Merge master into staging-next

CONTRIBUTING.md

@@ -129,19 +129,17 @@ When a PR is created, it will be pre-populated with some checkboxes detailed bel
 
 #### Tested using sandboxing
 
-When sandbox builds are enabled, Nix will setup an isolated environment for each build process. It is used to remove further hidden dependencies set by the build environment to improve reproducibility. This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store. Depending on the operating system access to other resources are blocked as well (ex. inter process communication is isolated on Linux); see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.
+When sandbox builds are enabled, Nix will set up an isolated environment for each build process.
+It is used to remove further hidden dependencies set by the build environment to improve reproducibility.
+This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store.
+Depending on the operating system, access to other resources is blocked as well (e.g., inter-process communication is isolated on Linux); see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.
 
-Sandboxing is not enabled by default in Nix due to a small performance hit on each build. In pull requests for [nixpkgs](https://github.com/NixOS/nixpkgs/) people are asked to test builds with sandboxing enabled (see `Tested using sandboxing` in the pull request template) because in [Hydra](https://nixos.org/hydra/) sandboxing is also used.
+In pull requests for [nixpkgs](https://github.com/NixOS/nixpkgs/) people are asked to test builds with sandboxing enabled (see `Tested using sandboxing` in the pull request template) because in [Hydra](https://nixos.org/hydra/) sandboxing is also used.
 
-Depending if you use NixOS or other platforms you can use one of the following methods to enable sandboxing **before** building the package:
+If you are on Linux, sandboxing is enabled by default.
+On other platforms, sandboxing is disabled by default due to a small performance hit on each build.
 
-- **Globally enable sandboxing on NixOS**: add the following to `configuration.nix`
+Please enable sandboxing **before** building the package by adding the following to: `/etc/nix/nix.conf`:
-
-  ```nix
-  nix.settings.sandbox = true;
-  ```
-
-- **Globally enable sandboxing on non-NixOS platforms**: add the following to: `/etc/nix/nix.conf`
 
   ```ini
   sandbox = true

maintainers/maintainer-list.nix

@@ -4433,6 +4433,12 @@
     githubId = 49904992;
     name = "Dawid Sowa";
   };
+  dawoox = {
+    email = "contact@antoinebellanger.fr";
+    github = "dawoox";
+    githubId = 48325941;
+    name = "Dawoox";
+  };
   daylinmorgan = {
     email = "daylinmorgan@gmail.com";
     github = "daylinmorgan";

nixos/modules/programs/ccache.nix

@@ -1,35 +1,43 @@
 { config, pkgs, lib, ... }:
 
-with lib;
 let
   cfg = config.programs.ccache;
 in {
   options.programs.ccache = {
     # host configuration
-    enable = mkEnableOption (lib.mdDoc "CCache");
+    enable = lib.mkEnableOption (lib.mdDoc "CCache");
-    cacheDir = mkOption {
+    cacheDir = lib.mkOption {
-      type = types.path;
+      type = lib.types.path;
       description = lib.mdDoc "CCache directory";
       default = "/var/cache/ccache";
     };
     # target configuration
-    packageNames = mkOption {
+    packageNames = lib.mkOption {
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       description = lib.mdDoc "Nix top-level packages to be compiled using CCache";
       default = [];
       example = [ "wxGTK32" "ffmpeg" "libav_all" ];
     };
+    owner = lib.mkOption {
+      type = lib.types.str;
+      default = "root";
+      description = lib.mdDoc "Owner of CCache directory";
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "nixbld";
+      description = lib.mdDoc "Group owner of CCache directory";
+    };
   };
 
-  config = mkMerge [
+  config = lib.mkMerge [
     # host configuration
-    (mkIf cfg.enable {
+    (lib.mkIf cfg.enable {
-      systemd.tmpfiles.rules = [ "d ${cfg.cacheDir} 0770 root nixbld -" ];
+      systemd.tmpfiles.rules = [ "d ${cfg.cacheDir} 0770 ${cfg.owner} ${cfg.group} -" ];
 
       # "nix-ccache --show-stats" and "nix-ccache --clear"
       security.wrappers.nix-ccache = {
-        owner = "root";
+        inherit (cfg) owner group;
-        group = "nixbld";
         setuid = false;
         setgid = true;
         source = pkgs.writeScript "nix-ccache.pl" ''
@@ -50,9 +58,9 @@ in {
     })
 
     # target configuration
-    (mkIf (cfg.packageNames != []) {
+    (lib.mkIf (cfg.packageNames != []) {
       nixpkgs.overlays = [
-        (self: super: genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))
+        (self: super: lib.genAttrs cfg.packageNames (pn: super.${pn}.override { stdenv = builtins.trace "with ccache: ${pn}" self.ccacheStdenv; }))
 
         (self: super: {
           ccacheWrapper = super.ccacheWrapper.override {
@@ -65,7 +73,7 @@ in {
                 echo "Directory '$CCACHE_DIR' does not exist"
                 echo "Please create it with:"
                 echo "  sudo mkdir -m0770 '$CCACHE_DIR'"
-                echo "  sudo chown root:nixbld '$CCACHE_DIR'"
+                echo "  sudo chown ${cfg.owner}:${cfg.group} '$CCACHE_DIR'"
                 echo "====="
                 exit 1
               fi

nixos/tests/ccache.nix

@@ -0,0 +1,24 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "ccache";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ehmry ];
