Merge master into haskell-updates

CONTRIBUTING.md

@@ -322,6 +322,8 @@ All the review template samples provided in this section are generic and meant a
 
 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
 
+If a pull request contains documentation changes that might require feedback from the documentation team, ping @NixOS/documentation-team on the pull request.
+
 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
 
 Container system, boot system and library changes are some examples of the pull requests fitting this category.
@@ -512,34 +514,19 @@ To get a sense for what changes are considered mass rebuilds, see [previously me
 
 - If you have commits `pkg-name: oh, forgot to insert whitespace`: squash commits in this case. Use `git rebase -i`.
 
-- Format the commit messages in the following way:
+- For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
 
-  ```
-  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
-
-  (Motivation for change. Link to release notes. Additional information.)
-  ```
-
-  For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
-
-  Examples:
-
-  * nginx: init at 2.0.1
-  * firefox: 54.0.1 -> 55.0
-
-    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
-  * nixos/hydra: add bazBaz option
-
-    Dual baz behavior is needed to do foo.
-  * nixos/nginx: refactor config generation
-
-    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
-
-  When adding yourself as maintainer, in the same pull request, make a separate
+- When adding yourself as maintainer in the same pull request, make a separate
   commit with the message `maintainers: add <handle>`.
   Add the commit before those making changes to the package or module.
   See [Nixpkgs Maintainers](./maintainers/README.md) for details.
 
+- Make sure you read about any commit conventions specific to the area you're touching. See:
+  - [Commit conventions](./pkgs/README.md#commit-conventions) for changes to `pkgs`.
+  - [Commit conventions](./lib/README.md#commit-conventions) for changes to `lib`.
+  - [Commit conventions](./nixos/README.md#commit-conventions) for changes to `nixos`.
+  - [Commit conventions](./doc/README.md#commit-conventions) for changes to `doc`, the Nixpkgs manual.
+
 ### Writing good commit messages
 
 In addition to writing properly formatted commit messages, it's important to include relevant information so other developers can later understand *why* a change was made. While this information usually can be found by digging code, mailing list/Discourse archives, pull request discussions or upstream changes, it may require a lot of work.

doc/README.md

@@ -114,3 +114,24 @@ pear
 watermelon
 :   green fruit with red flesh
 ```
+
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- If creating a commit purely for documentation changes, format the commit message in the following way:
+
+  ```
+  doc: (documentation summary)
+
+  (Motivation for change, relevant links, additional information.)
+  ```
+
+  Examples:
+
+  * doc: update the kernel config documentation to use `nix-shell`
+  * doc: add information about `nix-update-script`
+
+    Closes #216321.
+
+- If the commit contains more than just documentation changes, follow the commit message format relevant for the rest of the changes.

doc/hooks/index.md

@@ -25,7 +25,6 @@ perl.section.md
 pkg-config.section.md
 postgresql-test-hook.section.md
 python.section.md
-qt-4.section.md
 scons.section.md
 tetex-tex-live.section.md
 unzip.section.md

doc/hooks/qt-4.section.md

@@ -1,3 +0,0 @@
-# Qt 4 {#qt-4}
-
-Sets the `QTDIR` environment variable to Qt’s path.

doc/languages-frameworks/go.section.md

@@ -20,7 +20,7 @@ In the following is an example expression using `buildGoModule`, the following a
 
   To obtain the actual hash, set `vendorHash = lib.fakeHash;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
-- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash` (or `vendorSha256`). Note that if you change this attribute, you need to update `vendorHash` (or `vendorSha256`) attribute.
+- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash`. Note that if you change this attribute, you need to update `vendorHash` attribute.
 
 ```nix
 pet = buildGoModule rec {

lib/README.md

@@ -74,3 +74,23 @@ path/tests/prop.sh
 # Run the lib.fileset tests
 fileset/tests.sh
 ```
+
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  lib.(section): (init | add additional argument | refactor | etc)
+
+  (Motivation for change. Additional information.)
+  ```
+
+  Examples:
+
+  * lib.getExe': check arguments
+  * lib.fileset: Add an additional argument in the design docs
+
+    Closes #264537
+

lib/customisation.nix

@@ -76,19 +76,22 @@ rec {
      Type:
        makeOverridable :: (AttrSet -> a) -> AttrSet -> a
   */
-  makeOverridable = f: lib.setFunctionArgs
-    (origArgs: let
+  makeOverridable = f:
+    let
+      # Creates a functor with the same arguments as f
+      mirrorArgs = lib.mirrorFunctionArgs f;
+    in
+    mirrorArgs (origArgs:
+    let
       result = f origArgs;
 
-      # Creates a functor with the same arguments as f
-      copyArgs = g: lib.setFunctionArgs g (lib.functionArgs f);
       # Changes the original arguments with (potentially a function that returns) a set of new attributes
       overrideWith = newArgs: origArgs // (if lib.isFunction newArgs then newArgs origArgs else newArgs);
 
       # Re-call the function but with different arguments
-      overrideArgs = copyArgs (newArgs: makeOverridable f (overrideWith newArgs));
+      overrideArgs = mirrorArgs (newArgs: makeOverridable f (overrideWith newArgs));
       # Change the result of the function call by applying g to it
-      overrideResult = g: makeOverridable (copyArgs (args: g (f args))) origArgs;
+      overrideResult = g: makeOverridable (mirrorArgs (args: g (f args))) origArgs;
     in
       if builtins.isAttrs result then
         result // {
@@ -102,8 +105,7 @@ rec {
         lib.setFunctionArgs result (lib.functionArgs result) // {
           override = overrideArgs;
         }
-      else result)
-    (lib.functionArgs f);
+      else result);
 
 
   /* Call the package function in the file `fn` with the required

lib/default.nix

@@ -74,7 +74,7 @@ let
       importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum
       info showWarnings nixpkgsVersion version isInOldestRelease
       mod compare splitByAndCompare
-      functionArgs setFunctionArgs isFunction toFunction
+      functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
       toHexString toBaseDigits inPureEvalMode;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;

lib/fileset/README.md

@@ -241,7 +241,4 @@ Arguments:
 ## To update in the future
 
 Here's a list of places in the library that need to be updated in the future:
-- > The file set library is currently somewhat limited but is being expanded to include more functions over time.
-
-  in [the manual](../../doc/functions/fileset.section.md)
 - If/Once a function exists that can optionally include a path depending on whether it exists, the error message for the path not existing in `_coerce` should mention the new function

lib/fileset/default.nix

@@ -188,7 +188,7 @@ in {
             - Set `root` to ${toString fileset._internalBase} or any directory higher up. This changes the layout of the resulting store path.
             - Set `fileset` to a file set that cannot contain files outside the `root` (${toString root}). This could change the files included in the result.''
     else
-      builtins.seq sourceFilter
+      seq sourceFilter
       cleanSourceWith {
         name = "source";
         src = root;

lib/trivial.nix

@@ -448,6 +448,40 @@ rec {
   isFunction = f: builtins.isFunction f ||
     (f ? __functor && isFunction (f.__functor f));
 
+  /*
+    `mirrorFunctionArgs f g` creates a new function `g'` with the same behavior as `g` (`g' x == g x`)
+    but its function arguments mirroring `f` (`lib.functionArgs g' == lib.functionArgs f`).
+
+    Type:
+      mirrorFunctionArgs :: (a -> b) -> (a -> c) -> (a -> c)
+
+    Example:
+      addab = {a, b}: a + b
+      addab { a = 2; b = 4; }
+      => 6
+      lib.functionArgs addab
+      => { a = false; b = false; }
+      addab1 = attrs: addab attrs + 1
+      addab1 { a = 2; b = 4; }
+      => 7
+      lib.functionArgs addab1
+      => { }
+      addab1' = lib.mirrorFunctionArgs addab addab1
+      addab1' { a = 2; b = 4; }
+      => 7
+      lib.functionArgs addab1'
+      => { a = false; b = false; }
+  */
+  mirrorFunctionArgs =
+    # Function to provide the argument metadata
+    f:
+    let
+      fArgs = functionArgs f;
+    in
+    # Function to set the argument metadata to
+    g:
+    setFunctionArgs g fArgs;
+
   /*
     Turns any non-callable values into constant functions.
     Returns callable values as is.

maintainers/maintainer-list.nix

@@ -19245,12 +19245,6 @@
     githubId = 168610;
     name = "Ricardo M. Correia";
   };
-  wjlroe = {
-    email = "willroe@gmail.com";
-    github = "wjlroe";
-    githubId = 43315;
-    name = "William Roe";
-  };
   wladmis = {
     email = "dev@wladmis.org";
     github = "wladmis";

nixos/README.md

@@ -8,6 +8,27 @@ https://nixos.org/nixos and in the manual in doc/manual.
 
 You can add new module to your NixOS configuration file (usually it’s `/etc/nixos/configuration.nix`). And do `sudo nixos-rebuild test -I nixpkgs=<path to your local nixpkgs folder> --fast`.
 
