ -16,6 +16,13 @@ stdenv.mkDerivation rec {
     sha256 = "GcCRVkv+1mREq3MhMRn5fICthwI4WRQJSP6InuzxP1Q=";
   };
 
+  postPatch = ''
+    # Fix gcc-13 build by pulling missing header. UPstream also fixed it
+    # in next major version, but there are many other patch dependencies.
+    # TODO: remove on next major version update
+    sed -e '1i #include <cstdint>' -i src/scsiencrypt.h
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
 
   passthru.updateScript = gitUpdater { };

pkgs/tools/graphics/vkmark/default.nix

@@ -13,17 +13,18 @@
 , assimp
 , libxcb
 , xcbutilwm
+, unstableGitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "vkmark";
-  version = "unstable-2022-09-09";
+  version = "2017.08-unstable-2023-04-12";
 
   src = fetchFromGitHub {
     owner = "vkmark";
     repo = "vkmark";
-    rev = "30d2cd37f0566589d90914501fc7c51a4e51f559";
+    rev = "ab6e6f34077722d5ae33f6bd40b18ef9c0e99a15";
-    sha256 = "sha256-/awEJbmSiNJT71bijI5mrJkKN4DhRNxXO/qYpQECFnA=";
+    sha256 = "sha256-X1Y2U1aJymKrv3crJLN7tvXHG2W+w0W5gB2g00y4yvc=";
   };
 
   nativeBuildInputs = [ meson ninja pkg-config ];
@@ -39,6 +40,8 @@ stdenv.mkDerivation rec {
     wayland-protocols
   ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     description = "An extensible Vulkan benchmarking suite";
     homepage = "https://github.com/vkmark/vkmark";

pkgs/tools/misc/phrase-cli/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.21.2";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-I+ETZhYOd8AMiFf7aLME9FiNHFNfvjGAjSuOjxdkJc8=";
+    sha256 = "sha256-k0Di69toio7uZiTCI34H0N+PnYXfxygQW9sZ9GpG3rU=";
   };
 
-  vendorHash = "sha256-aabTjk6MJy6wnpGVTL3J7qMxvU1SfAd+lPOH5HUPkg4=";
+  vendorHash = "sha256-/V1jAF3Uf0AT8JF7hERK3Kc4fX15lDnoEsjeHS0QjpE=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 

pkgs/tools/misc/thumbs/default.nix

@@ -2,22 +2,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "thumbs";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "fcsonline";
     repo = "tmux-thumbs";
     rev = version;
-    sha256 = "sha256-PH1nscmVhxJFupS7dlbOb+qEwG/Pa/2P6XFIbR/cfaQ=";
+    sha256 = "sha256-XMz1ZOTz2q1Dt4QdxG83re9PIsgvxTTkytESkgKxhGM=";
   };
 
-  cargoSha256 = "sha256-6htKiXMMyYRFefJzvDnmdx3CJ3XL8zONhGlV2wcbr9g=";
+  cargoSha256 = "sha256-PfTx6PcW5DESShfr9Ekhbq1asZ0xUGM4Vi9EwmoDv+s";
 
   patches = [ ./fix.patch ];
 
   meta = with lib; {
     homepage = "https://github.com/fcsonline/tmux-thumbs";
-    description = "A lightning fast version copy/pasting like vimium/vimperator";
+    description = "A lightning fast version of tmux-fingers written in Rust, copy/pasting tmux like vimium/vimperator";
     license = licenses.mit;
     maintainers = with maintainers; [ ghostbuster91 ];
   };

