Merge master into staging-next

nixos/doc/manual/administration/service-mgmt.chapter.md

@@ -118,3 +118,33 @@ the symlink, and this path is in `/nix/store/.../lib/systemd/user/`.
 Hence [garbage collection](#sec-nix-gc) will remove that file and you
 will wind up with a broken symlink in your systemd configuration, which
 in turn will not make the service / timer start on login.
+
+## Template units {#sect-nixos-systemd-template-units}
+
+systemd supports templated units where a base unit can be started multiple
+times with a different parameter. The syntax to accomplish this is
+`service-name@instance-name.service`. Units get the instance name passed to
+them (see `systemd.unit(5)`). NixOS has support for these kinds of units and
+for template-specific overrides. A service needs to be defined twice, once
+for the base unit and once for the instance. All instances must include
+`overrideStrategy = "asDropin"` for the change detection to work. This
+example illustrates this:
+```nix
+{
+  systemd.services = {
+    "base-unit@".serviceConfig = {
+      ExecStart = "...";
+      User = "...";
+    };
+    "base-unit@instance-a" = {
+      overrideStrategy = "asDropin"; # needed for templates to work
+      wantedBy = [ "multi-user.target" ]; # causes NixOS to manage the instance
+    };
+    "base-unit@instance-b" = {
+      overrideStrategy = "asDropin"; # needed for templates to work
+      wantedBy = [ "multi-user.target" ]; # causes NixOS to manage the instance
+      serviceConfig.User = "root"; # also override something for this specific instance
+    };
+  };
+}
+```

nixos/modules/services/video/mediamtx.nix

@@ -1,79 +1,66 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
   cfg = config.services.mediamtx;
-  package = pkgs.mediamtx;
   format = pkgs.formats.yaml {};
 in
 {
+  meta.maintainers = with lib.maintainers; [ fpletz ];
+
   options = {
     services.mediamtx = {
-      enable = mkEnableOption (lib.mdDoc "MediaMTX");
+      enable = lib.mkEnableOption (lib.mdDoc "MediaMTX");
 
-      settings = mkOption {
+      package = lib.mkPackageOptionMD pkgs "mediamtx" { };
+
+      settings = lib.mkOption {
         description = lib.mdDoc ''
-          Settings for MediaMTX.
-          Read more at <https://github.com/aler9/mediamtx/blob/main/mediamtx.yml>
+          Settings for MediaMTX. Refer to the defaults at
+          <https://github.com/bluenviron/mediamtx/blob/main/mediamtx.yml>.
         '';
         type = format.type;
-
-        default = {
-          logLevel = "info";
-          logDestinations = [
-            "stdout"
-          ];
-          # we set this so when the user uses it, it just works (see LogsDirectory below). but it's not used by default.
-          logFile = "/var/log/mediamtx/mediamtx.log";
-        };
-
+        default = {};
         example = {
           paths = {
             cam = {
-              runOnInit = "ffmpeg -f v4l2 -i /dev/video0 -f rtsp rtsp://localhost:$RTSP_PORT/$RTSP_PATH";
+              runOnInit = "\${lib.getExe pkgs.ffmpeg} -f v4l2 -i /dev/video0 -f rtsp rtsp://localhost:$RTSP_PORT/$RTSP_PATH";
               runOnInitRestart = true;
             };
           };
         };
       };
 
-      env = mkOption {
-        type = with types; attrsOf anything;
+      env = lib.mkOption {
+        type = with lib.types; attrsOf anything;
         description = lib.mdDoc "Extra environment variables for MediaMTX";
         default = {};
         example = {
           MTX_CONFKEY = "mykey";
         };
       };
+
+      allowVideoAccess = lib.mkEnableOption (lib.mdDoc ''
+        Enable access to video devices like cameras on the system.
+      '');
     };
   };
 
-  config = mkIf (cfg.enable) {
+  config = lib.mkIf cfg.enable {
     # NOTE: mediamtx watches this file and automatically reloads if it changes
     environment.etc."mediamtx.yaml".source = format.generate "mediamtx.yaml" cfg.settings;
 
     systemd.services.mediamtx = {
-      environment = cfg.env;
-
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      path = with pkgs; [
-        ffmpeg
-      ];
+      environment = cfg.env;
 
       serviceConfig = {
         DynamicUser = true;
         User = "mediamtx";
         Group = "mediamtx";
-
-        LogsDirectory = "mediamtx";
-
-        # user likely may want to stream cameras, can't hurt to add video group
-        SupplementaryGroups = "video";
-
-        ExecStart = "${package}/bin/mediamtx /etc/mediamtx.yaml";
+        SupplementaryGroups = lib.mkIf cfg.allowVideoAccess "video";
+        ExecStart = "${cfg.package}/bin/mediamtx /etc/mediamtx.yaml";
       };
     };
   };

nixos/modules/system/activation/switch-to-configuration.pl

@@ -253,16 +253,24 @@ sub parse_systemd_ini {
 # If a directory with the same basename ending in .d exists next to the unit file, it will be
 # assumed to contain override files which will be parsed as well and handled properly.
 sub parse_unit {
-    my ($unit_path) = @_;
+    my ($unit_path, $base_unit_path) = @_;
 
     # Parse the main unit and all overrides
     my %unit_data;
     # Replace \ with \\ so glob() still works with units that have a \ in them
     # Valid characters in unit names are ASCII letters, digits, ":", "-", "_", ".", and "\"
+    $base_unit_path =~ s/\\/\\\\/gmsx;
     $unit_path =~ s/\\/\\\\/gmsx;
-    foreach (glob("${unit_path}{,.d/*.conf}")) {
+
+    foreach (glob("${base_unit_path}{,.d/*.conf}")) {
         parse_systemd_ini(\%unit_data, "$_")
     }
+    # Handle drop-in template-unit instance overrides
+    if ($unit_path ne $base_unit_path) {
+        foreach (glob("${unit_path}.d/*.conf")) {
+            parse_systemd_ini(\%unit_data, "$_")
+        }
+    }
     return %unit_data;
 }
 
@@ -423,7 +431,7 @@ sub compare_units { ## no critic(Subroutines::ProhibitExcessComplexity)
 # Called when a unit exists in both the old systemd and the new system and the units
 # differ. This figures out of what units are to be stopped, restarted, reloaded, started, and skipped.
 sub handle_modified_unit { ## no critic(Subroutines::ProhibitManyArgs, Subroutines::ProhibitExcessComplexity)
-    my ($unit, $base_name, $new_unit_file, $new_unit_info, $active_cur, $units_to_stop, $units_to_start, $units_to_reload, $units_to_restart, $units_to_skip) = @_;
+    my ($unit, $base_name, $new_unit_file, $new_base_unit_file, $new_unit_info, $active_cur, $units_to_stop, $units_to_start, $units_to_reload, $units_to_restart, $units_to_skip) = @_;
 
     if ($unit eq "sysinit.target" || $unit eq "basic.target" || $unit eq "multi-user.target" || $unit eq "graphical.target" || $unit =~ /\.path$/msx || $unit =~ /\.slice$/msx) {
         # Do nothing.  These cannot be restarted directly.
@@ -442,7 +450,7 @@ sub handle_modified_unit { ## no critic(Subroutines::ProhibitManyArgs, Subroutin
         # Revert of the attempt: https://github.com/NixOS/nixpkgs/pull/147609
         # More details: https://github.com/NixOS/nixpkgs/issues/74899#issuecomment-981142430
     } else {
-        my %new_unit_info = $new_unit_info ? %{$new_unit_info} : parse_unit($new_unit_file);
+        my %new_unit_info = $new_unit_info ? %{$new_unit_info} : parse_unit($new_unit_file, $new_base_unit_file);
         if (parse_systemd_bool(\%new_unit_info, "Service", "X-ReloadIfChanged", 0) and not $units_to_restart->{$unit} and not $units_to_stop->{$unit}) {
             $units_to_reload->{$unit} = 1;
             record_unit($reload_list_file, $unit);
@@ -538,31 +546,33 @@ my %units_to_filter; # units not shown
 
 my $active_cur = get_active_units();
 while (my ($unit, $state) = each(%{$active_cur})) {
-    my $base_unit = $unit;
+    my $cur_unit_file = "/etc/systemd/system/$unit";
+    my $new_unit_file = "$toplevel/etc/systemd/system/$unit";
 
-    my $cur_unit_file = "/etc/systemd/system/$base_unit";
-    my $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+    my $base_unit = $unit;
+    my $cur_base_unit_file = $cur_unit_file;
+    my $new_base_unit_file = $new_unit_file;
 
     # Detect template instances.
     if (!-e $cur_unit_file && !-e $new_unit_file && $unit =~ /^(.*)@[^\.]*\.(.*)$/msx) {
       $base_unit = "$1\@.$2";
-      $cur_unit_file = "/etc/systemd/system/$base_unit";
-      $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+      $cur_base_unit_file = "/etc/systemd/system/$base_unit";
+      $new_base_unit_file = "$toplevel/etc/systemd/system/$base_unit";
     }
 
     my $base_name = $base_unit;
     $base_name =~ s/\.[[:lower:]]*$//msx;
 
-    if (-e $cur_unit_file && ($state->{state} eq "active" || $state->{state} eq "activating")) {
-        if (! -e $new_unit_file || abs_path($new_unit_file) eq "/dev/null") {
-            my %cur_unit_info = parse_unit($cur_unit_file);
+    if (-e $cur_base_unit_file && ($state->{state} eq "active" || $state->{state} eq "activating")) {
+        if (! -e $new_base_unit_file || abs_path($new_base_unit_file) eq "/dev/null") {
+            my %cur_unit_info = parse_unit($cur_unit_file, $cur_base_unit_file);
             if (parse_systemd_bool(\%cur_unit_info, "Unit", "X-StopOnRemoval", 1)) {
                 $units_to_stop{$unit} = 1;
             }
         }
 
         elsif ($unit =~ /\.target$/msx) {
-            my %new_unit_info = parse_unit($new_unit_file);
+            my %new_unit_info = parse_unit($new_unit_file, $new_base_unit_file);
 
             # Cause all active target units to be restarted below.
             # This should start most changed units we stop here as
@@ -596,11 +606,11 @@ while (my ($unit, $state) = each(%{$active_cur})) {
         }
 
         else {
-            my %cur_unit_info = parse_unit($cur_unit_file);
-            my %new_unit_info = parse_unit($new_unit_file);
+            my %cur_unit_info = parse_unit($cur_unit_file, $cur_base_unit_file);
+            my %new_unit_info = parse_unit($new_unit_file, $new_base_unit_file);
             my $diff = compare_units(\%cur_unit_info, \%new_unit_info);
             if ($diff == 1) {
-                handle_modified_unit($unit, $base_name, $new_unit_file, \%new_unit_info, $active_cur, \%units_to_stop, \%units_to_start, \%units_to_reload, \%units_to_restart, \%units_to_skip);
+                handle_modified_unit($unit, $base_name, $new_unit_file, $new_base_unit_file, \%new_unit_info, $active_cur, \%units_to_stop, \%units_to_start, \%units_to_reload, \%units_to_restart, \%units_to_skip);
             } elsif ($diff == 2 and not $units_to_restart{$unit}) {
                 $units_to_reload{$unit} = 1;
                 record_unit($reload_list_file, $unit);
@@ -710,13 +720,14 @@ if ($action eq "dry-activate") {
     # Handle the activation script requesting the restart or reload of a unit.
     foreach (split(/\n/msx, read_file($dry_restart_by_activation_file, err_mode => "quiet") // "")) {
         my $unit = $_;
+        my $new_unit_file = "$toplevel/etc/systemd/system/$unit";
         my $base_unit = $unit;
-        my $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+        my $new_base_unit_file = $new_unit_file;
 
         # Detect template instances.
         if (!-e $new_unit_file && $unit =~ /^(.*)@[^\.]*\.(.*)$/msx) {
           $base_unit = "$1\@.$2";
-          $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+          $new_base_unit_file = "$toplevel/etc/systemd/system/$base_unit";
         }
 
         my $base_name = $base_unit;
@@ -728,7 +739,7 @@ if ($action eq "dry-activate") {
             next;
         }
 
-        handle_modified_unit($unit, $base_name, $new_unit_file, undef, $active_cur, \%units_to_restart, \%units_to_restart, \%units_to_reload, \%units_to_restart, \%units_to_skip);
+        handle_modified_unit($unit, $base_name, $new_unit_file, $new_base_unit_file, undef, $active_cur, \%units_to_restart, \%units_to_restart, \%units_to_reload, \%units_to_restart, \%units_to_skip);
     }
     unlink($dry_restart_by_activation_file);
 
