Merge master into staging-next

nixos/modules/config/users-groups.nix

@@ -730,7 +730,8 @@ in {
 
     environment.profiles = [
       "$HOME/.nix-profile"
-      "\${XDG_STATE_HOME:-$HOME/.local/state}/nix/profile"
+      "\${XDG_STATE_HOME}/nix/profile"
+      "$HOME/.local/state/nix/profile"
       "/etc/profiles/per-user/$USER"
     ];
 

pkgs/applications/blockchains/optimism/default.nix

@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "optimism";
-  version = "1.1.4";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "optimism";
     rev = "op-node/v${version}";
-    hash = "sha256-UDNqD3gA27qqaJYbpgOWoL0AeLb7OZRCRJcGNKRq67g=";
+    hash = "sha256-kzJ2zV4Iz3LqrVrs6mluiXluFqFaftycHhOAE8m0vns=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];
 
-  vendorHash = "sha256-OGOdU6X3dcAu4BDpG62bK8LaMo+NuzFOUSjdPNhRGZM=";
+  vendorHash = "sha256-6ChcT8rgyxiory//EHNA0Q0AZRhUIDpe1pmVeQ66gA4=";
 
   buildInputs = [
     libpcap

pkgs/applications/editors/jetbrains/linux.nix

@@ -127,8 +127,8 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
       --set-default ANDROID_JAVA_HOME "$jdk" \
       --set-default JAVA_HOME "$jdk" \
       --set-default JETBRAINSCLIENT_JDK "$jdk" \
-      --set ${hiName}_JDK "$jdk" \
+      --set-default ${hiName}_JDK "$jdk" \
-      --set ${hiName}_VM_OPTIONS ${vmoptsFile}
+      --set-default ${hiName}_VM_OPTIONS ${vmoptsFile}
 
     ln -s "$out/$pname/bin/${loName}.sh" $out/bin/$pname
     echo -e '#!/usr/bin/env bash\n'"$out/$pname/bin/remote-dev-server.sh"' "$@"' > $out/$pname/bin/remote-dev-server-wrapped.sh

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1ayb0fj3dfcvwmfc749aihn1mm2h4nin914kvalchkm9q0xvc2y9";
+    x86_64-linux = "1061hpazgs2gbn1xbn3in1sh7img71l5fx1irlgr86k70jdjw0qp";
-    x86_64-darwin = "0yvcm1m1dlklacc0rir4ja2bqiwlwmrmx3qwxf3ik40m1dfwhh53";
+    x86_64-darwin = "17n16az3b8lnh1wq7mj4fd2kvvbh3l4d72iwxqx2z08vpsiaivad";
-    aarch64-linux = "0vj7q6b82n9509dph0p4d6n7b9gwz5b3wkg4wysm4w4xflqlx9al";
+    aarch64-linux = "0ggjh58nxwz5hlv4hwig2w32lcg2vsvszsr7dq6p7rd3c7l13mqr";
-    aarch64-darwin = "144fxkxg6c5216ds32wdx7qf5hnvlq4a429z90wz62iynslaggl4";
+    aarch64-darwin = "0irvjlzx79a2p8jbv8kiblkrzkslpv6qmqzi5yj7gl2dl2f5y1lx";
-    armv7l-linux = "1819dg30dy8hd8gi84b1992ii1bxcfcvhx9yf4q8wdf62hw5nkpq";
+    armv7l-linux = "1nyaz1nmswyy6qkz83cqb8nw1ajlhchqcwbj5msq3camkjdjr8g6";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.83.0";
+    version = "1.83.1";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "e7e037083ff4455cf320e344325dacb480062c3c";
+    rev = "f1b07bd25dfad64b0167beb15359ae573aecd2cc";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "11lf24hsbc4xbi08lrzxw4bn0jqp7rbhz120y9i3ffq25kni989l";
+        sha256 = "0hbqbkzynqxp99rhqq46878cp1jnjklqy8vgbf0dm2cwfw86jbrw";
       };
     };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -81,6 +81,15 @@
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-q9PO9tMbaXTs3nBLElwU05GcDZMZqNmLVVGDmiSRSfo="
   },
+  "artifactory": {
+    "hash": "sha256-NIykaB1KStKEk/B1EChI4oUhS9roEpl9g/YVRCX3GJg=",
+    "homepage": "https://registry.terraform.io/providers/jfrog/artifactory",
+    "owner": "jfrog",
+    "repo": "terraform-provider-artifactory",
+    "rev": "v9.5.0",
+    "spdx": "Apache-2.0",
+    "vendorHash": "sha256-52cO9473VWzIqD0rVl9hm7NNfLb6Lund3Dyt4N0IMck="
+  },
   "auth0": {
     "hash": "sha256-QljqPcupvU7AgVSuarpd0FwLuAPJI9umgsgMXc2/v6w=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
@@ -943,6 +952,15 @@
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
+  "project": {
+    "hash": "sha256-MrzuyL0aVOzMuIeJLzH/oElbY6nG0xPG5H0vovBsVgA=",
+    "homepage": "https://registry.terraform.io/providers/jfrog/project",
+    "owner": "jfrog",
+    "repo": "terraform-provider-project",
+    "rev": "v1.3.1",
+    "spdx": "Apache-2.0",
+    "vendorHash": "sha256-AdkyM9Uvv9BLfxex9a+KFom0cV9GrQSVaZ3qw/UehLQ="
+  },
   "rabbitmq": {
     "hash": "sha256-ArteHTNNUxgiBJamnR1bJFDrvNnqjbJ6D3mj1XlpVUA=",
     "homepage": "https://registry.terraform.io/providers/cyrilgdn/rabbitmq",