+  };
+
+  nodes.machine = { ... }: {
+    imports = [ ../modules/profiles/minimal.nix ];
+    environment.systemPackages = [ pkgs.hello ];
+    programs.ccache = {
+      enable = true;
+      packageNames = [ "hello" ];
+    };
+  };
+
+  testScript =
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("nix-ccache --show-stats")
+      machine.succeed("hello")
+      machine.shutdown()
+    '';
+})

nixos/tests/matomo.nix

@@ -47,4 +47,8 @@ in {
     name = "matomo-beta";
     meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ];
   };
+  matomo_5 = matomoTest pkgs.matomo_5 // {
+    name = "matomo-5";
+    meta.maintainers = with maintainers; [ florianjacob kiwi mmilata twey boozedog ] ++ lib.teams.flyingcircus.members;
+  };
 }

pkgs/applications/audio/raysession/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "raysession";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchurl {
     url = "https://github.com/Houston4444/RaySession/releases/download/v${version}/RaySession-${version}-source.tar.gz";
-    sha256 = "sha256-qEN3zBK/goRLIZaU06XXm8H5yj4Qjj/NH+bkHkjhLaw=";
+    sha256 = "sha256-3+g1zdjGkxNEpyuKuxzhr2p9gkEFjYAso4fPedbjmlY=";
   };
 
   postPatch = ''

pkgs/applications/graphics/rawtherapee/default.nix

@@ -20,17 +20,21 @@
 , librsvg
 , libcanberra-gtk3
 , gtk-mac-integration
+, exiv2
 }:
 
 stdenv.mkDerivation rec {
   pname = "rawtherapee";
-  version = "5.9";
+  version = "5.10";
 
   src = fetchFromGitHub {
     owner = "Beep6581";
     repo = "RawTherapee";
     rev = version;
-    hash = "sha256-kdctfjss/DHEcaSDPXcmT20wXTwkI8moRX/i/5wT5Hg=";
+    hash = "sha256-rIwwKNm7l7oPEt95sHyRj4aF3mtnvM4KAu8oVaIMwyE=";
+    # The developpers ask not to use the tarball from Github releases, see
+    # https://www.rawtherapee.com/downloads/5.10/#news-relevant-to-package-maintainers
+    forceFetchGit = true;
   };
 
   postPatch = ''
@@ -61,6 +65,7 @@ stdenv.mkDerivation rec {
     libsigcxx
     lensfun
     librsvg
+    exiv2
   ] ++ lib.optionals stdenv.isLinux [
     libcanberra-gtk3
   ] ++ lib.optionals stdenv.isDarwin [

pkgs/applications/networking/browsers/yandex-browser/default.nix

@@ -54,15 +54,15 @@
 
 let
   version = {
-    corporate = "23.9.1.1016-1";
+    corporate = "23.11.1.822-1";
-    beta = "23.9.1.1028-1";
+    beta = "24.1.1.939-1";
-    stable = "23.9.1.962-1";
+    stable = "24.1.1.940-1";
   }.${edition};
 
   hash = {
-    corporate = "sha256-A/MjphA6vefDzPmShpPbgjDTl4WnCiZWuHofy1Djrzc=";
+    corporate = "sha256-OOcz2dQeVea0vBjF1FyrCsnRR+WrCzfLTd+YXpLJCsI=";
-    beta = "sha256-vnz1weMwR3V/mBNzrJ0iqnA/aifYTCucW+9kyy/0SnA=";
+    beta = "sha256-Meswp1aeNTBr79l7XGWqJT9qqUdOfSzIpdL1L29UfJw=";
-    stable = "sha256-VrDqFLvK7RdnV6Yt1DILu7mV1WFcilOH5+VKlCdpXjc=";
+    stable = "sha256-FZHoCRedpHHVwibSXts2DncUN83PZ9UlVOSXPjgAaNs=";
   }.${edition};
 
   app = {

pkgs/applications/networking/cluster/opentofu/default.nix

@@ -14,13 +14,13 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.6.1";
+    version = "1.6.2";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-wEDxZtmC+SLIYbN+mGTmefcD6VZu87E9E0XhiJPGmK0=";
+      hash = "sha256-CYiwn2NDIAx30J8tmbrV45dbCIGoA3U+yBdMj4RX5Ho=";
     };
 
     vendorHash = "sha256-kSm5RZqQRgbmPaKt5IWmuMhHwAu+oJKTX1q1lbE7hWk=";

pkgs/applications/radio/gnss-sdr/default.nix

@@ -21,13 +21,13 @@
 
 gnuradio.pkgs.mkDerivation rec {
   pname = "gnss-sdr";
-  version = "0.0.17";
+  version = "0.0.19.1";
 
   src = fetchFromGitHub {
     owner = "gnss-sdr";
     repo = "gnss-sdr";
     rev = "v${version}";
-    sha256 = "sha256-0aAjkrVAswoRL/KANBSZ5Jq4Y9VwOHZKUKLpXDdKtk8=";
+    sha256 = "sha256-IbkYdw1pwI+FMnZMChsxMz241Kv4EzMcBb0mm6/jq1k=";
   };
 
   patches = [
@@ -75,27 +75,27 @@ gnuradio.pkgs.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DGFlags_INCLUDE_DIRS=${gflags}/include"
+    (lib.cmakeFeature "GFlags_INCLUDE_DIRS" "${gflags}/include")
-    "-DGLOG_INCLUDE_DIR=${glog}/include"
+    (lib.cmakeFeature "GLOG_INCLUDE_DIR" "${glog}/include")
     # Should use .dylib if darwin support is requested
-    "-DGFlags_LIBS=${gflags}/lib/libgflags.so"
+    (lib.cmakeFeature "GFlags_LIBS" "${gflags}/lib/libgflags.so")
-    "-DGLOG_LIBRARIES=${glog}/lib/libglog.so"
+    (lib.cmakeFeature "-DGLOG_LIBRARIES" "${glog}/lib/libglog.so")
     # Use our dependencies glog, gflags and armadillo dependencies
-    "-DENABLE_OWN_GLOG=OFF"
+    (lib.cmakeBool "ENABLE_OWN_GLOG" false)
-    "-DENABLE_OWN_ARMADILLO=OFF"
+    (lib.cmakeBool "ENABLE_OWN_ARMADILLO" false)
-    "-DENABLE_ORC=ON"
+    (lib.cmakeBool "ENABLE_ORC" true)
-    "-DENABLE_LOG=ON"
+    (lib.cmakeBool "ENABLE_LOG" true)
-    "-DENABLE_RAW_UDP=${if enableRawUdp then "ON" else "OFF"}"
+    (lib.cmakeBool "ENABLE_RAW_UDP" enableRawUdp)
-    "-DENABLE_UHD=${if (gnuradio.hasFeature "gr-uhd") then "ON" else "OFF"}"
+    (lib.cmakeBool "ENABLE_UHD" (gnuradio.hasFeature "gr-uhd"))
-    "-DENABLE_FMCOMMS2=${if (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
+    (lib.cmakeBool "ENABLE_FMCOMMS2" (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu"))
-    "-DENABLE_PLUTOSDR=${if (gnuradio.hasFeature "gr-iio") then "ON" else "OFF"}"
+    (lib.cmakeBool "ENABLE_PLUTOSDR" (gnuradio.hasFeature "gr-iio"))
-    "-DENABLE_AD9361=${if (gnuradio.hasFeature "gr-pdu") then "ON" else "OFF"}"
+    (lib.cmakeBool "ENABLE_AD9361" (gnuradio.hasFeature "gr-pdu"))
-    "-DENABLE_UNIT_TESTING=OFF"
+    (lib.cmakeBool "ENABLE_UNIT_TESTING" false)
 