@@ -782,13 +793,14 @@ system("$out/activate", "$out") == 0 or $res = 2;
 # Handle the activation script requesting the restart or reload of a unit.
 foreach (split(/\n/msx, read_file($restart_by_activation_file, err_mode => "quiet") // "")) {
     my $unit = $_;
+    my $new_unit_file = "$toplevel/etc/systemd/system/$unit";
     my $base_unit = $unit;
-    my $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+    my $new_base_unit_file = $new_unit_file;
 
     # Detect template instances.
     if (!-e $new_unit_file && $unit =~ /^(.*)@[^\.]*\.(.*)$/msx) {
       $base_unit = "$1\@.$2";
-      $new_unit_file = "$toplevel/etc/systemd/system/$base_unit";
+      $new_base_unit_file = "$toplevel/etc/systemd/system/$base_unit";
     }
 
     my $base_name = $base_unit;
@@ -801,7 +813,7 @@ foreach (split(/\n/msx, read_file($restart_by_activation_file, err_mode => "quie
         next;
     }
 
-    handle_modified_unit($unit, $base_name, $new_unit_file, undef, $active_cur, \%units_to_restart, \%units_to_restart, \%units_to_reload, \%units_to_restart, \%units_to_skip);
+    handle_modified_unit($unit, $base_name, $new_unit_file, $new_base_unit_file, undef, $active_cur, \%units_to_restart, \%units_to_restart, \%units_to_reload, \%units_to_restart, \%units_to_skip);
 }
 # We can remove the file now because it has been propagated to the other restart/reload files
 unlink($restart_by_activation_file);
@@ -859,7 +871,7 @@ if (scalar(keys(%units_to_reload)) > 0) {
     for my $unit (keys(%units_to_reload)) {
         if (!unit_is_active($unit)) {
             # Figure out if we need to start the unit
-            my %unit_info = parse_unit("$toplevel/etc/systemd/system/$unit");
+            my %unit_info = parse_unit("$toplevel/etc/systemd/system/$unit", "$toplevel/etc/systemd/system/$unit");
             if (!(parse_systemd_bool(\%unit_info, "Unit", "RefuseManualStart", 0) || parse_systemd_bool(\%unit_info, "Unit", "X-OnlyManualStart", 0))) {
                 $units_to_start{$unit} = 1;
                 record_unit($start_list_file, $unit);

nixos/tests/all-tests.nix

@@ -463,6 +463,7 @@ in {
   matrix-conduit = handleTest ./matrix/conduit.nix {};
   matrix-synapse = handleTest ./matrix/synapse.nix {};
   mattermost = handleTest ./mattermost.nix {};
+  mediamtx = handleTest ./mediamtx.nix {};
   mediatomb = handleTest ./mediatomb.nix {};
   mediawiki = handleTest ./mediawiki.nix {};
   meilisearch = handleTest ./meilisearch.nix {};

nixos/tests/mediamtx.nix

@@ -0,0 +1,57 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+{
+  name = "mediamtx";
+  meta.maintainers = with lib.maintainers; [ fpletz ];
+
+  nodes = {
+    machine = { config, ... }: {
+      services.mediamtx = {
+        enable = true;
+        settings = {
+          metrics = true;
+          paths.all.source = "publisher";
+        };
+      };
+
+      systemd.services.rtmp-publish = {
+        description = "Publish an RTMP stream to mediamtx";
+        after = [ "mediamtx.service" ];
+        bindsTo = [ "mediamtx.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "on-failure";
+          RestartSec = "1s";
+          TimeoutStartSec = "10s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -c libx264 -f flv rtmp://localhost:1935/test";
+        };
+      };
+
+      systemd.services.rtmp-receive = {
+        description = "Receive an RTMP stream from mediamtx";
+        after = [ "rtmp-publish.service" ];
+        bindsTo = [ "rtmp-publish.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "on-failure";
+          RestartSec = "1s";
+          TimeoutStartSec = "10s";
+          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -y -re -i rtmp://localhost:1935/test -f flv /dev/null";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("mediamtx.service")
+    machine.wait_for_unit("rtmp-publish.service")
+    machine.wait_for_unit("rtmp-receive.service")
+    machine.wait_for_open_port(9998)
+    machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"publish\".*1$'")
+    machine.succeed("curl http://localhost:9998/metrics | grep '^rtmp_conns.*state=\"read\".*1$'")
+  '';
+})

nixos/tests/switch-test.nix

@@ -1,6 +1,6 @@
 # Test configuration switching.
 
-import ./make-test-python.nix ({ pkgs, ...} : let
+import ./make-test-python.nix ({ lib, pkgs, ...} : let
 
   # Simple service that can either be socket-activated or that will
   # listen on port 1234 if not socket-activated.
@@ -279,6 +279,28 @@ in {
           systemd.services.test-service.unitConfig.RefuseManualStart = true;
         };
 
+        unitWithTemplate.configuration = {
+          systemd.services."instantiated@".serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.coreutils}/bin/true";
+            ExecReload = "${pkgs.coreutils}/bin/true";
+          };
+          systemd.services."instantiated@one" = {
+            wantedBy = [ "multi-user.target" ];
+            overrideStrategy = "asDropin";
+          };
+          systemd.services."instantiated@two" = {
+            wantedBy = [ "multi-user.target" ];
+            overrideStrategy = "asDropin";
+          };
+        };
+
+        unitWithTemplateModified.configuration = {
+          imports = [ unitWithTemplate.configuration ];
+          systemd.services."instantiated@".serviceConfig.X-Test = "test";
+        };
+
         restart-and-reload-by-activation-script.configuration = {
           systemd.services = rec {
             simple-service = {
@@ -290,29 +312,50 @@ in {
                 ExecReload = "${pkgs.coreutils}/bin/true";
               };
             };
+            "templated-simple-service@" = simple-service;
+            "templated-simple-service@instance".overrideStrategy = "asDropin";
 
             simple-restart-service = simple-service // {
               stopIfChanged = false;
             };
+            "templated-simple-restart-service@" = simple-restart-service;
+            "templated-simple-restart-service@instance".overrideStrategy = "asDropin";
 
             simple-reload-service = simple-service // {
               reloadIfChanged = true;
             };
+            "templated-simple-reload-service@" = simple-reload-service;
+            "templated-simple-reload-service@instance".overrideStrategy = "asDropin";
 
             no-restart-service = simple-service // {
               restartIfChanged = false;
             };
+            "templated-no-restart-service@" = no-restart-service;
+            "templated-no-restart-service@instance".overrideStrategy = "asDropin";
 
             reload-triggers = simple-service // {
               wantedBy = [ "multi-user.target" ];
             };
+            "templated-reload-triggers@" = simple-service;
+            "templated-reload-triggers@instance" = {
+              overrideStrategy = "asDropin";
+              wantedBy = [ "multi-user.target" ];
+            };
 
             reload-triggers-and-restart-by-as = simple-service;
+            "templated-reload-triggers-and-restart-by-as@" = reload-triggers-and-restart-by-as;
+            "templated-reload-triggers-and-restart-by-as@instance".overrideStrategy = "asDropin";
 
             reload-triggers-and-restart = simple-service // {
               stopIfChanged = false; # easier to check for this
               wantedBy = [ "multi-user.target" ];
             };
+            "templated-reload-triggers-and-restart@" = simple-service;
+            "templated-reload-triggers-and-restart@instance" = {
+              overrideStrategy = "asDropin";
+              stopIfChanged = false; # easier to check for this
+              wantedBy = [ "multi-user.target" ];
+            };
           };
 
           system.activationScripts.restart-and-reload-test = {
@@ -332,12 +375,20 @@ in {
               simple-reload-service.service
               no-restart-service.service
               reload-triggers-and-restart-by-as.service
+              templated-simple-service@instance.service
+              templated-simple-restart-service@instance.service
+              templated-simple-reload-service@instance.service
+              templated-no-restart-service@instance.service
+              templated-reload-triggers-and-restart-by-as@instance.service
               EOF
 
               cat <<EOF >> "$g"
               reload-triggers.service
               reload-triggers-and-restart-by-as.service
               reload-triggers-and-restart.service
+              templated-reload-triggers@instance.service
+              templated-reload-triggers-and-restart-by-as@instance.service
+              templated-reload-triggers-and-restart@instance.service
               EOF
             '';
           };
@@ -346,6 +397,10 @@ in {
         restart-and-reload-by-activation-script-modified.configuration = {
           imports = [ restart-and-reload-by-activation-script.configuration ];
           systemd.services.reload-triggers-and-restart.serviceConfig.X-Modified = "test";
+          systemd.services."templated-reload-triggers-and-restart@instance" = {
+            overrideStrategy = "asDropin";
+            serviceConfig.X-Modified = "test";
+          };
         };
 
         simple-socket.configuration = {
@@ -507,6 +562,10 @@ in {
       set -o pipefail
       exec env -i "$@" | tee /dev/stderr
     '';
+
+    # Returns a comma separated representation of the given list in sorted
+    # order, that matches the output format of switch-to-configuration.pl
+    sortedUnits = xs: lib.concatStringsSep ", " (builtins.sort builtins.lessThan xs);
   in /* python */ ''
     def switch_to_specialisation(system, name, action="test", fail=False):
         if name == "":
@@ -733,6 +792,16 @@ in {
         assert_contains(out, "\nstarting the following units: required-service.service\n")
         assert_lacks(out, "the following new units were started:")
 
+        # Ensure templated units are restarted when the base unit changes
+        switch_to_specialisation("${machine}", "unitWithTemplate")
+        out = switch_to_specialisation("${machine}", "unitWithTemplateModified")
+        assert_contains(out, "stopping the following units: instantiated@one.service, instantiated@two.service\n")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_contains(out, "\nstarting the following units: instantiated@one.service, instantiated@two.service\n")
+        assert_lacks(out, "the following new units were started:")
+
     with subtest("failing units"):
         # Let the simple service fail
         switch_to_specialisation("${machine}", "simpleServiceModified")
@@ -896,15 +965,62 @@ in {
         assert_lacks(out, "NOT restarting the following changed units:")
         assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "restarting the following units:")
-        assert_contains(out, "\nstarting the following units: no-restart-service.service, reload-triggers-and-restart-by-as.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
-        assert_contains(out, "the following new units were started: no-restart-service.service, reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, reload-triggers.service, simple-reload-service.service, simple-restart-service.service, simple-service.service\n")
+        assert_contains(out, "\nstarting the following units: ${sortedUnits [
+          "no-restart-service.service"
+          "reload-triggers-and-restart-by-as.service"
+          "simple-reload-service.service"
+          "simple-restart-service.service"
+          "simple-service.service"
+          "templated-no-restart-service@instance.service"
+          "templated-reload-triggers-and-restart-by-as@instance.service"
+          "templated-simple-reload-service@instance.service"
+          "templated-simple-restart-service@instance.service"
+          "templated-simple-service@instance.service"
+        ]}\n")
+        assert_contains(out, "the following new units were started: ${sortedUnits [
+          "no-restart-service.service"
+          "reload-triggers-and-restart-by-as.service"
+          "reload-triggers-and-restart.service"
+          "reload-triggers.service"
+          "simple-reload-service.service"
+          "simple-restart-service.service"
+          "simple-service.service"
+          "system-templated\\\\x2dno\\\\x2drestart\\\\x2dservice.slice"
+          "system-templated\\\\x2dreload\\\\x2dtriggers.slice"
+          "system-templated\\\\x2dreload\\\\x2dtriggers\\\\x2dand\\\\x2drestart.slice"
+          "system-templated\\\\x2dreload\\\\x2dtriggers\\\\x2dand\\\\x2drestart\\\\x2dby\\\\x2das.slice"
+          "system-templated\\\\x2dsimple\\\\x2dreload\\\\x2dservice.slice"
+          "system-templated\\\\x2dsimple\\\\x2drestart\\\\x2dservice.slice"
+          "system-templated\\\\x2dsimple\\\\x2dservice.slice"
+          "templated-no-restart-service@instance.service"
+          "templated-reload-triggers-and-restart-by-as@instance.service"
+          "templated-reload-triggers-and-restart@instance.service"
+          "templated-reload-triggers@instance.service"
+          "templated-simple-reload-service@instance.service"
+          "templated-simple-restart-service@instance.service"
+          "templated-simple-service@instance.service"
+        ]}\n")
         # Switch to the same system where the example services get restarted
         # and reloaded by the activation script
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: reload-triggers-and-restart.service, reload-triggers.service, simple-reload-service.service\n")
-        assert_contains(out, "restarting the following units: reload-triggers-and-restart-by-as.service, simple-restart-service.service, simple-service.service\n")
+        assert_contains(out, "reloading the following units: ${sortedUnits [
+          "reload-triggers-and-restart.service"
+          "reload-triggers.service"
+          "simple-reload-service.service"
+          "templated-reload-triggers-and-restart@instance.service"
+          "templated-reload-triggers@instance.service"
+          "templated-simple-reload-service@instance.service"
+        ]}\n")
+        assert_contains(out, "restarting the following units: ${sortedUnits [
+          "reload-triggers-and-restart-by-as.service"
+          "simple-restart-service.service"
+          "simple-service.service"
+          "templated-reload-triggers-and-restart-by-as@instance.service"
+          "templated-simple-restart-service@instance.service"
+          "templated-simple-service@instance.service"
+        ]}\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
         # Switch to the same system and see if the service gets restarted when it's modified
@@ -912,16 +1028,44 @@ in {
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script-modified")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: reload-triggers.service, simple-reload-service.service\n")
-        assert_contains(out, "restarting the following units: reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, simple-restart-service.service, simple-service.service\n")
+        assert_contains(out, "reloading the following units: ${sortedUnits [
+          "reload-triggers.service"
+          "simple-reload-service.service"
+          "templated-reload-triggers@instance.service"
+          "templated-simple-reload-service@instance.service"
+        ]}\n")
+        assert_contains(out, "restarting the following units: ${sortedUnits [
+          "reload-triggers-and-restart-by-as.service"
+          "reload-triggers-and-restart.service"
+          "simple-restart-service.service"
+          "simple-service.service"
+          "templated-reload-triggers-and-restart-by-as@instance.service"
+          "templated-reload-triggers-and-restart@instance.service"
+          "templated-simple-restart-service@instance.service"
+          "templated-simple-service@instance.service"
+        ]}\n")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
         # The same, but in dry mode
         out = switch_to_specialisation("${machine}", "restart-and-reload-by-activation-script", action="dry-activate")
         assert_lacks(out, "would stop the following units:")
         assert_lacks(out, "would NOT stop the following changed units:")
-        assert_contains(out, "would reload the following units: reload-triggers.service, simple-reload-service.service\n")
-        assert_contains(out, "would restart the following units: reload-triggers-and-restart-by-as.service, reload-triggers-and-restart.service, simple-restart-service.service, simple-service.service\n")
+        assert_contains(out, "would reload the following units: ${sortedUnits [
+          "reload-triggers.service"
+          "simple-reload-service.service"
+          "templated-reload-triggers@instance.service"
+          "templated-simple-reload-service@instance.service"
+        ]}\n")
+        assert_contains(out, "would restart the following units: ${sortedUnits [
+          "reload-triggers-and-restart-by-as.service"
+          "reload-triggers-and-restart.service"
+          "simple-restart-service.service"
+          "simple-service.service"
+          "templated-reload-triggers-and-restart-by-as@instance.service"
+          "templated-reload-triggers-and-restart@instance.service"
+          "templated-simple-restart-service@instance.service"
+          "templated-simple-service@instance.service"
+        ]}\n")
         assert_lacks(out, "\nwould start the following units:")
 