pkgs/applications/networking/nextdns/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.40.1";
+  version = "1.41.0";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-VK6e8+r0A642zP0Pae8qbQCWT+CGpHY7B9ZGobXl92A=";
+    sha256 = "sha256-uLX5M9DW8wfVKSV+/pwy+ZK6M6OQSq7qYjRcBvOOqOQ=";
   };
 
-  vendorHash = "sha256-CKKyLtqSzbmvpmDcoyGD79msAudlumqxcXaMTNbCbNI=";
+  vendorHash = "sha256-vYE/GdN2ooSW4LMg1D5t5zOgATruB4Q449JdNo87fkM=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 

pkgs/development/libraries/eccodes/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eccodes";
-  version = "2.30.2";
+  version = "2.32.0";
 
   src = fetchurl {
     url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "sha256-ObleQiGxFtyBhlbQTIKIQFXUiuuqKZDCWeqM3/2kJYI=";
+    sha256 = "sha256-tX6O6w66DAXWb9pVJ8T/qEtas1xGvLyaIicUKXPMuOY=";
   };
 
   postPatch = ''

pkgs/development/libraries/kronosnet/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kronosnet";
-  version = "1.26";
+  version = "1.28";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LkV5bi1kMRP2ofBIe+hbOzbSRStWyr3afnNdZqpVDBA=";
+    sha256 = "sha256-HxdZy2TiQT7pWyhaSq4YJAcqjykzWy1aI3gEZrlbghQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];

pkgs/development/python-modules/clarifai-grpc/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "9.8.4";
+  version = "9.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-j+dtcNInkTcgcLt6IOjqVeI/qSczRNs9PhS9iPoUF+c=";
+    hash = "sha256-YZYawFGpGPK0T4MlWHwONqcx1fwcoZiNalhU2ydM+mo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/equinox/default.nix

@@ -7,19 +7,20 @@
 , jaxtyping
 , typing-extensions
 , beartype
+, optax
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "equinox";
-  version = "0.10.11";
+  version = "0.11.1";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick-kidger";
-    repo = pname;
+    repo = "equinox";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JffuPplIROPog29FBsWH9cQHSkrFKuXjaTjjEwIqW/0=";
+    hash = "sha256-iYVAbUIZG90kgWger+M+DZmS/kQ3nEPXQFU+90lHgK0=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     beartype
+    optax
     pytestCheckHook
   ];
 

pkgs/development/python-modules/evaluate/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "evaluate";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-O3W2m12R94iY3F7xgkIiiIyqI6vqiZPXn4jAqEDjVCw=";
+    hash = "sha256-axcJg0ZalEd4FOySCiFReKL7wmTCtLaw71YqyLHq8fc=";
   };
 
   nativeBuildInputs = [ pythonRelaxDepsHook ];

pkgs/development/python-modules/flask-babel/default.nix

@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "flask-babel";
-  version = "3.1.0";
+  version = "4.0.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "python-babel";
     repo = "flask-babel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KoTHBrGD6M3rkXoxUadRXhroRUbWKaL/rE6Rd2mxw4c=";
+    hash = "sha256-BAT+oupy4MCSjeZ4hFtSKMkGU9xZtc7Phnz1mIsb2Kc=";
   };
 