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  nixos/(module): (init module | add setting | refactor | etc)
+
+  (Motivation for change. Link to release notes. Additional information.)
+  ```
+
+  Examples:
+
+  * nixos/hydra: add bazBaz option
+
+    Dual baz behavior is needed to do foo.
+  * nixos/nginx: refactor config generation
+
+    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
+
 ## Reviewing contributions
 
 When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break people’s installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from \@edolstra.

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -189,6 +189,8 @@
 
 - JACK tools (`jack_*` except `jack_control`) have moved from the `jack2` package to `jack-example-tools`
 
+- The `waagent` service does provisioning now
+
 - The `matrix-synapse` package & module have undergone some significant internal changes, for most setups no intervention is needed, though:
   - The option [`services.matrix-synapse.package`](#opt-services.matrix-synapse.package) is now read-only. For modifying the package, use an overlay which modifies `matrix-synapse-unwrapped` instead. More on that below.
   - The `enableSystemd` & `enableRedis` arguments have been removed and `matrix-synapse` has been renamed to `matrix-synapse-unwrapped`. Also, several optional dependencies (such as `psycopg2` or `authlib`) have been removed.
@@ -323,6 +325,8 @@
 
 - Package `pash` was removed due to being archived upstream. Use `powershell` as an alternative.
 
+- The option `services.plausible.releaseCookiePath` has been removed: Plausible does not use any distributed Erlang features, and does not plan to (see [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)), so NixOS now disables them, and the Erlang cookie becomes unnecessary. You may delete the file that `releaseCookiePath` was set to.
+
 - `security.sudo.extraRules` now includes `root`'s default rule, with ordering
   priority 400. This is functionally identical for users not specifying rule
   order, or relying on `mkBefore` and `mkAfter`, but may impact users calling
@@ -521,6 +525,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - The Home Assistant module now offers support for installing custom components and lovelace modules. Available at [`services.home-assistant.customComponents`](#opt-services.home-assistant.customComponents) and [`services.home-assistant.customLovelaceModules`](#opt-services.home-assistant.customLovelaceModules).
 
+- The argument `vendorSha256` of `buildGoModule` is deprecated. Use `vendorHash` instead. ([\#259999](https://github.com/NixOS/nixpkgs/pull/259999))
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.

nixos/modules/security/acme/default.nix

@@ -345,6 +345,10 @@ let
       serviceConfig = commonServiceConfig // {
         Group = data.group;
 
+        # Let's Encrypt Failed Validation Limit allows 5 retries per hour, per account, hostname and hour.
+        # This avoids eating them all up if something is misconfigured upon the first try.
+        RestartSec = 15 * 60;
+
         # Keep in mind that these directories will be deleted if the user runs
         # systemctl clean --what=state
         # acme/.lego/${cert} is listed for this reason.

nixos/modules/security/sudo.nix

@@ -192,10 +192,12 @@ in
   ###### implementation
 
   config = mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.package.pname != "sudo-rs";
-        message = "The NixOS `sudo` module does not work with `sudo-rs` yet."; }
-    ];
+    assertions = [ {
+      assertion = cfg.package.pname != "sudo-rs";
+      message = ''
+        NixOS' `sudo` module does not support `sudo-rs`; see `security.sudo-rs` instead.
+      '';
+    } ];
 
     security.sudo.extraRules =
       let

nixos/modules/services/audio/navidrome.nix

@@ -28,10 +28,17 @@ in {
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Whether to open the TCP port in the firewall";
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [cfg.settings.Port];
+
     systemd.services.navidrome = {
       description = "Navidrome Media Server";
       after = [ "network.target" ];

nixos/modules/services/hardware/fwupd.nix

@@ -187,13 +187,20 @@ in {
       # fwupd-refresh expects a user that we do not create, so just run with DynamicUser
       # instead and ensure we take ownership of /var/lib/fwupd
       services.fwupd-refresh.serviceConfig = {
-        DynamicUser = true;
         StateDirectory = "fwupd";
+        # Better for debugging, upstream sets stderr to null for some reason..
+        StandardError = "inherit";
       };
 
       timers.fwupd-refresh.wantedBy = [ "timers.target" ];
     };
 
+    users.users.fwupd-refresh = {
+      isSystemUser = true;
+      group = "fwupd-refresh";
+    };
+    users.groups.fwupd-refresh = {};
+
     security.polkit.enable = true;
   };
 

nixos/modules/services/misc/autofs.nix

@@ -74,7 +74,7 @@ in
 
   config = mkIf cfg.enable {
 
-    boot.kernelModules = [ "autofs4" ];
+    boot.kernelModules = [ "autofs" ];
 
     systemd.services.autofs =
       { description = "Automounts filesystems on demand";

nixos/modules/services/networking/harmonia.nix

@@ -28,6 +28,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    nix.settings.extra-allowed-users = [ "harmonia" ];
+
     systemd.services.harmonia = {
       description = "harmonia binary cache service";
 

nixos/modules/services/torrent/flexget.nix

@@ -64,7 +64,6 @@ in {
         path = [ pkg ];
         serviceConfig = {
           User = cfg.user;
-          Environment = "TZ=${config.time.timeZone}";
           ExecStartPre = "${pkgs.coreutils}/bin/install -m644 ${ymlFile} ${configFile}";
           ExecStart = "${pkg}/bin/flexget -c ${configFile} daemon start";
           ExecStop = "${pkg}/bin/flexget -c ${configFile} daemon stop";

nixos/modules/services/web-apps/plausible.nix

@@ -11,13 +11,6 @@ in {
 
     package = mkPackageOptionMD pkgs "plausible" { };
 
-    releaseCookiePath = mkOption {
-      type = with types; either str path;
-      description = lib.mdDoc ''
-        The path to the file with release cookie. (used for remote connection to the running node).
-      '';
-    };
-
     adminUser = {
       name = mkOption {
         default = "admin";
@@ -92,6 +85,13 @@ in {
           framework docs](https://hexdocs.pm/phoenix/Mix.Tasks.Phx.Gen.Secret.html#content).
         '';
       };
+      listenAddress = mkOption {
+        default = "127.0.0.1";
+        type = types.str;
+        description = lib.mdDoc ''
+          The IP address on which the server is listening.
+        '';
+      };
       port = mkOption {
         default = 8000;
         type = types.port;
@@ -162,6 +162,10 @@ in {
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule [ "services" "plausible" "releaseCookiePath" ] "Plausible uses no distributed Erlang features, so this option is no longer necessary and was removed")
+  ];
+
   config = mkIf cfg.enable {
     assertions = [
       { assertion = cfg.adminUser.activate -> cfg.database.postgres.setup;
@@ -180,8 +184,6 @@ in {
       enable = true;
     };
 
-    services.epmd.enable = true;
-
     environment.systemPackages = [ cfg.package ];
 
     systemd.services = mkMerge [
@@ -209,6 +211,32 @@ in {
             # Configuration options from
             # https://plausible.io/docs/self-hosting-configuration
             PORT = toString cfg.server.port;
+            LISTEN_IP = cfg.server.listenAddress;
+
+            # Note [plausible-needs-no-erlang-distributed-features]:
+            # Plausible does not use, and does not plan to use, any of
+            # Erlang's distributed features, see:
+            #     https://github.com/plausible/analytics/pull/1190#issuecomment-1018820934
+            # Thus, disable distribution for improved simplicity and security:
+            #
+            # When distribution is enabled,
+            # Elixir spwans the Erlang VM, which will listen by default on all
+            # interfaces for messages between Erlang nodes (capable of
+            # remote code execution); it can be protected by a cookie; see
+            # https://erlang.org/doc/reference_manual/distributed.html#security).
+            #
+            # It would be possible to restrict the interface to one of our choice
+            # (e.g. localhost or a VPN IP) similar to how we do it with `listenAddress`
+            # for the Plausible web server; if distribution is ever needed in the future,