     with subtest("socket-activated services"):

pkgs/applications/audio/jamesdsp/default.nix

@@ -1,34 +1,34 @@
-{ stdenv
-, lib
+{ copyDesktopItems
 , fetchFromGitHub
-, pipewire
-, pulseaudio
-, gst_all_1
 , glibmm
+, gst_all_1
+, lib
+, libarchive
+, makeDesktopItem
+, pipewire
+, pkg-config
+, pulseaudio
 , qmake
 , qtbase
 , qtsvg
-, wrapQtAppsHook
-, makeDesktopItem
-, pkg-config
-, libarchive
-, copyDesktopItems
+, stdenv
 , usePipewire ? true
 , usePulseaudio ? false
+, wrapQtAppsHook
 }:
 
 assert lib.asserts.assertMsg (usePipewire != usePulseaudio) "You need to enable one and only one of pulseaudio or pipewire support";
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jamesdsp";
-  version = "2.6.0";
+  version = "2.6.1";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "Audio4Linux";
     repo = "JDSP4Linux";
     fetchSubmodules = true;
-    rev = version;
-    hash = "sha256-pogBpmGlqQnkXMdp5HbMYISjwMJalSPvEV9MDHj8aec=";
+    rev = finalAttrs.version;
+    hash = "sha256-XYJl94/PstWG5qaBQ2rXc/nG9bDeP3Q62zDYHmZvPaw=";
   };
 
   nativeBuildInputs = [
@@ -43,15 +43,16 @@ stdenv.mkDerivation rec {
     libarchive
     qtbase
     qtsvg
-  ] ++ lib.optional usePipewire pipewire
-  ++ lib.optionals usePulseaudio [
+  ] ++ lib.optionals usePipewire [
+    pipewire
+  ] ++ lib.optionals usePulseaudio [
     pulseaudio
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
     gst_all_1.gstreamer
   ];
 
-  preFixup = lib.optionals usePulseaudio ''
+  preFixup = lib.optionalString usePulseaudio ''
     qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
@@ -76,12 +77,12 @@ stdenv.mkDerivation rec {
     install -D resources/icons/icon.svg $out/share/icons/hicolor/scalable/apps/jamesdsp.svg
   '';
 
-  meta = with lib;{
+  meta = {
     broken = (stdenv.isLinux && stdenv.isAarch64);
     description = "An audio effect processor for PipeWire clients";
     homepage = "https://github.com/Audio4Linux/JDSP4Linux";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ pasqui23 rewine ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ pasqui23 rewine ];
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/applications/audio/musescore/default.nix

@@ -64,6 +64,18 @@ in stdenv'.mkDerivation rec {
       url = "https://github.com/doronbehar/MuseScore/commit/f48448a3ede46f5a7ef470940072fbfb6742487c.patch";
       hash = "sha256-UEc7auscnW0KMfWkLKQtm+UstuTNsuFeoNJYIidIlwM=";
     })
+    # Upstream removed the option to use system freetype library in v4.1.0,
+    # causing the app to crash on systems when the outdated bundled freetype
+    # tries to load the Noto Sans font. For more info on the crash itself,
+    # see #244409 and https://github.com/musescore/MuseScore/issues/18795.
+    # For now, re-add the option ourselves. The fix has been merged upstream,
+    # so we can remove this patch with the next version. In the future, we
+    # may replace the other bundled thirdparty libs with system libs, see
+    # https://github.com/musescore/MuseScore/issues/11572.
+    (fetchpatch {
+      url = "https://github.com/musescore/MuseScore/commit/9ab6b32b1c3b990cfa7bb172ee8112521dc2269c.patch";
+      hash = "sha256-5GA29Z+o3I/uDTTDbkauZ8/xSdCE6yY93phMSY0ea7s=";
+    })
   ];
 
   cmakeFlags = [
@@ -73,7 +85,7 @@ in stdenv'.mkDerivation rec {
     # https://github.com/musescore/MuseScore/issues/15571
     "-DMUE_BUILD_CRASHPAD_CLIENT=OFF"
     # Use our freetype
-    "-DUSE_SYSTEM_FREETYPE=ON"
+    "-DMUE_COMPILE_USE_SYSTEM_FREETYPE=ON"
     # From some reason, in $src/build/cmake/SetupBuildEnvironment.cmake,
     # upstream defaults to compiling to x86_64 only, unless this cmake flag is
     # set
@@ -141,6 +153,9 @@ in stdenv'.mkDerivation rec {
     ln -s $out/Applications/mscore.app/Contents/MacOS/mscore $out/bin/mscore.
   '';
 
+  # Don't run bundled upstreams tests, as they require a running X window system.
+  doCheck = false;
+
   passthru.tests = nixosTests.musescore;
 
   meta = with lib; {

pkgs/applications/misc/syncthingtray/default.nix

@@ -30,14 +30,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 mkDerivation rec {
-  version = "1.4.4";
+  version = "1.4.5";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${version}";
-    sha256 = "sha256-i13Mt4xASneE4sBIt9fbdoFV1KnoVfaGRwQXX+1NgI4=";
+    sha256 = "sha256-EizKDw5Fv2qXxmiCx4NAvwxBZ+qhTIx4NMZedZ9OuyA=";
   };
 
   buildInputs = [

pkgs/applications/networking/cluster/click/default.nix

@@ -1,19 +1,22 @@
-{ darwin, fetchFromGitHub, rustPlatform, lib, stdenv }:
+{ darwin, fetchFromGitHub, rustPlatform, lib, stdenv, pkg-config, openssl }:
 
 rustPlatform.buildRustPackage rec {
   pname = "click";
-  version = "0.4.2";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
-    rev = "v${version}";
     owner = "databricks";
     repo = "click";
-    sha256 = "18mpzvvww2g6y2d3m8wcfajzdshagihn59k03xvcknd5d8zxagl3";
+    rev = "v${version}";
+    hash = "sha256-rwS08miRpc+Q9DRuspr21NMYpEYmmscvzarDnjyVe5c=";
   };
 
-  cargoSha256 = "16r5rwdbqyb5xrjc55i30xb20crpyjc75zn10xxjkicmvrpwydp6";
+  cargoHash = "sha256-WNITVYTS7JWrBBwxlQuVTmLddWLbDJACizEsRiustGg=";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
+
+  buildInputs = lib.optionals stdenv.isLinux [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
   meta = with lib; {
     description = ''The "Command Line Interactive Controller for Kubernetes"'';
@@ -21,5 +24,6 @@ rustPlatform.buildRustPackage rec {
     license = [ licenses.asl20 ];
     maintainers = [ maintainers.mbode ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    mainProgram = "click";
   };
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -291,13 +291,13 @@
     "vendorHash": "sha256-foS7GyRUdhF/M8uTPf2I4WQo7qEg4Z/3FXjagoeSRkU="
   },
   "dexidp": {
-    "hash": "sha256-+Nt4bX6+4VB+mtJbsP166RObFbXaNyFrF+80x2/pRco=",
+    "hash": "sha256-69r3m3lIKftZQ8NXBD5KEHbsNUwCGpFgn/CYO+921M4=",
     "homepage": "https://registry.terraform.io/providers/marcofranssen/dexidp",
     "owner": "marcofranssen",
     "repo": "terraform-provider-dexidp",
-    "rev": "v0.2.1",
+    "rev": "v0.3.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-L8baV03p0V/xKi1O3YQxvoJXgP21qNhzznyvwrauVqI="
+    "vendorHash": "sha256-EWEc7tILolAIzT7ZOLXlrlrt3hsgJxFD89y/USLeE40="
   },
   "dhall": {
     "hash": "sha256-K0j90YAzYqdyJD4aofyxAJF9QBYNMbhSVm/s1GvWuJ4=",
@@ -454,24 +454,24 @@
     "vendorHash": "sha256-AVTWTS16d8QsPLLAJeAfgcVDzUBMp+b2oAphaCBqhS0="
   },
   "google": {
-    "hash": "sha256-vhWtIJ5hKe/8a7N5Qxs8CQuSNlZEF3gdRzSqZiFqhVg=",
+    "hash": "sha256-11iT/zjoSScSdLGWFPxEURiIBvcz5jK8QZAHdqRwHD0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.77.0",
+    "rev": "v4.78.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rlNYh42Cw2wMF/9aI8QM0x8t2jdz+V9u4uJvS6A4zx8="
+    "vendorHash": "sha256-lyOupw64LQvdTJZjJ1RvAn1JLDHAZ4qAaagASXHcEXA="
   },
   "google-beta": {
-    "hash": "sha256-nfgoGYBAW5VdgMm2gkI2Ff5NlY2CAwuFjckN7xgGtcI=",
+    "hash": "sha256-dKB9rdMZP+Ln3M9bL7MC6RGlDXZ/IydD4g5Jp1jjEh4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.77.0",
+    "rev": "v4.78.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rlNYh42Cw2wMF/9aI8QM0x8t2jdz+V9u4uJvS6A4zx8="
+    "vendorHash": "sha256-lyOupw64LQvdTJZjJ1RvAn1JLDHAZ4qAaagASXHcEXA="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -556,11 +556,11 @@
     "vendorHash": "sha256-hxT9mpKifb63wlCUeUzgVo4UB2TnYZy9lXF4fmGYpc4="
   },
   "huaweicloud": {
-    "hash": "sha256-Uon1nXtoILFOQp9DsOubi31v6WJqWBa3zDZKHJdboHY=",
+    "hash": "sha256-zfYIhROmNEXUmO52zs1u6X4WXFtE+duuiS6wlSBLygw=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.53.0",
+    "rev": "v1.54.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/flexget/default.nix