pkgs/tools/misc/thumbs/fix.patch

@@ -1,13 +1,13 @@
-diff --git a/src/swapper.rs b/src/swapper.rs
+diff --git i/src/swapper.rs w/src/swapper.rs
-index 6cf1e89..bcb0969 100644
+index c901f48..cbd278d 100644
---- a/src/swapper.rs
+--- i/src/swapper.rs
-+++ b/src/swapper.rs
++++ w/src/swapper.rs
 @@ -215,7 +215,7 @@ impl<'a> Swapper<'a> {
      };
-
+ 
      let pane_command = format!(
--        "tmux capture-pane -t {active_pane_id} -p{scroll_params} | tail -n {height} | {dir}/target/release/thumbs -f '%U:%H' -t {tmp} {args}; tmux swap-pane -t {active_pane_id}; {zoom_command} tmux wait-for -S {signal}",
+-        "tmux capture-pane -J -t {active_pane_id} -p{scroll_params} | tail -n {height} | {dir}/target/release/thumbs -f '%U:%H' -t {tmp} {args}; tmux swap-pane -t {active_pane_id}; {zoom_command} tmux wait-for -S {signal}",
-+        "tmux capture-pane -t {active_pane_id} -p{scroll_params} | tail -n {height} | {dir}/thumbs -f '%U:%H' -t {tmp} {args}; tmux swap-pane -t {active_pane_id}; {zoom_command} tmux wait-for -S {signal}",
++        "tmux capture-pane -J -t {active_pane_id} -p{scroll_params} | tail -n {height} | {dir}/thumbs -f '%U:%H' -t {tmp} {args}; tmux swap-pane -t {active_pane_id}; {zoom_command} tmux wait-for -S {signal}",
          active_pane_id = active_pane_id,
          scroll_params = scroll_params,
          height = self.active_pane_height.unwrap_or(i32::MAX),

pkgs/tools/networking/croc/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.6.8";
+  version = "9.6.9";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-AiRtEXYWu7Y2D7pNnOrmkT3YQ3FUEHHWuEwJrABPkX0=";
+    sha256 = "sha256-5nYC94x4Be1cvOumhlzCFwn+3ZsAhq66Qs/2Pk6Ko+o=";
   };
 
-  vendorHash = "sha256-Qt+NMpcEHn6K6rA+rxkW6uqTBvjbMkUK1KvmvUHJ8XM=";
+  vendorHash = "sha256-mxEDatG1VIPhnk7RUuobGGbUUi7HmeJvyBJFEEx4NMg=";
 
   subPackages = [ "." ];
 

pkgs/tools/networking/ghostunnel/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "ghostunnel";
-  version = "1.7.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
     rev = "v${version}";
-    hash = "sha256-yG9PfpYqW95X7EfbAhKEDmqBue7SjFULXUO73V4s3t4=";
+    hash = "sha256-6yGAXJOyXNj0xf+1vKxVcU6w3VMpSLh+6PC+yKzFbrs=";
   };
 
   vendorHash = null;

pkgs/tools/networking/minio-client/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-01-31T08-59-40Z";
+  version = "2024-02-09T22-18-24Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-SD/CtYQFWy7VFo2jT53LDQfH7fw14OOKAbImNeG/amE=";
+    sha256 = "sha256-Z4bqbU5ZDVlHLHyJWTNLSjBgE3Fybn/oUyqjod0bUCw=";
   };
 
   vendorHash = "sha256-wxFhj+oqj5WV/UkPZlmeJHF2WC4oLlZOql1qgSFs+zU=";

pkgs/tools/networking/rshijack/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rshijack";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ys1uiUQbge/eKAog2f0wL9xM+RxuxNlsc8ZceoDJk9s=";
+    sha256 = "sha256-UyrHMw+3JE4zR+N7rdcTkLP3m4h6txkYa8uG9r7S9ZE=";
   };
 
-  cargoHash = "sha256-GkoRgl0jzej8HoD2wojLg71NQcGvQZTtdD4zuvsJa4Y=";
+  cargoHash = "sha256-bGGbZ3JXeo6eytiDHrgHOQN3VgfaqtWssz5hY0RZoZ0=";
 
   meta = with lib; {
     description = "TCP connection hijacker";

pkgs/tools/package-management/emplace/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "emplace";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "tversteeg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gq9JapddDCllczT7Xb71pui3ywbS/ArrjhIU6XfM0B8=";
+    sha256 = "sha256-KwA0GlZatY1DvtqSR4rwq/nODSa9n+S0gPVqS6agSzM=";
   };
 