   outputs = [

pkgs/development/python-modules/jaxtyping/default.nix

@@ -16,14 +16,14 @@
 let
   self = buildPythonPackage rec {
     pname = "jaxtyping";
-    version = "0.2.22";
+    version = "0.2.23";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "google";
       repo = "jaxtyping";
       rev = "refs/tags/v${version}";
-      hash = "sha256-OYx7Eq5jxSGERHsk611+n+Nq2B915gpJLPZYdO7Lt+k=";
+      hash = "sha256-22dIuIjFgqRmV9AQok02skVt7fm17/WpzBm3FrJ6/zs=";
     };
 
     nativeBuildInputs = [

pkgs/development/python-modules/libcst/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "libcst";
-  version = "1.0.1";
+  version = "1.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -28,14 +28,14 @@ buildPythonPackage rec {
     owner = "instagram";
     repo = "libcst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FgQE8ofRXQs/zHh7AKscXu0deN3IG+Nk/h+a09Co5R8=";
+    hash = "sha256-kFs7edBWz0GRbgbLDmtpUVi5R+6mYXsJSvceOoPW9ck=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-rPB3bAMdvjgsT3jkEDoWatW8LPwgIaFSbFPqiqANtBY=";
+    hash = "sha256-fhaHiz64NH6S61fSXj4gNxxcuB+ECxWSSmG5StiFr1k=";
   };
 
   cargoRoot = "native";
@@ -92,6 +92,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Concrete Syntax Tree (CST) parser and serializer library for Python";
     homepage = "https://github.com/Instagram/libcst";
+    changelog = "https://github.com/Instagram/LibCST/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit asl20 psfl ];
     maintainers = with maintainers; [ ];
   };

pkgs/development/python-modules/numpy/default.nix

@@ -11,6 +11,7 @@
 , lapack
 , writeTextFile
 , cython
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -42,7 +43,7 @@ in buildPythonPackage rec {
   pname = "numpy";
   version = "1.25.2";
   format = "setuptools";
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;

pkgs/development/python-modules/shap/default.nix

@@ -31,16 +31,16 @@
 
 buildPythonPackage rec {
   pname = "shap";
-  version = "0.42.1";
+  version = "0.43.0";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "slundberg";
     repo = "shap";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ezq6WS6QnoM5uEfo2DgDAEo1HkQ1KjmfgIyVWh3RM94=";
+    hash = "sha256-ylkpXhaLXsQiu6YMC3pUtlicptQmtjITzW+ydinB4ls=";
   };
 
   nativeBuildInputs = [
@@ -124,9 +124,11 @@ buildPythonPackage rec {
 
   disabledTests = [
     # The same reason as above test_summary.py
-    "test_simple_bar_with_cohorts_dict"
+    "test_random_force_plot_negative_sign"
-    "test_random_summary_violin_with_data2"
+    "test_random_force_plot_positive_sign"
     "test_random_summary_layered_violin_with_data2"
+    "test_random_summary_violin_with_data2"
+    "test_simple_bar_with_cohorts_dict"
   ];
 
   pythonImportsCheck = [

pkgs/development/tools/flyway/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flyway";
-  version = "9.22.2";
+  version = "9.22.3";
   src = fetchurl {
     url = "mirror://maven/org/flywaydb/flyway-commandline/${finalAttrs.version}/flyway-commandline-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-IaURrRP1Q/Neu/HmPfCDsL6rZ59Gll5AzgniQhRK3GU=";
+    sha256 = "sha256-utAJpbU5NkKyJyyWB0yfwHZJxQAVJgiKm12wmGK1ojQ=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;

pkgs/development/tools/misc/editorconfig-checker/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "editorconfig-checker";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "editorconfig-checker";
     repo = "editorconfig-checker";
     rev = version;
-    hash = "sha256-TycKc6Zgf9QFTH3lfNC+/O52cp2xhKsKflxuQTac794=";
+    hash = "sha256-ktZeBj5feJMf4XR4hybKdNrNCIrQD6KPetZffAZjwqI=";
   };
 
-  vendorHash = "sha256-S93ZvC92V9nrBicEv1yQ3DEuf1FmxtvFoKPR15e8VmA=";
+  vendorHash = "sha256-dhvRZ+AYSmSzHsf3yOYBSvZbw7dfwQiILu+VSUX8N3s=";
 
   doCheck = false;
 

pkgs/development/tools/rust/cargo-llvm-lines/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.35";
+  version = "0.4.36";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    hash = "sha256-lxS9j733dhoM5bQSuo9jGOIHaKtcHzCDR5E9ko8U8xI=";
+    hash = "sha256-kj5dsZWf1dp6NG9AIj5GdRoXIb6J3bSXnJNNEVAKnaM=";
   };
 