@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.8.6";
+  version = "3.8.7";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KF5d9SjKUkkHoYWmNWNBMe567w2StgEFsZprS+SFw7Y=";
+    hash = "sha256-WfOLDTwmHPfg4UkrPC7gvDNJtAorrateQ4W59NmhdHc=";
   };
 
   postPatch = ''

pkgs/applications/virtualization/podman/default.nix

@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-8cfEZBYhR5CWkHEpIZ0j011gyV6lnY7z4KgJPJr0MfQ=";
+    hash = "sha256-bGhLjf4GZpuWX1xOC4Hm9SkYvUJ45ZipcKAIEJF0tDQ=";
   };
 
   patches = [

pkgs/development/ocaml-modules/linol/default.nix

@@ -16,7 +16,10 @@ rec {
     sha256 = "sha256-51k+Eo3buzby9cWtbl+/0wbAxa2QSS+Oq0aEao0VBCM=";
   };
 
-  propagatedBuildInputs = [ yojson logs lsp ppx_yojson_conv_lib ];
+  lsp_v = lsp.override {
+    version = "1.14.2";
+  };
+  propagatedBuildInputs = [ yojson logs lsp_v ppx_yojson_conv_lib ];
 
   meta = with lib; {
     description = "LSP server library";

pkgs/development/ocaml-modules/ocaml-lsp/default.nix

@@ -1,4 +1,16 @@
-{ lib, buildDunePackage, lsp, xdg, re, fiber, makeWrapper, dot-merlin-reader, spawn, ocamlc-loc }:
+{ lib
+, buildDunePackage
+, lsp
+, xdg
+, re
+, fiber
+, makeWrapper
+, dot-merlin-reader
+, spawn
+, ocamlc-loc
+, odoc-parser
+, merlin-lib
+}:
 
 buildDunePackage rec {
   pname = "ocaml-lsp-server";
@@ -8,7 +20,8 @@ buildDunePackage rec {
   buildInputs = lsp.buildInputs ++ [ lsp re ]
   ++ lib.optional (lib.versionAtLeast version "1.9") spawn
   ++ lib.optionals (lib.versionAtLeast version "1.10") [ fiber xdg ]
-  ++ lib.optional (lib.versionAtLeast version "1.14.2") ocamlc-loc;
+  ++ lib.optional (lib.versionAtLeast version "1.14.2") ocamlc-loc
+  ++ lib.optional (lib.versionAtLeast version "1.16.2") [ odoc-parser merlin-lib ];
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix

@@ -7,41 +7,55 @@
 , fetchurl
 , lib
 , ocaml
+, version ?
+    if lib.versionAtLeast ocaml.version "4.14" then
+      "1.16.2"
+    else if lib.versionAtLeast ocaml.version "4.13" then
+      "1.10.5"
+    else if lib.versionAtLeast ocaml.version "4.12" then
+      "1.9.0"
+    else
+      "1.4.1"
 }:
 
-let params =
-  if lib.versionAtLeast ocaml.version "4.14"
-  then {
+let params = {
+  "1.16.2" = {
     name = "lsp";
-    version = "1.14.2";
+    minimalOCamlVersion = "4.14";
+    sha256 = "sha256-FIfVpOLy1PAjNBBYVRvbi6hsIzZ7fFtP3aOqfcAqrsQ=";
+  };
+  "1.14.2" = {
+    name = "lsp";
+    minimalOCamlVersion = "4.14";
     sha256 = "sha256-1R+HYaGbPLGDs5DMN3jmnrZFMhMmPUHgF+s+yNzIVJQ=";
-  } else if lib.versionAtLeast ocaml.version "4.13"
-  then {
+  };
+  "1.10.5" = {
     name = "jsonrpc";
-    version = "1.10.5";
+    minimalOCamlVersion = "4.13";
     sha256 = "sha256-TeJS6t1ruWhWPvWNatrnSUWI6T17XKiosHLYizBDDcw=";
-  } else if lib.versionAtLeast ocaml.version "4.12"
-  then {
+  };
+  "1.9.0" = {
     name = "jsonrpc";
-    version = "1.9.0";
+    minimalOCamlVersion = "4.12";
     sha256 = "sha256:1ac44n6g3rf84gvhcca545avgf9vpkwkkkm0s8ipshfhp4g4jikh";
-  } else {
+  };
+  "1.4.1" = {
     name = "jsonrpc";
-    version = "1.4.1";
+    minimalOCamlVersion = "4.06";
     sha256 = "1ssyazc0yrdng98cypwa9m3nzfisdzpp7hqnx684rqj8f0g3gs6f";
-  }
-; in
+  };
+}."${version}"; in
 
 buildDunePackage rec {
   pname = "jsonrpc";
-  inherit (params) version;
+  inherit version;
   src = fetchurl {
     url = "https://github.com/ocaml/ocaml-lsp/releases/download/${version}/${params.name}-${version}.tbz";
     inherit (params) sha256;
   };
 
   duneVersion = "3";
-  minimalOCamlVersion = "4.06";
+  inherit (params) minimalOCamlVersion;
 
   buildInputs =
     if lib.versionAtLeast version "1.7.0" then

pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix

@@ -21,11 +21,24 @@
 , cmdliner
 , ordering
 , ocamlformat-rpc-lib
+, ocaml
+, version ?
+    if lib.versionAtLeast ocaml.version "4.14" then
+      "1.16.2"
+    else if lib.versionAtLeast ocaml.version "4.13" then
+      "1.10.5"
+    else if lib.versionAtLeast ocaml.version "4.12" then
+      "1.9.0"
+    else
+      "1.4.1"
 }:
 
+let jsonrpc_v = jsonrpc.override {
+  inherit version;
+}; in
 buildDunePackage rec {
   pname = "lsp";
-  inherit (jsonrpc) version src;
+  inherit (jsonrpc_v) version src;
   duneVersion = "3";
   minimalOCamlVersion =
     if lib.versionAtLeast version "1.7.0" then

pkgs/development/python-modules/ailment/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.63";
+  version = "9.2.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Hg8KSReRHOmdoN8CZiX8i8Xdrn5/Gnqmx1QE6elV6qA=";
+    hash = "sha256-KUJpcP7bf8BjmB/QojTQHSwkmzW0bN4nJaD8GcNbcyE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aiohomekit/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.6.15";
+  version = "2.6.16";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-PX2OIgfVOlCEudObJrz/WRQXW7c6Gq9PQqD52D3lmmo=";
+    hash = "sha256-2QnM5WJ0UyuRyL6NiXz22SLUMvyNfbdNIutJSNjS+G8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/altair/default.nix

@@ -11,9 +11,10 @@
 , typing-extensions
 , pandas
 , jinja2
-, importlib-metadata
+, packaging
 
 # Build, dev and test dependencies
+, anywidget
 , ipython
 , pytestCheckHook
 , vega_datasets
@@ -22,15 +23,17 @@
 
 buildPythonPackage rec {
   pname = "altair";
-  version = "5.0.1";
+  # current version, 5.0.1, is broken with jsonschema>=4.18
+  # we use unstable version instead of patch due to many changes
+  version = "unstable-2023-08-12";
   format = "pyproject";
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "altair-viz";
     repo = "altair";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-7bTrfryu4oaodVGNFNlVk9vXmDA5/9ahvCmvUGzZ5OQ=";
+    rev = "56b3b66daae7160c8d82777d2646131afcc3dab4";
+    hash = "sha256-uVE3Bth1D1mIhaULB4IxEtOzhQd51Pscqyfdys65F6A=";
   };
 
   nativeBuildInputs = [
@@ -41,12 +44,13 @@ buildPythonPackage rec {
     jinja2
     jsonschema
     numpy
+    packaging
     pandas
     toolz
-  ] ++ lib.optional (pythonOlder "3.8") importlib-metadata
-    ++ lib.optional (pythonOlder "3.11") typing-extensions;
+  ] ++ lib.optional (pythonOlder "3.11") typing-extensions;
 
   nativeCheckInputs = [
+    anywidget
     ipython
     sphinx
     vega_datasets
@@ -62,6 +66,8 @@ buildPythonPackage rec {
     "tests/vegalite/v5/test_api.py"
     # avoid updating files and dependency on black
     "tests/test_toplevel.py"
+    # require vl-convert package
+    "tests/utils/test_compiler.py"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/angr/default.nix

@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.63";
+  version = "9.2.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vrcziVoH+P0cqnzalwZOyu7awidQ0Lv6vT6Uq9Pu4I0=";
+    hash = "sha256-NQopPg7ZAKkbq6T/1U8VYT/9oRz9ssg5yqTBpInNHNk=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/anywidget/default.nix

@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, hatch-jupyter-builder
+, hatchling
+, importlib-metadata
+, ipywidgets
+, jupyterlab
+, psygnal
+, typing-extensions
+, watchfiles
+}:
+
+buildPythonPackage rec {
+  pname = "anywidget";
+  version = "0.6.3";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-OUKxmYceEKURJeQTVI7oLT4SdZM90V7BoZf0UykkEV4=";
+  };
+
+  nativeBuildInputs = [
+    hatch-jupyter-builder
+    hatchling
+    jupyterlab
+  ];
+
+  propagatedBuildInputs = [
+    ipywidgets
+    psygnal
+    typing-extensions
+  ] ++ lib.optional (pythonOlder "3.8") importlib-metadata;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    watchfiles
+  ];
+
+  pythonImportsCheck = [ "anywidget" ];
+
+  meta = with lib; {
+    description = "Custom jupyter widgets made easy";
+    homepage = "https://github.com/manzt/anywidget";
+    changelog = "https://github.com/manzt/anywidget/releases/tag/anywidget%40${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}

pkgs/development/python-modules/archinfo/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.63";
+  version = "9.2.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-10ocfA1JFHyZA8Uv5b209rOjY5OeBtKITnoiRaw/w7k=";
+    hash = "sha256-/3dc0p6xDFvv8VwFi5hxiXveiWYr9w3s0PwMv3uV2yw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/azure-eventhub/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "azure-eventhub";
-  version = "5.11.3";
+  version = "5.11.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-mXXMvKHk+U+VtBG5zPbKJcXrRMDssnU/18wGXT5xSK8=";
+    hash = "sha256-aLiaNRUEDxF2+bSWxMdtOBwQd3mu13V8u7mj2r4wqCM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/azure-synapse-artifacts/default.nix

@@ -1,29 +1,39 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
 , azure-common
 , azure-core
+, azure-mgmt-core
 , msrest
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "azure-synapse-artifacts";
-  version = "0.16.0";
+  version = "0.17.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-J96cBqCCajK34M7v+2h6t2ptm7QwmfQt25674Q4Nr94=";
+    hash = "sha256-58k8F/aUBBNJwGBiPZojkSzEXZ3Kd6uEwr0cZbFaM9k=";
   };
 
   propagatedBuildInputs = [
     azure-common
     azure-core
+    azure-mgmt-core
     msrest
   ];
 
   # zero tests run
   doCheck = false;
 
-  pythonImportsCheck = [ "azure.synapse.artifacts" ];
+  pythonImportsCheck = [
+    "azure.synapse.artifacts"
+  ];
 
   meta = with lib; {
     description = "Microsoft Azure Synapse Artifacts Client Library for Python";

pkgs/development/python-modules/claripy/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.63";
+  version = "9.2.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-p5fJ5+YFQIs397eVFxtMMJj/FwfH97CY1HjFJqPVVc0=";
+    hash = "sha256-vx4wFZdycXow/t2LT4t1kO81JPvsB1mQF1GWgYRZiWs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/cle/default.nix

@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.63";
+  version = "9.2.64";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rCopCv7CPx04MYW1HkP0RP4NRZZlKtD4D8854FqIu10=";
+    hash = "sha256-wF3T8Kr09jqe4b/qctKXzFAnaTTtOkceHEoEN8J0mTs=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/dask/default.nix

@@ -38,7 +38,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2023.7.1";
+  version = "2023.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-1KnvIMEWT1MwlvkdgH10xk+lGSsGWJMLBonTtWwKjog=";
+    hash = "sha256-ZKjfxTJCu3EUOKz16+VP8+cPqQliFNc7AU1FPC1gOXw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/dbus-fast/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "1.90.1";
+  version = "1.91.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-B+NW7ORKIBtjxeR0W0tX7V1MgBtNoyGFX35TXUl7rVE=";
+    hash = "sha256-5f9mnNdUgPTk30V2mrYpSvYMqss40DiLEVGzYevlrag=";
   };
 
   # The project can build both an optimized cython version and an unoptimized

pkgs/development/python-modules/distributed/default.nix

@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2023.4.1";
+  version = "2023.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-KCgftu3i8N0WSelHiqWqa1vLN5gUtleftSUx1Zu4nZg=";
+    hash = "sha256-FvNh7gfxUR1iIUY3kMolhzcbWupQL39E9JXWip8bdrQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/django-extensions/default.nix

