Merge staging-next into staging

2024-10-05 20:19:16 +03:00 · 2024-06-12 18:01:23 +00:00 · 2024-06-12 18:01:23 +00:00 · ee4da03e6e
commit ee4da03e6e
parent 93fb179750 7bf80873ba
67 changed files with 882 additions and 289 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -20823,6 +20823,12 @@
    githubId = 14172;
    name = "Tim Cuthbertson";
  };
+  timhae = {
+    email = "tim.haering@posteo.net";
+    githubId = 6264882;
+    github = "timhae";
+    name = "Tim Häring";
+  };
  timma = {
    email = "kunduru.it.iitb@gmail.com";
    github = "ktrsoft";
@ -21619,6 +21625,12 @@
    githubId = 6943308;
    name = "Varun Patro";
  };
+  vasissualiyp = {
+    email = "vaspust@gmail.com";
+    github = "vasissualiyp";
+    githubId = 110242808;
+    name = "Vasilii Pustovoit";
+  };
  vbgl = {
    email = "Vincent.Laporte@gmail.com";
    github = "vbgl";
--- a/nixos/modules/services/networking/aria2.nix
+++ b/nixos/modules/services/networking/aria2.nix
@ -1,98 +1,137 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
  cfg = config.services.aria2;

  homeDir = "/var/lib/aria2";
+  defaultRpcListenPort = 6800;
+  defaultDir = "${homeDir}/Downloads";

-  settingsDir = "${homeDir}";
-  sessionFile = "${homeDir}/aria2.session";
-  downloadDir = "${homeDir}/Downloads";
+  rangesToStringList = map (x:
+    if x.from == x.to
+    then builtins.toString x.from
+    else builtins.toString x.from + "-" + builtins.toString x.to
+  );

-  rangesToStringList = map (x: builtins.toString x.from +"-"+ builtins.toString x.to);
-
-  settingsFile = pkgs.writeText "aria2.conf"
-  ''
-    dir=${cfg.downloadDir}
-    listen-port=${concatStringsSep "," (rangesToStringList cfg.listenPortRange)}
-    rpc-listen-port=${toString cfg.rpcListenPort}
-  '';
+  portRangesToString = ranges: lib.concatStringsSep "," (map
+    (x:
+      if x.from == x.to
+      then builtins.toString x.from
+      else builtins.toString x.from + "-" + builtins.toString x.to
+    )
+    ranges);

+  customToKeyValue = lib.generators.toKeyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault
+      {
+        mkValueString = v:
+          if builtins.isList v then portRangesToString v
+          else lib.generators.mkValueStringDefault { } v;
+      } "=";
+  };
 in
 {
  imports = [
-    (mkRemovedOptionModule [ "services" "aria2" "rpcSecret" ] "Use services.aria2.rpcSecretFile instead")
+    (lib.mkRemovedOptionModule [ "services" "aria2" "rpcSecret" ] "Use services.aria2.rpcSecretFile instead")
+    (lib.mkRemovedOptionModule [ "services" "aria2" "extraArguments" ] "Use services.aria2.settings instead")
+    (lib.mkRenamedOptionModule [ "services" "aria2" "downloadDir" ] [ "services" "aria2" "settings" "dir" ])
+    (lib.mkRenamedOptionModule [ "services" "aria2" "listenPortRange" ] [ "services" "aria2" "settings" "listen-port" ])
+    (lib.mkRenamedOptionModule [ "services" "aria2" "rpcListenPort" ] [ "services" "aria2" "settings" "rpc-listen-port" ])
  ];

  options = {
    services.aria2 = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = ''
          Whether or not to enable the headless Aria2 daemon service.

-          Aria2 daemon can be controlled via the RPC interface using
-          one of many WebUI (http://localhost:6800/ by default).
+          Aria2 daemon can be controlled via the RPC interface using one of many
+          WebUIs (http://localhost:${toString defaultRpcListenPort}/ by default).

-          Targets are downloaded to ${downloadDir} by default and are
-          accessible to users in the "aria2" group.
+          Targets are downloaded to `${defaultDir}` by default and are
+          accessible to users in the `aria2` group.
        '';
      };
-      openPorts = mkOption {
-        type = types.bool;
+      openPorts = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = ''
-          Open listen and RPC ports found in listenPortRange and rpcListenPort
-          options in the firewall.
+          Open listen and RPC ports found in `settings.listen-port` and
+          `settings.rpc-listen-port` options in the firewall.
        '';
      };
-      downloadDir = mkOption {
-        type = types.path;
-        default = downloadDir;
-        description = ''
-          Directory to store downloaded files.
-        '';
-      };
-      listenPortRange = mkOption {
-        type = types.listOf types.attrs;
-        default = [ { from = 6881; to = 6999; } ];
-        description = ''
-          Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.
-        '';
-      };
-      rpcListenPort = mkOption {
-        type = types.int;
-        default = 6800;
-        description = "Specify a port number for JSON-RPC/XML-RPC server to listen to. Possible Values: 1024-65535";
-      };
-      rpcSecretFile = mkOption {
-        type = types.path;
+      rpcSecretFile = lib.mkOption {
+        type = lib.types.path;
        example = "/run/secrets/aria2-rpc-token.txt";
        description = ''
          A file containing the RPC secret authorization token.
          Read https://aria2.github.io/manual/en/html/aria2c.html#rpc-auth to know how this option value is used.
        '';
      };
-      extraArguments = mkOption {
-        type = types.separatedString " ";
-        example = "--rpc-listen-all --remote-time=true";
-        default = "";
+      settings = lib.mkOption {
        description = ''
-          Additional arguments to be passed to Aria2.
+          Generates the `aria2.conf` file. Refer to [the documentation][0] for
+          all possible settings.
+
+          [0]: https://aria2.github.io/manual/en/html/aria2c.html#synopsis
        '';
+        type = lib.types.submodule {
+          freeformType = with lib.types; attrsOf (oneOf [ bool int float singleLineStr ]);
+          options = {
+            save-session = lib.mkOption {
+              type = lib.types.singleLineStr;
+              default = "${homeDir}/aria2.session";
+              description = "Save error/unfinished downloads to FILE on exit.";
+            };
+            dir = lib.mkOption {
+              type = lib.types.singleLineStr;
+              default = defaultDir;
+              description = "Directory to store downloaded files.";
+            };
+            conf-path = lib.mkOption {
+              type = lib.types.singleLineStr;
+              default = "${homeDir}/aria2.conf";
+              description = "Configuration file path.";
+            };
+            enable-rpc = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = "Enable JSON-RPC/XML-RPC server.";
+            };
+            listen-port = lib.mkOption {
+              type = with lib.types; listOf (attrsOf port);
+              default = [{ from = 6881; to = 6999; }];
+              description = "Set UDP listening port range used by DHT(IPv4, IPv6) and UDP tracker.";
+            };
+            rpc-listen-port = lib.mkOption {
+              type = lib.types.port;
+              default = defaultRpcListenPort;
+              description = "Specify a port number for JSON-RPC/XML-RPC server to listen to. Possible Values: 1024-65535";
+            };
+          };
+        };
      };
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings.enable-rpc;
+        message = "RPC has to be enabled, the default module option takes care of that.";
+      }
+      {
+        assertion = !(cfg.settings ? rpc-secret);
+        message = "Set the RPC secret through services.aria2.rpcSecretFile so it will not end up in the world-readable nix store.";
+      }
+    ];

    # Need to open ports for proper functioning
-    networking.firewall = mkIf cfg.openPorts {
-      allowedUDPPortRanges = config.services.aria2.listenPortRange;
-      allowedTCPPorts = [ config.services.aria2.rpcListenPort ];
+    networking.firewall = lib.mkIf cfg.openPorts {
+      allowedUDPPortRanges = config.services.aria2.settings.listen-port;
+      allowedTCPPorts = [ config.services.aria2.settings.rpc-listen-port ];
    };

    users.users.aria2 = {
@ -107,7 +146,7 @@ in

    systemd.tmpfiles.rules = [
      "d '${homeDir}' 0770 aria2 aria2 - -"
-      "d '${config.services.aria2.downloadDir}' 0770 aria2 aria2 - -"
+      "d '${config.services.aria2.settings.dir}' 0770 aria2 aria2 - -"
    ];

    systemd.services.aria2 = {
@ -115,22 +154,25 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      preStart = ''
-        if [[ ! -e "${sessionFile}" ]]
+        if [[ ! -e "${cfg.settings.save-session}" ]]
        then
-          touch "${sessionFile}"
+          touch "${cfg.settings.save-session}"
        fi
-        cp -f "${settingsFile}" "${settingsDir}/aria2.conf"
-        echo "rpc-secret=$(cat "$CREDENTIALS_DIRECTORY/rpcSecretFile")" >> "${settingsDir}/aria2.conf"
+        cp -f "${pkgs.writeText "aria2.conf" (customToKeyValue cfg.settings)}" "${cfg.settings.conf-path}"
+        chmod +w "${cfg.settings.conf-path}"
+        echo "rpc-secret=$(cat "$CREDENTIALS_DIRECTORY/rpcSecretFile")" >> "${cfg.settings.conf-path}"
      '';