-  cargoHash = "sha256-d5b/ggk/FxCgUJrYCtrmSPAwLftMKzuOhg+0mQQ+ntM=";
+  cargoHash = "sha256-iZtT1ywFIgPhBnW4losd1J+WHUtzgW47657vGi6mI7I=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";

pkgs/os-specific/linux/freeipa/default.nix

@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.10.2";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-9DbfxJeEUGnBE7pULTPrVgqRePILUFk4Kn0WFNmcFVg=";
+    sha256 = "sha256-l/e2Dq/ako41QWEZyJCD+PA44PzTnzC8B7jYAm/Tt6Q=";
   };
 
   nativeBuildInputs = [
@@ -167,5 +167,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.s1341 ];
     platforms = platforms.linux;
+    mainProgram = "ipa";
   };
 }

pkgs/os-specific/linux/wireless-tools/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "30.pre9";
 
   src = fetchurl {
-    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    url = "https://hewlettpackard.github.io/wireless-tools/wireless_tools.${version}.tar.gz";
     sha256 = "0qscyd44jmhs4k32ggp107hlym1pcyjzihiai48xs7xzib4wbndb";
   };
 
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
+    description = "Wireless tools for Linux";
+    homepage = "https://hewlettpackard.github.io/wireless-tools/Tools.html";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2;
   };

pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch

@@ -1,22 +1,29 @@
-From 1b6ad143c0f5f96c42f603bb93a72f788b88b622 Mon Sep 17 00:00:00 2001
+From 4a9739da420b9584d5b9582c19cf3f86a6a90609 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
 Date: Fri, 12 May 2023 08:12:04 +0100
-Subject: [PATCH 1/2] nixpkgs: use system Python
+Subject: [PATCH 1/3] nixpkgs: use system Python
 
 ---
- bazel/python_dependencies.bzl |  4 ----
+ bazel/python_dependencies.bzl | 11 ++++-------
- bazel/repositories_extra.bzl  | 13 +------------
+ bazel/repositories_extra.bzl  | 16 ----------------
- 2 files changed, 1 insertion(+), 16 deletions(-)
+ 2 files changed, 4 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index 37c0183664..0bee5feb7e 100644
+index ea50bf30ba..b82f374720 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
-@@ -1,24 +1,20 @@
+@@ -1,27 +1,24 @@
  load("@rules_python//python:pip.bzl", "pip_parse")
--load("@python3_10//:defs.bzl", "interpreter")
+-load("@python3_11//:defs.bzl", "interpreter")
+-load("@envoy_toolshed//:packages.bzl", "load_packages")
  
  def envoy_python_dependencies():
+-    # TODO(phlax): rename base_pip3 -> pip3 and remove this
+-    load_packages()
++    pip_parse(
++        name = "pip3",
++        requirements_lock = "@envoy_toolshed//:requirements.txt",
++    )
      pip_parse(
          name = "base_pip3",
 -        python_interpreter_target = interpreter,
@@ -38,34 +45,39 @@ index 37c0183664..0bee5feb7e 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index 9d1b31c5d6..ac5605eb30 100644
+index 40d348073f..17b98b1ea1 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
-@@ -1,23 +1,12 @@
+@@ -1,29 +1,13 @@
  load("@emsdk//:deps.bzl", emsdk_deps = "deps")
 -load("@rules_python//python:repositories.bzl", "python_register_toolchains")
  load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
  load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
  load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
  
+-def _python_minor_version(python_version):
+-    return "_".join(python_version.split(".")[:-1])
+-
 -# Python version for `rules_python`
--PYTHON_VERSION = "3.10.2"
+-PYTHON_VERSION = "3.11.3"
+-PYTHON_MINOR_VERSION = _python_minor_version(PYTHON_VERSION)
 -
  # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies().
--def envoy_dependencies_extra(python_version = PYTHON_VERSION):
+ def envoy_dependencies_extra(
-+def envoy_dependencies_extra():
+-        python_version = PYTHON_VERSION,
+         ignore_root_user_error = False):
      emsdk_deps()
      raze_fetch_remote_crates()
      wasmtime_fetch_remote_crates()
  
 -    # Registers underscored Python minor version - eg `python3_10`
 -    python_register_toolchains(
--        name = "python%s" % ("_".join(python_version.split(".")[:-1])),
+-        name = "python%s" % _python_minor_version(python_version),
 -        python_version = python_version,
--        ignore_root_user_error = True,
+-        ignore_root_user_error = ignore_root_user_error,
 -    )
 -
      aspect_bazel_lib_dependencies()
 -- 
-2.40.0
+2.42.0
 

pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch

@@ -1,7 +1,7 @@
-From 30e059d652bd4e352e2c1dc3c44d03a1e42ff912 Mon Sep 17 00:00:00 2001
+From 10e577a3c300f76ead5a5512f2fe970f12e46592 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
 Date: Fri, 12 May 2023 08:13:21 +0100
-Subject: [PATCH 2/2] nixpkgs: use system Go
+Subject: [PATCH 2/3] nixpkgs: use system Go
 