+            # https://github.com/NixOS/nixpkgs/pull/130297 shows how to do it.
+            #
+            # But since Plausible does not use this feature in any way,
+            # we just disable it.
+            RELEASE_DISTRIBUTION = "none";
+            # Additional safeguard, in case `RELEASE_DISTRIBUTION=none` ever
+            # stops disabling the start of EPMD.
+            ERL_EPMD_ADDRESS = "127.0.0.1";
+
             DISABLE_REGISTRATION = if isBool cfg.server.disableRegistration then boolToString cfg.server.disableRegistration else cfg.server.disableRegistration;
 
             RELEASE_TMP = "/var/lib/plausible/tmp";
@@ -238,7 +266,10 @@ in {
           path = [ cfg.package ]
             ++ optional cfg.database.postgres.setup config.services.postgresql.package;
           script = ''
-            export RELEASE_COOKIE="$(< $CREDENTIALS_DIRECTORY/RELEASE_COOKIE )"
+            # Elixir does not start up if `RELEASE_COOKIE` is not set,
+            # even though we set `RELEASE_DISTRIBUTION=none` so the cookie should be unused.
+            # Thus, make a random one, which should then be ignored.
+            export RELEASE_COOKIE=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 20)
             export ADMIN_USER_PWD="$(< $CREDENTIALS_DIRECTORY/ADMIN_USER_PWD )"
             export SECRET_KEY_BASE="$(< $CREDENTIALS_DIRECTORY/SECRET_KEY_BASE )"
 
@@ -265,7 +296,6 @@ in {
             LoadCredential = [
               "ADMIN_USER_PWD:${cfg.adminUser.passwordFile}"
               "SECRET_KEY_BASE:${cfg.server.secretKeybaseFile}"
-              "RELEASE_COOKIE:${cfg.releaseCookiePath}"
             ] ++ lib.optionals (cfg.mail.smtp.passwordFile != null) [ "SMTP_USER_PWD:${cfg.mail.smtp.passwordFile}"];
           };
         };

nixos/modules/system/boot/systemd/initrd.nix

@@ -370,7 +370,7 @@ in {
 
     boot.initrd.availableKernelModules = [
       # systemd needs this for some features
-      "autofs4"
+      "autofs"
       # systemd-cryptenroll
     ] ++ lib.optional cfg.enableTpm2 "tpm-tis"
     ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb";

nixos/modules/virtualisation/azure-agent.nix

@@ -61,7 +61,7 @@ in
 
         # Which provisioning agent to use. Supported values are "auto" (default), "waagent",
         # "cloud-init", or "disabled".
-        Provisioning.Agent=disabled
+        Provisioning.Agent=auto
 
         # Password authentication for root account will be unavailable.
         Provisioning.DeleteRootPassword=n
@@ -246,7 +246,7 @@ in
         pkgs.bash
 
         # waagent's Microsoft.OSTCExtensions.VMAccessForLinux needs Python 3
-        pkgs.python3
+        pkgs.python39
 
         # waagent's Microsoft.CPlat.Core.RunCommandLinux needs lsof
         pkgs.lsof
@@ -259,5 +259,10 @@ in
       };
     };
 
+    # waagent will generate files under /etc/sudoers.d during provisioning
+    security.sudo.extraConfig = ''
+      #includedir /etc/sudoers.d
+    '';
+
   };
 }

nixos/modules/virtualisation/azure-image.nix

@@ -37,42 +37,5 @@ in
       inherit config lib pkgs;
     };
 
-    # Azure metadata is available as a CD-ROM drive.
-    fileSystems."/metadata".device = "/dev/sr0";
-
-    systemd.services.fetch-ssh-keys = {
-      description = "Fetch host keys and authorized_keys for root user";
-
-      wantedBy = [ "sshd.service" "waagent.service" ];
-      before = [ "sshd.service" "waagent.service" ];
-
-      path  = [ pkgs.coreutils ];
-      script =
-        ''
-          eval "$(cat /metadata/CustomData.bin)"
-          if ! [ -z "$ssh_host_ecdsa_key" ]; then
-            echo "downloaded ssh_host_ecdsa_key"
-            echo "$ssh_host_ecdsa_key" > /etc/ssh/ssh_host_ed25519_key
-            chmod 600 /etc/ssh/ssh_host_ed25519_key
-          fi
-
-          if ! [ -z "$ssh_host_ecdsa_key_pub" ]; then
-            echo "downloaded ssh_host_ecdsa_key_pub"
-            echo "$ssh_host_ecdsa_key_pub" > /etc/ssh/ssh_host_ed25519_key.pub
-            chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
-          fi
-
-          if ! [ -z "$ssh_root_auth_key" ]; then
-            echo "downloaded ssh_root_auth_key"
-            mkdir -m 0700 -p /root/.ssh
-            echo "$ssh_root_auth_key" > /root/.ssh/authorized_keys
-            chmod 600 /root/.ssh/authorized_keys
-          fi
-        '';
-      serviceConfig.Type = "oneshot";
-      serviceConfig.RemainAfterExit = true;
-      serviceConfig.StandardError = "journal+console";
-      serviceConfig.StandardOutput = "journal+console";
-    };
   };
 }

nixos/tests/plausible.nix

@@ -8,9 +8,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     virtualisation.memorySize = 4096;
     services.plausible = {
       enable = true;
-      releaseCookiePath = "${pkgs.runCommand "cookie" { } ''
-        ${pkgs.openssl}/bin/openssl rand -base64 64 >"$out"
-      ''}";
       adminUser = {
         email = "admin@example.org";
         passwordFile = "${pkgs.writeText "pwd" "foobar"}";
@@ -28,6 +25,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     machine.wait_for_unit("plausible.service")
     machine.wait_for_open_port(8000)
 
+    # Ensure that the software does not make not make the machine
+    # listen on any public interfaces by default.
+    machine.fail("ss -tlpn 'src = 0.0.0.0 or src = [::]' | grep LISTEN")
+
     machine.succeed("curl -f localhost:8000 >&2")
 
     machine.succeed("curl -f localhost:8000/js/script.js >&2")

nixos/tests/pleroma.nix

@@ -25,6 +25,18 @@
 
 import ./make-test-python.nix ({ pkgs, ... }:
   let
+  # Fix for https://github.com/ihabunek/toot/pull/405. Includes
+  # https://github.com/ihabunek/toot/pull/405. TOREMOVE when
+  # toot > 0.38.1
+  patched-toot = pkgs.toot.overrideAttrs (old: {
+    version = "unstable-24-09-2023";
+    src = pkgs.fetchFromGitHub {
+      owner = "ihabunek";
+      repo = "toot";
+      rev = "30857f570d64a26da80d0024227a8259f7cb65b5";
+      sha256 = "sha256-BxrI7UY9bfqPzS+VLqCFSmu4PkIkvhntcEeNJb1AzOs=";
+    };
+  });
   send-toot = pkgs.writeScriptBin "send-toot" ''
     set -eux
     # toot is using the requests library internally. This library
@@ -164,9 +176,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
   '';
 
   tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
-    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=pleroma.nixos.test' -days 36500
     mkdir -p $out
-    cp key.pem cert.pem $out
+    openssl req -x509 \
+      -subj '/CN=pleroma.nixos.test/' -days 49710 \
+      -addext 'subjectAltName = DNS:pleroma.nixos.test' \
+      -keyout "$out/key.pem" -newkey ed25519 \
+      -out "$out/cert.pem" -noenc
   '';
 
   hosts = nodes: ''
@@ -180,7 +195,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
       networking.extraHosts = hosts nodes;
       environment.systemPackages = with pkgs; [
-        toot
+        patched-toot
         send-toot
       ];
     };

nixos/tests/xmpp/ejabberd.nix

@@ -1,7 +1,7 @@
 import ../make-test-python.nix ({ pkgs, ... }: {
   name = "ejabberd";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ ajs124 ];
+    maintainers = [ ];
   };
   nodes = {
     client = { nodes, pkgs, ... }: {

pkgs/README.md

@@ -114,6 +114,25 @@ Now that this is out of the way. To add a package to Nixpkgs:
 
 7. Optionally commit the new package and open a pull request [to nixpkgs](https://github.com/NixOS/nixpkgs/pulls), or use [the Patches category](https://discourse.nixos.org/t/about-the-patches-category/477) on Discourse for sending a patch without a GitHub account.
 
+## Commit conventions
+
+- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
+
+- Format the commit messages in the following way:
+
+  ```
+  (pkg-name): (from -> to | init at version | refactor | etc)
+
+  (Motivation for change. Link to release notes. Additional information.)
+  ```
+
+  Examples:
+
+  * nginx: init at 2.0.1
+  * firefox: 54.0.1 -> 55.0
+
+    https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
+
 ## Category Hierarchy
 [categories]: #category-hierarchy
 

pkgs/applications/backup/unifi-protect-backup/default.nix

@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "unifi-protect-backup";
-  version = "0.9.4";
+  version = "0.10.1";
 
   format = "pyproject";
 
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "ep1cman";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-MFg518iodxdHbr7k5kpkTWI59Kk7pPwyIVswVcjasl8=";