-  cargoHash = "sha256-jE0nxIM0K6rQDlYGDFyqcQrqRVh+wqoXQE+SHZMwe+A=";
+  cargoHash = "sha256-eQ+T6YiYYeWaUezXB59+Ki05PXtJd7ISwnRw/x/YTZA=";
 
   meta = with lib; {
     description = "Mirror installed software on multiple machines";

pkgs/tools/package-management/home-manager/default.nix

@@ -16,14 +16,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "unstable-2024-02-06";
+  version = "unstable-2024-02-11";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "f99eace7c167b8a6a0871849493b1c613d0f1b80";
+    rev = "bfd0ae29a86eff4603098683b516c67e22184511";
-    hash = "sha256-0MKHC6tQ4KEuM5rui6DjKZ/VNiSANB4E+DJ/+wPS1PU=";
+    hash = "sha256-hj/RgQMTvCWQVInkZwiMMieumkfOjHXhtWhfuXHop/8=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/clamav/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clamav";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    hash = "sha256-mhT+hwy7j1959mi3idyg8lzGviKr4y9PfTZ35O45NbA=";
+    hash = "sha256-CoamSWMg2RV2A3szEBEZr2/Y1bkQYM0xajqcIp6WBKo=";
   };
 
   patches = [

pkgs/tools/security/gotestwaf/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gotestwaf";
-  version = "0.4.11";
+  version = "0.4.12";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = "gotestwaf";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xvlzSBvOM09b/m4gI1sbIpIlFJnXQL0G4xet/AL3Yxo=";
+    hash = "sha256-av6N6RQ+9iW+xG1FpmFjBHL1leU4P0IPiqf7kvJxm6M=";
   };
 
   vendorHash = null;

pkgs/top-level/all-packages.nix

@@ -20626,7 +20626,8 @@ with pkgs;
     withCMake = false;
   };
 
-  c-blosc = callPackage ../development/libraries/c-blosc { };
+  inherit (callPackages ../development/libraries/c-blosc { })
+    c-blosc c-blosc2;
 
   cachix = lib.getBin haskellPackages.cachix;
 
@@ -21434,12 +21435,12 @@ with pkgs;
   };
 
   libgit2_1_6 = libgit2.overrideAttrs rec {
-    version = "1.6.4";
+    version = "1.6.5";
     src = fetchFromGitHub {
       owner = "libgit2";
       repo = "libgit2";
       rev = "v${version}";
-      hash = "sha256-lW3mokVKsbknVj2xsxEbeZH4IdKZ0aIgGutzenS0Eh0=";
+      hash = "sha256-2tgXnrB85dEfxu7giETqMuFxfm0RH5MicHZqO3ezGu0=";
     };
     patches = [ ];
   };
@@ -34593,8 +34594,6 @@ with pkgs;
 
   pop-launcher = callPackage ../applications/misc/pop-launcher { };
 
-  popcorntime = callPackage ../applications/video/popcorntime { };
-
   pot = callPackage ../applications/misc/pot { };
 
   pothos = libsForQt5.callPackage ../applications/radio/pothos { };

pkgs/top-level/kodi-packages.nix

@@ -181,6 +181,8 @@ let self = rec {
 
   six = callPackage ../applications/video/kodi/addons/six { };
 
+  sponsorblock = callPackage ../applications/video/kodi/addons/sponsorblock { };
+
   urllib3 = callPackage ../applications/video/kodi/addons/urllib3 { };
 
   websocket = callPackage ../applications/video/kodi/addons/websocket { };

pkgs/top-level/python-packages.nix

@@ -5055,6 +5055,8 @@ self: super: with self; {
     inherit (pkgs) h3;
   };
 
+  h5io = callPackage ../development/python-modules/h5io { };
+
   h5netcdf = callPackage ../development/python-modules/h5netcdf { };
 
   h5py = callPackage ../development/python-modules/h5py { };
@@ -10813,6 +10815,8 @@ self: super: with self; {
 
   pymatgen = callPackage ../development/python-modules/pymatgen { };
 
+  pymatreader = callPackage ../development/python-modules/pymatreader { };
+
   pymatting = callPackage ../development/python-modules/pymatting { };
 
   pymaven-patch = callPackage ../development/python-modules/pymaven-patch { };
@@ -11585,6 +11589,8 @@ self: super: with self; {
 
   pytest-grpc = callPackage ../development/python-modules/pytest-grpc { };
 
+  pytest-harvest = callPackage ../development/python-modules/pytest-harvest { };
+
   pytest-helpers-namespace = callPackage ../development/python-modules/pytest-helpers-namespace { };
 
   pytest-html = callPackage ../development/python-modules/pytest-html { };