@@ -5,6 +5,7 @@
 , django
 , factory_boy
 , mock
+, pip
 , pygments
 , pytest-django
 , pytestCheckHook
@@ -46,6 +47,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     factory_boy
     mock
+    pip
     pygments # not explicitly declared in setup.py, but some tests require it
     pytest-django
     pytestCheckHook

pkgs/development/python-modules/doc8/default.nix

@@ -2,6 +2,7 @@
 , buildPythonPackage
 , chardet
 , docutils
+, fetchpatch
 , fetchPypi
 , pbr
 , pygments
@@ -10,6 +11,7 @@
 , restructuredtext_lint
 , setuptools-scm
 , stevedore
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -24,8 +26,18 @@ buildPythonPackage rec {
     hash = "sha256-2XqT6PWi78RxOggEZX3trYN0XMpM0diN6Rhvd/l3YAQ=";
   };
 
+  patches = [
+    # https://github.com/PyCQA/doc8/pull/146
+    (fetchpatch {
+      name = "remove-setuptools-scm-git-archive.patch";
+      url = "https://github.com/PyCQA/doc8/commit/06416e95041db92e4295b13ab596351618f6b32e.patch";
+      hash = "sha256-IIE3cDNOx+6RLjidGrokyazaX7MOVbMKUb7yQIM5sI0=";
+    })
+  ];
+
   nativeBuildInputs = [
     setuptools-scm
+    wheel
   ];
 
   buildInputs = [

pkgs/development/python-modules/dvc-data/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.13.1";
+  version = "2.14.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-RmUwo7NcbDjRf+sVgthno+ZvxXhMDwmoTfiN7cJM/5s=";
+    hash = "sha256-tXUGQI3TwBEHW+wxNn14zUx6PhzAwe5NX+78JIdTI5c=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dvc-objects/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "0.25.0";
+  version = "1.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-RzVvF9fv2VtSWzhD3+TJ3I2WKSu016+MlfnFEFj3YxQ=";
+    hash = "sha256-9R1fhRwGYkwykiTnddjIJHmJxMcpwS+a9hgqBzFyJeM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/dvc/default.nix

@@ -55,14 +55,14 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.15.2";
+  version = "3.15.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-dp4WovmiSHgjk48aq4BjEed80XFHgd61BkRQbYgxp0A=";
+    hash = "sha256-ceN8wgQRiwz3R98iPH+cJXqPTTxlBgnSGkpuVgWLvwY=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/dvclive/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "2.13.1";
+  version = "2.14.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-g2pRr8a+Rp2zIoB+Mmrb99nfbhrEQKTmJ6lfOOqiCrs=";
+    hash = "sha256-aFES2+ZpbrVoMbIOW73ec1HD/tKhKTiZ0tAIV5vx/OQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/etils/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "etils";
-  version = "1.1.0";
+  version = "1.4.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eipJUHeaKB70x+WVriFZkLFcHYxviwonhQCSr1rSxkE=";
+    hash = "sha256-Uxk7V7KP8UxO4rJ/yh0JxME1bOuTJLQW6dnC7vX239s=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/fastparquet/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "fastparquet";
-  version = "2023.4.0";
+  version = "2023.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    hash = "sha256-1hWiwXjTgflQlmy0Dk2phUa1cgYBvvH99tb0TdUmDRI=";
+    hash = "sha256-pJ0zK0upEV7TyuNMIcozugkwBlYpK/Dg6BdB0kBpn9k=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/flask-marshmallow/default.nix

@@ -1,24 +1,55 @@
-{ lib, buildPythonPackage, fetchPypi,
-  flask, six, marshmallow
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, flask
+, marshmallow
+, packaging
+, pytestCheckHook
+, flask-sqlalchemy
+, marshmallow-sqlalchemy
 }:
 
 buildPythonPackage rec {
   pname = "flask-marshmallow";
-  version = "0.14.0";
+  version = "0.15.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "marshmallow-code";
+    repo = "flask-marshmallow";
+    rev = "refs/tags/${version}";
+    hash = "sha256-N21M/MzcvOaDh5BgbbZtNcpRAULtWGLTMberCfOUoEM=";
+  };
+
+  propagatedBuildInputs = [
+    flask
+    marshmallow
+    packaging
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.sqlalchemy;
+
+  pythonImportsCheck = [
+    "flask_marshmallow"
+  ];
+
+  passthru.optional-dependencies = {
+    sqlalchemy = [
+      flask-sqlalchemy
+      marshmallow-sqlalchemy
+    ];
+  };
 
   meta = {
-    homepage = "https://github.com/marshmallow-code/flask-marshmallow";
     description = "Flask + marshmallow for beautiful APIs";
+    homepage = "https://github.com/marshmallow-code/flask-marshmallow";
+    changelog = "https://github.com/marshmallow-code/flask-marshmallow/releases/tag/${version}";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "bd01a6372cbe50e36f205cfff0fc5dab0b7b662c4c8b2c4fc06a3151b2950950";
-  };
-
-  propagatedBuildInputs = [ flask marshmallow ];
-  buildInputs = [ six ];
-
-  doCheck = false;
 }

pkgs/development/python-modules/google-cloud-language/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.10.1";
+  version = "2.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FAwHU1haRZd7ucfRxwfn+KtWM8/1a97Z74UvkBa3Mq8=";
+    hash = "sha256-ldI19QPZBOiFQRfpKO82rJMMJIJfy4QAw/NoqQj9vhQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/ipympl/default.nix

@@ -1,9 +1,14 @@
 { lib
 , buildPythonPackage
+, pythonOlder
 , fetchPypi
 , ipykernel
+, ipython_genutils
 , ipywidgets
 , matplotlib
+, numpy
+, pillow
+, traitlets
 }:
 
 buildPythonPackage rec {
@@ -11,13 +16,22 @@ buildPythonPackage rec {
   version = "0.9.3";
   format = "wheel";
 
+  disabled = pythonOlder "3.5";
+
   src = fetchPypi {
     inherit pname version format;
     hash = "sha256-0RPNVYkbr+myfvmbbdERqHvra7KuVQxAQpInIQO+gBM=";
   };
 
-
-  propagatedBuildInputs = [ ipykernel ipywidgets matplotlib ];
+  propagatedBuildInputs = [
+    ipykernel
+    ipython_genutils
+    ipywidgets
+    matplotlib
+    numpy
+    pillow
+    traitlets
+  ];
 
   # There are no unit tests in repository
   doCheck = false;

pkgs/development/python-modules/ipytablewidgets/default.nix

@@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, ipywidgets
+, jupyter-packaging
+, jupyterlab
+, lz4
+, numpy
+, pandas
+, setuptools
+, traitlets
+, traittypes
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "ipytablewidgets";
+  version = "0.3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-14vIih+r/PHLxhgG29YtwuosSBLpewD2CluWpH2+pLc=";
+  };
+
+  nativeBuildInputs = [
+    jupyter-packaging
+    jupyterlab
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    ipywidgets
+    lz4
+    numpy
+    pandas
+    traitlets
+    traittypes
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "ipytablewidgets" ];
+
+  meta = with lib; {
+    description = "Traitlets and widgets to efficiently data tables (e.g. Pandas DataFrame) using the jupyter notebook";
+    homepage = "https://github.com/progressivis/ipytablewidgets";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}

pkgs/development/python-modules/msal/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "msal";
-  version = "1.22.0";
+  version = "1.23.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ioL1N1ZCwWJciQWAGEMClMEJRA3OQupmfUZsLKtSCs0=";
+    hash = "sha256-JcmjOs+EMB+T0f2+nxqcYM04rw1f/9v6N4E4/HvB6Gs=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pykeepass/default.nix

@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname   = "pykeepass";
-  version = "4.0.3";
+  version = "4.0.5";
 
   format = "setuptools";
 
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     owner = "libkeepass";
     repo = "pykeepass";
     rev = "v${version}";
-    hash = "sha256-HyveBBsd1OFWoY3PgqqaKRLBhsxgFv8PRAxEF6r+bf4=";
+    hash = "sha256-IdILcIhrxcTDddoxiK257II0V7ctVb1CTLfTPmuwjTQ=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyvex/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.63";
+  version = "9.2.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HuAyI+X9XDcIJQw6+O1TrFdSsA0TNZpW5MAm70ox24c=";
+    hash = "sha256-dIM/LybJNiQTB8SnZuIVOaxrL6KwZzEuQdRj30pMOeI=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/todoist-api-python/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "todoist-api-python";
-  version = "2.1.1";
+  version = "2.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Doist";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mBQCC1beBAB+vDV/TrQHQB7cTjjoCDZlqpiYP8IphUA=";
+    hash = "sha256-Xi3B/Nl5bMbW0lYwrkEbBgFTEl07YkFyN18kN0WyGyw=";
   };
 
   patches = [

pkgs/development/python-modules/torch/default.nix

@@ -68,7 +68,7 @@ let
   # https://github.com/pytorch/pytorch/blob/v2.0.1/torch/utils/cpp_extension.py#L1744
   supportedTorchCudaCapabilities =
     let
-      real = ["3.5" "3.7" "5.0" "5.2" "5.3" "6.0" "6.1" "6.2" "7.0" "7.2" "7.5" "8.0" "8.6" "8.9" "9.0"];
+      real = ["3.5" "3.7" "5.0" "5.2" "5.3" "6.0" "6.1" "6.2" "7.0" "7.2" "7.5" "8.0" "8.6" "8.7" "8.9" "9.0"];
       ptx = lists.map (x: "${x}+PTX") real;
     in
     real ++ ptx;

pkgs/development/python-modules/types-pytz/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-pytz";
-  version = "2023.3.0.0";
+  version = "2023.3.0.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7Nxw1UOq82FqfkhjFUOohPdCBfKEzv1mSd30TGqCCqw=";
+    hash = "sha256-GnuNSqxwmBz6JEeKQerfzZagh8mG1vFQ13486zwr36s=";
   };
 
   # Modules doesn't have tests

pkgs/development/python-modules/upcloud-api/default.nix

@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "upcloud-api";
-  version = "2.0.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "UpCloudLtd";
     repo = "upcloud-python-api";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-thmrbCpGjlDkHIZwIjRgIVMplaypiKByFS/nS8F2LXA=";
+    hash = "sha256-35vPODc/oL+JPMnStFutIRYVTUkYAXKRt/KXBW0Yc+U=";
   };
 
   propagatedBuildInputs = [
@@ -29,6 +29,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "upcloud_api" ];
 
   meta = with lib; {
+    changelog = "https://github.com/UpCloudLtd/upcloud-python-api/blob/${src.rev}/CHANGELOG.md";
     description = "UpCloud API Client";
     homepage = "https://github.com/UpCloudLtd/upcloud-python-api";
     license = licenses.mit;

pkgs/development/python-modules/vega/default.nix

@@ -1,20 +1,71 @@
-{ lib, buildPythonPackage , fetchPypi, pythonOlder
-, jupyter-core, pandas, ipywidgets, jupyter }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, pythonRelaxDepsHook
+, altair
+, ipytablewidgets
+, ipywidgets
+, jupyter
+, jupyter-core
+, jupyterlab
+, pandas
+, poetry-core
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "vega";
-  version = "3.6.0";
-  disabled = pythonOlder "3.6";
+  version = "4.0.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cO+7Ynbv/+uoNUOPQvDNZji04llHUBlm95Cyfy+Ny80=";
+    hash = "sha256-v1/8taHdN1n9+gy7L+g/wAJ2x9FwYCaxZiEdFqLct1Y=";
   };
 
-  propagatedBuildInputs = [ jupyter jupyter-core pandas ipywidgets ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pandas"
+  ];
+
+  propagatedBuildInputs = [
+    ipytablewidgets
+    jupyter
+    jupyter-core
+    pandas
+  ];
+
+  passthru.optional-dependencies = {
+    widget = [
+      ipywidgets
+    ];
+    jupyterlab = [
+      jupyterlab
+    ];
+  };
+
+  nativeCheckInputs = [
+    altair
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # these tests are broken with jupyter-notebook >= 7
+    "vega/tests/test_entrypoint.py"
+  ];
 