      serviceConfig = {
        Restart = "on-abort";
-        ExecStart = "${pkgs.aria2}/bin/aria2c --enable-rpc --conf-path=${settingsDir}/aria2.conf ${config.services.aria2.extraArguments} --save-session=${sessionFile}";
+        ExecStart = "${pkgs.aria2}/bin/aria2c --conf-path=${cfg.settings.conf-path}";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        User = "aria2";
        Group = "aria2";
-        LoadCredential="rpcSecretFile:${cfg.rpcSecretFile}";
+        LoadCredential = "rpcSecretFile:${cfg.rpcSecretFile}";
      };
    };
  };
+
+  meta.maintainers = [ lib.maintainers.timhae ];
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -130,6 +130,7 @@ in {
  appliance-repart-image = runTest ./appliance-repart-image.nix;
  apparmor = handleTest ./apparmor.nix {};
  archi = handleTest ./archi.nix {};
+  aria2 = handleTest ./aria2.nix {};
  armagetronad = handleTest ./armagetronad.nix {};
  artalk = handleTest ./artalk.nix {};
  atd = handleTest ./atd.nix {};
--- a/nixos/tests/aria2.nix
+++ b/nixos/tests/aria2.nix
@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  rpcSecret = "supersecret";
+  rpc-listen-port = 6800;
+  curlBody = {
+    jsonrpc = 2.0;
+    id = 1;
+    method = "aria2.getVersion";
+    params = [ "token:${rpcSecret}" ];
+  };
+in
+rec {
+  name = "aria2";
+
+  nodes.machine = {
+    environment.etc."aria2Rpc".text = rpcSecret;
+    services.aria2 = {
+      enable = true;
+      rpcSecretFile = "/etc/aria2Rpc";
+      settings = {
+        inherit rpc-listen-port;
+        allow-overwrite = false;
+        check-integrity = true;
+        console-log-level = "warn";
+        listen-port = [{ from = 20000; to = 20010; } { from = 22222; to = 22222; }];
+        max-concurrent-downloads = 50;
+        seed-ratio = 1.2;
+        summary-interval = 0;
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("aria2.service")
+    curl_cmd = 'curl --fail-with-body -X POST -H "Content-Type: application/json" \
+                -d \'${builtins.toJSON curlBody}\' http://localhost:${toString rpc-listen-port}/jsonrpc'
+    print(machine.wait_until_succeeds(curl_cmd, timeout=10))
+    machine.shutdown()
+  '';
+
+  meta.maintainers = [ pkgs.lib.maintainers.timhae ];
+})
--- a/pkgs/applications/backup/unifi-protect-backup/default.nix
+++ b/pkgs/applications/backup/unifi-protect-backup/default.nix
@ -3,16 +3,32 @@
 , python3
 }:

-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      pyunifiprotect = super.pyunifiprotect.overridePythonAttrs {
+        version = "unstable-2024-06-08";
+        src = fetchFromGitHub {
+          owner = "ep1cman";
+          repo = "pyunifiprotect";
+          rev = "d967bca2c65e0aa6a7363afb6367c3745c076747";
+          hash = "sha256-gSAK/T9cjIiRC/WjwrdLP+LHzEEUsNbwpXClYqpnMio=";
+        };
+      };
+    };
+  };
+in
+
+python.pkgs.buildPythonApplication rec {
  pname = "unifi-protect-backup";
-  version = "0.10.7";
+  version = "0.11.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ep1cman";
    repo = "unifi-protect-backup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Ypx9drM9Ks3RR75lz2COflr6GF6Bm9D+GwJWPGwuq/c=";
+    hash = "sha256-t4AgPFqKS6u9yITIkUUB19/SxVwR7X8Cc01oPx3M+E0=";
  };

  pythonRelaxDeps = [
@ -22,12 +38,12 @@ python3.pkgs.buildPythonApplication rec {
    "pyunifiprotect"
  ];

-  nativeBuildInputs = with python3.pkgs; [
+  nativeBuildInputs = with python.pkgs; [
    poetry-core
    pythonRelaxDepsHook
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python.pkgs; [
    aiocron
    aiolimiter
    aiorun
@ -40,7 +56,7 @@ python3.pkgs.buildPythonApplication rec {
    pyunifiprotect
  ];

-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python.pkgs; [
    pytestCheckHook
  ];

--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -8173,6 +8173,30 @@ final: prev:
    meta.homepage = "https://github.com/ojroques/nvim-osc52/";
  };

+  nvim-paredit = buildVimPlugin {
+    pname = "nvim-paredit";
+    version = "2024-03-30";
+    src = fetchFromGitHub {
+      owner = "julienvincent";
+      repo = "nvim-paredit";
+      rev = "8dd4ffd6ee0d798026f9ad6cf04344560207b9f1";
+      sha256 = "0kqd87m58ya9faijs2ldzirps5ayillfmcdgd19b342jw0q393k6";
+    };
+    meta.homepage = "https://github.com/julienvincent/nvim-paredit/";
+  };
+
+  nvim-parinfer = buildVimPlugin {
+    pname = "nvim-parinfer";
+    version = "2023-08-09";
+    src = fetchFromGitHub {
+      owner = "gpanders";
+      repo = "nvim-parinfer";
+      rev = "5ca09287ab3f4144f78ff7977fabc27466f71044";
+      sha256 = "0qci774sf7kxsq1a77nmis4zgjggf89w0j5ibzdbrw11cyv0nb3n";
+    };
+    meta.homepage = "https://github.com/gpanders/nvim-parinfer/";
+  };
+
  nvim-peekup = buildVimPlugin {
    pname = "nvim-peekup";
    version = "2023-02-23";
@ -8979,6 +9003,18 @@ final: prev:
    meta.homepage = "https://github.com/NLKNguyen/papercolor-theme/";
  };

+  parpar-nvim = buildVimPlugin {
+    pname = "parpar-nvim";
+    version = "2023-09-12";
+    src = fetchFromGitHub {
+      owner = "dundalek";
+      repo = "parpar.nvim";
+      rev = "e99a88f0f0b1234f49a3efe9c49b712b58a5acfc";
+      sha256 = "09y0q4shgi8a88z42lrkh41ay64yhb7050rlc3b6r2lk6k72xdqz";
+    };
+    meta.homepage = "https://github.com/dundalek/parpar.nvim/";
+  };
+
  pear-tree = buildVimPlugin {
    pname = "pear-tree";
    version = "2019-12-08";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -687,6 +687,8 @@ https://github.com/yamatsum/nvim-nonicons/,,
 https://github.com/rcarriga/nvim-notify/,,
 https://github.com/LhKipp/nvim-nu/,HEAD,
 https://github.com/ojroques/nvim-osc52/,,
+https://github.com/julienvincent/nvim-paredit,,
+https://github.com/gpanders/nvim-parinfer/,HEAD,
 https://github.com/gennaro-tedesco/nvim-peekup/,,
 https://github.com/yorickpeterse/nvim-pqf/,HEAD,
 https://github.com/jamestthompson3/nvim-remote-containers/,HEAD,
@ -754,6 +756,7 @@ https://github.com/drewtempelmeyer/palenight.vim/,,
 https://github.com/JoosepAlviste/palenightfall.nvim/,,
 https://github.com/roobert/palette.nvim/,HEAD,
 https://github.com/NLKNguyen/papercolor-theme/,,
+https://github.com/dundalek/parpar.nvim,,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/olimorris/persisted.nvim/,HEAD,
--- a/pkgs/applications/graphics/curtail/default.nix
+++ b/pkgs/applications/graphics/curtail/default.nix
@ -20,14 +20,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "curtail";
-  version = "1.9.1";
+  version = "1.10.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "Huluti";
    repo = "Curtail";
    rev = "refs/tags/${version}";
-    sha256 = "sha256-9xTdT2mS3aWyimkxrNwCuWIzZ0dPE7w4xUwO53kKr30=";
+    sha256 = "sha256-xwpjyMMdjYMrd79/EzoNae4rQuq2VjwJRNoudNGD78E=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -259,6 +259,14 @@ let
      # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn
      # flag (declare_args) so we simply hardcode it to false.
      ./patches/widevine-disable-auto-download-allow-bundle.patch
+    ] ++ lib.optionals (versionRange "125" "126") [
+      # Fix building M125 with ninja 1.12. Not needed for M126+.
+      # https://issues.chromium.org/issues/336911498
+      # https://chromium-review.googlesource.com/c/chromium/src/+/5487538
+      (githubPatch {
+        commit = "a976cb05b4024b7a6452d1541378d718cdfe33e6";
+        hash = "sha256-K2PSeJAvhGH2/Yp63/4mJ85NyqXqDDkMWY+ptrpgmOI=";
+      })
    ] ++ [
      # Required to fix the build with a more recent wayland-protocols version
      # (we currently package 1.26 in Nixpkgs while Chromium bundles 1.21):
--- a/pkgs/applications/science/logic/cryptoverif/default.nix
+++ b/pkgs/applications/science/logic/cryptoverif/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, ocaml }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "cryptoverif";
-  version = "2.08pl1";
+  version = "2.09";

  src = fetchurl {
-    url    = "http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverif${version}.tar.gz";
-    hash = "sha256-rmORSZuhds9W2WpNgYf4AJM2jgEUPoJit4G64qLqj5w=";
+    url    = "http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverif${finalAttrs.version}.tar.gz";
+    hash = "sha256-FJlPZgTUZ+6HzhG/B0dOiVIjDvoCnF6yg2E9UriSojw=";
  };