 ---
  bazel/dependency_imports.bzl | 29 +----------------------------
@@ -9,11 +9,11 @@ Subject: [PATCH 2/2] nixpkgs: use system Go
  2 files changed, 1 insertion(+), 31 deletions(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index 681617f1b8..a10c560baf 100644
+index b743a1936d..afa04ef5c0 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -17,7 +17,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis
+@@ -18,7 +18,7 @@ load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
- load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
+ load("@com_github_chrusty_protoc_gen_jsonschema//:deps.bzl", protoc_gen_jsonschema_go_dependencies = "go_dependencies")
  
  # go version for rules_go
 -GO_VERSION = "1.18"
@@ -22,17 +22,17 @@ index 681617f1b8..a10c560baf 100644
  JQ_VERSION = "1.6"
  YQ_VERSION = "4.24.4"
 @@ -27,7 +27,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-     rules_foreign_cc_dependencies(register_default_tools = False, register_built_tools = False)
+     rules_foreign_cc_dependencies()
      go_rules_dependencies()
      go_register_toolchains(go_version)
 -    envoy_download_go_sdks(go_version)
      gazelle_dependencies(go_sdk = "go_sdk")
      apple_rules_dependencies()
      pip_dependencies()
-@@ -146,29 +145,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
+@@ -148,29 +147,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-         # use_category = ["api"],
-         # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L23-L28"
      )
+ 
+     protoc_gen_jsonschema_go_dependencies()
 -
 -def envoy_download_go_sdks(go_version):
 -    go_download_sdk(
@@ -60,10 +60,10 @@ index 681617f1b8..a10c560baf 100644
 -        version = go_version,
 -    )
 diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 6d2cf2014c..a8375bcdef 100644
+index 71667227f7..b10a47d344 100644
 --- a/bazel/repositories.bzl
 +++ b/bazel/repositories.bzl
-@@ -196,9 +196,6 @@ def _go_deps(skip_targets):
+@@ -215,9 +215,6 @@ def _go_deps(skip_targets):
      if "io_bazel_rules_go" not in skip_targets:
          external_http_archive(
              name = "io_bazel_rules_go",
@@ -74,5 +74,5 @@ index 6d2cf2014c..a8375bcdef 100644
          external_http_archive("bazel_gazelle")
  
 -- 
-2.40.0
+2.42.0
 

pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch

@@ -0,0 +1,29 @@
+From 6175deb13a2df8bd25a56021ba8754e4be445219 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Fri, 13 Oct 2023 21:42:51 +0000
+Subject: [PATCH 3/3] nixpkgs: use system C/C++ toolchains
+
+---
+ bazel/dependency_imports.bzl | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
+index afa04ef5c0..a5ffaf4ff3 100644
+--- a/bazel/dependency_imports.bzl
++++ b/bazel/dependency_imports.bzl
+@@ -24,7 +24,11 @@ JQ_VERSION = "1.6"
+ YQ_VERSION = "4.24.4"
+ 
+ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION):
+-    rules_foreign_cc_dependencies()
++    rules_foreign_cc_dependencies(
++        register_default_tools=False,  # no prebuilt toolchains
++	register_built_tools=False,  # nor from source
++	register_preinstalled_tools=True,  # use host tools (default)
++    )
+     go_rules_dependencies()
+     go_register_toolchains(go_version)
+     gazelle_dependencies(go_sdk = "go_sdk")
+-- 
+2.42.0
+

pkgs/servers/http/envoy/default.nix

@@ -24,8 +24,8 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.26.4";
+    version = "1.27.1";
-    rev = "cfa32deca25ac57c2bbecdad72807a9b13493fc1";
+    rev = "6b9db09c69965d5bfb37bdd29693f8b7f9e9e9ec";
   };
 in
 buildBazelPackage rec {
@@ -36,7 +36,7 @@ buildBazelPackage rec {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    hash = "sha256-j5QyqT+9tpChg5JxdSw21rtb9AI036vIiAmzCNzGWGc=";
+    hash = "sha256-eZ3UCVqQbtK2GbawUVef5+BMSQbqe+owtwH+b887mQE=";
 