-  # currently, recommonmark is broken on python3
-  doCheck = false;
   pythonImportsCheck = [ "vega" ];
 
   meta = with lib; {
@@ -28,6 +79,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/vega/ipyvega";
     license = licenses.bsd3;
     maintainers = with maintainers; [ teh ];
-    platforms = platforms.unix;
   };
 }

pkgs/development/tools/database/sqlfluff/default.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "2.2.1";
+  version = "2.3.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-TRu9pDvVQIyT9aZR9MSYOtTbsUV596OcAZlGY4VrrKY=";
+    hash = "sha256-zIufjQ8JNt3/GGd7Q1wEdJULKe+qXtZpEJJzrH3KVno=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [

pkgs/games/openxcom/default.nix

@@ -1,40 +1,54 @@
-{ lib
-, stdenv
-, fetchFromGitHub
+{ boost
 , cmake
-, pkg-config
+, fetchFromGitHub
+, lib
 , libGLU
 , libGL
-, zlib
 , openssl
-, yaml-cpp
-, boost
+, pkg-config
 , SDL
 , SDL_image
 , SDL_mixer
 , SDL_gfx
+, stdenv
+, yaml-cpp
+, zlib
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "openxcom";
-  version = "1.0.0.2019.10.18";
+  version = "1.0.0.2023.08.12";
 
   src = fetchFromGitHub {
     owner = "OpenXcom";
     repo = "OpenXcom";
-    rev = "f9853b2cb8c8f741ac58707487ef493416d890a3";
-    hash = "sha256-APv49ZT94oeM4KVKGtUdoQ1t8Ly8lsocr+FqXiRXbk0=";
+    rev = "bd632cc8569a57fdc3b68ce53f6ea850422ec5ac";
+    hash = "sha256-ouYZ4rAEluqeP+ZUrbEZwCpXCw0cZLWsf1GbIE3jaTc=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = [ SDL SDL_gfx SDL_image SDL_mixer boost yaml-cpp libGLU libGL openssl zlib ];
+  buildInputs = [
+    boost
+    libGL
+    libGLU
+    SDL
+    SDL_gfx
+    SDL_image
+    SDL_mixer
+    yaml-cpp
+    openssl
+    zlib
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Open source clone of UFO: Enemy Unknown";
     homepage = "https://openxcom.org";
-    maintainers = with maintainers; [ cpages ];
-    platforms = platforms.linux;
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ cpages ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/games/path-of-building/default.nix

@@ -1,11 +1,39 @@
-{ stdenv, lib, fetchFromGitHub, runCommand, unzip, meson, ninja, pkg-config, qtbase, qttools, wrapQtAppsHook, luajit }:
+{ stdenv, lib, fetchFromGitHub, unzip, meson, ninja, pkg-config, qtbase, qttools, wrapQtAppsHook, luajit }:
 let
-  dataVersion = "2.31.1";
-  frontendVersion = "unstable-2023-04-09";
+  data = stdenv.mkDerivation(finalAttrs: {
+    pname = "path-of-building-data";
+    version = "2.31.2";
+
+    src = fetchFromGitHub {
+      owner = "PathOfBuildingCommunity";
+      repo = "PathOfBuilding";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-E178uYVQ+B08h1lM7h+hwfMb08VZK+r25pD4haT1tc8=";
+    };
+
+    nativeBuildInputs = [ unzip ];
+
+    buildCommand = ''
+      # I have absolutely no idea how this file is generated
+      # and I don't think I want to know. The Flatpak also does this.
+      unzip -j -d $out $src/runtime-win32.zip lua/sha1.lua
+
+      # Install the actual data
+      cp -r $src/src $src/runtime/lua/*.lua $src/manifest.xml $out
+
+      # Pretend this is an official build so we don't get the ugly "dev mode" warning
+      substituteInPlace $out/manifest.xml --replace '<Version' '<Version platform="nixos"'
+      touch $out/installed.cfg
+
+      # Completely stub out the update check
+      chmod +w $out/src/UpdateCheck.lua
+      echo 'return "none"' > $out/src/UpdateCheck.lua
+    '';
+  });
 in
 stdenv.mkDerivation {
   pname = "path-of-building";
-  version = "${dataVersion}-${frontendVersion}";
+  version = "${data.version}-unstable-2023-04-09";
 
   src = fetchFromGitHub {
     owner = "ernstp";
@@ -14,36 +42,8 @@ stdenv.mkDerivation {
     hash = "sha256-zhw2PZ6ZNMgZ2hG+a6AcYBkeg7kbBHNc2eSt4if17Wk=";
   };
 
-  data = runCommand "path-of-building-data" {
-    src = fetchFromGitHub {
-      owner = "PathOfBuildingCommunity";
-      repo = "PathOfBuilding";
-      rev = "v${dataVersion}";
-      hash = "sha256-K/u8NYUv4U/XgGP/LkYMRzwmw1LFn25OW6bmvqqRpVQ=";
-    };
-
-    nativeBuildInputs = [ unzip ];
-  }
-  ''
-    # I have absolutely no idea how this file is generated
-    # and I don't think I want to know. The Flatpak also does this.
-    unzip -j -d $out $src/runtime-win32.zip lua/sha1.lua
-
-    # Install the actual data
-    cp -r $src/src $src/runtime/lua/*.lua $src/manifest.xml $out
-
-    # Pretend this is an official build so we don't get the ugly "dev mode" warning
-    substituteInPlace $out/manifest.xml --replace '<Version' '<Version platform="nixos"'
-    touch $out/installed.cfg
-
-    # Completely stub out the update check
-    chmod +w $out/src/UpdateCheck.lua
-    echo 'return "none"' > $out/src/UpdateCheck.lua
-  '';
-
   nativeBuildInputs = [ meson ninja pkg-config qttools wrapQtAppsHook ];
   buildInputs = [ qtbase luajit luajit.pkgs.lua-curl ];
-  dontWrapQtApps = true;
 
   installPhase = ''
     runHook preInstall
@@ -51,13 +51,16 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  postFixup = ''
-    wrapQtApp $out/bin/pobfrontend \
-      --set LUA_PATH "$LUA_PATH" \
-      --set LUA_CPATH "$LUA_CPATH" \
-      --chdir "$data"
+  preFixup = ''
+    qtWrapperArgs+=(
+      --set LUA_PATH "$LUA_PATH"
+      --set LUA_CPATH "$LUA_CPATH"
+      --chdir "${data}"
+    )
   '';
 
+  passthru.data = data;
+
   meta = {
     description = "Offline build planner for Path of Exile";
     homepage = "https://pathofbuilding.community/";

pkgs/servers/atlassian/confluence.nix

@@ -15,11 +15,11 @@ in
 optionalWarning (crowdProperties != null) "Using `crowdProperties` is deprecated!"
 (stdenvNoCC.mkDerivation rec {
   pname = "atlassian-confluence";
-  version = "7.19.5";
+  version = "7.19.12";
 
   src = fetchurl {
     url = "https://product-downloads.atlassian.com/software/confluence/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-32syhzbFCWzwE2NftTY58aA+iD0kABraT4FA7mYU1II=";
+    sha256 = "sha256-59JOZWKhHPtz9NFiGreFHAOgIL5aB227j6nC1XyofvE=";
   };
 
   buildPhase = ''

pkgs/servers/mediamtx/default.nix

@@ -1,20 +1,21 @@
 { lib
 , fetchFromGitHub
 , buildGoModule
+, nixosTests
 }:
 
 buildGoModule rec {
   pname = "mediamtx";
-  version = "0.23.8";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    owner = "aler9";
+    owner = "bluenviron";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ICH102Z18dbabXVYgxCX4JTQ75v0A9wx2pIsZHIXDFg=";
+    hash = "sha256-SKNCQu5uRAxKpQbceha50K4ShV7mE0VI1PGFVAlWq4Q=";
   };
 
-  vendorHash = "sha256-uqcv05AHwwPxrix+FWSWpV8vKFqKQsMn8qEgD71zgo8=";
+  vendorHash = "sha256-mPnAlFHCJKXOdmKP3Ff7cQJMStKtu4Sa7iYuot5/IKE=";
 
   # Tests need docker
   doCheck = false;
@@ -23,13 +24,15 @@ buildGoModule rec {
     "-X github.com/bluenviron/mediamtx/internal/core.version=v${version}"
   ];
 
+  passthru.tests = { inherit (nixosTests) mediamtx; };
+
   meta = with lib; {
     description =
       "Ready-to-use RTSP server and RTSP proxy that allows to read and publish video and audio streams"
     ;
     inherit (src.meta) homepage;
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    mainProgram = "mediamtx";
+    maintainers = with maintainers; [ fpletz ];
   };
-
 }

pkgs/servers/monitoring/matrix-alertmanager/default.nix

@@ -1,39 +1,34 @@
-{ lib, callPackage, mkYarnPackage, fetchYarnDeps, fetchFromGitHub, nodejs }:
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, jq
+}:
 
-mkYarnPackage rec {
+buildNpmPackage rec {
   pname = "matrix-alertmanager";
-  version = "0.5.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "jaywink";
     repo = pname;
     rev = "v${version}";
-    sha256 = "M3/8viRCRiVJGJSHidP6nG8cr8wOl9hMFY/gzdSRN+4=";
+    hash = "sha256-7rsY/nUiuSVkM8fbPPa9DB3c+Uhs+Si/j1Jzls6d2qc=";
   };
 
-  packageJSON = ./package.json;
-  yarnLock = ./yarn.lock;
-
-  offlineCache = fetchYarnDeps {
-    inherit yarnLock;
-    sha256 = lib.fileContents ./yarn-hash;
-  };
-
-  prePatch = ''
-    cp ${./package.json} ./package.json
-  '';
-  postInstall = ''
-    sed '1 s;^;#!${nodejs}/bin/node\n;' -i $out/libexec/matrix-alertmanager/node_modules/matrix-alertmanager/src/app.js
-    chmod +x $out/libexec/matrix-alertmanager/node_modules/matrix-alertmanager/src/app.js
+  postPatch = ''
+    ${lib.getExe jq} '. += {"bin": "src/app.js"}' package.json > package.json.tmp
+    mv package.json.tmp package.json
   '';
 
-  passthru.updateScript = callPackage ./update.nix {};
+  npmDepsHash = "sha256-OI/zlz03YQwUnpOiHAVQfk8PWKsurldpp0PbF1K9zbM=";
+
+  dontNpmBuild = true;
 
   meta = with lib; {
+    changelog = "https://github.com/jaywink/matrix-alertmanager/blob/${src.rev}/CHANGELOG.md";
     description = "Bot to receive Alertmanager webhook events and forward them to chosen rooms";
     homepage = "https://github.com/jaywink/matrix-alertmanager";
     license = licenses.mit;
     maintainers = with maintainers; [ yuka ];
-    platforms = platforms.all;
   };
 }

pkgs/servers/monitoring/matrix-alertmanager/package.json

@@ -1,41 +0,0 @@
-{
-  "name": "matrix-alertmanager",
-  "version": "0.5.0",
-  "description": "Prometheus Alertmanager bot for Matrix",
-  "main": "src/app.js",
-  "scripts": {
-    "dev": "node_modules/.bin/nodemon src/app.js localhost 3000",
-    "test": "node_modules/.bin/mocha tests/",
-    "start": "node src/app.js"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/jaywink/matrix-alertmanager"
-  },
-  "keywords": [
-    "matrix",
-    "alertmanager",
-    "prometheus",
-    "bot"
-  ],
-  "engines": {
-    "node": ">= 14"
-  },
-  "author": "Jason Robinson",
-  "license": "MIT",
-  "devDependencies": {
-    "chai": "^4.3.4",
-    "eslint": "^7.32.0",
-    "mocha": "^9.1.1",
-    "nodemon": "^2.0.12",
-    "npm-check-updates": "^11.8.5",
-    "sinon": "^11.1.2"
-  },
-  "dependencies": {
-    "dotenv": "^10.0.0",
-    "express": "^4.17.1",
-    "matrix-js-sdk": "^12.5.0",
-    "striptags": "^3.2.0"
-  },
-  "bin": "src/app.js"
-}

pkgs/servers/monitoring/matrix-alertmanager/update.nix

@@ -1,32 +0,0 @@
-{ lib, writeShellScript
-, coreutils, jq, common-updater-scripts
-, curl, wget, gnugrep, yarn, prefetch-yarn-deps
-}:
-
-writeShellScript "update-matrix-alertmanager" ''
-  set -xe
-  export PATH="${lib.makeBinPath [ gnugrep coreutils curl wget jq common-updater-scripts yarn prefetch-yarn-deps ]}"
-
-  cd pkgs/servers/monitoring/matrix-alertmanager/
-
-  owner="jaywink"
-  repo="matrix-alertmanager"
-  version=`curl -s "https://api.github.com/repos/$owner/$repo/tags" | jq -r .[0].name | grep -oP "^v\K.*"`
-  url="https://raw.githubusercontent.com/$owner/$repo/v$version/"
-
-  (
-    cd ../../../..
-    update-source-version matrix-alertmanager "$version" --file=pkgs/servers/monitoring/matrix-alertmanager/default.nix
-  )
-
-  rm -f package.json package-lock.json yarn.lock
-  wget "$url/package.json" "$url/package-lock.json"
-
-  yarn import
-  echo $(prefetch-yarn-deps) > yarn-hash
-
-  jq '. + { bin: .main }' package.json > package.json.tmp
-  mv package.json{.tmp,}
-
-  rm -rf package-lock.json node_modules
-''