+    hash = "sha256-5SarQw4xvLzL2JyBOqv5AtMAk3T4IHJN7fwk+OmujLM=";
   };
 
   pythonRelaxDeps = [

pkgs/applications/editors/emacs/make-emacs.nix

@@ -89,6 +89,7 @@
 , withX ? !(stdenv.isDarwin || noGui || withPgtk)
 , withXinput2 ? withX && lib.versionAtLeast version "29"
 , withXwidgets ? !stdenv.isDarwin && !noGui && (withGTK3 || withPgtk)
+, withSmallJaDic ? false
 
 # Options
 , siteStart ? ./site-start.el
@@ -337,6 +338,7 @@ mkDerivation (finalAttrs: {
   ++ lib.optional withTreeSitter "--with-tree-sitter"
   ++ lib.optional withXinput2 "--with-xinput2"
   ++ lib.optional withXwidgets "--with-xwidgets"
+  ++ lib.optional withSmallJaDic "--with-small-ja-dic"
   ;
 
   env = lib.optionalAttrs withNativeCompilation {

pkgs/applications/editors/texworks/default.nix

@@ -8,6 +8,7 @@
 , poppler
 , qt5compat
 , qttools
+, qtwayland
 , withLua ? true, lua
 , withPython ? true, python3 }:
 
@@ -36,7 +37,8 @@ stdenv.mkDerivation rec {
     qt5compat
     qttools
   ] ++ lib.optional withLua lua
-    ++ lib.optional withPython python3;
+    ++ lib.optional withPython python3
+    ++ lib.optional stdenv.isLinux qtwayland;
 
   cmakeFlags = [
     "-DQT_DEFAULT_MAJOR_VERSION=6"

pkgs/applications/graphics/structorizer/default.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "structorizer";
-  version = "3.32-12";
+  version = "3.32-14";
 
   desktopItems = [
     (makeDesktopItem {
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "fesch";
     repo = "Structorizer.Desktop";
     rev = version;
-    hash = "sha256-DZktq07MoXBg2AwHOoPLTbON/giSqDZOfmaMkZl1w1g=";
+    hash = "sha256-pnzvfXH4KC067aqqH9h1+T3K+6IzIYw8IJCMdmGrN6c=";
   };
 
   patches = [ ./makeStructorizer.patch ./makeBigJar.patch ];

pkgs/applications/networking/cluster/k9s/default.nix

@@ -1,14 +1,14 @@
-{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, k9s }:
+{ stdenv, lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, nix-update-script, k9s }:
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.28.0";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-qFZLl37Y9g9LMRnWacwz46cgjVreLg2WyWZrSj3T4ok=";
+    sha256 = "sha256-3ij77aBNufSEP3wf8wtQ/aBehE45fwrgofCmyXxuyPM=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   tags = [ "netgo" ];
 
-  vendorHash = "sha256-TfU1IzTdrWQpK/YjQQImRGeo7byaXUI182xSed+21PU=";
+  vendorHash = "sha256-kgi5ZfbjkSiJ/uZkfpeMhonSt/4sO3RKARpoww1FsTo=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
@@ -28,10 +28,13 @@ buildGoModule rec {
   preCheck = "export HOME=$(mktemp -d)";
   # For arch != x86
   # {"level":"fatal","error":"could not create any of the following paths: /homeless-shelter/.config, /etc/xdg","time":"2022-06-28T15:52:36Z","message":"Unable to create configuration directory for k9s"}
-  passthru.tests.version = testers.testVersion {
-    package = k9s;
-    command = "HOME=$(mktemp -d) k9s version -s";
-    inherit version;
+  passthru = {
+    tests.version = testers.testVersion {
+      package = k9s;
+      command = "HOME=$(mktemp -d) k9s version -s";
+      inherit version;
+    };
+    updateScript = nix-update-script { };
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/networking/cluster/kaniko/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-O4FPz62QnvG+Q2l4Gr/O0XFpkXE2G4RO/G6KNDdanzk=";
+    hash = "sha256-EMBCJc9x4oduFSHMYajc/Pf8nHwRP7qMsvJUbnDkjdk=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/kops/default.nix

@@ -61,8 +61,8 @@ rec {
   };
 
   kops_1_28 = mkKops rec {
-    version = "1.28.0";
-    sha256 = "sha256-a/3amvgGG7Gro6K7uIi20jwCo+JAlSuPB3/EUf75hxc=";
+    version = "1.28.1";
+    sha256 = "sha256-jVaSqBdxg70XODwmFIpufJGXqB4r0UfNc/J+ZnjkhDU=";
     rev = "v${version}";
   };
 }

pkgs/applications/networking/cluster/opentofu/default.nix

@@ -14,15 +14,15 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.6.0-alpha4";
+    version = "1.6.0-alpha5";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-JkYMGD6hNMcMYPXnFUm/6T0EfzeAfG4oQuyqcNv3hVE=";
+      hash = "sha256-nkDDq9/ruiSvACw997DgnswwTVzCaZ5K9oT2bKrBYWA=";
     };
-    vendorHash = "sha256-kE61inSQ8aCFnPf8plVRUJgruSFVOsogJAbI1zvJdb4=";
+    vendorHash = "sha256-mUakrS3d4UXA5XKyuiIUbGsCAiUMwVbYr8UWOyAtA8Y=";
     ldflags = [ "-s" "-w" ];
 
     postConfigure = ''

pkgs/applications/networking/cluster/starboard/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.15.16";
+  version = "0.15.17";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-n4gChQQMVdtEKW2WqQAEVtlU2fFxLxBem2yAJzDjx2Q=";
+    sha256 = "sha256-RzwLc29f+u/m1x5R199M8XQQ5nn33ofYi3AyMCimMtA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/applications/networking/cluster/tektoncd-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.32.1";
+  version = "0.32.2";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-qxKWyNQRWc0krdIfG6Mkn8ZZSkCkb0V41nIUsN5azGo=";
+    sha256 = "sha256-CNjZpiIKkky4BVmz6pN5tdADIt6hlnWY8ig9Rdt6qmI=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1,10 +1,10 @@
 {
   "aci": {
-    "hash": "sha256-rJ4xiBLrwhYkVPFDo6vZkk+w3v07EuK5a2gn1cbEA6Q=",
+    "hash": "sha256-RcMT8KD2V9JsAoQCznHpWIe+DHcTfKuW6gJlnxw9Kxo=",
     "homepage": "https://registry.terraform.io/providers/CiscoDevNet/aci",
     "owner": "CiscoDevNet",
     "repo": "terraform-provider-aci",
-    "rev": "v2.10.1",
+    "rev": "v2.11.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -28,29 +28,29 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-3agD22viTP+yntNg2nyYi5OpknXnfI2Jk/xEcvXgia8=",
+    "hash": "sha256-RxqrgekgPkLUTJsrEVfQPTOodv/hNWXFV7c/1Mg6mt0=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.8.2",
+    "rev": "v4.9.3",
     "spdx": "MIT",
-    "vendorHash": "sha256-sVPby/MLAgU7DfBDACqxvkLWblBhisHcUaoOgR3fMaM="
+    "vendorHash": "sha256-gRcWzrI8qNpP/xxGV6MOYm79h4mH4hH+NW8W2BbGdYw="
   },
   "akamai": {
-    "hash": "sha256-4AosPUVnwq8Ptw1O6jT1V8xahmTigGpBqm4JJjzMXus=",
+    "hash": "sha256-Du0ANsAHzV6zKobpiJzdy26JgIW1NRO6fbAHNMCDbaI=",
     "homepage": "https://registry.terraform.io/providers/akamai/akamai",
     "owner": "akamai",
     "repo": "terraform-provider-akamai",
-    "rev": "v5.3.0",
+    "rev": "v5.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Iuz5yxuxRwzj8BvoEXp8ePzaSA/vb7WbffljO1dBtxU="
+    "vendorHash": "sha256-4w3zYSO0GIL636FFuv1X4covAyFHVQ2Ah9N4RUQd7wM="
   },
   "alicloud": {
-    "hash": "sha256-ZcING8FOCZE+Wrpr2Gov0WmdjQUZU3K3Moj+0gMVKuQ=",
+    "hash": "sha256-GdoesVK4awNjMMBE6YuLIMh23WyMLKxABWLQ/y5H4kw=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.211.1",
+    "rev": "v1.212.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -82,66 +82,66 @@
     "vendorHash": "sha256-q9PO9tMbaXTs3nBLElwU05GcDZMZqNmLVVGDmiSRSfo="
   },
   "artifactory": {
-    "hash": "sha256-knQZsPb41JJjtSLV51/c33jlXM5Jud0QIaB/78iFQKs=",
+    "hash": "sha256-F491M8AS+nh4fCPUA/6R9c6MQ6CB29QJsWjk1L5LOwI=",
     "homepage": "https://registry.terraform.io/providers/jfrog/artifactory",
     "owner": "jfrog",
     "repo": "terraform-provider-artifactory",
-    "rev": "v9.7.2",
+    "rev": "v9.8.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-H91JHkL32B1arXlqwhhK8M24s3lW3O8gMXd+0waMIKQ="
+    "vendorHash": "sha256-Ne0ed+H6lPEH5uTYS98pLIf+7B1w+HSM77tGGG9E5RQ="
   },
   "auth0": {
-    "hash": "sha256-QljqPcupvU7AgVSuarpd0FwLuAPJI9umgsgMXc2/v6w=",
+    "hash": "sha256-//F0WsvL8jkDCywdGCC6NaQD4oG/X/KeMuq8vWpnlSE=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v0.50.0",
+    "rev": "v1.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-+ZYbaQICwcABnJE9p6Lwk0gXqeHfO/TLkvwvLD9v8ng="
+    "vendorHash": "sha256-8gfCVvFFcuoR4KL6nawJXSdWgnZfOgehs9GxO5n8w9A="
   },
   "avi": {
-    "hash": "sha256-xis3uVCK+dck6R5ru8suNQov9qTLwLIdeQCAR9Jwqcs=",
+    "hash": "sha256-EGpHajrTTOx7LrFHzsrrkGMqsuUEJLJAN6AJ48QdJis=",
     "homepage": "https://registry.terraform.io/providers/vmware/avi",
     "owner": "vmware",
     "proxyVendor": true,
     "repo": "terraform-provider-avi",
-    "rev": "v22.1.4",
+    "rev": "v22.1.5",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vORXHX6VKP/JHP/InB2b9Rqej2JIIDOzS3r05wO2I+c="
+    "vendorHash": "sha256-1+VDh9hR/2Knl5oV9ZQiPCt+F7VmaTU4MI1+o8Msu8M="
   },
   "aviatrix": {
-    "hash": "sha256-T/GPJBcKxWhBxB7fVACkkwRm6dqixQpkAzi6UYw6TRw=",
+    "hash": "sha256-PRYtkq4CLEbUJ7YOSlvDyz+z4icLi0DBkDCTs/tNoIQ=",
     "homepage": "https://registry.terraform.io/providers/AviatrixSystems/aviatrix",
     "owner": "AviatrixSystems",
     "repo": "terraform-provider-aviatrix",
-    "rev": "v3.1.2",