     postFetch = ''
       chmod -R +w $out
@@ -59,6 +59,9 @@ buildBazelPackage rec {
 
     # use system Go, not bazel-fetched binary Go
     ./0002-nixpkgs-use-system-Go.patch
+
+    # use system C/C++ tools
+    ./0003-nixpkgs-use-system-C-C-toolchains.patch
   ];
 
   nativeBuildInputs = [
@@ -80,8 +83,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-MvY4cLdLOeb7+Zt7Oz7Kzz1+dsUceemP/V02egvHg+M=";
+      x86_64-linux = "sha256-bBi+3sAwtj5qu1npFpNMK2C99Q0ZI3zaSmMsTcreD8Y=";
-      aarch64-linux = "sha256-U5mnAq8RHDygxiYeNc0HDeOgoaGyrd0MPjHKdyUkM0A=";
+      aarch64-linux = "sha256-piIekotpxB02COglAon9w7a+1jXlHX29/VkrgKFsQ3c=";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;

pkgs/servers/http/envoy/protobuf.patch

@@ -1,33 +1,39 @@
 diff --git a/BUILD.bazel b/BUILD.bazel
-index 0f6e41e3a..c0d2bbccf 100644
+index 637882c49..2cb08f1b0 100644
 --- a/BUILD.bazel
 +++ b/BUILD.bazel
-@@ -138,7 +138,7 @@ cc_library(
+@@ -165,6 +165,8 @@ alias(
      visibility = ["//visibility:public"],
-     deps = [":protobuf_lite"] + select({
-         "//build_defs:config_msvc": [],
--        "//conditions:default": ["@zlib//:zlib"],
-+        "//conditions:default": ["//external:zlib"],
-     }),
  )
  
-@@ -755,7 +820,7 @@ cc_test(
++# Envoy: Patch
-         "@com_google_googletest//:gtest_main",
++
-     ] + select({
+ cc_binary(
-         "//build_defs:config_msvc": [],
+     name = "protoc",
--        "//conditions:default": ["@zlib//:zlib"],
+     copts = COPTS,
-+        "//conditions:default": ["//external:zlib"],
+@@ -173,6 +175,14 @@ cc_binary(
-     }),
+     deps = ["//src/google/protobuf/compiler:protoc_lib"],
  )
  
++alias(
++    name = "protobuf_python_genproto",
++    actual = "//python:well_known_types_py_pb2_genproto",
++    visibility = ["//visibility:public"],
++)
++
++# /Envoy: Patch
++
+ cc_binary(
+     name = "protoc_static",
+     copts = COPTS,
 diff --git a/python/google/protobuf/__init__.py b/python/google/protobuf/__init__.py
-index e7555ee10..a93beb1c5 100644
+index 88de4cf8a..b3e046997 100755
 --- a/python/google/protobuf/__init__.py
 +++ b/python/google/protobuf/__init__.py
 @@ -31,3 +31,10 @@
  # Copyright 2007 Google Inc. All Rights Reserved.
  
- __version__ = '4.21.12'
+ __version__ = '4.23.1'
 +
 +
 +if __name__ != '__main__':
@@ -35,19 +41,76 @@ index e7555ee10..a93beb1c5 100644
 +        __import__('pkg_resources').declare_namespace(__name__)
 +    except ImportError:
 +        __path__ = __import__('pkgutil').extend_path(__path__, __name__)
-diff --git a/src/google/protobuf/generated_message_tctable_lite.cc b/src/google/protobuf/generated_message_tctable_lite.cc
+diff --git a/src/google/protobuf/compiler/BUILD.bazel b/src/google/protobuf/compiler/BUILD.bazel
-index 9993811dc..d80006af7 100644
+index a2171c806..8aec6187f 100644
---- a/src/google/protobuf/generated_message_tctable_lite.cc
+--- a/src/google/protobuf/compiler/BUILD.bazel
-+++ b/src/google/protobuf/generated_message_tctable_lite.cc
++++ b/src/google/protobuf/compiler/BUILD.bazel
-@@ -343,11 +343,6 @@ const char* TcParser::MiniParse(PROTOBUF_TC_PARAM_DECL) {
+@@ -306,7 +306,7 @@ cc_library(
+     srcs = ["retention.cc"],
+     hdrs = ["retention.h"],
+     include_prefix = "google/protobuf/compiler",
+-    visibility = ["//src/google/protobuf:__subpackages__"],
++    visibility = ["//visibility:public"],
+     deps = [
+         "//src/google/protobuf:protobuf_nowkt",
+         "@com_google_absl//absl/types:span",
+diff --git a/src/google/protobuf/io/BUILD.bazel b/src/google/protobuf/io/BUILD.bazel
+index 8f39625c2..2c2c73dcd 100644
+--- a/src/google/protobuf/io/BUILD.bazel
++++ b/src/google/protobuf/io/BUILD.bazel
+@@ -142,7 +142,7 @@ cc_library(
+         "@com_google_absl//absl/log:absl_log",
+     ] + select({
+         "//build_defs:config_msvc": [],
+-        "//conditions:default": ["@zlib//:zlib"],
++        "//conditions:default": ["//external:zlib"],
+     }),
+ )
  