pkgs/servers/monitoring/matrix-alertmanager/yarn-hash

@@ -1 +0,0 @@
-03a217ppbscz4fqc10c829p5frbs7j9qli5126cibz2b3pk2mi66

pkgs/servers/roadrunner/default.nix

@@ -0,0 +1,57 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "roadrunner";
+  version = "2023.2.2";
+  src = fetchFromGitHub {
+    repo = "roadrunner";
+    owner = "roadrunner-server";
+    rev = "v${version}";
+    hash = "sha256-tkJ7MDFHWps6bCppFJXMFYQl7+i8OhuDVrk1n78rrUc";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  # Flags as provided by the build automation of the project:
+  # https://github.com/roadrunner-server/roadrunner/blob/fe572d0eceae8fd05225fbd99ba50a9eb10c4393/.github/workflows/release.yml#L89
+  ldflags = [
+    "-s"
+    "-X github.com/roadrunner-server/roadrunner/v2023/internal/meta.version=${version}"
+    "-X github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd rr \
+      --bash <($out/bin/rr completion bash) \
+      --zsh <($out/bin/rr zsh) \
+      --fish <($out/bin/rr fish)
+  '';
+
+  postPatch = ''
+    substituteInPlace internal/rpc/client_test.go \
+      --replace "127.0.0.1:55555" "127.0.0.1:55554"
+
+    substituteInPlace internal/rpc/test/config_rpc_ok.yaml \
+      --replace "127.0.0.1:55555" "127.0.0.1:55554"
+
+    substituteInPlace internal/rpc/test/config_rpc_conn_err.yaml \
+      --replace "127.0.0.1:0" "127.0.0.1:55554"
+  '';
+
+  vendorHash = "sha256-pRZaJ1PBtshhna71V86IJ0VKs0u9wCFG27mghcE/8xY";
+
+  meta = {
+    changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
+    description = "High-performance PHP application server, process manager written in Go and powered with plugins";
+    homepage = "https://roadrunner.dev";
+    license = lib.licenses.mit;
+    mainProgram = "rr";
+    maintainers = with lib.maintainers; [ shyim ];
+  };
+}

pkgs/tools/admin/syft/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.85.0";
+  version = "0.86.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-TNo5WNSy0ogv0hn+O7VL7DCMaDtwhs1UNbTt5K7/40U=";
+    hash = "sha256-9NrUNaBRrewoep4eUm94gw/ndI/Qhh3P848NB2IH2qM=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-OVCM7WAyKVpd7VNV4wmfAoMJWurEhTBPQsln34oS5U8=";
+  vendorHash = "sha256-tHP6BBeKWJpynnGp2EP3tKGWiv/JIdi6xvTrg6IivWg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/misc/nncp/default.nix

@@ -1,17 +1,27 @@
-{ lib, stdenv, go, fetchurl, redo-apenwarr, curl, perl, genericUpdater
-, writeShellScript, cfgPath ? "/etc/nncp.hjson" }:
+{ cfgPath ? "/etc/nncp.hjson"
+, curl
+, fetchurl
+, lib
+, genericUpdater
+, go
+, perl
+, stdenv
+, writeShellScript
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nncp";
-  version = "8.8.3";
+  version = "8.9.0";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
-    url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz";
-    hash = "sha256-IldQCEdH6XDYK+DW5lB/5HFFFGuq1nDkCwEaVo7vIvE=";
+    url = "http://www.nncpgo.org/download/nncp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-JZ+svDNU7cwW58ZOJ4qszbR/+j7Cr+oLNig/RqqCS10=";
   };
 
-  nativeBuildInputs = [ go redo-apenwarr ];
+  nativeBuildInputs = [
+    go
+  ];
 
   # Build parameters
   CFGPATH = cfgPath;
@@ -19,11 +29,15 @@ stdenv.mkDerivation rec {
 
   preConfigure = "export GOCACHE=$NIX_BUILD_TOP/gocache";
 
+  buildPhase = ''
+    runHook preBuild
+    ./bin/build
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
-    export PREFIX=$out
-    rm -f INSTALL # work around case insensitivity
-    redo install
+    PREFIX=$out ./install
     runHook postInstall
   '';
 
@@ -31,12 +45,17 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = genericUpdater {
     versionLister = writeShellScript "nncp-versionLister" ''
-      ${curl}/bin/curl -s ${meta.downloadPage} | ${perl}/bin/perl -lne 'print $1 if /Release.*>([0-9.]+)</'
+      ${curl}/bin/curl -s ${finalAttrs.meta.downloadPage} | ${perl}/bin/perl -lne 'print $1 if /Release.*>([0-9.]+)</'
     '';
   };
 
-  meta = with lib; {
+  meta = {
+    broken = stdenv.isDarwin;
+    changelog = "http://www.nncpgo.org/News.html";
     description = "Secure UUCP-like store-and-forward exchanging";
+    downloadPage = "http://www.nncpgo.org/Tarballs.html";
+    homepage = "http://www.nncpgo.org/";
+    license = lib.licenses.gpl3Only;
     longDescription = ''
       This utilities are intended to help build up small size (dozens of
       nodes) ad-hoc friend-to-friend (F2F) statically routed darknet
@@ -52,11 +71,7 @@ stdenv.mkDerivation rec {
       support. But online TCP daemon with full-duplex resumable data
       transmission exists.
     '';
-    homepage = "http://www.nncpgo.org/";
-    downloadPage = "http://www.nncpgo.org/Tarballs.html";
-    changelog = "http://www.nncpgo.org/News.html";
-    license = licenses.gpl3Only;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ ehmry woffs ];
+    maintainers = with lib.maintainers; [ ehmry woffs ];
+    platforms = lib.platforms.all;
   };
-}
+})

pkgs/tools/security/shhgit/default.nix

@@ -1,27 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-}:
-
-buildGoModule rec {
-  pname = "shhgit";
-  version = "0.4-${lib.strings.substring 0 7 rev}";
-  rev = "7e55062d10d024f374882817692aa2afea02ff84";
-
-  src = fetchFromGitHub {
-    owner = "eth0izzle";
-    repo = pname;
-    inherit rev;
-    sha256 = "1b7r4ivfplm4crlvx571nyz2rc6djy0xvl14nz7m0ngh6206df9k";
-  };
-
-  vendorSha256 = null; #vendorSha256 = "";
-
-  meta = with lib; {
-    description = "Tool to detect secrets in repositories";
-    homepage = "https://github.com/eth0izzle/shhgit";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
-    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.goModules --check
-  };
-}

pkgs/tools/security/trufflehog/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.48.0";
+  version = "3.49.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mt4ht9bRV6yh5aunX/zelqttNGvPvhIrX0rN7nEpS2g=";
+    hash = "sha256-IJFsEfWNstbawqnWa3E/7DVgEishOtM0AAGc5lqPVOU=";
   };
 
-  vendorHash = "sha256-AlyONwUP4Z8S8Qj3hbGFCyhUlYzlN6AIxGzrnQaXBLY=";
+  vendorHash = "sha256-RHNt9GxqWb4EDKg5of5s88iUmJPI2w7i5hPoCFMmnew=";
 
   ldflags = [
     "-s"

pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile

@@ -8,7 +8,6 @@ gem 'asciidoctor-mathematical'
 gem 'asciidoctor-multipage'
 gem 'asciidoctor-pdf'
 gem 'asciidoctor-revealjs'
-gem 'asciidoctor-rouge'
 gem 'coderay'
 gem 'pygments.rb'
 gem 'rouge'

pkgs/tools/typesetting/asciidoctor-with-extensions/Gemfile.lock

@@ -2,23 +2,23 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    addressable (2.8.1)
+    addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
     afm (0.2.2)
-    asciidoctor (2.0.18)
+    asciidoctor (2.0.20)
     asciidoctor-bibtex (0.8.0)
       asciidoctor (~> 2.0)
       bibtex-ruby (~> 5.1)
       citeproc-ruby (~> 1)
       csl-styles (~> 1)
       latex-decode (~> 0.2)
-    asciidoctor-diagram (2.2.3)
+    asciidoctor-diagram (2.2.11)
       asciidoctor (>= 1.5.7, < 3.x)
       asciidoctor-diagram-ditaamini (~> 1.0)
       asciidoctor-diagram-plantuml (~> 1.2021)
       rexml
     asciidoctor-diagram-ditaamini (1.0.3)
-    asciidoctor-diagram-plantuml (1.2022.5)
+    asciidoctor-diagram-plantuml (1.2023.10)
     asciidoctor-epub3 (1.5.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
       gepub (~> 1.0.0)
@@ -32,7 +32,7 @@ GEM
       mathematical (~> 1.6.0)
     asciidoctor-multipage (0.0.16)
       asciidoctor (>= 2.0.11, < 2.1)
-    asciidoctor-pdf (2.3.2)
+    asciidoctor-pdf (2.3.9)
       asciidoctor (~> 2.0)
       concurrent-ruby (~> 1.1)
       matrix (~> 0.4)
@@ -42,14 +42,9 @@ GEM
       prawn-table (~> 0.2.0)
       prawn-templates (~> 0.1.0)
       treetop (~> 1.6.0)
-    asciidoctor-revealjs (4.1.0)
+    asciidoctor-revealjs (5.0.1)
       asciidoctor (>= 2.0.0, < 3.0.0)
-      concurrent-ruby (~> 1.0)
-      thread_safe (~> 0.3.5)
-    asciidoctor-rouge (0.4.0)
-      asciidoctor (>= 1.5.6, < 2.1)
-      rouge (>= 2.2, < 4)
-    asciimath (2.0.4)
+    asciimath (2.0.5)
     bibtex-ruby (5.1.6)
       latex-decode (~> 0.0)
     citeproc (1.0.10)
@@ -58,34 +53,34 @@ GEM
       citeproc (~> 1.0, >= 1.0.9)
       csl (~> 1.6)
     coderay (1.1.3)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.2.2)
     csl (1.6.0)
       namae (~> 1.0)
       rexml
     csl-styles (1.0.1.11)
       csl (~> 1.0)
-    css_parser (1.12.0)
+    css_parser (1.14.0)
       addressable
     gepub (1.0.15)
       nokogiri (>= 1.8.2, < 2.0)
       rubyzip (> 1.1.1, < 2.4)
     hashery (2.1.2)
-    i18n (1.12.0)
+    i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     latex-decode (0.4.0)
     mathematical (1.6.14)
       ruby-enum (~> 0.4)
     matrix (0.4.2)
-    mime-types (3.4.1)
+    mime-types (3.5.0)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2022.0105)
-    mini_portile2 (2.8.0)
+    mime-types-data (3.2023.0808)
+    mini_portile2 (2.8.4)
     namae (1.1.1)
-    nokogiri (1.13.8)
-      mini_portile2 (~> 2.8.0)
+    nokogiri (1.15.4)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     pdf-core (0.9.0)
-    pdf-reader (2.10.0)
+    pdf-reader (2.11.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
@@ -106,17 +101,17 @@ GEM
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
-    public_suffix (5.0.0)
-    pygments.rb (2.3.0)
-    racc (1.6.0)
-    rexml (3.2.5)
-    rouge (3.30.0)
+    public_suffix (5.0.3)
+    pygments.rb (2.4.0)
+    racc (1.7.1)
+    rexml (3.2.6)
+    rouge (4.1.3)
     ruby-enum (0.9.0)
       i18n
     ruby-rc4 (0.1.5)
     rubyzip (2.3.2)
     thread_safe (0.3.6)
-    treetop (1.6.11)
+    treetop (1.6.12)
       polyglot (~> 0.3)
     ttfunk (1.7.0)
 
@@ -133,10 +128,9 @@ DEPENDENCIES
   asciidoctor-multipage
   asciidoctor-pdf
   asciidoctor-revealjs
-  asciidoctor-rouge
   coderay
   pygments.rb
   rouge
 