  /* Fix up the frontend to load the 'default' cryptoverif library
@ -48,4 +48,4 @@ stdenv.mkDerivation rec {
    platforms   = lib.platforms.unix;
    maintainers = [ lib.maintainers.thoughtpolice ];
  };
-}
+})
--- a/pkgs/by-name/bo/boxbuddy/package.nix
+++ b/pkgs/by-name/bo/boxbuddy/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "boxbuddy";
-  version = "2.2.4";
+  version = "2.2.5";

  src = fetchFromGitHub {
    owner = "Dvlv";
    repo = "BoxBuddyRS";
    rev = version;
-    hash = "sha256-1a9rSVP40+ZKp21BJLO+6HGDf1m6dROqGyTkql58iA4=";
+    hash = "sha256-Dy7mSBraMHAno8cIk9f6/Ofsm2ZGSb7VS5Wy1o+ZoC8=";
  };

-  cargoHash = "sha256-Y89TkqjTmaYnFsQmg48FSPMFoUL7Wbgb2xh60boILdQ=";
+  cargoHash = "sha256-NB93bw2mMCVmZWpxCJGusXp2DgotjrlHUlsd0mb+fBA=";

  # The software assumes it is installed either in flatpak or in the home directory
  # so the xdg data path needs to be patched here
--- a/pkgs/by-name/li/linux-scripts/package.nix
+++ b/pkgs/by-name/li/linux-scripts/package.nix
@ -0,0 +1,64 @@
+{ lib
+, linuxHeaders # Linux source tree
+, makeWrapper
+, stdenvNoCC
+
+, binutils
+, coreutils
+, gnugrep
+
+  # decompressors for possible kernel image formats
+, bzip2
+, gzip
+, lz4
+, lzop
+, xz
+, zstd
+}:
+
+let
+  commonDeps = [
+    binutils
+    coreutils
+    gnugrep
+    gzip
+    xz
+    bzip2
+    lzop
+    lz4
+    zstd
+  ];
+
+  toWrapScriptLines = scriptName: ''
+    install -Dm 0755 scripts/${scriptName} $out/bin/${scriptName}
+    wrapProgram $out/bin/${scriptName} --prefix PATH : ${lib.makeBinPath commonDeps}
+  '';
+in
+stdenvNoCC.mkDerivation
+{
+  inherit (linuxHeaders) version;
+  pname = "linux-scripts";
+
+  # These scripts will rarely change and are usually not bound to a specific
+  # version of Linux. So it is okay to just use whatever Linux version comes
+  # from `linuxHeaders.
+  src = linuxHeaders.src;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    ${toWrapScriptLines "extract-ikconfig"}
+    ${toWrapScriptLines "extract-vmlinux"}
+  '';
+
+  meta = with lib; {
+    description = "Standalone scripts from <linux>/scripts";
+    homepage = "https://www.kernel.org/";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.phip1611 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/mo/mousam/package.nix
+++ b/pkgs/by-name/mo/mousam/package.nix
@ -12,15 +12,15 @@

 python3Packages.buildPythonApplication rec {
  pname = "mousam";
-  version = "1.2.0";
+  version = "1.3.1";
  # built with meson, not a python format
  pyproject = false;

  src = fetchFromGitHub {
    owner = "amit9838";
    repo = "mousam";
-    rev = "v${version}";
-    hash = "sha256-/mOb4Pgdn5DcxwHjlI8L9kKD/Y6a4vROLbsQBb62VXM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QFEn7o3DRJyRLbEfb86AsS/ifYqzs3b5n2fZa/9Mm1A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@ -70,17 +70,16 @@ let
      "but they are mutually exclusive; falling back to cpu"
    ])
    (!(config.rocmSupport && config.cudaSupport));
-  validateLinux = api: (lib.warnIfNot stdenv.isLinux
-    "building ollama with `${api}` is only supported on linux; falling back to cpu"
-    stdenv.isLinux);
  shouldEnable = assert accelIsValid;
    mode: fallback:
-      ((acceleration == mode)
-      || (fallback && acceleration == null && validateFallback))
-      && (validateLinux mode);
+      (acceleration == mode)
+      || (fallback && acceleration == null && validateFallback);

-  enableRocm = shouldEnable "rocm" config.rocmSupport;
-  enableCuda = shouldEnable "cuda" config.cudaSupport;
+  rocmRequested = shouldEnable "rocm" config.rocmSupport;
+  cudaRequested = shouldEnable "cuda" config.cudaSupport;
+
+  enableRocm = rocmRequested && stdenv.isLinux;
+  enableCuda = cudaRequested && stdenv.isLinux;


  rocmLibs = [
@ -209,13 +208,13 @@ goBuild ((lib.optionalAttrs enableRocm {

  meta = {
    description = "Get up and running with large language models locally"
-      + lib.optionalString enableRocm ", using ROCm for AMD GPU acceleration"
-      + lib.optionalString enableCuda ", using CUDA for NVIDIA GPU acceleration";
+      + lib.optionalString rocmRequested ", using ROCm for AMD GPU acceleration"
+      + lib.optionalString cudaRequested ", using CUDA for NVIDIA GPU acceleration";
    homepage = "https://github.com/ollama/ollama";
    changelog = "https://github.com/ollama/ollama/releases/tag/v${version}";
    license = licenses.mit;
    platforms =
-      if (enableRocm || enableCuda) then platforms.linux
+      if (rocmRequested || cudaRequested) then platforms.linux
      else platforms.unix;
    mainProgram = "ollama";
    maintainers = with maintainers; [ abysssol dit7ya elohmeier roydubnium ];
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@ -7,19 +7,19 @@
 }:
 let
  pname = "open-webui";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    rev = "v${version}";
-    hash = "sha256-hUm4UUQUFoDRrAg+RqIo735iQs8304OUJlT91vILmXo=";
+    hash = "sha256-hEO00R96vOi4FlUY46ajBvw0PUc2hA7tAS+hldXNLzY=";
  };

  frontend = buildNpmPackage {
    inherit pname version src;

-    npmDepsHash = "sha256-VdGneemYLMuMczjQB6I35Ry2kyIuAe2IaeDus/NvzK8=";
+    npmDepsHash = "sha256-BeN9e74/D5jv+t214llmVhU/IJWfjRpUy5EFBAH+K4k=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
@ -73,6 +73,7 @@ python3.pkgs.buildPythonApplication rec {
    boto3
    chromadb
    docx2txt
+    duckduckgo-search
    extract-msg
    fake-useragent
    fastapi
@ -85,7 +86,6 @@ python3.pkgs.buildPythonApplication rec {
    langchain-chroma
    langchain-community
    langfuse
-    litellm
    markdown
    opencv4
    openpyxl
--- a/pkgs/by-name/pw/pwalarmctl/package.nix
+++ b/pkgs/by-name/pw/pwalarmctl/package.nix
@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, alsa-lib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pwalarmctl";
+  version = "0.1.0";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ alsa-lib ];
+
+  src = fetchFromGitHub {
+    owner = "amyipdev";
+    repo = "pwalarmd";
+    rev = "v${version}";
+    hash = "sha256-xoC1PtDQjkvoWb9x8A43ITo6xyYOv9hxH2pxiZBBvKI=";
+  };
+
+  cargoHash = "sha256-OvTGpekiy6j7un+jF4t9tauzi4RndIyPwJRHTOtt4GM=";
+
+  preBuild = ''
+    cargo check
+  '';
+
+  buildAndTestSubdir = "pwalarmctl";
+
+  meta = {
+    description = "Controller for pwalarmd";
+    longDescription = ''
+      pwalarmctl is a command-line controller for pwalarmd which allows
+      for live configuration changes and access to the active state
+      of pwalarmd.
+    '';
+    mainProgram = "pwalarmctl";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.all;
+    badPlatforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ amyipdev ];
+  };
+}
--- a/pkgs/by-name/py/pybibget/package.nix
+++ b/pkgs/by-name/py/pybibget/package.nix
@ -0,0 +1,42 @@
+{ lib
+, python3
+, fetchPypi
+}:
+
+let
+  pname = "pybibget";
+  version = "0.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1n4as3kdsgrcmxxyjz9klm0v0pb24rsa1b7r43j7wmnfsir8i81k";
+  };
+
+in
+python3.pkgs.buildPythonApplication  {
+  inherit pname version src;
+  pyproject = true;
+
+  propagatedBuildInputs = with python3.pkgs; [
+    lxml
+    httpx
+    appdirs
+    aiolimiter
+    pybtex
+    pylatexenc
+    numpy
+    networkx
+    requests
+  ];
+
+  # Tests for this applicaiton do not run on NixOS, and binaries were
+  # manually tested instead
+  doCheck = false;
+
+  meta = {
+    description = "Command line utility to automatically retrieve BibTeX citations from MathSciNet, arXiv, PubMed and doi.org";
+    homepage = "https://github.com/wirhabenzeit/pybibget";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ vasissualiyp ];
+  };
+}
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@ -16,6 +16,11 @@ python3.pkgs.toPythonModule (python3.pkgs.buildPythonApplication rec {