- namespace {
+diff --git a/src/google/protobuf/map.h b/src/google/protobuf/map.h
+index 869ebf100..fec92e2b1 100644
+--- a/src/google/protobuf/map.h
++++ b/src/google/protobuf/map.h
+@@ -883,7 +883,7 @@ class KeyMapBase : public UntypedMapBase {
+         TreeConvert(b);
+       }
+       ABSL_DCHECK(TableEntryIsTree(b))
+-          << (void*)table_[b] << " " << (uintptr_t)table_[b];
++          << reinterpret_cast<void*>(table_[b]) << " " << static_cast<uintptr_t>(table_[b]);
+       InsertUniqueInTree(b, node);
+       index_of_first_non_null_ = (std::min)(index_of_first_non_null_, b);
+     }
+diff --git a/src/google/protobuf/map_field.h b/src/google/protobuf/map_field.h
+index 70b12b1e7..b8f46db45 100644
+--- a/src/google/protobuf/map_field.h
++++ b/src/google/protobuf/map_field.h
+@@ -345,7 +345,7 @@ class PROTOBUF_EXPORT MapFieldBase : public MapFieldBaseForParse {
  
--// Offset returns the address `offset` bytes after `base`.
+  protected:
--inline void* Offset(void* base, uint32_t offset) {
+   // "protected" stops users from deleting a `MapFieldBase *`
--  return static_cast<uint8_t*>(base) + offset;
+-  ~MapFieldBase();
--}
++  virtual ~MapFieldBase();
--
+ 
- // InvertPacked changes tag bits from the given wire type to length
+  public:
- // delimited. This is the difference expected between packed and non-packed
+   // Returns reference to internal repeated field. Data written using
- // repeated fields.
+diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc
+index 1c6a24945..6186c2ad1 100644
+--- a/src/google/protobuf/port_def.inc
++++ b/src/google/protobuf/port_def.inc
+@@ -1004,7 +1004,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
+ #pragma clang diagnostic ignored "-Wshorten-64-to-32"
+ // Turn on -Wdeprecated-enum-enum-conversion. This deprecation comes in C++20
+ // via http://wg21.link/p1120r0.
+-#pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
++// #pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
+ // This error has been generally flaky, but we need to disable it specifically
+ // to fix https://github.com/protocolbuffers/protobuf/issues/12313
+ #pragma clang diagnostic ignored "-Wunused-parameter"
+@@ -1062,6 +1062,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
+ #pragma warning(disable: 4125)
+ #endif
+ 
++#pragma GCC diagnostic ignored "-Wundef"
+ #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
+ #define PROTOBUF_DEBUG true
+ #else

pkgs/servers/monitoring/grafana-image-renderer/default.nix

@@ -7,18 +7,18 @@
 
 mkYarnPackage rec {
   pname = "grafana-image-renderer";
-  version = "3.7.2";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     rev = "v${version}";
-    hash = "sha256-I5UHNt4vOsXqgeQ96CxJwxuD/MiGK1NEAFJItN1CkwA=";
+    hash = "sha256-3CaIVOzya0euQEpFAqqwy9L6Dn6qxPzpYFjJOL80Ka0=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-YT2tHvLtn4Z2CxH9utmsT8r/UM4/OdPFXByp9pBHDqU=";
+    hash = "sha256-GQ4dV3tyyKSYDA1tUgB+VaUBKIktdbx0o6GgBLQQkFc=";
   };
 
   packageJSON = ./package.json;