+    "rev": "v3.1.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-tiSCEHOjhOXW4XcQ3FrkNg6AVtFrDLqVe0fB3o1KAmU=",
+    "hash": "sha256-4ecgttYOAQ/I+ma1eSPomiJ4rdT9F1gtQUu4OS4stlQ=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.22.0",
+    "rev": "v5.25.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pRnQUCuAk02dM5NozNirH7c+meewwf0DMjwZlazD30Q="
+    "vendorHash": "sha256-twXEX5emBPQUMQcf11S9ZKfuaGv74LtXUE2LxqmN2xo="
   },
   "azuread": {
-    "hash": "sha256-aTIxJgKk0bRvJyONn7iGLbsEbfe0Vzmtk+bTj3tZFPI=",
+    "hash": "sha256-PwHnyw0sZurUMLWKUmC3ULB8bc9adIU5C9WzVqBsLBA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v2.43.0",
+    "rev": "v2.45.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-jgnWSOwcocdWS531sjOFYiNx43Orx78WfS0glHRznfw=",
+    "hash": "sha256-sGZvfjq2F1BjvqgYel0P/ofGmHXv8c7OhfXGGoXB2+Q=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v3.77.0",
+    "rev": "v3.80.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/cluster/waagent/default.nix

@@ -10,7 +10,7 @@
   openssl,
   parted,
   procps, # for pidof,
-  python3,
+  python39, # the latest python version that waagent test against according to https://github.com/Azure/WALinuxAgent/blob/28345a55f9b21dae89472111635fd6e41809d958/.github/workflows/ci_pr.yml#L75
   shadow, # for useradd, usermod
   util-linux, # for (u)mount, fdisk, sfdisk, mkswap
 }:
@@ -19,7 +19,7 @@ let
   inherit (lib) makeBinPath;
 
 in
-python3.pkgs.buildPythonPackage rec {
+python39.pkgs.buildPythonPackage rec {
   pname = "waagent";
   version = "2.8.0.11";
   src = fetchFromGitHub {
@@ -28,9 +28,14 @@ python3.pkgs.buildPythonPackage rec {
     rev = "04ded9f0b708cfaf4f9b68eead1aef4cc4f32eeb";
     sha256 = "0fvjanvsz1zyzhbjr2alq5fnld43mdd776r2qid5jy5glzv0xbhf";
   };
+  patches = [
+    # Suppress the following error when waagent try to configure sshd:
+    # Read-only file system: '/etc/ssh/sshd_config'
+    ./dont-configure-sshd.patch
+  ];
   doCheck = false;
 
-  buildInputs = with python3.pkgs; [ distro ];
+  buildInputs = with python39.pkgs; [ distro ];
   runtimeDeps = [
     findutils
     gnugrep

pkgs/applications/networking/cluster/waagent/dont-configure-sshd.patch

@@ -0,0 +1,23 @@
+From 383e7c826906baedcd12ae7c20a4a5d4b32b104a Mon Sep 17 00:00:00 2001
+From: "Yang, Bo" <bo@preemo.io>
+Date: Wed, 8 Nov 2023 23:08:07 +0000
+Subject: [PATCH] Don't configure sshd
+
+---
+ azurelinuxagent/pa/provision/default.py | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/azurelinuxagent/pa/provision/default.py b/azurelinuxagent/pa/provision/default.py
+index 91fe04edab..48edf01490 100644
+--- a/azurelinuxagent/pa/provision/default.py
++++ b/azurelinuxagent/pa/provision/default.py
+@@ -237,9 +237,6 @@ def config_user_account(self, ovfenv):
+         self.osutil.conf_sudoer(ovfenv.username,
+                                 nopasswd=ovfenv.user_password is None)
+ 
+-        logger.info("Configure sshd")
+-        self.osutil.conf_sshd(ovfenv.disable_ssh_password_auth)
+-
+         self.deploy_ssh_pubkeys(ovfenv)
+         self.deploy_ssh_keypairs(ovfenv)
+ 

pkgs/applications/networking/instant-messengers/qq/sources.nix

@@ -1,8 +1,8 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-10-16
+# Last updated: 2023-11-14
 {
-  version = "3.2.1-17412";
-  urlhash = "423936b9";
-  arm64_hash = "sha256-gvKBcfQafDtNioFg4Cyy92VMAX4uKL5H7wBkxQgDwjI=";
-  amd64_hash = "sha256-cg2YXB1/pf5eDRHFgzydIb4GICjh9XRtCquPspgCL6c=";
+  version = "3.2.2-18394";
+  urlhash = "fd2e886e";
+  arm64_hash = "sha256-6E3h7Z4936YKZb+G0FoMb90T3EzH8z07mmGMnL4SDFk=";
+  amd64_hash = "sha256-L1M8O0FzVKLXNNYGGMPf1Nbh/DFxLHBlbzapr7uz5Sk=";
 }

pkgs/applications/networking/instant-messengers/qq/update.sh

@@ -9,7 +9,7 @@ payload=$(curl https://im.qq.com/rainbow/linuxQQDownload | grep -oP "var params=
 amd64_url=$(jq -r .x64DownloadUrl.deb <<< "$payload")
 arm64_url=$(jq -r .armDownloadUrl.deb <<< "$payload")
 
-urlhash=$(grep -oP "(?<=QQNT/)[a-e0-9]+(?=/linuxqq)" <<< "$amd64_url")
+urlhash=$(grep -oP "(?<=QQNT/)[a-f0-9]+(?=/linuxqq)" <<< "$amd64_url")
 version=$(grep -oP "(?<=/linuxqq_).*(?=_amd64.deb)" <<< "$amd64_url")
 
 amd64_hash=$(nix-prefetch-url $amd64_url)

pkgs/applications/networking/kubo/default.nix

@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.23.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.24.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "15"; # Also update kubo-migrator when changing the repo version
@@ -15,7 +15,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-ycXn8h8sFGJXVMldneN51lZgXoPaZ/XeXLtqqJ4w6H0=";
+    hash = "sha256-stSjLvg8G1EiXon3Qby4wLgbhX7Aaj9pnxcvE32/42k=";
   };
 
   # tarball contains multiple files/directories

pkgs/applications/networking/mailreaders/betterbird/default.nix

@@ -12,13 +12,13 @@
 let
   thunderbird-unwrapped = thunderbirdPackages.thunderbird-115;
 
-  version = "115.3.2";
+  version = "115.4.2";
   majVer = lib.versions.major version;
 
   betterbird-patches = fetchFromGitHub {
     owner = "Betterbird";
     repo = "thunderbird-patches";
-    rev = "${version}-bb15";
+    rev = "${version}-bb17";
     postFetch = ''
       echo "Retrieving external patches"
 
@@ -36,7 +36,7 @@ let
       . ./external.sh
       rm external.sh
     '';
-    hash = "sha256-6alAGEid7ipr01I52TB0xrlLroCIc03N2IagGJq8te8=";
+    hash = "sha256-hfM1VzYD0TsjZik0MLXBAkD5ecyvbg7jn2pKdrzMEfo=";
   };
 in ((buildMozillaMach {
   pname = "betterbird";
@@ -49,7 +49,7 @@ in ((buildMozillaMach {
   src = fetchurl {
     # https://download.cdn.mozilla.net/pub/thunderbird/releases/
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    hash = "sha256-kn35avKqUdMix8VJrKJjSWViMLe/WnnxNasPpM7/cdM=";
+    hash = "sha256-PAjj7FvIA7uB0yngkL4KYKZoYU1CF2qQTF5+sG2VLtI=";
   };
 
   extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ ''

pkgs/applications/networking/p2p/transmission/4.nix

@@ -139,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
       include <local/bin.transmission-daemon>
     }
     EOF
+    install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg
   '';
 
   passthru.tests = {

pkgs/applications/networking/seafile-client/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seafile-client";
-  version = "9.0.3";
+  version = "9.0.4";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "seafile-client";
     rev = "v${version}";
-    sha256 = "sha256-zoo34mhNZTEwxjSy8XgmZfEjkujmWj34OtDJQSCb/zk=";
+    sha256 = "sha256-Qt4Y7s2BMwuKXTYjHAzK40HgAsxlk98af3irOXT4/Vs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/sync/backintime/qt.nix

@@ -1,4 +1,4 @@
-{ mkDerivation, backintime-common, python3 }:
+{ lib, mkDerivation, backintime-common, python3, polkit, which, su, coreutils, util-linux }:
 
 let
   python' = python3.withPackages (ps: with ps; [ pyqt5 backintime-common packaging ]);
@@ -21,6 +21,29 @@ mkDerivation {
 
   preFixup = ''
     wrapQtApp "$out/bin/backintime-qt" \
-      --prefix PATH : "${backintime-common}/bin:$PATH"
+      --prefix PATH : "${lib.getBin backintime-common}/bin:$PATH"
+
+    substituteInPlace "$out/share/polkit-1/actions/net.launchpad.backintime.policy" \
+      --replace "/usr/bin/backintime-qt" "$out/bin/backintime-qt"
+
+    substituteInPlace "$out/share/applications/backintime-qt-root.desktop" \
+      --replace "/usr/bin/backintime-qt" "backintime-qt"
+
+    substituteInPlace "$out/share/backintime/qt/serviceHelper.py" \
+      --replace "'which'" "'${lib.getBin which}/bin/which'" \
+      --replace "/bin/su" "${lib.getBin su}/bin/su" \
+      --replace "/usr/bin/backintime" "${lib.getBin backintime-common}/bin/backintime" \
+      --replace "/usr/bin/nice" "${lib.getBin coreutils}/bin/nice" \
+      --replace "/usr/bin/ionice" "${lib.getBin util-linux}/bin/ionice"
+
+    substituteInPlace "$out/share/dbus-1/system-services/net.launchpad.backintime.serviceHelper.service" \
+      --replace "/usr/bin/python3" "${lib.getBin python'}/bin/python3" \
+      --replace "/usr/share/backintime" "$out/share/backintime"
+
+    substituteInPlace "$out/bin/backintime-qt_polkit" \
+      --replace "/usr/bin/backintime-qt" "$out/bin/backintime-qt"
+
+    wrapProgram "$out/bin/backintime-qt_polkit" \
+      --prefix PATH : "${lib.getBin polkit}/bin:$PATH"
   '';
 }

pkgs/applications/networking/sync/storj-uplink/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.90.1";
+  version = "1.90.2";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-LJtNsemNbN+TLyUxSgB/wftKxOfI/y/t+qv1TjcsXzQ=";