  postPatch = ''
    sed -i 's/==.*$//' requirements.txt
+
+    # can't be fetchpatched as it is essentially empty and it complains about that
+    # TODO: drop when updating to a version that includes https://github.com/searxng/searxng/pull/3563
+    touch searx/answerers/random/__init__.py
+    touch searx/answerers/statistics/__init__.py
  '';

  preBuild =
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  substituteAll,
+  makeBinaryWrapper,
  makeWrapper,
  makeDesktopItem,
  copyDesktopItems,
@ -31,19 +32,35 @@ stdenv.mkDerivation (finalAttrs: {
  };

  pnpmDeps = pnpm.fetchDeps {
-    inherit (finalAttrs) pname version src patches;
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
    hash = "sha256-PogE8uf3W5cKSCqFHMz7FOvT7ONUP4FiFWGBgtk3UC8=";
  };

-  nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
-    makeWrapper
-    nodejs
-    pnpm.configHook
-  ];
+  nativeBuildInputs =
+    [
+      nodejs
+      pnpm.configHook
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      # vesktop uses venmic, which is a shipped as a prebuilt node module
+      # and needs to be patched
+      autoPatchelfHook
+      copyDesktopItems
+      # we use a script wrapper here for environment variable expansion at runtime
+      # https://github.com/NixOS/nixpkgs/issues/172583
+      makeWrapper
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # on macos we don't need to expand variables, so we can use the faster binary wrapper
+      makeBinaryWrapper
+    ];

-  buildInputs = [
+  buildInputs = lib.optionals stdenv.isLinux [
    libpulseaudio
    pipewire
    stdenv.cc.cc.lib
@ -56,65 +73,92 @@ stdenv.mkDerivation (finalAttrs: {
      src = ./use_system_vencord.patch;
    });

-  ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  # disable code signing on macos
+  # https://github.com/electron-userland/electron-builder/blob/77f977435c99247d5db395895618b150f5006e8f/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
+  postConfigure = lib.optionalString stdenv.isDarwin ''
+    export CSC_IDENTITY_AUTO_DISCOVERY=false
+  '';
+
+  # electron builds must be writable on darwin
+  preBuild = lib.optionalString stdenv.isDarwin ''
+    cp -r ${electron}/Applications/Electron.app .
+    chmod -R u+w Electron.app
+  '';

  buildPhase = ''
    runHook preBuild

    pnpm build
-    # using `pnpm exec` here apparently makes it ignore ELECTRON_SKIP_BINARY_DOWNLOAD
-    ./node_modules/.bin/electron-builder \
+    pnpm exec electron-builder \
      --dir \
      -c.asarUnpack="**/*.node" \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
      -c.electronVersion=${electron.version}

    runHook postBuild
  '';

-  # this is consistent with other nixpkgs electron packages and upstream, as far as I am aware
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/opt/Vesktop
-    cp -r dist/linux-*unpacked/resources $out/opt/Vesktop/
-
+  postBuild = lib.optionalString stdenv.isLinux ''
    pushd build
    ${libicns}/bin/icns2png -x icon.icns
-    for file in icon_*x32.png; do
-      file_suffix=''${file//icon_}
-      install -Dm0644 $file $out/share/icons/hicolor/''${file_suffix//x32.png}/apps/vesktop.png
-    done
-
-    makeWrapper ${electron}/bin/electron $out/bin/vesktop \
-      --add-flags $out/opt/Vesktop/resources/app.asar \
-      ${lib.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
-
-    runHook postInstall
+    popd
  '';

-  desktopItems = [
-    (makeDesktopItem {
-      name = "vesktop";
-      desktopName = "Vesktop";
-      exec = "vesktop %U";
-      icon = "vesktop";
-      startupWMClass = "Vesktop";
-      genericName = "Internet Messenger";
-      keywords = [
-        "discord"
-        "vencord"
-        "electron"
-        "chat"
-      ];
-      categories = [
-        "Network"
-        "InstantMessaging"
-        "Chat"
-      ];
-    })
-  ];
+  installPhase =
+    ''
+      runHook preInstall
+    ''
+    + lib.optionalString stdenv.isLinux ''
+      mkdir -p $out/opt/Vesktop
+      cp -r dist/*unpacked/resources $out/opt/Vesktop/
+
+      for file in build/icon_*x32.png; do
+        file_suffix=''${file//icon_}
+        install -Dm0644 $file $out/share/icons/hicolor/''${file_suffix//x32.png}/apps/vesktop.png
+      done
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/{Applications,bin}
+      mv dist/mac*/Vesktop.App $out/Applications
+    ''
+    + ''
+      runHook postInstall
+    '';
+
+  postFixup =
+    lib.optionalString stdenv.isLinux ''
+      makeWrapper ${electron}/bin/electron $out/bin/vesktop \
+        --add-flags $out/opt/Vesktop/resources/app.asar \
+        ${lib.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      makeWrapper $out/Applications/Vesktop.app/Contents/MacOS/Vesktop $out/bin/vesktop
+    '';
+
+  desktopItems = lib.optional stdenv.isLinux (makeDesktopItem {
+    name = "vesktop";
+    desktopName = "Vesktop";
+    exec = "vesktop %U";
+    icon = "vesktop";
+    startupWMClass = "Vesktop";
+    genericName = "Internet Messenger";
+    keywords = [
+      "discord"
+      "vencord"
+      "electron"
+      "chat"
+    ];
+    categories = [
+      "Network"
+      "InstantMessaging"
+      "Chat"
+    ];
+  });

  passthru = {
    inherit (finalAttrs) pnpmDeps;
@ -131,10 +175,12 @@ stdenv.mkDerivation (finalAttrs: {
      vgskye
      pluiedev
    ];
+    mainProgram = "vesktop";
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
    ];
-    mainProgram = "vesktop";
  };
 })
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@ -1,10 +1,10 @@
 {
  "darwin": {
-    "hash": "sha256-cK82M7vOjtDdfWbaYzbHHkcqwF8L3crVA9jJotnPpX4=",
-    "version": "0.2024.05.21.16.09.stable_02"
+    "hash": "sha256-PWcsgYnq8dCyAPJPPWeWXi1HpEgpKBt8OS4VH7XcLFM=",
+    "version": "0.2024.06.04.08.02.stable_02"
  },
  "linux": {
-    "hash": "sha256-chIrRzsxjFYS4UFYCTy04cdwSyCq/+/WiKBAmV9OdLs=",
-    "version": "0.2024.05.21.16.09.stable_02"
+    "hash": "sha256-65H9SVcsco282MA//URP6gBuFjDc3R5elL2oZ0ae4W4=",
+    "version": "0.2024.06.04.08.02.stable_02"
  }
 }
--- a/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-power-manager/default.nix
@ -12,9 +12,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-power-manager";
-  version = "4.18.3";
+  version = "4.18.4";