     # gnss-sdr doesn't truly depend on BLAS or LAPACK, as long as
     # armadillo is built using both, so skip checking for them.
-    "-DBLAS_LIBRARIES=-lblas"
+    (lib.cmakeFeature "BLAS_LIBRARIES" "-lblas")
-    "-DLAPACK_LIBRARIES=-llapack"
+    (lib.cmakeFeature "LAPACK_LIBRARIES" "-llapack")
   ];
 
   meta = with lib; {

pkgs/applications/radio/gnss-sdr/fix_libcpu_features_install_path.patch

@@ -1,7 +1,7 @@
 --- i/CMakeLists.txt
 +++ w/CMakeLists.txt
-@@ -1210,7 +1210,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1233,7 +1233,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-             BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+             BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
              CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                  -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@@ -9,17 +9,17 @@
              DOWNLOAD_COMMAND ""
              UPDATE_COMMAND ""
              PATCH_COMMAND ""
-@@ -1248,7 +1248,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1274,7 +1274,7 @@ if(NOT VOLKGNSSSDR_FOUND)
                      )
                      set(VOLK_GNSSSDR_BUILD_BYPRODUCTS
                          ${VOLK_GNSSSDR_BUILD_BYPRODUCTS}
--                        ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+-                        ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
-+                        ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
++                        ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
                      )
                  endif()
              endif()
-@@ -1261,7 +1261,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1287,7 +1287,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+                 BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                  CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                      -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@@ -27,8 +27,8 @@
                  DOWNLOAD_COMMAND ""
                  UPDATE_COMMAND ""
                  PATCH_COMMAND ""
-@@ -1280,7 +1280,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1306,7 +1306,7 @@ if(NOT VOLKGNSSSDR_FOUND)
-                 BINARY_DIR ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/build
+                 BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                  CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                      -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
 -                    -DCMAKE_INSTALL_LIBDIR=${CMAKE_INSTALL_LIBDIR}
@@ -36,12 +36,12 @@
                  DOWNLOAD_COMMAND ""
                  UPDATE_COMMAND ""
                  PATCH_COMMAND ""
-@@ -1319,7 +1319,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1346,7 +1346,7 @@ if(NOT VOLKGNSSSDR_FOUND)
          if(CMAKE_VERSION VERSION_GREATER 3.0 AND SUPPORTED_CPU_FEATURES_ARCH)
              if(NOT CPUFEATURES_FOUND AND ENABLE_CPUFEATURES)
                  set_target_properties(Volkgnsssdr::volkgnsssdr PROPERTIES
--                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
+-                    INTERFACE_LINK_LIBRARIES ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
-+                    INTERFACE_LINK_LIBRARIES ${CMAKE_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
++                    INTERFACE_LINK_LIBRARIES ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}cpu_features${CMAKE_STATIC_LIBRARY_SUFFIX}
                  )
              endif()
          endif()

pkgs/applications/science/logic/elan/default.nix

@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "elan";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "elan";
     rev = "v${version}";
-    hash = "sha256-IC/xb4tZer2cbwIusdCwXxJS3K7kN/XFoU4mxKW4dVc=";
+    hash = "sha256-/g5bO3UQcg0XYm62KdoWcVQqOV3SIedWUYLufEcblmE=";
   };
 
-  cargoHash = "sha256-F80iiXb0UpV+N9q7Msef6/Uzas1DGjMKPWuOKrk8tqU=";
+  cargoHash = "sha256-f8YVUTxHX1FY2p73DlnLDtCJaG/0JImUtJFraV6ErNM=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 

pkgs/by-name/ac/action-validator/package.nix

@@ -5,17 +5,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "action-validator";
-  version = "0.5.4";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "mpalmer";
     repo = "action-validator";
     rev = "v${version}";
-    hash = "sha256-roWmks+AgRf2ACoI7Vc/QEyqgQ0bR/XhRwLk9VaLEdY=";
+    hash = "sha256-lJHGx/GFddIwVVXRj75Z/l5CH/yuw/uIhr02Qkjruww=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-WUtFWuk2y/xXe39doMqANaIr0bbxmLDpT4/H2GRGH6k=";
+  cargoHash = "sha256-mBY+J6JcIhV++tO6Dhw5JvYLSwoYZR3lB3l0KTjkcQM=";
 
   meta = with lib; {
     description = "Tool to validate GitHub Action and Workflow YAML files";

pkgs/by-name/as/ast-grep/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-uRAWcEG4+8tkfHe9bmVSWsRp3A35+5PRPdGuXuDm210=";
+    hash = "sha256-u9VoLGf8Qfy6wtU+rWZvIxOj1Q3RUKjE+LKISKtTKfA=";
   };
 
-  cargoHash = "sha256-U7W3Ila75XQDwtcVDEzooLxdbcGZCrUU/Ijcx/xhRaM=";
+  cargoHash = "sha256-IPZ0R7SMdZi/h51lInXhRZFBAyEu/D8fwnUUkWV9Ivg=";
 
   # Work around https://github.com/NixOS/nixpkgs/issues/166205.
   env = lib.optionalAttrs stdenv.cc.isClang {

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.171.0";
+  version = "0.172.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-+kM/RKC/HxGRH3qOzlhkzaxj1l60D+6aNGIkrDuTk7A=";
+    hash = "sha256-DzbCtTXeoERV9ceUsZ+srATIyviJp+oNyB7EE/iHe6g=";
   };
 
-  vendorHash = "sha256-cuLzn0OZ5VC+RWGsJ8DCdJN8wm0DrsjH55K/cnyuqB8=";
+  vendorHash = "sha256-P+T+ynSkG3KEmJsrzJusCPBD1ClaVK/VIHD+2xkGswQ=";
 
   doCheck = false;
 

pkgs/by-name/my/mystmd/package.nix

@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.42";
+  version = "1.1.43";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-oVdZ2U1h1BFjo82IDFFHlQHR/V/GNLx4qWtSLhWm3ck=";
+    hash = "sha256-NKb62xhmdqA/fLF2HIm/t+eiIiSLKvPDLlAdjWBKJrQ=";
   };
 
-  npmDepsHash = "sha256-ucw9ayyIocF/AKkXrzvBDaQ5Mv2edQdiYbX+G3bcHrs=";
+  npmDepsHash = "sha256-5PcGD5La3g9Gd9Me31nLZA+Pi9k+x0s8APXYVa6QSH8=";
 
   dontNpmInstall = true;
 

pkgs/by-name/ne/neocities-cli/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'neocities'

pkgs/by-name/ne/neocities-cli/Gemfile.lock

@@ -0,0 +1,48 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    equatable (0.5.0)
+    httpclient-fixcerts (2.8.5)
+    necromancer (0.4.0)
+    neocities (0.0.18)
+      httpclient-fixcerts (~> 2.8, >= 2.8.5)
+      pastel (~> 0.7, = 0.7.2)
+      rake (~> 12.3, >= 12.3.1)
+      tty-prompt (~> 0.12, = 0.12.0)
+      tty-table (~> 0.10, = 0.10.0)
+    pastel (0.7.2)
+      equatable (~> 0.5.0)
+      tty-color (~> 0.4.0)
+    rake (12.3.3)
+    strings (0.1.8)
+      strings-ansi (~> 0.1)