pkgs/servers/monitoring/grafana-image-renderer/package.json

@@ -5,7 +5,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "http://github.com/grafana/grafana-image-renderer.git"
+    "url": "https://github.com/grafana/grafana-image-renderer.git"
   },
   "scripts": {
     "eslint": "eslint . --ext .ts",
@@ -16,13 +16,14 @@
     "watch": "tsc-watch --onSuccess \"node build/app.js server --config=dev.json\"",
     "watch:debug": "tsc-watch --onSuccess \"cross-env DEBUG=puppeteer-cluster:* node build/app.js server --config=dev.json\"",
     "build": "tsc",
-    "start": "node build/app.js --config=dev.json",
+    "start": "node build/app.js server --config=dev.json",
     "create-gcom-plugin-json": "ts-node scripts/createGcomPluginJson.ts ./scripts/tmp"
   },
   "dependencies": {
     "@grpc/grpc-js": "^1.7.0",
     "@grpc/proto-loader": "^0.7.2",
     "@hapi/boom": "^10.0.0",
+    "@puppeteer/browsers": "^1.6.0",
     "chokidar": "^3.5.2",
     "dompurify": "^2.4.0",
     "express": "^4.16.3",
@@ -37,13 +38,13 @@
     "on-finished": "^2.3.0",
     "poolpeteer": "^0.23.0",
     "prom-client": "^14.1.0",
-    "puppeteer": "^17.1.3",
+    "puppeteer": "^21.0.3",
     "puppeteer-cluster": "^0.23.0",
     "unique-filename": "^2.0.1",
     "winston": "^3.8.2"
   },
   "devDependencies": {
-    "@grafana/eslint-config": "5.0.0",
+    "@grafana/eslint-config": "^6.0.0",
     "@types/dompurify": "2.3.4",
     "@types/express": "^4.17.14",
     "@types/jsdom": "20.0.0",
@@ -55,7 +56,7 @@
     "cross-env": "7.0.3",
     "eslint": "8.23.1",
     "eslint-config-prettier": "8.5.0",
-    "eslint-plugin-jsdoc": "39.3.6",
+    "eslint-plugin-jsdoc": "^46.5.0",
     "eslint-plugin-prettier": "4.2.1",
     "eslint-plugin-react": "7.31.8",
     "eslint-plugin-react-hooks": "4.6.0",
@@ -80,6 +81,6 @@
   },
   "bin": "build/app.js",
   "engines": {
-    "node": ">= 16"
+    "node": ">= 18"
   }
 }

pkgs/servers/pocketbase/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.18.6";
+  version = "0.18.10";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-QfipP/nq/vE0TnK/JGLIbO282bFSrnIgGzkfU6N+euY=";
+    hash = "sha256-fbzoUmxWwQYEGrUIXtHP6Lz71C51TR30gz+5deB00LM=";
   };
 
-  vendorHash = "sha256-pDLj0Az7aQow1Q+7ANxv5kZQrqBby6gzkfAoV87/k9E=";
+  vendorHash = "sha256-b0i+I/HzHbpmgclYn2g6MtpbslT/sLm9K2woMjvWaD0=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];

pkgs/servers/web-apps/dolibarr/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dolibarr";
-  version = "18.0.1";
+  version = "18.0.2";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     rev = version;
-    sha256 = "sha256-vOHspLYH0hB2aPVzfTqHzKdHFScyxFez5kHozAiokBo=";
+    sha256 = "sha256-dlyq+ZrsiodYwZqzFLdR067O6gaePdPIX3N0xvXLcwg=";
   };
 
   dontBuild = true;

pkgs/tools/networking/mockoon/default.nix

@@ -5,11 +5,11 @@
 
 let
   pname = "mockoon";
-  version = "4.1.0";
+  version = "5.0.0";
 
   src = fetchurl {
     url = "https://github.com/mockoon/mockoon/releases/download/v${version}/mockoon-${version}.AppImage";
-    hash = "sha256-7wf7RFyYQN0pGcfKRzYOxs0qNi27JuX/nXUzT/zMSY4=";
+    hash = "sha256-CxWjnDNobeDbvNx5gVLGfVxrQyMITZJYmJMzf2XlzQQ=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/tools/networking/networkmanager/applet/default.nix

@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "network-manager-applet";
-  version = "1.32.0";
+  version = "1.34.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-orWv+hUFrUOQKVn9vgnlvOxXsR7TM/pgRY/7nGLvujg=";
+    sha256 = "sha256-qzaORw9rFh/IuDS8l5ErfnmvkrjNfqOZwtQAzomrpag=";
   };
 
   mesonFlags = [

pkgs/tools/wayland/swayr/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayr";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "swayr-${version}";
-    sha256 = "sha256-FvlBpBBvmivrnHaKYPxmRAE+PCfTxWS+tYYAFjq8Q6I=";
+    sha256 = "sha256-0qWrVf7Ou7psczg3vlFMh/QO95yPBUZ/fKQ7w0sE/4I=";
   };
 
-  cargoHash = "sha256-Ux0Tx5+manPNUUtiCBo7FCMrBYwwUggrdpitywQ7MPk=";
+  cargoHash = "sha256-r8QcLYBKOfUdzwmohUfg4ZrLqQudIfHB/DETO9byrB0=";
 
   patches = [
     ./icon-paths.patch