-  sha256 = "sha256-CuW2siApho7u8P01t15dAiqNAiwQzAMZsEugYuKN4kM=";
+  sha256 = "sha256-aybY+B8VC/XS6FO3XRpYuJd9Atr9Tc/Uo45q9fh3YLE=";

  buildInputs = [
    gtk3
@ -29,9 +29,9 @@ mkXfceDerivation {
  # using /run/current-system/sw/bin instead of nix store path prevents polkit permission errors on
  # rebuild.  See https://github.com/NixOS/nixpkgs/issues/77485
  postPatch = ''
-    substituteInPlace src/org.xfce.power.policy.in2 --replace "@sbindir@" "/run/current-system/sw/bin"
-    substituteInPlace common/xfpm-brightness.c --replace "SBINDIR" "\"/run/current-system/sw/bin\""
-    substituteInPlace src/xfpm-suspend.c --replace "SBINDIR" "\"/run/current-system/sw/bin\""
+    substituteInPlace src/org.xfce.power.policy.in2 --replace-fail "@sbindir@" "/run/current-system/sw/bin"
+    substituteInPlace common/xfpm-brightness.c --replace-fail "SBINDIR" "\"/run/current-system/sw/bin\""
+    substituteInPlace src/xfpm-suspend.c --replace-fail "SBINDIR" "\"/run/current-system/sw/bin\""
  '';

  meta = with lib; {
--- a/pkgs/desktops/xfce/core/xfce4-session/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session/default.nix
@ -1,6 +1,5 @@
 { lib
 , mkXfceDerivation
-, fetchpatch
 , polkit
 , exo
 , libxfce4util
@ -16,18 +15,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-session";
-  version = "4.18.3";
+  version = "4.18.4";

-  sha256 = "sha256-qCkE3aVYVwphoO1ZAyzpL1ZtsLaP6XT1H1rlFoBI3yg=";
-
-  patches = [
-    # Add minimal xdg-desktop-portal conf file
-    # https://gitlab.xfce.org/xfce/xfce4-session/-/issues/181
-    (fetchpatch {
-      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/6451c8b21085631d8861e07ff4e1b2ef64a64ad3.patch";
-      sha256 = "sha256-t3opom0iv7QsKoivzk+nXbxI5uFhNmB8/Qwb4QHvcCQ=";
-    })
-  ];
+  sha256 = "sha256-YxIHxb8mRggHLJ9TQ+KGb9qjt+DMZrxMn+oFuFRL8GI=";

  buildInputs = [
    exo
@ -43,9 +33,6 @@ mkXfceDerivation {

  configureFlags = [ "--with-xsession-prefix=${placeholder "out"}" ];

-  # See https://github.com/NixOS/nixpkgs/issues/36468
-  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
  passthru.xinitrc = "${xfce4-session}/etc/xdg/xfce4/xinitrc";

  meta = with lib; {
--- a/pkgs/desktops/xfce/core/xfce4-settings/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings/default.nix
@ -16,15 +16,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-settings";
-  version = "4.18.4";
+  version = "4.18.6";

-  sha256 = "sha256-f6ldTmTSvfRjn6j/LKIoFI3cbYZFtNdnAq3dQewc948=";
-
-  postPatch = ''
-    for f in xfsettingsd/pointers.c dialogs/mouse-settings/main.c; do
-      substituteInPlace $f --replace \"libinput-properties.h\" '<xorg/libinput-properties.h>'
-    done
-  '';
+  sha256 = "sha256-xiu26B3dbWu+/AtF/iUC6Wo2U5ZZyzN9RfdbBaQRJ1M=";

  buildInputs = [
    exo
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.105";
+  version = "9.2.106";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "ailment";
    rev = "refs/tags/v${version}";
-    hash = "sha256-9Qg8vWSojYcfWhKcGeV+UcrZCpae6/bVOxMyRCLXQPY=";
+    hash = "sha256-f1F1mPqrZJvXPmziyRIoPj7lIAfSWzpSpLtVs1RjzhI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -37,7 +37,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.105";
+  version = "9.2.106";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -46,7 +46,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KYRbMrxPAZAY/KGWnf5GYowXufhriWCJhV8ZbhIzsVc=";
+    hash = "sha256-TM6Jvb260lQWDrqYASdpRqgS9PmkmPUBcncDtTwWKAU=";
  };

  pythonRelaxDeps = [ "capstone" ];
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.105";
+  version = "9.2.106";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "archinfo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xLwqK4CwgxIWjmVVR5GnK0KacL08ojKXtMkhwBE+5xI=";
+    hash = "sha256-tjM0+R7m9jlhf/cXptjOoyV7o+9xU889wTwOBcFjNSQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.105";
+  version = "9.2.106";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Jiv8j6lpNaQjPFSaWUiakxQnh67EvTtE+WxjB3E06LY=";
+    hash = "sha256-y3r0/FU8GcVMv+wnccCB/SUBS+TC22S3qp4Awbhoung=";
  };

  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -19,14 +19,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.105";
+  version = "9.2.106";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-O5VCPxpm/aVBYrJG49t1McGYN4mTLItDW2aBzdznTlw=";
+    hash = "sha256-f8lbofU5VYWDZ4BmSRE81X/3Rk8aj9yvEn9PM0lkZoM=";
  };
 in
 buildPythonPackage rec {
@ -40,7 +40,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nbcU/t9mwcpLPcx1By+maMLyWD/b1BBhCg52+qNqrhI=";
+    hash = "sha256-eOKAVqtGt86UJhdobKu4QYN5lC9YjZ+luZwwSm3J1xw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/curl-cffi/default.nix
+++ b/pkgs/development/python-modules/curl-cffi/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "curl-cffi";
-  version = "0.6.4";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "yifeikong";
    repo = "curl_cffi";
    rev = "refs/tags/v${version}";
-    hash = "sha256-bNBpZAIdfub2osByo827RBw/gouCmNt8uVN0y1KdcUk=";
+    hash = "sha256-txrJNUzswAPeH4Iazn0iKJI0Rqk0HHRoDrtTfDHKMoo=";
  };

  patches = [ ./use-system-libs.patch ];
--- a/pkgs/development/python-modules/duckduckgo-search/default.nix
+++ b/pkgs/development/python-modules/duckduckgo-search/default.nix
@ -8,42 +8,10 @@
  orjson,
  curl-cffi,

-  # To build orjson
-  rustPlatform,
-
  # Optional dependencies
  lxml,
 }:
-let
-  curl-cffi_0_7_0 = curl-cffi.overrideAttrs (
-    final: old: {
-      version = "0.7.0b4";
-      src = fetchFromGitHub {
-        owner = "yifeikong";
-        repo = "curl_cffi";
-        rev = "v${final.version}";
-        hash = "sha256-txrJNUzswAPeH4Iazn0iKJI0Rqk0HHRoDrtTfDHKMoo=";
-      };
-    }
-  );

-  orjson_3_10_3 = orjson.overrideAttrs (
-    final: old: {
-      version = "3.10.3";
-      src = fetchFromGitHub {
-        owner = "ijl";
-        repo = "orjson";
-        rev = "refs/tags/${final.version}";
-        hash = "sha256-bK6wA8P/IXEbiuJAx7psd0nUUKjR1jX4scFfJr1MBAk=";
-      };
-      cargoDeps = rustPlatform.fetchCargoTarball {
-        inherit (final) src;
-        name = "${old.pname}-${final.version}";
-        hash = "sha256-ilGq+/gPSuNwURUWy2ZxInzmUv+PxYMxd8esxrMpr2o=";
-      };
-    }
-  );
-in
 buildPythonPackage rec {
  pname = "duckduckgo-search";
  version = "v5.3.1";
@ -58,12 +26,12 @@ buildPythonPackage rec {
    hash = "sha256-T7rlB3dU7y+HbHr1Ss9KkejlXFORhnv9Va7cFTRtfQU=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    click
-    orjson_3_10_3
-    curl-cffi_0_7_0
+    curl-cffi
+    orjson
  ];

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/einops/default.nix
+++ b/pkgs/development/python-modules/einops/default.nix
@ -55,6 +55,8 @@ buildPythonPackage rec {

  disabledTestPaths = [ "tests/test_layers.py" ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Flexible and powerful tensor operations for readable and reliable code";
    homepage = "https://github.com/arogozhnikov/einops";
--- a/pkgs/development/python-modules/google-nest-sdm/default.nix
+++ b/pkgs/development/python-modules/google-nest-sdm/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "google-nest-sdm";
-  version = "4.0.4";
+  version = "4.0.5";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "allenporter";
    repo = "python-google-nest-sdm";
    rev = "refs/tags/${version}";
-    hash = "sha256-bvfc9FPUSCVaHxyICCXmUCbbc6Vdxba1Tv8dbi7Ax6M=";
+    hash = "sha256-SA2PlHiqvvbXmCg0WqehLDiIGEMDbzwbzbCX1klMHis=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ipywidgets/default.nix
+++ b/pkgs/development/python-modules/ipywidgets/default.nix
@ -17,12 +17,12 @@

 buildPythonPackage rec {
  pname = "ipywidgets";
-  version = "8.1.2";
+  version = "8.1.3";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-0Lm0Hkm66SaoZuYTo5sPAJd0XSufHz3UBmQbSlfsQsk=";
+    hash = "sha256-9fnuquCCsYI86erCV1JylS9A10iJOXKVbcCXAKY5LZw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@ -35,14 +35,14 @@

 buildPythonPackage rec {
  pname = "jupyter-server";
-  version = "2.14.0";
+  version = "2.14.1";
  pyproject = true;
  disabled = pythonOlder "3.8";

  src = fetchPypi {
    pname = "jupyter_server";
    inherit version;
-    hash = "sha256-ZZFUzqUSCDQ0/XyTt/4Il696L9C53UdJKCtC6qxK5nc=";
+    hash = "sha256-ElWNFY7HoGU7+WzCcrx6154BJ9UDuYLtFEOZNGaU9yY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/jupyterlab-widgets/default.nix
+++ b/pkgs/development/python-modules/jupyterlab-widgets/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "jupyterlab-widgets";
-  version = "3.0.10";
+  version = "3.0.11";
  pyproject = true;

  src = fetchPypi {
    pname = "jupyterlab_widgets";
    inherit version;
-    hash = "sha256-BPKsBJdnJ+T50PqRzcLxq4YPll5QTCnb1qZciCydBMA=";
+    hash = "sha256-3VrGeVk8lprynJvtBUwk8mhCuqUTUhFHNnVrwDXe7ic=";
  };