 BUNDLED WITH
-   2.3.22
+   2.4.17

pkgs/tools/typesetting/asciidoctor-with-extensions/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ypdmpdn20hxp5vwxz3zc04r5xcwqc25qszdlg41h8ghdqbllwmw";
+      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.8.5";
   };
   afm = {
     groups = ["default"];
@@ -35,10 +35,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11z3vnd8vh3ny1vx69bjrbck5b2g8zsbj94npyadpn7fdp8y3ldv";
+      sha256 = "0yblqlbix3is5ihiqrpbfazb44in7ichfkjzdbsqibp48paanpl3";
       type = "gem";
     };
-    version = "2.0.18";
+    version = "2.0.20";
   };
   asciidoctor-bibtex = {
     dependencies = ["asciidoctor" "bibtex-ruby" "citeproc-ruby" "csl-styles" "latex-decode"];
@@ -57,10 +57,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jzaahnnyarjn24vvgprkisij5nw5mzqjphgycxf11gpmnvs2lar";
+      sha256 = "0j6622x9525xbshvbds4gkavvy72lqjqq1jw9flljr8vvsv7xjcs";
       type = "gem";
     };
-    version = "2.2.3";
+    version = "2.2.11";
   };
   asciidoctor-diagram-ditaamini = {
     groups = ["default"];
@@ -77,10 +77,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18vbvj9cjr5f63jmjlq9kdknpn2dzykhnrv3i4y5gnbhs6f4jhi2";
+      sha256 = "0c1pz97fvc0hwvh0by5i682mxnwngqpxb5hp85fly9k8q9hb2hwg";
       type = "gem";
     };
-    version = "1.2022.5";
+    version = "1.2023.10";
   };
   asciidoctor-epub3 = {
     dependencies = ["asciidoctor" "gepub" "mime-types"];
@@ -132,42 +132,31 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16mw0mlrrx44wn5j2knp3cv7b7phan90y4dr285c1qgdd25310xv";
+      sha256 = "19c98a6riqhxxlc7kmksjslnyxdjp106ppsqy1vdbkjb39zfign3";
       type = "gem";
     };
-    version = "2.3.2";
+    version = "2.3.9";
   };
   asciidoctor-revealjs = {
-    dependencies = ["asciidoctor" "concurrent-ruby" "thread_safe"];
+    dependencies = ["asciidoctor"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03vmbcc3x059h17ry4qwk1p0yar9wgh87l2qssi307gy45cjw2mq";
+      sha256 = "0xh8ax5pv7cc9wa4sx0njpyj20gzfbhramca31qwldgi6hwk4wm8";
       type = "gem";
     };
-    version = "4.1.0";
-  };
-  asciidoctor-rouge = {
-    dependencies = ["asciidoctor" "rouge"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "197sbzs9km58pgfqdnnglhqr7anhb0m330cv1vxfc3s2qz106zjz";
-      type = "gem";
-    };
-    version = "0.4.0";
+    version = "5.0.1";
   };
   asciimath = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fy2jrn3gr7cl33qydp3pwyfilcmb4m4z6hfhnvydzg8r3srp36j";
+      sha256 = "1ny2qql3lgh7gx54psji2lm4mmbwyiwy00a17w26rjyh6cy55491";
       type = "gem";
     };
-    version = "2.0.4";
+    version = "2.0.5";
   };
   bibtex-ruby = {
     dependencies = ["latex-decode"];
@@ -217,10 +206,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
+      sha256 = "0krcwb6mn0iklajwngwsg850nk8k9b35dhmc2qkbdqvmifdi2y9q";
       type = "gem";
     };
-    version = "1.1.10";
+    version = "1.2.2";
   };
   csl = {
     dependencies = ["namae" "rexml"];
@@ -250,10 +239,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1107j3frhmcd95wcsz0rypchynnzhnjiyyxxcl6dlmr2lfy08z4b";
+      sha256 = "04q1vin8slr3k8mp76qz0wqgap6f9kdsbryvgfq9fljhrm463kpj";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.14.0";
   };
   gepub = {
     dependencies = ["nokogiri" "rubyzip"];
@@ -282,10 +271,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vdcchz7jli1p0gnc669a7bj3q1fv09y9ppf0y3k0vb1jwdwrqwi";
+      sha256 = "0qaamqsh5f3szhcakkak8ikxlzxqnv49n2p7504hcz2l0f4nj0wx";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.14.1";
   };
   latex-decode = {
     groups = ["default"];
@@ -324,30 +313,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ipw892jbksbxxcrlx9g5ljq60qx47pm24ywgfbyjskbcl78pkvb";
+      sha256 = "1s95nyppk5wrpfgqrzf6f00g7nk0662zmxm4mr2vbdbl83q3k72x";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.5.0";
   };
   mime-types-data = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "003gd7mcay800k2q4pb2zn8lwwgci4bhi42v2jvlidm8ksx03i6q";
+      sha256 = "17zdim7kzrh5j8c97vjqp4xp78wbyz7smdp4hi5iyzk0s9imdn5a";
       type = "gem";
     };
-    version = "3.2022.0105";
+    version = "3.2023.0808";
   };
   mini_portile2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rapl1sfmfi3bfr68da4ca16yhc0pp93vjwkj7y3rdqrzy3b41hy";
+      sha256 = "02mj8mpd6ck5gpcnsimx5brzggw5h5mmmpq2djdypfq16wcw82qq";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.8.4";
   };
   namae = {
     groups = ["default"];
@@ -365,10 +354,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7axlq2y6gzmixzzzhw3fn6nhrhg469jj8gfr7gs8igiclpkhkr";
+      sha256 = "0k9w2z0953mnjrsji74cshqqp08q7m1r6zhadw1w0g34xzjh3a74";
       type = "gem";
     };
-    version = "1.13.8";
+    version = "1.15.4";
   };
   pdf-core = {
     groups = ["default"];
@@ -386,10 +375,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07chhyxf3qlr65jngns3z5187ibfibf5h2q59505vx45dfr3lvwz";
+      sha256 = "09sx25jpnip2sp6wh5sn5ad7za78rfi95qp5iiczfh43z4jqa8q3";
       type = "gem";
     };
-    version = "2.10.0";
+    version = "2.11.0";
   };
   polyglot = {
     groups = ["default"];
@@ -461,50 +450,50 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sqw1zls6227bgq38sxb2hs8nkdz4hn1zivs27mjbniswfy4zvi6";
+      sha256 = "0n9j7mczl15r3kwqrah09cxj8hxdfawiqxa60kga2bmxl9flfz9k";
       type = "gem";
     };
-    version = "5.0.0";
+    version = "5.0.3";
   };
   "pygments.rb" = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "047mjyzz8v4kkgi1ap6fsjf7kcp6dwirpnigif00ss0hxsxchhac";
+      sha256 = "080kb51l3m0n7xbbzmlcy78wsi03wr995v932v3b6lf6xa6nq8rg";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
   };
   racc = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
+      sha256 = "11v3l46mwnlzlc371wr3x6yylpgafgwdf0q7hc7c1lzx6r414r5g";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.7.1";
   };
   rexml = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      sha256 = "05i8518ay14kjbma550mv0jm8a6di8yp5phzrd8rj44z9qnrlrp0";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rouge = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dnfkrk8xx2m8r3r9m2p5xcq57viznyc09k7r3i4jbm758i57lx3";
+      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
       type = "gem";
     };
-    version = "3.30.0";
+    version = "4.1.3";
   };
   ruby-enum = {
     dependencies = ["i18n"];
@@ -553,10 +542,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0697qz1akblf8r3wi0s2dsjh468hfsd57fb0mrp93z35y2ni6bhh";
+      sha256 = "0adc8qblz8ii668r3rksjx83p675iryh52rvdvysimx2hkbasj7d";
       type = "gem";
     };
-    version = "1.6.11";
+    version = "1.6.12";
   };
   ttfunk = {
     groups = ["default"];

pkgs/tools/typesetting/asciidoctor/Gemfile.lock

@@ -2,7 +2,7 @@ GEM
   remote: https://rubygems.org/
   specs:
     Ascii85 (1.1.0)
-    addressable (2.8.4)
+    addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
     afm (0.2.2)
     asciidoctor (2.0.20)
@@ -44,10 +44,10 @@ GEM
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
-    public_suffix (5.0.1)
+    public_suffix (5.0.3)
     pygments.rb (2.4.0)
-    rexml (3.2.5)
-    rouge (4.1.2)
+    rexml (3.2.6)
+    rouge (4.1.3)
     ruby-rc4 (0.1.5)
     tilt (2.2.0)
     treetop (1.6.12)
@@ -66,4 +66,4 @@ DEPENDENCIES
   tilt
 
 BUNDLED WITH
-   2.4.14
+   2.4.17

pkgs/tools/typesetting/asciidoctor/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15s8van7r2ad3dq6i03l3z4hqnvxcq75a3h72kxvf9an53sqma20";
+      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
       type = "gem";
     };
-    version = "2.8.4";
+    version = "2.8.5";
   };
   afm = {
     groups = ["default"];
@@ -193,10 +193,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hz0bx2qs2pwb0bwazzsah03ilpf3aai8b7lk7s35jsfzwbkjq35";
+      sha256 = "0n9j7mczl15r3kwqrah09cxj8hxdfawiqxa60kga2bmxl9flfz9k";
       type = "gem";
     };
-    version = "5.0.1";
+    version = "5.0.3";
   };
   "pygments.rb" = {
     groups = ["default"];
@@ -213,20 +213,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
+      sha256 = "05i8518ay14kjbma550mv0jm8a6di8yp5phzrd8rj44z9qnrlrp0";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rouge = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pym2zjwl6dwdfvbn7rbvmds32r70jx9qddhvvi6pqy6987ack1v";
+      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
       type = "gem";
     };
-    version = "4.1.2";
+    version = "4.1.3";
   };
   ruby-rc4 = {
     groups = ["default"];

pkgs/top-level/aliases.nix

@@ -1571,6 +1571,7 @@ mapAliases ({
   shared_mime_info = throw "'shared_mime_info' has been renamed to/replaced by 'shared-mime-info'"; # Converted to throw 2022-02-22
   inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
   shellinabox = throw "shellinabox has been removed from nixpkgs, as it was unmaintained upstream"; # Added 2021-12-15
+  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-" ; # Added 2023-08-08
   shipyard = jumppad; # Added 2023-06-06
   sickbeard = throw "sickbeard has been removed from nixpkgs, as it was unmaintained"; # Added 2022-01-01
   sickrage = throw "sickbeard has been removed from nixpkgs, as it was unmaintained"; # Added 2022-01-01

pkgs/top-level/all-packages.nix

@@ -24816,8 +24816,6 @@ with pkgs;
 
   sfsexp = callPackage ../development/libraries/sfsexp { };
 
-  shhgit = callPackage ../tools/security/shhgit { };
-
   shhmsg = callPackage ../development/libraries/shhmsg { };
 
   shhopt = callPackage ../development/libraries/shhopt { };
@@ -40737,6 +40735,8 @@ with pkgs;
 
   rivalcfg = callPackage ../misc/rivalcfg { };
 
+  roadrunner = callPackage ../servers/roadrunner { };
+
   rmfakecloud = callPackage ../servers/rmfakecloud { };
 
   rmfuse = callPackage ../tools/filesystems/rmfuse { };

pkgs/top-level/python-aliases.nix

@@ -132,6 +132,7 @@ mapAliases ({
   filemagic = throw "inactive since 2014, so use python-magic instead"; # added 2022-11-19
   flaskbabel = flask-babel; # added 2023-01-19
   flask_login = flask-login; # added 2022-10-17
+  flask_marshmallow = flask-marshmallow; # added 2023-08-16
   flask-restplus = throw "flask-restplus is no longer maintained, use flask-restx instead"; # added 2023-02-21
   flask_sqlalchemy = flask-sqlalchemy; # added 2022-07-20
   flask_testing = flask-testing; # added 2022-04-25

pkgs/top-level/python-packages.nix

@@ -548,6 +548,8 @@ self: super: with self; {
     inherit (pkgs) graphviz;
   };
 
+  anywidget = callPackage ../development/python-modules/anywidget { };
+
   aocd = callPackage ../development/python-modules/aocd { };
 
   apache-beam = callPackage ../development/python-modules/apache-beam { };
@@ -3821,7 +3823,7 @@ self: super: with self; {
 
   flask-mailman = callPackage ../development/python-modules/flask-mailman { };
 
-  flask_marshmallow = callPackage ../development/python-modules/flask-marshmallow { };
+  flask-marshmallow = callPackage ../development/python-modules/flask-marshmallow { };
 
   flask_migrate = callPackage ../development/python-modules/flask-migrate { };
 
@@ -5216,6 +5218,8 @@ self: super: with self; {
 
   ipyparallel = callPackage ../development/python-modules/ipyparallel { };
 
+  ipytablewidgets = callPackage ../development/python-modules/ipytablewidgets { };
+
   ipython_genutils = callPackage ../development/python-modules/ipython_genutils { };
 
   ipython = callPackage ../development/python-modules/ipython { };