+      unicode-display_width (~> 1.5)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    tty-color (0.4.3)
+    tty-cursor (0.4.0)
+    tty-prompt (0.12.0)
+      necromancer (~> 0.4.0)
+      pastel (~> 0.7.0)
+      tty-cursor (~> 0.4.0)
+      wisper (~> 1.6.1)
+    tty-screen (0.6.5)
+    tty-table (0.10.0)
+      equatable (~> 0.5.0)
+      necromancer (~> 0.4.0)
+      pastel (~> 0.7.2)
+      strings (~> 0.1.0)
+      tty-screen (~> 0.6.4)
+    unicode-display_width (1.8.0)
+    unicode_utils (1.4.0)
+    wisper (1.6.1)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  neocities
+
+BUNDLED WITH
+   2.5.5

pkgs/by-name/ne/neocities-cli/gemset.nix

@@ -0,0 +1,169 @@
+{
+  equatable = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1sjm9zjakyixyvsqziikdrsqfzis6j3fq23crgjkp6fwkfgndj7x";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  httpclient-fixcerts = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zfszylh51y8ic8sbff3mwf30jb0gj270r5nxkcm1ydxad19w6sl";
+      type = "gem";
+    };
+    version = "2.8.5";
+  };
+  necromancer = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0v9nhdkv6zrp7cn48xv7n2vjhsbslpvs0ha36mfkcd56cp27pavz";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  neocities = {
+    dependencies =
+      [ "httpclient-fixcerts" "pastel" "rake" "tty-prompt" "tty-table" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hfvy4gc7rzxkgl2dbrjs2fqzi5mphmr22rjfhk6n0i3bd0wazbw";
+      type = "gem";
+    };
+    version = "0.0.18";
+  };
+  pastel = {
+    dependencies = [ "equatable" "tty-color" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yf30d9kzpm96gw9kwbv31p0qigwfykn8qdis5950plnzgc1vlp1";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  rake = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
+      type = "gem";
+    };
+    version = "12.3.3";
+  };
+  strings = {
+    dependencies = [ "strings-ansi" "unicode-display_width" "unicode_utils" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "111876lcqrykh30w7zzkrl06d6rj9lq24y625m28674vgfxkkcz0";
+      type = "gem";
+    };
+    version = "0.1.8";
+  };
+  strings-ansi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  tty-color = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0zz5xa6xbrj69h334d8nx7z732fz80s1a0b02b53mim95p80s7bk";
+      type = "gem";
+    };
+    version = "0.4.3";
+  };
+  tty-cursor = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07whfm8mnp7l49s2cm2qy1snhsqq3a90sqwb71gvym4hm2kx822a";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  tty-prompt = {
+    dependencies = [ "necromancer" "pastel" "tty-cursor" "wisper" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1026nyqhgmgxi2nmk8xk3hca07gy5rpisjs8y6w00wnw4f01kpv0";
+      type = "gem";
+    };
+    version = "0.12.0";
+  };
+  tty-screen = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0azpjgyhdm8ycblnx9crq3dgb2x8yg454a13n60zfpsc0n138sw1";
+      type = "gem";
+    };
+    version = "0.6.5";
+  };
+  tty-table = {
+    dependencies =
+      [ "equatable" "necromancer" "pastel" "strings" "tty-screen" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05krrj1x5pmfbz74paszrsr1316w9b9jlc4wpd9s9gpzqfzwjzcg";
+      type = "gem";
+    };
+    version = "0.10.0";
+  };
+  unicode-display_width = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1204c1jx2g89pc25qk5150mk7j5k90692i7ihgfzqnad6qni74h2";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  unicode_utils = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  wisper = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19bw0z1qw1dhv7gn9lad25hgbgpb1bkw8d599744xdfam158ms2s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
+}

pkgs/by-name/ne/neocities-cli/package.nix

@@ -0,0 +1,22 @@
+{ lib
+, bundlerApp
+, bundlerUpdateScript
+}:
+
+bundlerApp {
+  pname = "neocities";
+  gemdir = ./.;
+  exes = [ "neocities" ];
+
+  passthru.updateScript = bundlerUpdateScript "neocities";
+
+  meta = with lib; {
+    description = "The Neocities Gem - A CLI and library for using the Neocities web site API.";
+    homepage = "https://github.com/neocities/neocities-ruby";
+    license = licenses.mit;
+    mainProgram = "neocities";
+    maintainers = with maintainers; [ dawoox ];
+    platforms = platforms.unix;
+  };
+}
+

pkgs/by-name/um/umpire/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umpire";
-  version = "2023.06.0";
+  version = "2024.02.0";
 
   src = fetchFromGitHub {
     owner = "LLNL";
     repo = "umpire";
     rev = "v${version}";
-    hash = "sha256-gdwr0ACCfkrtlVROPhxM7zT7SaCo2Eg1etrPFN4JHaA=";
+    hash = "sha256-0xJrICpGHQCLXfhDfS0/6gD3wrM9y6XB4XxyjG3vWGw=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/uv/uv/Cargo.lock

@@ -909,6 +909,7 @@ dependencies = [
  "tracing",
  "url",
  "urlencoding",
+ "uv-auth",
  "uv-fs",
  "uv-git",
  "uv-normalize",
@@ -4127,7 +4128,7 @@ checksum = "f00cc9702ca12d3c81455259621e676d0f7251cec66a21e98fe2e9a37db93b2a"
 
 [[package]]
 name = "uv"
-version = "0.1.8"
+version = "0.1.9"
 dependencies = [
  "anstream",
  "anyhow",
@@ -4193,6 +4194,14 @@ dependencies = [
  "which",
 ]
 
+[[package]]
+name = "uv-auth"
+version = "0.0.1"
+dependencies = [
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "uv-build"
 version = "0.0.1"
@@ -4284,6 +4293,7 @@ dependencies = [
  "tracing",
  "url",
  "urlencoding",
+ "uv-auth",
  "uv-cache",
  "uv-fs",
  "uv-normalize",
@@ -4590,9 +4600,12 @@ name = "uv-traits"
 version = "0.0.1"
 dependencies = [
  "anyhow",
+ "clap",
  "distribution-types",
  "once-map",
  "pep508_rs",
+ "serde",
+ "serde_json",
  "tokio",
  "uv-cache",
  "uv-interpreter",

pkgs/by-name/uv/uv/package.nix

@@ -15,14 +15,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "uv";
-  version = "0.1.8";
+  version = "0.1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = version;
-    hash = "sha256-nFhCl/5s+Ts3pTXtweoUXfBA3PN2jm08eHalMekPwnM=";
+    hash = "sha256-N9m0dvJXABAY7dFTE5i7KXIHF9AMEFptEwKFoBsxmyE=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {

pkgs/development/libraries/glfw/3.x.nix

@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.3.9";
+  version = "3.3.10";
   pname = "glfw";
 
   src = fetchFromGitHub {
     owner = "glfw";
     repo = "GLFW";
     rev = version;
-    sha256 = "sha256-DlPRNGCBr6XF9Jn8kWs5lCRTyjPeDt/69PNDzBDhoyg=";
+    sha256 = "sha256-kTRXsfQ+9PFurG3ffz0lwnITAYAXtNl3h/3O6FSny5o=";
   };
 
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)

pkgs/development/libraries/ocl-icd/default.nix

@@ -5,6 +5,7 @@
 , opencl-headers
 , addOpenGLRunpath
 , autoreconfHook
+, windows
 }:
 
 stdenv.mkDerivation rec {
@@ -23,17 +24,21 @@ stdenv.mkDerivation rec {
     ruby
   ];
 
-  buildInputs = [ opencl-headers ];
+  buildInputs = [ opencl-headers ]
+    ++ lib.optionals stdenv.hostPlatform.isWindows [ windows.dlfcn ];
 
   configureFlags = [