  # jupyterlab is required to build from source but we use the pre-build package
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "marimo";
-  version = "0.6.14";
+  version = "0.6.17";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-9rbRoBshVK0P8eqdOHyKQCwNkPsp2HiIhzyST3QXJpc=";
+    hash = "sha256-vK4pa7CnVQp78DhEFIkNLNS5y35x9YV2nV3d0JOBTIA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@ -53,6 +53,8 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "mkdocs_jupyter" ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Use Jupyter Notebook in mkdocs";
    homepage = "https://github.com/danielfrg/mkdocs-jupyter";
--- a/pkgs/development/python-modules/nbexec/default.nix
+++ b/pkgs/development/python-modules/nbexec/default.nix
@ -7,6 +7,7 @@
  jupyter-client,
  nbformat,
  nbconvert,
+  setuptools,
  # check inputs
  unittestCheckHook,
  ipykernel,
@ -17,7 +18,7 @@ let
 in
 buildPythonPackage {
  inherit pname version;
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.9";

@ -28,7 +29,9 @@ buildPythonPackage {
    hash = "sha256-Vv6EHX6WlnSmzQAYlO1mHnz5t078z3RQfVfte1+X2pw=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    jupyter-client
    nbformat
    nbconvert
@ -52,6 +55,8 @@ buildPythonPackage {

  pythonImportsCheck = [ "nbexec" ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Dead-simple tool for executing Jupyter notebooks from the command line";
    mainProgram = "nbexec";
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "notebook";
-  version = "7.2.0";
-  disabled = pythonOlder "3.8";
+  version = "7.2.1";
+  pyproject = true;

-  format = "pyproject";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-NKK6SwitXRnskw23SE+3l0aheEvp4aX4IY+a+GVqFB8=";
+    hash = "sha256-Qoe22ll0CzIXPQHWQfdj0pL0nDDnpRuJxGuoRzEmNB4=";
  };

  postPatch = ''
@ -32,13 +32,13 @@ buildPythonPackage rec {
      --replace "timeout = 300" ""
  '';

-  nativeBuildInputs = [
+  build-system = [
    hatch-jupyter-builder
    hatchling
    jupyterlab
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    jupyter-server
    jupyterlab
    jupyterlab-server
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@ -5,13 +5,18 @@
  fetchPypi,
  google-api-python-client,
  google-auth-oauthlib,
+  jsonschema,
  jupyterhub,
  mwoauth,
  pyjwt,
  pytest-asyncio,
  pytestCheckHook,
+  requests,
  requests-mock,
+  ruamel-yaml,
  setuptools,
+  tornado,
+  traitlets,
 }:

 buildPythonPackage rec {
@ -34,8 +39,13 @@ buildPythonPackage rec {
  build-system = [ setuptools ];

  dependencies = [
+    jsonschema
    jupyterhub
    pyjwt
+    requests
+    ruamel-yaml
+    tornado
+    traitlets
  ];

  passthru.optional-dependencies = {
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "py-synologydsm-api";
-  version = "2.4.3";
+  version = "2.4.4";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mib1185";
    repo = "py-synologydsm-api";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KhYK72kIPeZ32bdJ+3j8rcq/LIrcuELQD+/OQYhktog=";
+    hash = "sha256-46KoOKBiulTYH2x8ftFPVDF0oeBG1Pe9PkonxIV7528=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pydantic/1.nix
+++ b/pkgs/development/python-modules/pydantic/1.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "pydantic";
-  version = "1.10.14";
+  version = "1.10.16";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "pydantic";
    repo = "pydantic";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tcaHSPZggVwyzCgDmwOgcGqUmUrJOmkdSNudJTFQ3bc=";
+    hash = "sha256-dn/ZsxbkyK2sJxpo6IsoMBRjq1STdu+xuqHXoNG+Kzk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pydub/default.nix
+++ b/pkgs/development/python-modules/pydub/default.nix
@ -7,6 +7,7 @@
  pytestCheckHook,
  pythonOlder,
  setuptools,
+  substituteAll,
 }:

 buildPythonPackage rec {
@ -30,12 +31,18 @@ buildPythonPackage rec {
      url = "https://github.com/jiaaro/pydub/commit/66c1bf7813ae8621a71484fdcdf609734c0d8efd.patch";
      hash = "sha256-3OIzvTgGK3r4/s5y7izHvouB4uJEmjO6cgKvegtTf7A=";
    })
+    # Fix paths to ffmpeg, ffplay and ffprobe
+    (substituteAll {
+      src = ./ffmpeg-fix-path.patch;
+      ffmpeg = lib.getExe ffmpeg-full;
+      ffplay = lib.getExe' ffmpeg-full "ffplay";
+      ffprobe = lib.getExe' ffmpeg-full "ffprobe";
+    })
  ];

  nativeBuildInputs = [ setuptools ];

  nativeCheckInputs = [
-    ffmpeg-full
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/pydub/ffmpeg-fix-path.patch
+++ b/pkgs/development/python-modules/pydub/ffmpeg-fix-path.patch
@ -0,0 +1,28 @@
+diff --git a/pydub/utils.py b/pydub/utils.py
+index 2694f90..7764b3f 100644
+--- a/pydub/utils.py
+++ b/pydub/utils.py
+@@ -172,7 +172,7 @@ def get_encoder_name():
+     else:
+         # should raise exception
+         warn("Couldn't find ffmpeg or avconv - defaulting to ffmpeg, but may not work", RuntimeWarning)
+-        return "ffmpeg"
+        return "@ffmpeg@"
+
+
+ def get_player_name():
+@@ -186,7 +186,7 @@ def get_player_name():
+     else:
+         # should raise exception
+         warn("Couldn't find ffplay or avplay - defaulting to ffplay, but may not work", RuntimeWarning)
+-        return "ffplay"
+        return "@ffplay@"
+
+
+ def get_prober_name():
+@@ -200,7 +200,7 @@ def get_prober_name():
+     else:
+         # should raise exception
+         warn("Couldn't find ffprobe or avprobe - defaulting to ffprobe, but may not work", RuntimeWarning)
+-        return "ffprobe"
+        return "@ffprobe@"
--- a/pkgs/development/python-modules/pyopenweathermap/default.nix
+++ b/pkgs/development/python-modules/pyopenweathermap/default.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch2,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  aiohttp,
+
+  # tests
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyopenweathermap";
+  version = "0.0.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "freekode";
+    repo = "pyopenweathermap";
+    # https://github.com/freekode/pyopenweathermap/issues/2
+    rev = "f8541960571591f47d74268d400dfd0d6c9adf67";
+    hash = "sha256-hQotoRbTbcsDTwZ3/A4HkWi2ma3b9L0vvwH9ej8k1eE=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/freekode/pyopenweathermap/pull/3
+      name = "pytest-network-mark.patch";
+      url = "https://github.com/freekode/pyopenweathermap/commit/580ce4317fdffb267fc9122c3c2f8355f1178502.patch";
+      hash = "sha256-dHopNTVO1sZgcMUYE1GrrMjbkwSFxNELIfXe2SyQrhw=";
+    })
+  ];
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-m"
+    "'not network'"
+  ];
+
+  pythonImportsCheck = [ "pyopenweathermap" ];
+
+  meta = with lib; {
+    description = "Python library for OpenWeatherMap API for Home Assistant";
+    homepage = "https://github.com/freekode/pyopenweathermap";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@ -75,6 +75,8 @@ buildPythonPackage rec {
    "test_run_pass_with_meta"
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = {
    changelog = "https://github.com/chrisjsewell/pytest-notebook/blob/${src.rev}/docs/source/changelog.md";
    description = "Pytest plugin for regression testing and regenerating Jupyter Notebooks";
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pyvex";
-  version = "9.2.105";
+  version = "9.2.106";
  pyproject = true;