+    hash = "sha256-VEO9LV6hzEd4IDnSPE5H0CDlwgRFEg4cheDx/RUGQug=";
   };
 
   subPackages = [ "cmd/uplink" ];

pkgs/applications/office/fava/default.nix

@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.26.1";
+  version = "1.26.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pj4kaQDXahjhN7bu7xxT/ZuoCfPdGyo898482S5gnlE=";
+    hash = "sha256-+rMuVfe6BDAcZgJkBb18YLFZirOBfad6WGbWtAT21uI=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
@@ -31,6 +31,11 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'setuptools_scm>=8.0' 'setuptools_scm'
+  '';
+
   preCheck = ''
     export HOME=$TEMPDIR
   '';

pkgs/applications/radio/gridtracker/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
-  version = "1.23.0402";
+  version = "1.23.1112";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker";
     rev = "v${version}";
-    sha256 = "sha256-6SQuFN8Fi0fbWCYrQIIeSaXR2haI7uux4txCPKEoJvo=";
+    sha256 = "sha256-0A1/P57RtUExxflr2XayHPEyr28B6UDYY7pVCAJpWX0=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];

pkgs/applications/science/chemistry/cp2k/default.nix

@@ -28,8 +28,16 @@
 , spfft
 , enableElpa ? false
 , elpa
-, gpuBackend ? "none"
 , cudaPackages
+, rocmPackages
+, config
+, gpuBackend ? (
+  if config.cudaSupport
+  then "cuda"
+  else if config.rocmSupport
+  then "rocm"
+  else "none"
+)
 # gpuVersion needs to be set for both CUDA as well as ROCM hardware.
 # gpuArch is only required for the ROCM stack.
 # Change to a value suitable for your target GPU.
@@ -37,7 +45,6 @@
 # and for Nvidia see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2i-cuda-optional-improved-performance-on-gpu-systems
 , gpuVersion ? "Mi100"
 , gpuArch ? "gfx908"
-, rocmPackages
 }:
 
 assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];

pkgs/applications/science/logic/abella/default.nix

@@ -2,20 +2,21 @@
 
 stdenv.mkDerivation rec {
   pname = "abella";
-  version = "2.0.7";
+  version = "2.0.8";
 
   src = fetchurl {
     url = "http://abella-prover.org/distributions/${pname}-${version}.tar.gz";
-    sha256 = "sha256-/eOiebMFHgrurtrSHPlgZO3xmmxBOUmyAzswXZLd3Yc=";
+    sha256 = "sha256-80b/RUpE3KRY0Qu8eeTxAbk6mwGG6jVTPOP0qFjyj2M=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [ rsync ] ++ (with ocamlPackages; [ ocaml ocamlbuild findlib ]);
+  nativeBuildInputs = [ rsync ] ++ (with ocamlPackages; [ ocaml dune_3 menhir findlib ]);
+  buildInputs = with ocamlPackages; [ cmdliner yojson ];
 
   installPhase = ''
     mkdir -p $out/bin
-    rsync -av abella    $out/bin/
+    rsync -av _build/default/src/abella.exe    $out/bin/abella
 
     mkdir -p $out/share/emacs/site-lisp/abella/
     rsync -av emacs/    $out/share/emacs/site-lisp/abella/

pkgs/applications/version-management/gh/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.38.0";
+  version = "2.39.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-t+JpCxJM2PO9nT9nYn/Rsz/s2lQQviggbjuEy0OQV88=";
+    hash = "sha256-cBdP514ZW7iSMzecGFCgiXz3bGZZ1LzxnVpEd9b4Dy0=";
   };
 
-  vendorHash = "sha256-XZhZDYdbjA/1g7/mPxm5u1b+z/TmwoH60/sJZ63LQMg=";
+  vendorHash = "sha256-RFForZy/MktbrNrcpp9G6VCB7A98liJvCxS0Yb16sMc=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/version-management/jujutsu/default.nix

@@ -20,16 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-LJW4Px3K5cz6RJ4sUbwUXsp2+rzEW5wowi+DALHajYA=";
+    hash = "sha256-yEW7+0MnJlW0WeZ6UItaCDrihPLA52mLcu15tJwZx9w=";
   };
 
-  cargoHash = "sha256-fs1cWhBFp2u3HiEx/mMnbwvgwKo97KmftA/sr4dGsiM=";
+  cargoHash = "sha256-xA9SDq1Kc0u8qFEPFFCic9uwE2Y/BXJzUHBCs1Czxtw=";
 
   cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
   useNextest = true; # nextest is the upstream integration framework

pkgs/applications/version-management/p4d/default.nix

@@ -7,23 +7,19 @@
 let
   # Upstream replaces minor versions, so use cached URLs.
   srcs = {
-    "i686-linux" = fetchurl {
-      url = "https://web.archive.org/web/20220907001049/https://ftp.perforce.com/perforce/r22.1/bin.linux26x86/helix-core-server.tgz";
-      sha256 = "e9cf27c9dd2fa6432745058a93896d151543aff712fce9f7322152d6ea88a12a";
-    };
     "x86_64-linux" = fetchurl {
-      url = "https://web.archive.org/web/20220907001202/https://ftp.perforce.com/perforce/r22.1/bin.linux26x86_64/helix-core-server.tgz";
-      sha256 = "9c272b67574264a4f49fe846ccda24fbd4baeb282665af74b6fbccff26a43558";
+      url = "https://web.archive.org/web/20231109221336id_/https://ftp.perforce.com/perforce/r23.1/bin.linux26x86_64/helix-core-server.tgz";
+      sha256 = "b68c4907cf9258ab47102e8f0e489c11d528a8f614bfa45e3a2fa198639e2362";
     };
     "x86_64-darwin" = fetchurl {
-      url = "https://web.archive.org/web/20220907001334/https://ftp.perforce.com/perforce/r22.1/bin.macosx1015x86_64/helix-core-server.tgz";
-      sha256 = "2500a23fe482a303bd400f0de460b7624ad3f940fef45246004b9f956e90ea45";
+      url = "https://web.archive.org/web/20231109221937id_/https://ftp.perforce.com/perforce/r23.1/bin.macosx1015x86_64/helix-core-server.tgz";
+      sha256 = "fcbf09787ffc29f7237839711447bf19a37ae18a8a7e19b2d30deb3715ae2c11";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "p4d";
-  version = "2022.1.2305383";
+  version = "2023.1.2513900";
 
   src =
     assert lib.assertMsg (builtins.hasAttr stdenv.hostPlatform.system srcs) "p4d is not available for ${stdenv.hostPlatform.system}";

pkgs/applications/video/frigate/default.nix

@@ -5,7 +5,6 @@
 , fetchurl
 , fetchpatch
 , frigate
-, opencv4
 , nixosTests
 }:
 
@@ -26,28 +25,6 @@ let
 
   python = python3.override {
     packageOverrides = self: super: {
-      # https://github.com/blakeblackshear/frigate/blob/v0.12.0/requirements-wheels.txt#L7
-      opencv = super.toPythonModule ((opencv4.override {
-        enablePython = true;
-        pythonPackages = self;
-      }).overrideAttrs (oldAttrs: rec {
-        version = "4.5.5";
-        src = fetchFromGitHub {
-          owner = "opencv";
-          repo = "opencv";
-          rev = "refs/tags/${version}";
-          hash = "sha256-TJfzEAMh4JSshZ7oEZPgB59+NBACsj6Z5TCzVOBaEP4=";
-        };
-        contribSrc = fetchFromGitHub {
-          owner = "opencv";
-          repo = "opencv_contrib";
-          rev = "refs/tags/${version}";
-          hash = "sha256-skuH9GYg0mivGaJjxbggXk4x/0bbQISrAawA3ZUGfCk=";
-        };
-        postUnpack = ''
-          cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
-        '';
-      }));
     };
   };
 
@@ -129,7 +106,7 @@ python.pkgs.buildPythonApplication rec {
     imutils
     matplotlib
     numpy
-    opencv
+    opencv4
     openvino
     paho-mqtt
     peewee

pkgs/applications/virtualization/podman-tui/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-XaZgvy8b/3XUjO/GAQV6fxfqlR+eSMeosC7ugoYsEJM=";
+    hash = "sha256-l6jbc/+Fi5xx7yhK0e5/iqcm7i8JnU37Qr4niVG4OvU=";
   };
 
   vendorHash = null;

pkgs/applications/virtualization/singularity/packages.nix

@@ -7,14 +7,14 @@ let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
-      version = "1.2.2";
+      version = "1.2.4";
       projectName = "apptainer";
 
       src = fetchFromGitHub {
         owner = "apptainer";
         repo = "apptainer";
-        rev = "v${version}";
-        hash = "sha256-CpNuoG+QykP+HDCyFuIbZKYez5XnYrE75SWFoWu34rg=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-VaVOepfjMBf8F56S1Clpn8HPw65MNQMoZsQguKQ4Sg0=";
       };
 
       # Update by running
@@ -38,25 +38,26 @@ let
   singularity = callPackage
     (import ./generic.nix rec {
       pname = "singularity-ce";
-      version = "3.11.4";
+      version = "4.0.1";
       projectName = "singularity";
 
       src = fetchFromGitHub {
         owner = "sylabs";
         repo = "singularity";
-        rev = "v${version}";
-        hash = "sha256-v8iHbn2OzK/egP2Go76BI74iX8izfy2PM4Uo8LsE8FY=";
+        rev = "refs/tags/v${version}";
+        hash = "sha256-rdpIAiLh4mlSu+1UUDN79gIzxy5X5wOB5XOW9oBm+HU=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-24Hnpq6LRh3JgaiJWCmHfJKoWLxsbceCdJutjPqZsX8=";
+      vendorHash = "sha256-kV4Yu9MBoF8spJroWqLOUt2v8YV79AoNUG9hYgPgXRc=";
 
-      # Do not build conmon from the Git submodule source,
+      # Do not build conmon and squashfuse from the Git submodule sources,
       # Use Nixpkgs provided version
       extraConfigureFlags = [
         "--without-conmon"
+        "--without-squashfuse"
       ];
 
       extraDescription = " (Sylabs Inc's fork of Singularity, a.k.a. SingularityCE)";