     "--enable-custom-vendordir=/run/opengl-driver/etc/OpenCL/vendors"
   ];
 
+  # fixes: can't build x86_64-w64-mingw32 shared library unless -no-undefined is specified
+  makeFlags = lib.optionals stdenv.hostPlatform.isWindows [ "LDFLAGS=-no-undefined" ];
+
   meta = with lib; {
     description = "OpenCL ICD Loader for ${opencl-headers.name}";
     homepage    = "https://github.com/OCL-dev/ocl-icd";
     license     = licenses.bsd2;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
     maintainers = with maintainers; [ r-burns ];
   };
 }

pkgs/development/libraries/opencl-headers/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Khronos OpenCL headers version ${finalAttrs.version}";
     homepage = "https://www.khronos.org/registry/cl/";
     license = licenses.asl20;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
     maintainers = [ ];
   };
 })

pkgs/development/python-modules/django-simple-history/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "django-simple-history";
-  version = "3.4.0";
+  version = "3.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "jazzband";
     repo = "django-simple-history";
     rev = "refs/tags/${version}";
-    hash = "sha256-XY6YNajwX5z3AXkYYGFtrURDqxub9EQwu52jQ7CZwrI=";
+    hash = "sha256-BW/F+RBf1KvwGRY9IK00+n69Jtx/ndEuvpHSi8/odSE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/google-cloud-appengine-logging/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.4.1";
+  version = "1.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mQXHwww8K77dCxMuKycfyCRzM+vJMdLSOvG7vRG0Nf4=";
+    hash = "sha256-E03mSoQBfP4mpLOjJbzJtKLboF+cnTkC7iS0sfo+KK8=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/google-cloud-firestore/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "2.14.0";
+  version = "2.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mr+3U+s89wB2uc/whvcdOYwJfAsbD9ll1a8n1a5K5AE=";
+    hash = "sha256-WJzknGuNcxWiSDJ+ShJKRBQ/WlMU6naPfIUWYMIeYyE=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/iodata/default.nix

@@ -2,22 +2,20 @@
 
 buildPythonPackage rec {
   pname = "iodata";
-  version = "0.1.7";
+  version = "1.0.0a2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "theochem";
     repo = pname;
     rev = version;
-    hash = "sha256-Qn2xWFxdS12K92DhdHVzYrBjPRV+vYo7Cs27vkeCaxM=";
+    hash = "sha256-GFTCYE19Re7WLhV8eU+0i8OMp/Tsms/Xj9DRTcgjcz4=";
   };
 
-  leaveDotGit = true;
-
   nativeBuildInputs = [ cython nose ];
   propagatedBuildInputs = [ numpy scipy attrs ];
 
-  pythonImportsCheck = [ "iodata" "iodata.overlap_accel" ];
+  pythonImportsCheck = [ "iodata" ];
   doCheck = false; # Requires roberto or nose and a lenghtly setup to find the cython modules
 
   meta = with lib; {

pkgs/development/python-modules/jaxlib/default.nix

@@ -12,6 +12,7 @@
 , curl
 , cython
 , fetchFromGitHub
+, fetchpatch
 , git
 , IOKit
 , jsoncpp
@@ -47,14 +48,19 @@
 
   # MKL:
 , mklSupport ? true
-}:
+}@inputs:
 
 let
-  inherit (cudaPackagesGoogle) backendStdenv cudatoolkit cudaFlags cudnn nccl;
+  inherit (cudaPackagesGoogle) autoAddOpenGLRunpathHook cudaFlags cudaVersion cudnn nccl;
 
   pname = "jaxlib";
   version = "0.4.24";
 
+  # It's necessary to consistently use backendStdenv when building with CUDA
+  # support, otherwise we get libstdc++ errors downstream
+  stdenv = throw "Use effectiveStdenv instead";
+  effectiveStdenv = if cudaSupport then cudaPackagesGoogle.backendStdenv else inputs.stdenv;
+
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
     homepage = "https://github.com/google/jax";
@@ -65,25 +71,51 @@ let
     # however even with that fix applied, it doesn't work for everyone:
     # https://github.com/NixOS/nixpkgs/pull/184395#issuecomment-1207287129
     # NOTE: We always build with NCCL; if it is unsupported, then our build is broken.
-    broken = stdenv.isDarwin || nccl.meta.unsupported;
+    broken = effectiveStdenv.isDarwin || nccl.meta.unsupported;
   };
 
-  cudatoolkit_joined = symlinkJoin {
+  # These are necessary at build time and run time.
-    name = "${cudatoolkit.name}-merged";
+  cuda_libs_joined = symlinkJoin {
-    paths = [
+    name = "cuda-joined";
-      cudatoolkit.lib
+    paths = with cudaPackagesGoogle; [
-      cudatoolkit.out
+      cuda_cudart.lib # libcudart.so
-    ] ++ lib.optionals (lib.versionOlder cudatoolkit.version "11") [
+      cuda_cudart.static # libcudart_static.a
-      # for some reason some of the required libs are in the targets/x86_64-linux
+      cuda_cupti.lib # libcupti.so
-      # directory; not sure why but this works around it
+      libcublas.lib # libcublas.so
-      "${cudatoolkit}/targets/${stdenv.system}"
+      libcufft.lib # libcufft.so
+      libcurand.lib # libcurand.so
+      libcusolver.lib # libcusolver.so
+      libcusparse.lib # libcusparse.so
+    ];
+  };
+  # These are only necessary at build time.
+  cuda_build_deps_joined = symlinkJoin {
+    name = "cuda-build-deps-joined";
+    paths = with cudaPackagesGoogle; [
+      cuda_libs_joined
+
+      # Binaries
+      cudaPackagesGoogle.cuda_nvcc.bin # nvcc
+
+      # Headers
+      cuda_cccl.dev # block_load.cuh
+      cuda_cudart.dev # cuda.h
+      cuda_cupti.dev # cupti.h
+      cuda_nvcc.dev # See https://github.com/google/jax/issues/19811
+      cuda_nvml_dev # nvml.h
+      cuda_nvtx.dev # nvToolsExt.h
+      libcublas.dev # cublas_api.h
+      libcufft.dev # cufft.h
+      libcurand.dev # curand.h
+      libcusolver.dev # cusolver_common.h
+      libcusparse.dev # cusparse.h
     ];
   };
 
-  cudatoolkit_cc_joined = symlinkJoin {
+  backend_cc_joined = symlinkJoin {
-    name = "${cudatoolkit.cc.name}-merged";
+    name = "cuda-cc-joined";
     paths = [
-      backendStdenv.cc
+      effectiveStdenv.cc
       binutils.bintools # for ar, dwp, nm, objcopy, objdump, strip
     ];
   };
@@ -137,8 +169,44 @@ let
 
   arch =
     # KeyError: ('Linux', 'arm64')
-    if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.linuxArch == "arm64" then "aarch64"
+    if effectiveStdenv.hostPlatform.isLinux && effectiveStdenv.hostPlatform.linuxArch == "arm64" then "aarch64"
-    else stdenv.hostPlatform.linuxArch;
+    else effectiveStdenv.hostPlatform.linuxArch;
+
+  xla = effectiveStdenv.mkDerivation {
+    pname = "xla-src";
+    version = "unstable";
+
+    src = fetchFromGitHub {
+      owner = "openxla";
+      repo = "xla";
+      # Update this according to https://github.com/google/jax/blob/jaxlib-v${version}/third_party/xla/workspace.bzl.
+      rev = "12eee889e1f2ad41e27d7b0e970cb92d282d3ec5";
+      hash = "sha256-68kjjgwYjRlcT0TVJo9BN6s+WTkdu5UMJqQcfHpBT90=";
+    };
+
+    patches = [
+      # Resolves "could not convert ‘result’ from ‘SmallVector<[...],6>’ to
+      # ‘SmallVector<[...],4>’" compilation error. See https://github.com/google/jax/issues/19814#issuecomment-1945141259.
+      (fetchpatch {
+        url = "https://github.com/openxla/xla/commit/7a614cd346594fc7ea2fe75570c9c53a4a444f60.patch";
+        hash = "sha256-RtuQTH8wzNiJcOtISLhf+gMlH1gg8hekvxEB+4wX6BM=";
+      })
+    ];
+
+    dontBuild = true;
+
+    # This is necessary for patchShebangs to know the right path to use.
+    nativeBuildInputs = [ python ];
+
+    # Main culprits we're targeting are third_party/tsl/third_party/gpus/crosstool/clang/bin/*.tpl
+    postPatch = ''
+      patchShebangs .
+    '';
+
+    installPhase = ''
+      cp -r . $out
+    '';
+  };
 
   bazel-build = buildBazelPackage rec {
     name = "bazel-build-${pname}-${version}";
@@ -162,7 +230,7 @@ let
       wheel
       build
       which
-    ] ++ lib.optionals stdenv.isDarwin [
+    ] ++ lib.optionals effectiveStdenv.isDarwin [
       cctools
     ];
 
@@ -181,15 +249,13 @@ let
       six
       snappy
       zlib
-    ] ++ lib.optionals cudaSupport [
+    ] ++ lib.optionals effectiveStdenv.isDarwin [
-      cudatoolkit
-      cudnn
-    ] ++ lib.optionals stdenv.isDarwin [
       IOKit
-    ] ++ lib.optionals (!stdenv.isDarwin) [
+    ] ++ lib.optionals (!effectiveStdenv.isDarwin) [
       nsync
     ];
 
+    # We don't want to be quite so picky regarding bazel version
     postPatch = ''
       rm -f .bazelversion
     '';
@@ -204,19 +270,36 @@ let
 
     removeRulesCC = false;
 
-    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
+    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${backend_cc_joined}/bin";
-    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/gcc";
+    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${backend_cc_joined}/bin/gcc";
 
     # The version is automatically set to ".dev" if this variable is not set.
     # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
     JAXLIB_RELEASE = "1";
 
-    preConfigure = ''
+    preConfigure =
-      # dummy ldconfig
+      # Dummy ldconfig to work around "Can't open cache file /nix/store/<hash>-glibc-2.38-44/etc/ld.so.cache" error
+      ''
         mkdir dummy-ldconfig
-      echo "#!${stdenv.shell}" > dummy-ldconfig/ldconfig
+        echo "#!${effectiveStdenv.shell}" > dummy-ldconfig/ldconfig
         chmod +x dummy-ldconfig/ldconfig
         export PATH="$PWD/dummy-ldconfig:$PATH"
+      '' +
+
+      # Construct .jax_configure.bazelrc. See https://github.com/google/jax/blob/b9824d7de3cb30f1df738cc42e486db3e9d915ff/build/build.py#L259-L345
+      # for more info. We assume
+      # * `cpu = None`
+      # * `enable_nccl = True`
+      # * `target_cpu_features = "release"`
+      # * `rocm_amdgpu_targets = None`
+      # * `enable_rocm = False`
+      # * `build_gpu_plugin = False`
+      # * `use_clang = False` (Should we use `effectiveStdenv.cc.isClang` instead?)
+      #
+      # Note: We should try just running https://github.com/google/jax/blob/ceb198582b62b9e6f6bdf20ab74839b0cf1db16e/build/build.py#L259-L266
+      # instead of duplicating the logic here. Perhaps we can leverage the
+      # `--configure_only` flag (https://github.com/google/jax/blob/ceb198582b62b9e6f6bdf20ab74839b0cf1db16e/build/build.py#L544-L548)?
+      ''
         cat <<CFG > ./.jax_configure.bazelrc
         build --strategy=Genrule=standalone
         build --repo_env PYTHON_BIN_PATH="${python}/bin/python"
@@ -224,18 +307,25 @@ let
         build --python_path="${python}/bin/python"
         build --distinct_host_configuration=false
         build --define PROTOBUF_INCLUDE_PATH="${pkgs.protobuf}/include"
-    '' + lib.optionalString (stdenv.hostPlatform.avxSupport && stdenv.hostPlatform.isUnix) ''
+      '' + lib.optionalString cudaSupport ''
+        build --config=cuda
+        build --action_env CUDA_TOOLKIT_PATH="${cuda_build_deps_joined}"
+        build --action_env CUDNN_INSTALL_PATH="${cudnn}"
+        build --action_env TF_CUDA_PATHS="${cuda_build_deps_joined},${cudnn},${nccl}"
+        build --action_env TF_CUDA_VERSION="${lib.versions.majorMinor cudaVersion}"
+        build --action_env TF_CUDNN_VERSION="${lib.versions.major cudnn.version}"
+        build:cuda --action_env TF_CUDA_COMPUTE_CAPABILITIES="${builtins.concatStringsSep "," cudaFlags.realArches}"
+      '' +
+      # Note that upstream conditions this on `wheel_cpu == "x86_64"`. We just
+      # rely on `effectiveStdenv.hostPlatform.avxSupport` instead. So far so
+      # good. See https://github.com/google/jax/blob/b9824d7de3cb30f1df738cc42e486db3e9d915ff/build/build.py#L322
+      # for upstream's version.
+      lib.optionalString (effectiveStdenv.hostPlatform.avxSupport && effectiveStdenv.hostPlatform.isUnix) ''
         build --config=avx_posix
       '' + lib.optionalString mklSupport ''
         build --config=mkl_open_source_only
-    '' + lib.optionalString cudaSupport ''
+      '' +
-      build --action_env CUDA_TOOLKIT_PATH="${cudatoolkit_joined}"
+      ''
-      build --action_env CUDNN_INSTALL_PATH="${cudnn}"
-      build --action_env TF_CUDA_PATHS="${cudatoolkit_joined},${cudnn},${nccl}"
-      build --action_env TF_CUDA_VERSION="${lib.versions.majorMinor cudatoolkit.version}"
-      build --action_env TF_CUDNN_VERSION="${lib.versions.major cudnn.version}"
-      build:cuda --action_env TF_CUDA_COMPUTE_CAPABILITIES="${builtins.concatStringsSep "," cudaFlags.realArches}"
-    '' + ''
         CFG
       '';
 
@@ -243,11 +333,17 @@ let
     # relevant dependencies can be downloaded.
     bazelFlags = [
       "-c opt"
-    ] ++ lib.optionals stdenv.cc.isClang [
+      # See https://bazel.build/external/advanced#overriding-repositories for
+      # information on --override_repository flag.
+      "--override_repository=xla=${xla}"
+    ] ++ lib.optionals effectiveStdenv.cc.isClang [
       # bazel depends on the compiler frontend automatically selecting these flags based on file
       # extension but our clang doesn't.
       # https://github.com/NixOS/nixpkgs/issues/150655
-      "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++"
+      "--cxxopt=-x"
+      "--cxxopt=c++"
+      "--host_cxxopt=-x"
+      "--host_cxxopt=c++"
     ];
 
     # We intentionally overfetch so we can share the fetch derivation across all the different configurations
@@ -257,40 +353,34 @@ let
       bazelTargets = [ bazelRunTarget "@mkl_dnn_v1//:mkl_dnn" ];
       bazelFlags = bazelFlags ++ [
         "--config=avx_posix"
+        "--config=mkl_open_source_only"
       ] ++ lib.optionals cudaSupport [
         # ideally we'd add this unconditionally too, but it doesn't work on darwin
         # we make this conditional on `cudaSupport` instead of the system, so that the hash for both
         # the cuda and the non-cuda deps can be computed on linux, since a lot of contributors don't
         # have access to darwin machines
         "--config=cuda"
-      ] ++ [
-        "--config=mkl_open_source_only"
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-c0avcURLAYNiLASjIeu5phXX3ze5TR812SW5SCG/iwk=";
+        x86_64-linux = "sha256-IEKoHjCOtKZKvU/DUUjbvXldORFJuyO1R3F6CZZDXxM=";
       } else {
-        x86_64-linux = "sha256-1hrQ9ehFy3vBJxKNUzi/T0l+eZxo26Th7i5VRd/9U+0=";
+        x86_64-linux = "sha256-IE4+Tk4llo85u3NjakvY04tPw4R1bidyecPpQ4gknR8=";
-        aarch64-linux = "sha256-3QVYJOj1lNHgYVV9rOzVdfhq5q6GDwpcWCjKNrSZ4aU=";
+        aarch64-linux = "sha256-NehnpA4m+Fynvh0S6WKy/v9ab81487NE9ahvbS70wjY=";
-      }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
+      }).${effectiveStdenv.system} or (throw "jaxlib: unsupported system: ${effectiveStdenv.system}");
     };
 
     buildAttrs = {
       outputs = [ "out" ];
 
-      TF_SYSTEM_LIBS = lib.concatStringsSep "," (tf_system_libs ++ lib.optionals (!stdenv.isDarwin) [
+      TF_SYSTEM_LIBS = lib.concatStringsSep "," (tf_system_libs ++ lib.optionals (!effectiveStdenv.isDarwin) [
         "nsync" # fails to build on darwin
       ]);
 
-      # Note: we cannot do most of this patching at `patch` phase as the deps are not available yet.
+      # Note: we cannot do most of this patching at `patch` phase as the deps
-      # 1) Link protobuf from nixpkgs (through TF_SYSTEM_LIBS when using gcc) to prevent crashes on
+      # are not available yet. Framework search paths aren't added by bintools
-      #    loading multiple extensions in the same python program due to duplicate protobuf DBs.
+      # hook. See https://github.com/NixOS/nixpkgs/pull/41914.
-      # 2) Patch python path in the compiler driver.
+      preBuild = lib.optionalString effectiveStdenv.isDarwin ''
-      preBuild = lib.optionalString cudaSupport ''
-        patchShebangs ../output/external/xla/third_party/gpus/crosstool/clang/bin/crosstool_wrapper_driver_is_not_gcc.tpl
-      '' + lib.optionalString stdenv.isDarwin ''
-        # Framework search paths aren't added by bintools hook
-        # https://github.com/NixOS/nixpkgs/pull/41914
         export NIX_LDFLAGS+=" -F${IOKit}/Library/Frameworks"
         substituteInPlace ../output/external/rules_cc/cc/private/toolchain/osx_cc_wrapper.sh.tpl \
           --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
@@ -302,13 +392,13 @@ let
     inherit meta;
   };
   platformTag =
-    if stdenv.hostPlatform.isLinux then
+    if effectiveStdenv.hostPlatform.isLinux then
       "manylinux2014_${arch}"
-    else if stdenv.system == "x86_64-darwin" then
+    else if effectiveStdenv.system == "x86_64-darwin" then
       "macosx_10_9_${arch}"
-    else if stdenv.system == "aarch64-darwin" then
+    else if effectiveStdenv.system == "aarch64-darwin" then
       "macosx_11_0_${arch}"
-    else throw "Unsupported target platform: ${stdenv.hostPlatform}";
+    else throw "Unsupported target platform: ${effectiveStdenv.hostPlatform}";
 
 in
 buildPythonPackage {
@@ -319,20 +409,18 @@ buildPythonPackage {
     let cp = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
     in "${bazel-build}/jaxlib-${version}-${cp}-${cp}-${platformTag}.whl";
 
-  # Note that cudatoolkit is necessary since jaxlib looks for "ptxas" in $PATH.
+  # Note that jaxlib looks for "ptxas" in $PATH. See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621
-  # See https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621 for
+  # for more info.
-  # more info.
   postInstall = lib.optionalString cudaSupport ''
     mkdir -p $out/bin
-    ln -s ${cudatoolkit}/bin/ptxas $out/bin/ptxas
+    ln -s ${cudaPackagesGoogle.cuda_nvcc.bin}/bin/ptxas $out/bin/ptxas
 
     find $out -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do
-      addOpenGLRunpath "$lib"
+      patchelf --add-rpath "${lib.makeLibraryPath [cuda_libs_joined cudnn nccl]}" "$lib"
-      patchelf --set-rpath "${cudatoolkit}/lib:${cudatoolkit.lib}/lib:${cudnn}/lib:${nccl}/lib:$(patchelf --print-rpath "$lib")" "$lib"
     done
   '';
 
-  nativeBuildInputs = lib.optional cudaSupport addOpenGLRunpath;
+  nativeBuildInputs = lib.optionals cudaSupport [ autoAddOpenGLRunpathHook ];
 
   propagatedBuildInputs = [
     absl-py

pkgs/development/python-modules/myuplink/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "myuplink";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,9 +17,14 @@ buildPythonPackage rec {
     owner = "pajzo";
     repo = "myuplink";
     rev = "refs/tags/${version}";
-    hash = "sha256-XDsQmgP3VvWpuZWGBVW5pBsxTRZT2cl3kp1i2sb+LnM=";
+    hash = "sha256-xITV5+d/9j8pjfvmnt8RfGHu4lfLu8cMFV0MzURy6hA=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail "%%VERSION_NO%%" "${version}"
+  '';
+
   nativeBuildInputs = [
     setuptools
   ];

pkgs/development/python-modules/rova/default.nix

@@ -4,22 +4,27 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "rova";
-  version = "0.3.0";
+  version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "GidoHakvoort";
-    repo = pname;
+    repo = "rova";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-TLL9Ta+7Xd55hGTTXjc6CBMj+tW1LpFrprpsnGqZvkQ=";
+    hash = "sha256-6tICjph+ffS6OSMxzR4ANB4Q6sG1AKAgUN83DyEGpvo=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
   ];
@@ -34,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to access for ROVA calendars";
     homepage = "https://github.com/GidoHakvoort/rova";
+    changelog = "https://github.com/GidoHakvoort/rova/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/tools/toast/default.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "toast";
-  version = "0.47.5";
+  version = "0.47.6";
 
   src = fetchFromGitHub {
     owner = "stepchowfun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kAXzBJMAxHjZSK6lbpF+/27n9CGvq7x6Ay2TaFYgQSU=";
+    sha256 = "sha256-+qntd687LF4tJwHZglZ6mppHq3dOZ+l431oKBBNDI0k=";
   };
 
-  cargoHash = "sha256-681ZFS8dtn815VYdFwPEJXnuMGTycSuRPDxmj1kN3rs=";
+  cargoHash = "sha256-A2sJ0o0RDztk3NjxG0CD8wNA4tmOizY4Tvff6ADzYQ8=";
 
   checkFlags = [ "--skip=format::tests::code_str_display" ]; # fails
 

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -8,31 +8,31 @@
         "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.1": {
-        "version": "6.1.78",
+        "version": "6.1.79",
-        "hash": "sha256:12fn23m2xwdlv6gr1s8872lk8mvigqkblvlhr54nh8rik2b6n835"
+        "hash": "sha256:16xkd0hcslqlcf55d4ivzhf1fkhfs5yy0m9arbax8pmm5yi9r97s"
     },
     "5.15": {
-        "version": "5.15.148",
+        "version": "5.15.149",
-        "hash": "sha256:1n75lrck581mppx84cds1a1l5vj05cdkp8ahpry7dx6rgz4pb1f4"
+        "hash": "sha256:1c01fnaghj55mkgsgddznq1zq4mswsa05rz00kmh1d3y6sd8115x"
     },
     "5.10": {
-        "version": "5.10.209",
+        "version": "5.10.210",
-        "hash": "sha256:1mc8rssk5aypgb58jz6i2bbflfr6qh1kgqpam0k8fqvwcjnjzqj4"
+        "hash": "sha256:0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf"
     },
     "5.4": {
-        "version": "5.4.268",
+        "version": "5.4.269",
-        "hash": "sha256:081695lgkdwlrp6gpp6pyflgh76zax1w52shys4s9zjnrfkarj5g"
+        "hash": "sha256:1kqqm4hpif3jy2ycnb0dfjgzyn18vqhm1i5q7d7rkisks33bwm7z"
     },
     "4.19": {
-        "version": "4.19.306",
+        "version": "4.19.307",
-        "hash": "sha256:06dy270xw4frnrc9p2qjh8chgp02fr5ll5g2b0lx9xqzlq7y86xr"
+        "hash": "sha256:0lp3fc7sqy48vpcl2g0n1bz7i1hp9k0nlz3i1xfh9l056ihzzvl3"
     },
     "6.6": {
-        "version": "6.6.17",
+        "version": "6.6.18",
-        "hash": "sha256:0si20m9ckir826jg40bh7sh4kwlp610rnc3gwsgs4nm7dfcm0xpf"
+        "hash": "sha256:07cv97l5jiakmmv35n0ganvqfr0590b02f3qb617qkx1zg2xhhsf"
     },
     "6.7": {
-        "version": "6.7.5",
+        "version": "6.7.6",
-        "hash": "sha256:1zrralagnv9yr8qdg7lc05735691dbh92mgwfyxrq5xqc504dxi9"
+        "hash": "sha256:1lrp7pwnxnqyy8c2l4n4nz997039gbnssrfm8ss8kl3h2c7fr2g4"
     }
 }

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -99,11 +99,11 @@ rec {
   };
 
   dc_535 = generic rec {
-    version = "535.129.03";
+    version = "535.154.05";
     url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
-    sha256_64bit = "sha256-5tylYmomCMa7KgRs/LfBrzOLnpYafdkKwJu4oSb/AC4=";
+    sha256_64bit = "sha256-fpUGXKprgt6SYRDxSCemGXLrEsIA6GOinp+0eGbqqJg=";
-    persistencedSha256 = "sha256-FRMqY5uAJzq3o+YdM2Mdjj8Df6/cuUUAnh52Ne4koME=";
+    persistencedSha256 = "sha256-d0Q3Lk80JqkS1B54Mahu2yY/WocOqFFbZVBh+ToGhaE=";
-    fabricmanagerSha256 = "sha256-5KRYS+JLVAhDkBn8Z7e0uJvULQy6dSpwnYsbBxw7Mxg=";
+    fabricmanagerSha256 = "sha256-/HQfV7YA3MYVmre/sz897PF6tc6MaMiS/h7Q10m2p/o=";
     useSettings = false;
     usePersistenced = true;
     useFabricmanager = true;

pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix

@@ -18,12 +18,12 @@ stdenv.mkDerivation rec {
   };
 
   installPhase = ''
-    find .
     mkdir -p $out/{bin,share/nvidia-fabricmanager}
     for bin in nv{-fabricmanager,switch-audit};do
     ${patchelf}/bin/patchelf \
       --set-interpreter ${stdenv.cc.libc}/lib/ld-${bsys}.so.2 \
       --set-rpath ${lib.makeLibraryPath [ stdenv.cc.libc ]} \
+      --shrink-rpath \
       bin/$bin
     done
     mv bin/nv{-fabricmanager,switch-audit} $out/bin/.

pkgs/servers/web-apps/matomo/default.nix

@@ -6,6 +6,10 @@ let
       version = "4.16.0";
       hash = "sha256-OFZT4195WTWw2XNAyGiNixW6hSNKC3IyBpa5kM9PCVk=";
     };
+    matomo_5 = {
+      version = "5.0.2";
+      hash = "sha256-rLAShJLtzd3HB1Je+P+i8GKWdeklyC2sTnmPR07Md+8=";
+    };
     matomo-beta = {
       version = "5.0.0";
       # `beta` examples: "b1", "rc1", null

pkgs/shells/zsh/zsh-autocomplete/default.nix

@@ -2,20 +2,20 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "zsh-autocomplete";
-  version = "23.05.24";
+  version = "23.07.13";
 
   src = fetchFromGitHub {
     owner = "marlonrichert";
     repo = "zsh-autocomplete";
     rev = version;
-    sha256 = "sha256-/6V6IHwB5p0GT1u5SAiUa20LjFDSrMo731jFBq/bnpw=";
+    sha256 = "sha256-0NW0TI//qFpUA2Hdx6NaYdQIIUpRSd0Y4NhwBbdssCs=";
   };
 
   strictDeps = true;
   installPhase = ''
     install -D zsh-autocomplete.plugin.zsh $out/share/zsh-autocomplete/zsh-autocomplete.plugin.zsh
-    cp -R scripts $out/share/zsh-autocomplete/scripts
+    cp -R Completions $out/share/zsh-autocomplete/Completions
-    cp -R functions $out/share/zsh-autocomplete/functions
+    cp -R Functions $out/share/zsh-autocomplete/Functions
   '';
 
   meta = with lib; {

pkgs/tools/networking/netbird/default.nix

@@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.25.9";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-asY5/g/RztQqZA5sH2Zoucm6QNUe/8QYoAmMAslnswo=";
+    hash = "sha256-hZnxemBoMAol0m9XZPMEh/Lf0woxoLNH97bRyg8xtv4=";
   };
 
-  vendorHash = "sha256-CFLwb5cqsfxTxOwuLOB0IMYkRZUNPgB7grjQ4xm84BM=";
+  vendorHash = "sha256-csa83P74Y9fHsPg5VgPfR9WMg4VKOXcIR0pOMzh0QoA=";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;
 

pkgs/top-level/all-packages.nix

@@ -27252,6 +27252,7 @@ with pkgs;
 
   inherit (callPackages ../servers/web-apps/matomo {})
     matomo
+    matomo_5
     matomo-beta;
 
   axis2 = callPackage ../servers/http/tomcat/axis2 { };