  disabled = pythonOlder "3.11";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SlWcrrv3IvoTDy8CIxL/cPGs+asTwmWXU6Exul8a/O8=";
+    hash = "sha256-rFdltQQOZN8qoG5m8Uvzi+zSD2vsq2Cb9Xpt2r5t678=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/sqlmodel/default.nix
+++ b/pkgs/development/python-modules/sqlmodel/default.nix
@ -1,20 +1,23 @@
 {
  lib,
  buildPythonPackage,
+  black,
+  jinja2,
  dirty-equals,
  fastapi,
  fetchFromGitHub,
+  fetchpatch,
  pdm-backend,
  pydantic,
  pytest-asyncio,
-  pytest7CheckHook,
+  pytestCheckHook,
  pythonOlder,
  sqlalchemy,
 }:

 buildPythonPackage rec {
  pname = "sqlmodel";
-  version = "0.0.18";
+  version = "0.0.19";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -23,9 +26,17 @@ buildPythonPackage rec {
    owner = "tiangolo";
    repo = "sqlmodel";
    rev = "refs/tags/${version}";
-    hash = "sha256-2ens+wEFJThccBTBeBy8j1AzKJtebg3dJTGG6+Cpt+Q=";
+    hash = "sha256-Fr/umAgTbcfBtui+V/ncp4no+pquLExB/dInSFhsgGc=";
  };

+  patches = [
+    (fetchpatch { # https://github.com/tiangolo/sqlmodel/pull/969
+      name = "passthru-environ-variables.patch";
+      url = "https://github.com/tiangolo/sqlmodel/pull/969/commits/42d33049e9e4182b78914ad41d1e3d30125126ba.patch";
+      hash = "sha256-dPuFCFUnmTpduxn45tE8XUP0Jlwjwmwe+zFaKSganOg=";
+    })
+  ];
+
  build-system = [ pdm-backend ];

  dependencies = [
@ -34,10 +45,12 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    black
+    jinja2
    dirty-equals
    fastapi
    pytest-asyncio
-    pytest7CheckHook
+    pytestCheckHook
  ];

  pythonImportsCheck = [ "sqlmodel" ];
--- a/pkgs/development/python-modules/torch/bin.nix
+++ b/pkgs/development/python-modules/torch/bin.nix
@ -97,6 +97,23 @@ buildPythonPackage {
    addAutoPatchelfSearchPath "$out/${python.sitePackages}/torch/lib"
  '';

+  # See https://github.com/NixOS/nixpkgs/issues/296179
+  #
+  # This is a quick hack to add `libnvrtc` to the runpath so that torch can find
+  # it when it is needed at runtime.
+  extraRunpaths = lib.optionals stdenv.hostPlatform.isLinux [ "${lib.getLib cudaPackages.cuda_nvrtc}/lib" ];
+  postPhases = lib.optionals stdenv.isLinux [ "postPatchelfPhase" ];
+  postPatchelfPhase = ''
+    while IFS= read -r -d $'\0' elf ; do
+      for extra in $extraRunpaths ; do
+        echo patchelf "$elf" --add-rpath "$extra" >&2
+        patchelf "$elf" --add-rpath "$extra"
+      done
+    done < <(
+      find "''${!outputLib}" "$out" -type f -iname '*.so' -print0
+    )
+  '';
+
  # The wheel-binary is not stripped to avoid the error of `ImportError: libtorch_cuda_cpp.so: ELF load command address/offset not properly aligned.`.
  dontStrip = true;

--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@ -612,6 +612,23 @@ buildPythonPackage rec {
      install_name_tool -change @rpath/libc10.dylib $lib/lib/libc10.dylib $lib/lib/libshm.dylib
    '';

+  # See https://github.com/NixOS/nixpkgs/issues/296179
+  #
+  # This is a quick hack to add `libnvrtc` to the runpath so that torch can find
+  # it when it is needed at runtime.
+  extraRunpaths = lib.optionals cudaSupport [ "${lib.getLib cudaPackages.cuda_nvrtc}/lib" ];
+  postPhases = lib.optionals stdenv.isLinux [ "postPatchelfPhase" ];
+  postPatchelfPhase = ''
+    while IFS= read -r -d $'\0' elf ; do
+      for extra in $extraRunpaths ; do
+        echo patchelf "$elf" --add-rpath "$extra" >&2
+        patchelf "$elf" --add-rpath "$extra"
+      done
+    done < <(
+      find "''${!outputLib}" "$out" -type f -iname '*.so' -print0
+    )
+  '';
+
  # Builds in 2+h with 2 cores, and ~15m with a big-parallel builder.
  requiredSystemFeatures = [ "big-parallel" ];

--- a/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix
+++ b/pkgs/development/python-modules/tuya-device-sharing-sdk/default.nix
@ -9,14 +9,14 @@
 }:
 let
  pname = "tuya-device-sharing-sdk";
-  version = "0.2.0";
+  version = "0.1.9";
 in
 buildPythonPackage {
  inherit pname version;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fu8zh59wlnxtstNbNL8mIm10tiXy22oPbi6oUy5x8c8=";
+    hash = "sha256-mBKR+ttBo0VF33pEmYdjbyM4bGgyDiYexIIsf8mXZW4=";
  };

  # workaround needed, upstream issue: https://github.com/tuya/tuya-device-sharing-sdk/issues/10
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@ -0,0 +1,93 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  aiofiles,
+  aiohttp,
+  aioshutil,
+  async-timeout,
+  dateparser,
+  orjson,
+  packaging,
+  pillow,
+  platformdirs,
+  pydantic,
+  pyjwt,
+  rich,
+  typer,
+  yarl,
+
+  # tests
+  aiosqlite,
+  asttokens,
+  ffmpeg,
+  pytest-asyncio,
+  pytest-benchmark,
+  pytest-timeout,
+  pytest-xdist,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "uiprotect";
+  version = "0.13.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "uilibs";
+    repo = "uiprotect";
+    rev = "v${version}";
+    hash = "sha256-Laf8P77fLTTJqqUoGZUtGIVmitrXS1OQLeW8Gqu66NU=";
+  };
+
+  postPatch = ''
+    sed -i "/addopts =/d" pyproject.toml
+  '';
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiofiles
+    aiohttp
+    aioshutil
+    async-timeout
+    dateparser
+    orjson
+    packaging
+    pillow
+    platformdirs
+    pydantic
+    pyjwt
+    rich
+    typer
+    yarl
+  ];
+
+  nativeCheckInputs = [
+    aiosqlite
+    asttokens
+    ffmpeg # Required for command ffprobe
+    pytest-asyncio
+    pytest-benchmark
+    pytest-timeout
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "--benchmark-disable" ];
+
+  pythonImportsCheck = [ "uiprotect" ];
+
+  meta = with lib; {
+    description = "Python API for UniFi Protect (Unofficial";
+    homepage = "https://github.com/uilibs/uiprotect";
+    changelog = "https://github.com/uilibs/uiprotect/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/development/python-modules/wasabi/default.nix
+++ b/pkgs/development/python-modules/wasabi/default.nix
@ -32,6 +32,8 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "wasabi" ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Lightweight console printing and formatting toolkit";
    homepage = "https://github.com/ines/wasabi";
--- a/pkgs/development/python-modules/widgetsnbextension/default.nix
+++ b/pkgs/development/python-modules/widgetsnbextension/default.nix
@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "widgetsnbextension";
-  version = "4.0.10";
+  version = "4.0.11";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ZBlsX/O5qRg6jmmaQif7C3AC8lLIFAmOZsTRzQZEaI8=";
+    hash = "sha256-iyKo8ZEL/RiOWW/n/AXcvYfoEMikugEL2z2oZjc5hHQ=";
  };

  nativeBuildInputs = [ jupyter-packaging ];
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@ -42,7 +42,7 @@ let
      ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
      ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = optional (versionOlder version "27.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "29.0.0") "Electron version ${version} is EOL";
  };

  fetcher = vers: tag: hash: fetchurl {
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@ -234,6 +234,7 @@ in (chromium.override { upstream-info = info.chromium; }).mkDerivation (base: {
  meta = with lib; {
    description = "Cross platform desktop application shell";
    homepage = "https://github.com/electron/electron";
+    knownVulnerabilities = optional (versionOlder info.version "29") "Electron version ${version} is EOL";
    platforms = lib.platforms.linux;
    license = licenses.mit;
    maintainers = with maintainers; [ yayayayaka teutat3s ];
--- a/pkgs/kde/frameworks/kio/default.nix
+++ b/pkgs/kde/frameworks/kio/default.nix
@ -10,8 +10,10 @@ mkKdeDerivation {