pkgs/build-support/go/module.nix

@@ -297,6 +297,7 @@ let
     } // meta;
   });
 in
+lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
   package

pkgs/by-name/am/amazon-ssm-agent/package.nix

@@ -2,6 +2,7 @@
 , writeShellScriptBin
 , buildGoModule
 , makeWrapper
+, darwin
 , fetchFromGitHub
 , coreutils
 , nettools
@@ -40,13 +41,13 @@ let
 in
 buildGoModule rec {
   pname = "amazon-ssm-agent";
-  version = "3.2.1705.0";
+  version = "3.2.1798.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     rev = "refs/tags/${version}";
-    hash = "sha256-4KhDD5G/fS1rHitQdbYqIz6RSQ3PTMZsUENC202a/Do=";
+    hash = "sha256-A7M8UbOJT9zvbcwlARMwA7a+LGk8KYmo9j31yzh5FDQ=";
   };
 
   vendorHash = null;
@@ -60,7 +61,11 @@ buildGoModule rec {
     ./0002-version-gen-don-t-use-unnecessary-constants.patch
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.DarwinTools
+  ];
 
   # See the list https://github.com/aws/amazon-ssm-agent/blob/3.2.1630.0/makefile#L120-L138
   # The updater is not built because it cannot work on NixOS
@@ -137,7 +142,8 @@ buildGoModule rec {
   ];
 
   postFixup = ''
-    wrapProgram $out/bin/amazon-ssm-agent --prefix PATH : ${bashInteractive}/bin
+    wrapProgram $out/bin/amazon-ssm-agent \
+      --prefix PATH : "${lib.makeBinPath [ bashInteractive ]}"
   '';
 
   passthru = {
@@ -148,6 +154,8 @@ buildGoModule rec {
     };
   };
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Agent to enable remote management of your Amazon EC2 instance configuration";
     changelog = "https://github.com/aws/amazon-ssm-agent/releases/tag/${version}";
@@ -155,8 +163,5 @@ buildGoModule rec {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = with maintainers; [ copumpkin manveru anthonyroussel ];
-
-    # Darwin support is broken
-    broken = stdenv.isDarwin;
   };
 }

pkgs/by-name/ce/certspotter/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "certspotter";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "SSLMate";
     repo = "certspotter";
     rev = "v${version}";
-    hash = "sha256-6ghS+9b8FZiYdiTk54XRHP46lOq98sN1RDYvRYTt6eU=";
+    hash = "sha256-nyeqpDMRZRuHjfl3cI/I00KpVg3udjr0B8MEBZcF7nY=";
   };
 
   vendorHash = "sha256-6dV9FoPV8UfS0z5RuuopE99fHcT3RAWCdDi7jpHzVRE=";

pkgs/by-name/co/cowsql/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cowsql";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "cowsql";
     repo = "cowsql";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-+za3pIcV4BhoImKvJlKatCK372wL4OyPbApQvGxGGGk=";
+    hash = "sha256-JbLiwWXOrEhqCdM8tWwxl68O5Sga4T7NYCXzqP9+Dh0=";
   };
 
   nativeBuildInputs = [
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
+    changelog = "https://github.com/cowsql/cowsql/releases/tag/${version}";
     description = "Embeddable, replicated and fault tolerant SQL engine";
     homepage = "https://github.com/cowsql/cowsql";
     license = licenses.lgpl3Only;

pkgs/by-name/ll/llama-cpp/package.nix

@@ -10,7 +10,7 @@
 , cudaSupport ? config.cudaSupport
 , cudaPackages ? { }
 
-, rocmSupport ? false
+, rocmSupport ? config.rocmSupport
 , rocmPackages ? { }
 
 , openclSupport ? false

pkgs/by-name/sh/shopware-cli/package.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.3.6";
+  version = "0.3.12";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-3Js44cLS6GLI6wFuT2wxgwyMF3beXaULVeaejfxxtA0=";
+    hash = "sha256-vGtHz1lSKbucR4MmXv542lv9kbON9Cwo7vB5TaeqoX8=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-QZ/zU67oUW75T8DOzjQwmEAr6gjIg/6ZO4Vm/47Lc40=";
+  vendorHash = "sha256-vE9gh0u8j2NViK2dUd39zZtUuaoKv0hf8VhSX/P4ar8=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"

pkgs/by-name/si/sirius/package.nix

@@ -21,9 +21,16 @@
 , eigen
 , libvdwxc
 , llvmPackages
-, gpuBackend ? "none"
 , cudaPackages
 , rocmPackages
+, config
+, gpuBackend ? (
+  if config.cudaSupport
+  then "cuda"
+  else if config.rocmSupport
+  then "rocm"
+  else "none"
+)
 }:
 
 assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];

pkgs/by-name/sp/spfft/package.nix

@@ -6,9 +6,16 @@
 , mpi
 , gfortran
 , llvmPackages
-, gpuBackend ? "none"
 , cudaPackages
 , rocmPackages
+, config
+, gpuBackend ? (
+  if config.cudaSupport
+  then "cuda"
+  else if config.rocmSupport
+  then "rocm"
+  else "none"
+)
 }:
 
 assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];

pkgs/by-name/sp/spla/package.nix

@@ -6,9 +6,16 @@
 , blas
 , gfortran
 , llvmPackages
-, gpuBackend ? "none"
 , cudaPackages
 , rocmPackages
+, config
+, gpuBackend ? (
+  if config.cudaSupport
+  then "cuda"
+  else if config.rocmSupport
+  then "rocm"
+  else "none"
+)
 }:
 
 assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];

pkgs/by-name/us/usql/package.nix

@@ -10,18 +10,18 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    hash = "sha256-SJypezOTQr+TiG/rePXxgjrspeErqj6qw9TBen41e4Q=";
+    hash = "sha256-XfzCJOr0lOkimUKbOW0+qFNQMmYc0DBgi+0ItmEOjwE=";
   };
 
   buildInputs = [ unixODBC icu ];
 
-  vendorHash = "sha256-i2lH6ajRmfJHsh7nzCjt7mi3issA4kSBdG42w67pOC4=";
+  vendorHash = "sha256-sijt6YOp1pFNhaxLIOLH90Z5ODVbWFj/mp8Csx8n+ac=";
   proxyVendor = true;
 
   # Exclude broken genji, hive & impala drivers (bad group)
@@ -35,7 +35,7 @@ buildGoModule rec {
     "impala"
   ];
 
-  # These tags and flags are copied from build-release.sh
+  # These tags and flags are copied from build.sh
   tags = [
     "most"
     "sqlite_app_armor"
@@ -46,7 +46,6 @@ buildGoModule rec {
     "sqlite_stat4"
     "sqlite_userauth"
     "sqlite_vtable"
-    "sqlite_icu"
     "no_adodb"
   ];
 

pkgs/data/fonts/noto-fonts/default.nix

@@ -160,8 +160,8 @@ rec {
 
   noto-fonts-cjk-serif = mkNotoCJK {
     typeface = "Serif";
-    version = "2.001";
-    sha256 = "sha256-y1103SS0qkZMhEL5+7kQZ+OBs5tRaqkqOcs4796Fzhg=";
+    version = "2.002";
+    sha256 = "sha256-GLjpTAiHfygj1J4AdUVDJh8kykkFOglq+h4kyat5W9s=";
   };
 
   noto-fonts-color-emoji =

pkgs/data/themes/colloid-gtk-theme/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
-, gitUpdater
 , gnome-themes-extra
 , gtk-engine-murrine
 , jdupes
@@ -23,13 +22,13 @@ lib.checkListOfEnum "${pname}: tweaks" [ "nord" "dracula" "gruvbox" "all" "black
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-08-12";
+  version = "2023-10-28";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    hash = "sha256-Ss6IXd4vYUvIF5/Hn4IVLNvDSaewTY0GNZp7X5Lmz/c=";
+    hash = "sha256-NxIWH3qLW8sEguovAv9wfgnlnmPlTipRJTmMo3rSHNY=";
   };
 
   nativeBuildInputs = [
@@ -64,8 +63,6 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.updateScript = gitUpdater { };
-
   meta = with lib; {
     description = "A modern and clean Gtk theme";
     homepage = "https://github.com/vinceliuice/Colloid-gtk-theme";

pkgs/data/themes/utterly-nord-plasma/default.nix

@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, breeze-icons
+, kdeclarative
+, kirigami2
+, plasma-framework
+, plasma-workspace
+}:
+
+stdenv.mkDerivation rec {
+  pname = "utterly-nord-plasma";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "HimDek";
+    repo = pname;
+    rev = "6d9ffe008f0bee47c8346c9a7ec71f206d999fd0";
+    hash = "sha256-B5pIwV0BHxDluKWKTy+xuBPaE3N6UOHXip1SIAm2kM8=";
+  };
+
+  propagatedUserEnvPkgs = [
+    breeze-icons
+    kdeclarative.bin
+    kirigami2
+    plasma-framework.bin
+    plasma-workspace
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{color-schemes,Kvantum,plasma/look-and-feel,sddm/themes,wallpapers,konsole}
+
+    cp -a look-and-feel $out/share/plasma/look-and-feel/Utterly-Nord
+    cp -a look-and-feel-solid $out/share/plasma/look-and-feel/Utterly-Nord-solid
+    cp -a look-and-feel-light $out/share/plasma/look-and-feel/Utterly-Nord-light
+    cp -a look-and-feel-light-solid $out/share/plasma/look-and-feel/Utterly-Nord-light-solid
+
+    cp -a *.colors $out/share/color-schemes/
+
+    cp -a wallpaper $out/share/wallpapers/Utterly-Nord
+
+    cp -a kvantum $out/share/Kvantum/Utterly-Nord
+    cp -a kvantum-solid $out/share/Kvantum/Utterly-Nord-Solid
+    cp -a kvantum-light $out/share/Kvantum/Utterly-Nord-Light
+    cp -a kvantum-light-solid $out/share/Kvantum/Utterly-Nord-Light-Solid
+
+    cp -a *.colorscheme $out/share/konsole/
+
+    cp -a sddm $out/share/sddm/themes/Utterly-Nord
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A Plasma theme with Nordic Colors, transparency, blur and round edges for UI elements";
+    homepage = "https://himdek.com/Utterly-Nord-Plasma/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}