  patches = [
    # Remove hardcoded smbd search path
-    # FIXME(later): discuss with upstream?
    ./0001-Remove-impure-smbd-search-path.patch
+    # When running a process through systemd, resolve the full path ourselves
+    ./early-resolve-executables.diff
+    # FIXME(later): discuss with upstream?
  ];

  extraBuildInputs = [qt5compat qttools acl attr];
--- a/pkgs/kde/frameworks/kio/early-resolve-executables.diff
+++ b/pkgs/kde/frameworks/kio/early-resolve-executables.diff
@ -0,0 +1,13 @@
+diff --git a/src/gui/systemd/systemdprocessrunner.cpp b/src/gui/systemd/systemdprocessrunner.cpp
+index afe3e2c69..5e5ee012d 100644
+--- a/src/gui/systemd/systemdprocessrunner.cpp
+++ b/src/gui/systemd/systemdprocessrunner.cpp
+@@ -128,7 +128,7 @@ void SystemdProcessRunner::startProcess()
+                                               // so we can be notified (see https://github.com/systemd/systemd/pull/3984)
+             {QStringLiteral("Environment"), m_process->environment()},
+             {QStringLiteral("WorkingDirectory"), m_process->workingDirectory()},
+-            {QStringLiteral("ExecStart"), QVariant::fromValue(ExecCommandList{{m_process->program().first(), m_process->program(), false}})},
+            {QStringLiteral("ExecStart"), QVariant::fromValue(ExecCommandList{{QStandardPaths::findExecutable(m_process->program().first()), m_process->program(), false}})},
+         },
+         {} // aux is currently unused and should be passed as empty array.
+     );
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -4,8 +4,8 @@
        "hash": "sha256:11kjvjww4n0l4knq1v4rsbnac4s01r69yk1lrb9hgikszxyjklwk"
    },
    "6.1": {
-        "version": "6.1.92",
-        "hash": "sha256:1j9n8gk76nn4gw42iba5zgghr360gb9n1mslr5dyv76wpwkz86ch"
+        "version": "6.1.93",
+        "hash": "sha256:1kqbfbw7ivhl6aqb8pl92fll4bhgyn8xkgv8vpx62gcjylpaycfz"
    },
    "5.15": {
        "version": "5.15.160",
@ -24,15 +24,15 @@
        "hash": "sha256:1j1j8awy0237jp2r211qpa305c10y7rlcbkxkzdvzbgyhwy4spkc"
    },
    "6.6": {
-        "version": "6.6.32",
-        "hash": "sha256:1qbc8dqmk2xs1cz968rysw5xvhq3lj8g0pxp48fr2qbzy3m29a5a"
+        "version": "6.6.33",
+        "hash": "sha256:15yy80dwis74gmmamnnn8kayak3am15gg6llk4k74x9avhhbqgm1"
    },
    "6.8": {
        "version": "6.8.12",
        "hash": "sha256:0fb0m0fv4521g63gq04d7lm6hy8169s1rykiav5bkd99s9b1kcqr"
    },
    "6.9": {
-        "version": "6.9.3",
-        "hash": "sha256:1bnzxparybwh320019pr2msaapas41dhjmvg4gy791rn05jc88f3"
+        "version": "6.9.4",
+        "hash": "sha256:1hpcc1bkan1y03bigi8mxd86z0c0bjpklnp9piw1ml57s7h00a17"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.10.217-rt109"; # updated by ./update-rt.sh
+  version = "5.10.218-rt110"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -18,14 +18,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0qhzqrjci45vcbzjch7vq75i6hpyap6yb7jw6g71phcnqgzw2ay5";
+    sha256 = "1mmj5hwm5i16gc1y4nzr1cs882vi6vrihrincdcivv63x11v4dlw";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1cszl9414vbycswx2gjv12wdghhw5s6amd9mjmx619r2a1r0gnb7";
+      sha256 = "0zam7hlcrphxv53jcza7sw0lv8a9mz15cl35adwb2rd2y1x9nhad";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2024.6.1";
+  version = "2024.6.2";
  components = {
    "3_day_blinds" = ps: with ps; [
    ];
@ -3210,7 +3210,8 @@
      pyopenuv
    ];
    "openweathermap" = ps: with ps; [
-    ]; # missing inputs: pyopenweathermap
+      pyopenweathermap
+    ];
    "opnsense" = ps: with ps; [
      pyopnsense
    ];
@ -4762,7 +4763,7 @@
      unifiled
    ];
    "unifiprotect" = ps: with ps; [
-      pyunifiprotect
+      uiprotect
      unifi-discovery
    ];
    "universal" = ps: with ps; [
@ -5724,6 +5725,7 @@
    "opensky"
    "opentherm_gw"
    "openuv"
+    "openweathermap"
    "opnsense"
    "opower"
    "oralb"
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -533,7 +533,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2024.6.1";
+  hassVersion = "2024.6.2";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -551,13 +551,13 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = "refs/tags/${version}";
-    hash = "sha256-T6qmmY7AIWUHwxD/WIrr9x685jrXzQ/1brTxWZTKsmw=";
+    hash = "sha256-o37/Vfs9+0pxihfaInB6f8DI1uExbBcQse2841v6+Ec=";
  };

  # Secondary source is pypi sdist for translations
  sdist = fetchPypi {
    inherit pname version;
-    hash = "sha256-Qp22sOVgxpbU9mglfK+IbWRvuyYm/jR70I4YvnDuF6s=";
+    hash = "sha256-eGlPcB5U6yJZd/771xzqKKY7REnCsniDypGndlsGo/E=";
  };

  build-system = with python.pkgs; [
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@ -4,7 +4,7 @@ buildPythonPackage rec {
  # the frontend version corresponding to a specific home-assistant version can be found here
  # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
  pname = "home-assistant-frontend";
-  version = "20240605.0";
+  version = "20240610.0";
  format = "wheel";

  src = fetchPypi {
@ -12,7 +12,7 @@ buildPythonPackage rec {
    pname = "home_assistant_frontend";
    dist = "py3";
    python = "py3";
-    hash = "sha256-xuzaGS26BmUlJqfRD65Rc+NpQmyQ77nNLbPAyYuqGNo=";
+    hash = "sha256-k4zUo439nfB71LVhv3Mfhj5mRD4Oduas+NHEyAqYBa4=";
  };

  # there is nothing to strip in this package
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2024.6.1";
+  version = "2024.6.2";
  pyproject = true;

  disabled = python.version != home-assistant.python.version;
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    rev = "refs/tags/${version}";
-    hash = "sha256-+zwhZ5og9OUb31gAZNbMM0ECswopZWKxhU+5lkjwaco=";
+    hash = "sha256-y1TiexWK5aJRa6Kfcdc8rPr+uueKJ2+4n2q6dCPCWjk=";
  };

  build-system = [
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , gnutls, c-ares, libxml2, sqlite, zlib, libssh2
 , cppunit, sphinx
-, Security
+, Security, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -38,12 +38,16 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  passthru.tests = {
+    aria2 = nixosTests.aria2;
+  };
+
  meta = with lib; {
    homepage = "https://aria2.github.io";
    description = "Lightweight, multi-protocol, multi-source, command-line download utility";
    mainProgram = "aria2c";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ Br1ght0ne koral ];
+    maintainers = with maintainers; [ Br1ght0ne koral timhae ];
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -10643,7 +10643,7 @@ with pkgs;
  mole = callPackage ../tools/networking/mole { };

  morgen = callPackage ../applications/office/morgen {
-    electron = electron_28;
+    electron = electron_29;
  };

  mosh = callPackage ../tools/networking/mosh { };
@ -33386,9 +33386,7 @@ with pkgs;
  obs-studio-plugins = recurseIntoAttrs (callPackage ../applications/video/obs-studio/plugins {});
  wrapOBS = callPackage ../applications/video/obs-studio/wrapper.nix { };

-  obsidian = callPackage ../applications/misc/obsidian {
-    electron = electron_28;
-  };
+  obsidian = callPackage ../applications/misc/obsidian { };

  octoprint = callPackage ../applications/misc/octoprint { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -11560,6 +11560,8 @@ self: super: with self; {

  pyopenuv = callPackage ../development/python-modules/pyopenuv { };

+  pyopenweathermap = callPackage ../development/python-modules/pyopenweathermap { };
+
  pyopnsense = callPackage ../development/python-modules/pyopnsense { };

  pyoppleio = callPackage ../development/python-modules/pyoppleio { };
@ -16472,6 +16474,8 @@ self: super: with self; {

  uhi = callPackage ../development/python-modules/uhi { };

+  uiprotect = callPackage ../development/python-modules/uiprotect { };
+
  ujson = callPackage ../development/python-modules/ujson { };

  ukkonen = callPackage ../development/python-modules/ukkonen { };