pkgs/data/themes/utterly-round-plasma-style/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "utterly-round-plasma-style";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "HimDek";
+    repo = pname;
+    rev = "c3677d5223286f69871f6745cdb3b71367229d40";
+    hash = "sha256-mlqRMz0cAZnnM4xE6p7fMzhGlqCQcM4FxmDlVnbGUgQ=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{aurorae/themes,plasma/desktoptheme}
+
+    cp -a aurorae/dark/translucent $out/share/aurorae/themes/Utterly-Round-Dark
+    cp -a aurorae/dark/solid $out/share/aurorae/themes/Utterly-Round-Dark-Solid
+    cp -a aurorae/light/translucent $out/share/aurorae/themes/Utterly-Round-Light
+    cp -a aurorae/light/solid $out/share/aurorae/themes/Utterly-Round-Light-Solid
+
+    cp -a desktoptheme/translucent $out/share/plasma/desktoptheme/Utterly-Round
+    cp -a desktoptheme/solid $out/share/plasma/desktoptheme/Utterly-Round-Solid
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A rounded desktop theme and window borders for Plasma 5 that follows any color scheme";
+    homepage = "https://himdek.com/Utterly-Round-Plasma-Style/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}

pkgs/development/compilers/closure/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "closure-compiler";
-  version = "20230802";
+  version = "20231112";
 
   src = fetchurl {
     url = "mirror://maven/com/google/javascript/closure-compiler/v${version}/closure-compiler-v${version}.jar";
-    sha256 = "sha256-IwqeBain2dqgg7H26G7bpusexkAqaiWEMv5CRc3EqV8=";
+    sha256 = "sha256-oH1/QZX8cF9sZikP5XpNdfsMepJrgW+uX0OGHhJVbmw=";
   };
 
   dontUnpack = true;

pkgs/development/compilers/opensycl/default.nix

@@ -8,8 +8,9 @@
 , libxml2
 , libffi
 , makeWrapper
+, config
 , rocmPackages
-, rocmSupport ? false
+, rocmSupport ? config.rocmSupport
 }:
 let
   inherit (llvmPackages_15) stdenv;

pkgs/development/interpreters/php/8.3.nix

@@ -2,14 +2,12 @@
 
 let
   base = (callPackage ./generic.nix (_args // {
-    version = "8.3.0RC5";
-    hash = null;
-  })).overrideAttrs (oldAttrs: {
-    src = fetchurl {
-      url = "https://downloads.php.net/~jakub/php-8.3.0RC5.tar.xz";
-      hash = "sha256-I42ded2tZO5ZQ+iU5DeNKjT+mNNoowew8gNOYDeB5aY=";
+    version = "8.3.0RC6";
+    phpSrc = fetchurl {
+      url = "https://downloads.php.net/~eric/php-8.3.0RC6.tar.xz";
+      hash = "sha256-Hntdz+vEkh7EQgnB4IrnG2sQ5bG2uJW7T3a0RIbHBe0=";
     };
-  });
+  }));
 in
 base.withExtensions ({ all, ... }: with all; ([
   bcmath

pkgs/development/interpreters/python/python-packages-base.nix

@@ -13,7 +13,7 @@ let
 
   # Derivations built with `buildPythonPackage` can already be overridden with `override`, `overrideAttrs`, and `overrideDerivation`.
   # This function introduces `overridePythonAttrs` and it overrides the call to `buildPythonPackage`.
-  makeOverridablePythonPackage = f: origArgs:
+  makeOverridablePythonPackage = f: lib.mirrorFunctionArgs f (origArgs:
     let
       args = lib.fix (lib.extends
         (_: previousAttrs: {
@@ -30,7 +30,7 @@ let
         overridePythonAttrs = newArgs: makeOverridablePythonPackage f (overrideWith newArgs);
         __functor = self: result;
       }
-      else result;
+      else result);
 
   mkPythonDerivation = if python.isPy3k then
     ./mk-python-derivation.nix

pkgs/development/libraries/gdcm/default.nix

@@ -10,6 +10,11 @@
 , enablePython ? false
 , python ? null
 , swig
+, expat
+, libuuid
+, openjpeg
+, zlib
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +32,10 @@ stdenv.mkDerivation rec {
     "-DGDCM_BUILD_APPLICATIONS=ON"
     "-DGDCM_BUILD_SHARED_LIBS=ON"
     "-DGDCM_BUILD_TESTING=ON"
+    "-DGDCM_USE_SYSTEM_EXPAT=ON"
+    "-DGDCM_USE_SYSTEM_ZLIB=ON"
+    "-DGDCM_USE_SYSTEM_UUID=ON"
+    "-DGDCM_USE_SYSTEM_OPENJPEG=ON"
     # hack around usual "`RUNTIME_DESTINATION` must not be an absolute path" issue:
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DCMAKE_INSTALL_BINDIR=bin"
@@ -38,9 +47,17 @@ stdenv.mkDerivation rec {
     "-DGDCM_INSTALL_PYTHONMODULE_DIR=${placeholder "out"}/${python.sitePackages}"
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
 
-  buildInputs = lib.optionals enableVTK [
+  buildInputs = [
+    expat
+    libuuid
+    openjpeg
+    zlib
+  ] ++ lib.optionals enableVTK [
     vtk
   ] ++ lib.optionals stdenv.isDarwin [
     ApplicationServices

pkgs/development/libraries/libgnome-games-support/2.0.nix

@@ -3,6 +3,7 @@
 , fetchurl
 , pkg-config
 , glib
+, gobject-introspection
 , gtk4
 , libgee
 , gettext
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gettext
+    gobject-introspection
     meson
     ninja
     pkg-config

pkgs/development/libraries/libgnome-games-support/default.nix

@@ -2,6 +2,7 @@
 , fetchurl
 , pkg-config
 , glib
+, gobject-introspection
 , gtk3
 , libgee
 , gettext
@@ -23,6 +24,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     gettext
+    gobject-introspection
     meson
     ninja
     pkg-config

pkgs/development/libraries/libhugetlbfs/default.nix

@@ -32,6 +32,9 @@ stdenv.mkDerivation rec {
     "EXEDIR=$(bin)/bin"
     "DOCDIR=$(doc)/share/doc/libhugetlbfs"
     "MANDIR=$(man)/share/man"
+  ] ++ lib.optionals (stdenv.buildPlatform.system != stdenv.hostPlatform.system) [
+    # The ARCH logic defaults to querying `uname`, which will return build platform arch
+    "ARCH=${stdenv.hostPlatform.uname.processor}"
   ];
 
   # Default target builds tests as well, and the tests want a static

pkgs/development/libraries/libime/default.nix

@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libime";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     rev = version;
-    sha256 = "sha256-0+NVGxujFOJvxX+Tk4mVYsk2Nl7WK6hjl0oylrT6PXU=";
+    sha256 = "sha256-C34hcea0htc9ayytjqy/t08yA2xMC18sAkDc9PK/Hhc=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/qt-6/modules/qtwayland.nix

@@ -1,10 +1,10 @@
 { qtModule
 , qtbase
-, qtquick3d
 , qtdeclarative
 , wayland
 , pkg-config
 , libdrm
+, fetchpatch
 }:
 
 qtModule {
@@ -12,4 +12,12 @@ qtModule {
   propagatedBuildInputs = [ qtbase qtdeclarative ];
   buildInputs = [ wayland libdrm ];
   nativeBuildInputs = [ pkg-config ];
+  patches = [
+    # Fix a freezing bug with fcitx5.
+    # https://codereview.qt-project.org/c/qt/qtwayland/+/517601
+    (fetchpatch {
+      url = "https://code.qt.io/cgit/qt/qtwayland.git/patch/?id=6fe83f6076423068b652fa4fcb0b5adbd297f2a8";
+      hash = "sha256-TlZozKezpYm90B9qFP9qv76asRdIt+5bq9E3GcmFiDc=";
+    })
+  ];
 }

pkgs/development/libraries/science/math/amd-libflame/default.nix

@@ -9,7 +9,7 @@
 
 , withOpenMP ? true
 , blas64 ? false
-, withAMDOpt ? false
+, withAMDOpt ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -37,15 +37,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ amd-blis aocl-utils ];
 
   cmakeFlags = [
-    "-DLIBAOCLUTILS_LIBRARY_PATH=${lib.getLib aocl-utils}/lib"
+    "-DLIBAOCLUTILS_LIBRARY_PATH=${lib.getLib aocl-utils}/lib/libaoclutils${stdenv.hostPlatform.extensions.sharedLibrary}"
     "-DLIBAOCLUTILS_INCLUDE_PATH=${lib.getDev aocl-utils}/include"
     "-DENABLE_BUILTIN_LAPACK2FLAME=ON"
     "-DENABLE_CBLAS_INTERFACES=ON"
     "-DENABLE_EXT_LAPACK_INTERFACE=ON"
   ]
-  ++ lib.optional (!withOpenMP) "ENABLE_MULTITHREADING=OFF"
-  ++ lib.optional blas64 "ENABLE_ILP64=ON"
-  ++ lib.optional withAMDOpt "ENABLE_AMD_OPT=ON";
+  ++ lib.optional (!withOpenMP) "-DENABLE_MULTITHREADING=OFF"
+  ++ lib.optional blas64 "-DENABLE_ILP64=ON"
+  ++ lib.optional withAMDOpt "-DENABLE_AMD_OPT=ON";
 
   postInstall = ''
     ln -s $out/lib/libflame.so $out/lib/liblapack.so.3

pkgs/development/libraries/science/math/blis/default.nix

@@ -48,8 +48,8 @@ in stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    ln -s $out/lib/libblis.so.3 $out/lib/libblas.so.3
-    ln -s $out/lib/libblis.so.3 $out/lib/libcblas.so.3
+    ln -s $out/lib/libblis.so.4 $out/lib/libblas.so.3
+    ln -s $out/lib/libblis.so.4 $out/lib/libcblas.so.3
     ln -s $out/lib/libblas.so.3 $out/lib/libblas.so
     ln -s $out/lib/libcblas.so.3 $out/lib/libcblas.so
   '';

pkgs/development/libraries/science/math/magma/generic.nix

@@ -24,7 +24,8 @@
 , libpthreadstubs
 , magmaRelease
 , ninja
-, rocmSupport ? false
+, config
+, rocmSupport ? config.rocmSupport
 , static ? false
 , stdenv
 , symlinkJoin

pkgs/development/libraries/ucx/default.nix

@@ -3,7 +3,7 @@
 , config
 , enableCuda ? config.cudaSupport
 , cudatoolkit
-, enableRocm ? false
+, enableRocm ? config.rocmSupport
 , rocmPackages
 }: