Merge branch 'master' into staging-next

ci/OWNERS

@@ -229,7 +229,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/servers/sql/postgresql @NixOS/postgres
 /nixos/modules/services/databases/postgresql.md @NixOS/postgres
 /nixos/modules/services/databases/postgresql.nix @NixOS/postgres
-/nixos/tests/postgresql.nix @NixOS/postgres
+/nixos/tests/postgresql @NixOS/postgres
 
 # Hardened profile & related modules
 /nixos/modules/profiles/hardened.nix                       @joachifm

maintainers/maintainer-list.nix

@@ -13509,6 +13509,12 @@
     githubId = 322214;
     name = "Mathnerd314";
   };
+  mathstlouis = {
+    email = "matfino+gh@gmail.com";
+    github = "mathstlouis";
+    githubId = 35696151;
+    name = "mathstlouis";
+  };
   matklad = {
     email = "aleksey.kladov@gmail.com";
     github = "matklad";
@@ -21772,6 +21778,12 @@
     githubId = 57180880;
     name = "Ansh Tyagi";
   };
+  therealgramdalf = {
+    email = "gramdalftech@gmail.com";
+    github = "TheRealGramdalf";
+    githubId = 79593869;
+    name = "Gramdalf";
+  };
   therealr5 = {
     email = "rouven@rfive.de";
     github = "therealr5";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -109,6 +109,8 @@
 
 - [Firefly-iii Data Importer](https://github.com/firefly-iii/data-importer), a data importer for Firefly-III. Available as [services.firefly-iii-data-importer](options.html#opt-services.firefly-iii-data-importer.enable).
 
+- [Dashy](https://dashy.to), an open source, highly customizable, easy to use, privacy-respecting dashboard app. Available as [services.dashy](options.html#opt-services.dashy).
+
 - [QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as [programs.qgroundcontrol](options.html#opt-programs.qgroundcontrol.enable).
 
 - [Eintopf](https://eintopf.info), a community event and calendar web application. Available as [services.eintopf](options.html#opt-services.eintopf.enable).

nixos/modules/services/web-apps/dashy.nix

@@ -0,0 +1,173 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib.types) package str;
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    ;
+  cfg = config.services.dashy;
+in
+{
+  options.services.dashy = {
+    enable = mkEnableOption ''
+      Dashy, a highly customizable, easy to use, privacy-respecting dashboard app.
+
+      Note that this builds a static web app as opposed to running a full node server, unlike the default docker image.
+
+      Writing config changes to disk through the UI, triggering a rebuild through the UI and application status checks are
+      unavailable without the node server; Everything else will work fine.
+
+      See the deployment docs for [building from source](https://dashy.to/docs/deployment#build-from-source), [hosting with a CDN](https://dashy.to/docs/deployment#hosting-with-cdn) and [CDN cloud deploy](https://dashy.to/docs/deployment#cdn--cloud-deploy) for more information.
+    '';
+
+    virtualHost = {
+      enableNginx = mkEnableOption "a virtualhost to serve dashy through nginx";
+
+      domain = mkOption {
+        description = ''
+          Domain to use for the virtual host.
+
+          This can be used to change nginx options like
+          ```nix
+          services.nginx.virtualHosts."$\{config.services.dashy.virtualHost.domain}".listen = [ ... ]
+          ```
+          or
+          ```nix
+          services.nginx.virtualHosts."example.com".listen = [ ... ]
+          ```
+        '';
+        type = str;
+      };
+    };
+
+    package = mkPackageOption pkgs "dashy-ui" { };
+
+    finalDrv = mkOption {
+      readOnly = true;
+      default =
+        if cfg.settings != { } then cfg.package.override { inherit (cfg) settings; } else cfg.package;
+      defaultText = ''
+        if cfg.settings != {}
+        then cfg.package.override {inherit (cfg) settings;}
+        else cfg.package;
+      '';
+      type = package;
+      description = ''
+        Final derivation containing the fully built static files
+      '';
+    };
+
+    settings = mkOption {
+      default = { };
+      description = ''
+        Settings serialized into `user-data/conf.yml` before build.
+        If left empty, the default configuration shipped with the package will be used instead.
+
+        Note that the full configuration will be written to the nix store as world readable, which may include secrets such as [password hashes](https://dashy.to/docs/configuring#appconfigauthusers-optional).
+
+        To add files such as icons or backgrounds, you can reference them in line such as
+        ```nix
+        icon = "$\{./icon.png}";
+        ```
+        This will add the file to the nix store upon build, referencing it by file path as expected by Dashy.
+      '';
+      example = ''
+        {
+          appConfig = {
+            cssThemes = [
+              "example-theme-1"
+              "example-theme-2"
+            ];
+            enableFontAwesome = true;
+            fontAwesomeKey = "e9076c7025";
+            theme = "thebe";
+          };
+          pageInfo = {
+            description = "My Awesome Dashboard";
+            navLinks = [
+              {
+                path = "/";
+                title = "Home";
+              }
+              {
+                path = "https://example.com";
+                title = "Example 1";
+              }
+              {
+                path = "https://example.com";
+                title = "Example 2";
+              }
+            ];
+            title = "Dashy";
+          };
+          sections = [
+            {
+              displayData = {
+                collapsed = true;
+                cols = 2;
+                customStyles = "border: 2px dashed red;";
+                itemSize = "large";
+              };
+              items = [
+                {
+                  backgroundColor = "#0079ff";
+                  color = "#00ffc9";
+                  description = "Source code and documentation on GitHub";
+                  icon = "fab fa-github";
+                  target = "sametab";
+                  title = "Source";
+                  url = "https://github.com/Lissy93/dashy";
+                }
+                {
+                  description = "View currently open issues, or raise a new one";
+                  icon = "fas fa-bug";
+                  title = "Issues";
+                  url = "https://github.com/Lissy93/dashy/issues";
+                }
+                {
+                  description = "Live Demo #1";
+                  icon = "fas fa-rocket";
+                  target = "iframe";
+                  title = "Demo 1";
+                  url = "https://dashy-demo-1.as93.net";
+                }
+                {
+                  description = "Live Demo #2";
+                  icon = "favicon";
+                  target = "newtab";
+                  title = "Demo 2";
+                  url = "https://dashy-demo-2.as93.net";
+                }
+              ];
+              name = "Getting Started";
+            }
+          ];
+        }
+      '';
+      inherit (pkgs.formats.json { }) type;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.nginx = mkIf cfg.virtualHost.enableNginx {
+      enable = true;
+      virtualHosts."${cfg.virtualHost.domain}" = {
+        locations."/" = {
+          root = cfg.finalDrv;
+          tryFiles = "$uri /index.html ";
+        };
+      };
+    };
+  };
+
+  meta.maintainers = [
+    lib.maintainers.therealgramdalf
+  ];
+}

nixos/tests/all-tests.nix

@@ -775,13 +775,10 @@ in {
   peering-manager = handleTest ./web-apps/peering-manager.nix {};
   peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
   peroxide = handleTest ./peroxide.nix {};
-  pg_anonymizer = handleTest ./pg_anonymizer.nix {};
   pgadmin4 = handleTest ./pgadmin4.nix {};
   pgbouncer = handleTest ./pgbouncer.nix {};
   pghero = runTest ./pghero.nix;
-  pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
-  pgvecto-rs = handleTest ./pgvecto-rs.nix {};
   phosh = handleTest ./phosh.nix {};
   photonvision = handleTest ./photonvision.nix {};
   photoprism = handleTest ./photoprism.nix {};
@@ -814,13 +811,7 @@ in {
   postfix = handleTest ./postfix.nix {};
   postfix-raise-smtpd-tls-security-level = handleTest ./postfix-raise-smtpd-tls-security-level.nix {};
   postfixadmin = handleTest ./postfixadmin.nix {};
-  postgis = handleTest ./postgis.nix {};
+  postgresql = handleTest ./postgresql {};
-  apache_datasketches = handleTest ./apache_datasketches.nix {};
-  postgresql = handleTest ./postgresql.nix {};
-  postgresql-jit = handleTest ./postgresql-jit.nix {};
-  postgresql-wal-receiver = handleTest ./postgresql-wal-receiver.nix {};
-  postgresql-tls-client-cert = handleTest ./postgresql-tls-client-cert.nix {};
-  postgresql-wal2json = handleTest ./postgresql-wal2json.nix {};
   powerdns = handleTest ./powerdns.nix {};
   powerdns-admin = handleTest ./powerdns-admin.nix {};
   power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};
@@ -1047,7 +1038,6 @@ in {
   tiddlywiki = handleTest ./tiddlywiki.nix {};
   tigervnc = handleTest ./tigervnc.nix {};
   tika = runTest ./tika.nix;
-  timescaledb = handleTest ./timescaledb.nix {};
   timezone = handleTest ./timezone.nix {};
   timidity = handleTestOn ["aarch64-linux" "x86_64-linux"] ./timidity {};
   tinc = handleTest ./tinc {};
@@ -1067,7 +1057,6 @@ in {
   trezord = handleTest ./trezord.nix {};
   trickster = handleTest ./trickster.nix {};
   trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
-  tsja = handleTest ./tsja.nix {};
   tsm-client-gui = handleTest ./tsm-client-gui.nix {};
   ttyd = handleTest ./web-servers/ttyd.nix {};
   txredisapi = handleTest ./txredisapi.nix {};

nixos/tests/apache_datasketches.nix

@@ -1,29 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
-  name = "postgis";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ lsix ]; # TODO: Who's the maintener now?
-  };
-
-  nodes = {
-    master =
-      { pkgs, ... }:
-
-      {
-        services.postgresql = let mypg = pkgs.postgresql_15; in {
-            enable = true;
-            package = mypg;
-            extraPlugins = with mypg.pkgs; [
-              apache_datasketches
-            ];
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-    master.wait_for_unit("postgresql")
-    master.sleep(10)  # Hopefully this is long enough!!
-    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION datasketches;'")
-    master.succeed("sudo -u postgres psql -c 'SELECT hll_sketch_to_string(hll_sketch_build(1));'")
-  '';
-})

nixos/tests/pg_anonymizer.nix

@@ -1,94 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }: {
-  name = "pg_anonymizer";
-  meta.maintainers = lib.teams.flyingcircus.members;
-
-  nodes.machine = { pkgs, ... }: {
-    environment.systemPackages = [ pkgs.pg-dump-anon ];
-    services.postgresql = {
-      enable = true;
-      extraPlugins = ps: [ ps.anonymizer ];
-      settings.shared_preload_libraries = [ "anon" ];
-    };
-  };
-
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.wait_for_unit("postgresql.service")
-
-    with subtest("Setup"):
-        machine.succeed("sudo -u postgres psql --command 'create database demo'")
-        machine.succeed(
-            "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
-              create extension anon cascade;
-              select anon.init();
-              create table player(id serial, name text, points int);
-              insert into player(id,name,points) values (1,'Foo', 23);
-              insert into player(id,name,points) values (2,'Bar',42);
-              security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name();';
-              security label for anon on column player.points is 'MASKED WITH VALUE NULL';
-            ''}"
-        )
-
-    def get_player_table_contents():
-        return [
-            x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
-        ]
-
-    def check_anonymized_row(row, id, original_name):
-        assert row[0] == id, f"Expected first row to have ID {id}, but got {row[0]}"
-        assert row[1] != original_name, f"Expected first row to have a name other than {original_name}"
-        assert not bool(row[2]), "Expected points to be NULL in first row"
-
-    def find_xsv_in_dump(dump, sep=','):
-        """
-        Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
-
-            COPY public.player ...
-            1,Shields,
-            2,Salazar,
-            \.
-
-        in the given dump (the commas are tabs in case of pg_dump).
-              Extract the CSV lines and split by `sep`.
-        """
-
-        try:
-            from itertools import dropwhile, takewhile
-            return [x.split(sep) for x in list(takewhile(
-                lambda x: x != "\\.",
-                dropwhile(
-                    lambda x: not x.startswith("COPY public.player"),
-                    dump.splitlines()
-                )
-            ))[1:]]
-        except:
-            print(f"Dump to process: {dump}")
-            raise
-
-    def check_original_data(output):
-        assert output[0] == ['1','Foo','23'], f"Expected first row from player table to be 1,Foo,23; got {output[0]}"
-        assert output[1] == ['2','Bar','42'], f"Expected first row from player table to be 2,Bar,42; got {output[1]}"
-
-    def check_anonymized_rows(output):
-        check_anonymized_row(output[0], '1', 'Foo')
-        check_anonymized_row(output[1], '2', 'Bar')
-
-    with subtest("Check initial state"):
-        check_original_data(get_player_table_contents())
-
-    with subtest("Anonymous dumps"):
-        check_original_data(find_xsv_in_dump(
-            machine.succeed("sudo -u postgres pg_dump demo"),
-            sep='\t'
-        ))
-        check_anonymized_rows(find_xsv_in_dump(
-            machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
-            sep=','
-        ))
-
-    with subtest("Anonymize"):
-        machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
-        check_anonymized_rows(get_player_table_contents())
-  '';
-})

nixos/tests/pgjwt.nix

@@ -1,35 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ...}:
-
-with pkgs; {
-  name = "pgjwt";
-  meta = with lib.maintainers; {
-    maintainers = [ spinus willibutz ];
-  };
-
-  nodes = {
-    master = { ... }:
-    {
-      services.postgresql = {
-        enable = true;
-        extraPlugins = ps: with ps; [ pgjwt pgtap ];
-      };
-    };
-  };
-
-  testScript = { nodes, ... }:
-  let
-    sqlSU = "${nodes.master.services.postgresql.superUser}";
-    pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
-    inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
-  in
-  ''
-    start_all()
-    master.wait_for_unit("postgresql")
-    master.succeed(
-        "${pkgs.gnused}/bin/sed -e '12 i CREATE EXTENSION pgcrypto;\\nCREATE EXTENSION pgtap;\\nSET search_path TO tap,public;' ${pgjwt.src}/test.sql > /tmp/test.sql"
-    )
-    master.succeed(
-        "${pkgs.sudo}/bin/sudo -u ${sqlSU} PGOPTIONS=--search_path=tap,public ${pgProve}/bin/pg_prove -d postgres -v -f /tmp/test.sql"
-    )
-  '';
-})

nixos/tests/pgvecto-rs.nix

@@ -1,76 +0,0 @@
-# mostly copied from ./timescaledb.nix which was copied from ./postgresql.nix
-# as it seemed unapproriate to test additional extensions for postgresql there.
-
-{ system ? builtins.currentSystem
-, config ? { }
-, pkgs ? import ../.. { inherit system config; }
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
-  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
-  # Test cases from https://docs.pgvecto.rs/use-cases/hybrid-search.html
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION vectors;
-
-    CREATE TABLE items (
-      id bigserial PRIMARY KEY,
-      content text NOT NULL,
-      embedding vectors.vector(3) NOT NULL -- 3 dimensions
-    );
-
-    INSERT INTO items (content, embedding) VALUES
-      ('a fat cat sat on a mat and ate a fat rat', '[1, 2, 3]'),
-      ('a fat dog sat on a mat and ate a fat rat', '[4, 5, 6]'),
-      ('a thin cat sat on a mat and ate a thin rat', '[7, 8, 9]'),
-      ('a thin dog sat on a mat and ate a thin rat', '[10, 11, 12]');
-  '';
-  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
-    name = postgresql-name;
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ diogotcorreia ];
-    };
-
-    nodes.machine = { ... }:
-      {
-        services.postgresql = {
-          enable = true;
-          package = postgresql-package;
-          extraPlugins = ps: with ps; [
-            pgvecto-rs
-          ];
-          settings.shared_preload_libraries = "vectors";
-        };
-      };
-
-    testScript = ''
-      def check_count(statement, lines):
-          return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
-              statement, lines
-          )
-
-
-      machine.start()
-      machine.wait_for_unit("postgresql")
-
-      with subtest("Postgresql with extension vectors is available just after unit start"):
-          machine.succeed(check_count("SELECT * FROM pg_available_extensions WHERE name = 'vectors' AND default_version = '${postgresql-package.pkgs.pgvecto-rs.version}';", 1))
-
-      machine.succeed("sudo -u postgres psql -f ${test-sql}")
-
-      machine.succeed(check_count("SELECT content, embedding FROM items WHERE to_tsvector('english', content) @@ 'cat & rat'::tsquery;", 2))
-
-      machine.shutdown()
-    '';
-
-  };
-  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "14") postgresql-versions;
-in
-mapAttrs'
-  (name: package: {
-    inherit name;
-    value = make-postgresql-test name package;
-  })
-  applicablePostgresqlVersions

nixos/tests/postgis.nix

@@ -1,38 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
-  name = "postgis";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ lsix ];
-  };
-
-  nodes = {
-    master =
-      { pkgs, ... }:
-
-      {
-        services.postgresql = {
-            enable = true;
-            package = pkgs.postgresql;
-            extraPlugins = ps: with ps; [
-              postgis
-            ];
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-    master.wait_for_unit("postgresql")
-    master.sleep(10)  # Hopefully this is long enough!!
-    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis;'")
-    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_raster;'")
-    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_topology;'")
-    master.succeed("sudo -u postgres psql -c 'select postgis_version();'")
-    master.succeed("[ \"$(sudo -u postgres psql --no-psqlrc --tuples-only -c 'select postgis_version();')\" = \" ${
-      pkgs.lib.versions.major pkgs.postgis.version
-    }.${
-      pkgs.lib.versions.minor pkgs.postgis.version
-    } USE_GEOS=1 USE_PROJ=1 USE_STATS=1\" ]")
-    # st_makepoint goes through c code
-    master.succeed("sudo -u postgres psql --no-psqlrc --tuples-only -c 'select st_makepoint(1, 1)'")
-  '';
-})

nixos/tests/postgresql-jit.nix

@@ -1,55 +0,0 @@
-{ system ? builtins.currentSystem
-, config ? {}
-, pkgs ? import ../.. { inherit system config; }
-, package ? null
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
-let
-  inherit (pkgs) lib;
-  packages = builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs);
-
-  mkJitTestFromName = name:
-    mkJitTest pkgs.${name};
-
-  mkJitTest = package: makeTest {
-    name = package.name;
-    meta.maintainers = with lib.maintainers; [ ma27 ];
-    nodes.machine = { pkgs, lib, ... }: {
-      services.postgresql = {
-        inherit package;
-        enable = true;
-        enableJIT = true;
-        initialScript = pkgs.writeText "init.sql" ''
-          create table demo (id int);
-          insert into demo (id) select generate_series(1, 5);
-        '';
-      };
-    };
-    testScript = ''
-      machine.start()
-      machine.wait_for_unit("postgresql.service")
-
-      with subtest("JIT is enabled"):
-          machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
-
-      with subtest("Test JIT works fine"):
-          output = machine.succeed(
-              "cat ${pkgs.writeText "test.sql" ''
-                set jit_above_cost = 1;
-                EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
-                SELECT CONCAT('jit result = ', SUM(id)) from demo;
-              ''} | sudo -u postgres psql"
-          )
-          assert "JIT:" in output
-          assert "jit result = 15" in output
-
-      machine.shutdown()
-    '';
-  };
-in
-if package == null then
-  lib.genAttrs packages mkJitTestFromName
-else
-  mkJitTest package

nixos/tests/postgresql-tls-client-cert.nix

@@ -1,141 +0,0 @@
-{ system ? builtins.currentSystem
-, config ? { }
-, pkgs ? import ../.. { inherit system config; }
-, package ? null
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
-let
-  lib = pkgs.lib;
-
-  # Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`.
-  makeTestAttribute = name:
-    {
-      inherit name;
-      value = makePostgresqlTlsClientCertTest pkgs."${name}";
-    };
-
-  makePostgresqlTlsClientCertTest = pkg:
-    let
-      runWithOpenSSL = file: cmd: pkgs.runCommand file
-        {
-          buildInputs = [ pkgs.openssl ];
-        }
-        cmd;
-      caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-      caCert = runWithOpenSSL
-        "ca.crt"
-        ''
-          openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
-        '';
-      serverKey =
-        runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-      serverKeyPath = "/var/lib/postgresql";
-      serverCert =
-        runWithOpenSSL "server.crt" ''
-          openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
-          openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
-            -CAcreateserial -out $out -days 36500 -sha256
-        '';
-      clientKey =
-        runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
-      clientCert =
-        runWithOpenSSL "client.crt" ''
-          openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
-          openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
-            -CAcreateserial -out $out -days 36500 -sha256
-        '';
-      clientKeyPath = "/root";
-
-    in
-    makeTest {
-      name = "postgresql-tls-client-cert-${pkg.name}";
-      meta.maintainers = with lib.maintainers; [ erictapen ];
-
-      nodes.server = { ... }: {
-        system.activationScripts = {
-          keyPlacement.text = ''
-            mkdir -p '${serverKeyPath}'
-            cp '${serverKey}' '${serverKeyPath}/server.key'
-            chown postgres:postgres '${serverKeyPath}/server.key'
-            chmod 600 '${serverKeyPath}/server.key'
-          '';
-        };
-        services.postgresql = {
-          package = pkg;
-          enable = true;
-          enableTCPIP = true;
-          ensureUsers = [
-            {
-              name = "test";
-              ensureDBOwnership = true;
-            }
-          ];
-          ensureDatabases = [ "test" ];
-          settings = {
-            ssl = "on";
-            ssl_ca_file = toString caCert;
-            ssl_cert_file = toString serverCert;
-            ssl_key_file = "${serverKeyPath}/server.key";
-          };
-          authentication = ''
-            hostssl test test ::/0 cert clientcert=verify-full
-          '';
-        };
-        networking = {
-          interfaces.eth1 = {
-            ipv6.addresses = [
-              { address = "fc00::1"; prefixLength = 120; }
-            ];
-          };
-          firewall.allowedTCPPorts = [ 5432 ];
-        };
-      };
-
-      nodes.client = { ... }: {
-        system.activationScripts = {
-          keyPlacement.text = ''
-            mkdir -p '${clientKeyPath}'
-            cp '${clientKey}' '${clientKeyPath}/client.key'
-            chown root:root '${clientKeyPath}/client.key'
-            chmod 600 '${clientKeyPath}/client.key'
-          '';
-        };
-        environment = {
-          variables = {
-            PGHOST = "db.test.example";
-            PGPORT = "5432";
-            PGDATABASE = "test";
-            PGUSER = "test";
-            PGSSLMODE = "verify-full";
-            PGSSLCERT = clientCert;
-            PGSSLKEY = "${clientKeyPath}/client.key";
-            PGSSLROOTCERT = caCert;
-          };
-          systemPackages = [ pkg ];
-        };
-        networking = {
-          interfaces.eth1 = {
-            ipv6.addresses = [
-              { address = "fc00::2"; prefixLength = 120; }
-            ];
-          };
-          hosts = { "fc00::1" = [ "db.test.example" ]; };
-        };
-      };
-
-      testScript = ''
-        server.wait_for_unit("multi-user.target")
-        client.wait_for_unit("multi-user.target")
-        client.succeed("psql -c \"SELECT 1;\"")
-      '';
-    };
-
-in
-if package == null then
-# all-tests.nix: Maps the generic function over all attributes of PostgreSQL packages
-  builtins.listToAttrs (map makeTestAttribute (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))
-else
-# Called directly from <package>.tests
-  makePostgresqlTlsClientCertTest package

nixos/tests/postgresql-wal-receiver.nix

@@ -1,124 +0,0 @@
-{ system ? builtins.currentSystem,
-  config ? {},
-  pkgs ? import ../.. { inherit system config; },
-  package ? null
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
-let
-  lib = pkgs.lib;
-
-  # Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`.
-  makeTestAttribute = name:
-  {
-    inherit name;
-    value = makePostgresqlWalReceiverTest pkgs."${name}";
-  };
-
-  makePostgresqlWalReceiverTest = pkg:
-    let
-      postgresqlDataDir = "/var/lib/postgresql/${pkg.psqlSchema}";
-      replicationUser = "wal_receiver_user";
-      replicationSlot = "wal_receiver_slot";
-      replicationConn = "postgresql://${replicationUser}@localhost";
-      baseBackupDir = "/var/cache/wals/pg_basebackup";
-      walBackupDir = "/var/cache/wals/pg_wal";
-
-      recoveryFile = pkgs.writeTextDir "recovery.signal" "";
-
-    in makeTest {
-      name = "postgresql-wal-receiver-${pkg.name}";
-      meta.maintainers = with lib.maintainers; [ pacien ];
-
-      nodes.machine = { ... }: {
-        systemd.tmpfiles.rules = [
-          "d /var/cache/wals 0750 postgres postgres - -"
-        ];
-
-        services.postgresql = {
-          package = pkg;
-          enable = true;
-          settings = {
-            max_replication_slots = 10;
-            max_wal_senders = 10;
-            recovery_end_command = "touch recovery.done";
-            restore_command = "cp ${walBackupDir}/%f %p";
-            wal_level = "archive"; # alias for replica on pg >= 9.6
-          };
-          authentication = ''
-            host replication ${replicationUser} all trust
-          '';
-          initialScript = pkgs.writeText "init.sql" ''
-            create user ${replicationUser} replication;
-            select * from pg_create_physical_replication_slot('${replicationSlot}');
-          '';
-        };
-
-        services.postgresqlWalReceiver.receivers.main = {
-          postgresqlPackage = pkg;
-          connection = replicationConn;
-          slot = replicationSlot;
-          directory = walBackupDir;
-        };
-        # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
-        # default 60sec is fine for real system, but is too much for a test
-        systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
-        systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
-      };
-
-      testScript = ''
-        # make an initial base backup
-        machine.wait_for_unit("postgresql")
-        machine.wait_for_unit("postgresql-wal-receiver-main")
-        # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
-        # required only for 9.4
-        machine.sleep(5)
-        machine.succeed(
-            "${pkg}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
-        )
-
-        # create a dummy table with 100 records
-        machine.succeed(
-            "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
-        )
-
-        # stop postgres and destroy data
-        machine.systemctl("stop postgresql")
-        machine.systemctl("stop postgresql-wal-receiver-main")
-        machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
-
-        # restore the base backup
-        machine.succeed(
-            "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
-        )
-
-        # prepare WAL and recovery
-        machine.succeed("chmod a+rX -R ${walBackupDir}")
-        machine.execute(
-            "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
-        )  # make use of partial segments too
-        machine.succeed(
-            "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
-        )
-
-        # replay WAL
-        machine.systemctl("start postgresql")
-        machine.wait_for_file("${postgresqlDataDir}/recovery.done")
-        machine.systemctl("restart postgresql")
-        machine.wait_for_unit("postgresql")
-
-        # check that our records have been restored
-        machine.succeed(
-            "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
-        )
-      '';
-    };
-
-in
-if package == null then
-  # all-tests.nix: Maps the generic function over all attributes of PostgreSQL packages
-  builtins.listToAttrs (map makeTestAttribute (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))
-else
-  # Called directly from <package>.tests
-  makePostgresqlWalReceiverTest package

nixos/tests/postgresql-wal2json.nix

@@ -1,60 +0,0 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  postgresql ? null,
-}:
-
-let
-  makeTest = import ./make-test-python.nix;
-  # Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`.
-  makeTestAttribute = name: {
-    inherit name;
-    value = makePostgresqlWal2jsonTest pkgs."${name}";
-  };
-
-  makePostgresqlWal2jsonTest =
-    postgresqlPackage:
-    makeTest {
-      name = "postgresql-wal2json-${postgresqlPackage.name}";
-      meta.maintainers = with pkgs.lib.maintainers; [ euank ];
-
-      nodes.machine = {
-        services.postgresql = {
-          package = postgresqlPackage;
-          enable = true;
-          extraPlugins = with postgresqlPackage.pkgs; [ wal2json ];
-          settings = {
-            wal_level = "logical";
-            max_replication_slots = "10";
-            max_wal_senders = "10";
-          };
-        };
-      };
-
-      testScript = ''
-        machine.wait_for_unit("postgresql")
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./postgresql/wal2json/example2.sql} postgres > /tmp/example2.out"
-        )
-        machine.succeed(
-            "diff ${./postgresql/wal2json/example2.out} /tmp/example2.out"
-        )
-        machine.succeed(
-            "sudo -u postgres psql -qAt -f ${./postgresql/wal2json/example3.sql} postgres > /tmp/example3.out"
-        )
-        machine.succeed(
-            "diff ${./postgresql/wal2json/example3.out} /tmp/example3.out"
-        )
-      '';
-    };
-
-in
-# By default, create one test per postgresql version
-if postgresql == null then
-  builtins.listToAttrs (
-    map makeTestAttribute (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs))
-  )
-# but if postgresql is set, we're being made as a passthru test for a specific postgres + wal2json version, just run one
-else
-  makePostgresqlWal2jsonTest postgresql

nixos/tests/postgresql.nix

@@ -1,226 +0,0 @@
-{ system ? builtins.currentSystem,
-  config ? {},
-  pkgs ? import ../.. { inherit system config; }
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
-  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
-    CREATE TABLE sth (
-      id int
-    );
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    INSERT INTO sth (id) VALUES (1);
-    CREATE TABLE xmltest ( doc xml );
-    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-  '';
-  make-postgresql-test = postgresql-name: postgresql-package: backup-all: makeTest {
-    name = postgresql-name;
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ zagy ];
-    };
-
-    nodes.machine = {...}:
-      {
-        services.postgresql = {
-          enable = true;
-          package = postgresql-package;
-        };
-
-        services.postgresqlBackup = {
-          enable = true;
-          databases = optional (!backup-all) "postgres";
-        };
-      };
-
-    testScript = let
-      backupName = if backup-all then "all" else "postgres";
-      backupService = if backup-all then "postgresqlBackup" else "postgresqlBackup-postgres";
-      backupFileBase = "/var/backup/postgresql/${backupName}";
-    in ''
-      def check_count(statement, lines):
-          return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
-              statement, lines
-          )
-
-
-      machine.start()
-      machine.wait_for_unit("postgresql")
-
-      with subtest("Postgresql is available just after unit start"):
-          machine.succeed(
-              "cat ${test-sql} | sudo -u postgres psql"
-          )
-
-      with subtest("Postgresql survives restart (bug #1735)"):
-          machine.shutdown()
-          import time
-          time.sleep(2)
-          machine.start()
-          machine.wait_for_unit("postgresql")
-
-      machine.fail(check_count("SELECT * FROM sth;", 3))
-      machine.succeed(check_count("SELECT * FROM sth;", 5))
-      machine.fail(check_count("SELECT * FROM sth;", 4))
-      machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
-
-      with subtest("Backup service works"):
-          machine.succeed(
-              "systemctl start ${backupService}.service",
-              "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-              "ls -hal /var/backup/postgresql/ >/dev/console",
-              "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-          )
-      with subtest("Backup service removes prev files"):
-          machine.succeed(
-              # Create dummy prev files.
-              "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
-              "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
-
-              # Run backup.
-              "systemctl start ${backupService}.service",
-              "ls -hal /var/backup/postgresql/ >/dev/console",
-
-              # Since nothing has changed in the database, the cur and prev files
-              # should match.
-              "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
-              "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
-
-              # The prev files with unused suffix should be removed.
-              "[ ! -f '${backupFileBase}.prev.sql' ]",
-              "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
-
-              # Both cur and prev file should only be accessible by the postgres user.
-              "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
-              "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
-          )
-      with subtest("Backup service fails gracefully"):
-          # Sabotage the backup process
-          machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
-          machine.fail(
-              "systemctl start ${backupService}.service",
-          )
-          machine.succeed(
-              "ls -hal /var/backup/postgresql/ >/dev/console",
-              "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-              "stat ${backupFileBase}.in-progress.sql.gz",
-          )
-          # In a previous version, the second run would overwrite prev.sql.gz,
-          # so we test a second run as well.
-          machine.fail(
-              "systemctl start ${backupService}.service",
-          )
-          machine.succeed(
-              "stat ${backupFileBase}.in-progress.sql.gz",
-              "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
-          )
-
-
-      with subtest("Initdb works"):
-          machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
-
-      machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
-
-      machine.shutdown()
-    '';
-
-  };
-
-  mk-ensure-clauses-test = postgresql-name: postgresql-package: makeTest {
-    name = postgresql-name;
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ zagy ];
-    };
-
-    nodes.machine = {...}:
-      {
-        services.postgresql = {
-          enable = true;
-          package = postgresql-package;
-          ensureUsers = [
-            {
-              name = "all-clauses";
-              ensureClauses = {
-                superuser = true;
-                createdb = true;
-                createrole = true;
-                "inherit" = true;
-                login = true;
-                replication = true;
-                bypassrls = true;
-              };
-            }
-            {
-              name = "default-clauses";
-            }
-          ];
-        };
-      };
-
-    testScript = let
-      getClausesQuery = user: pkgs.lib.concatStringsSep " "
-        [
-          "SELECT row_to_json(row)"
-          "FROM ("
-          "SELECT"
-            "rolsuper,"
-            "rolinherit,"
-            "rolcreaterole,"
-            "rolcreatedb,"
-            "rolcanlogin,"
-            "rolreplication,"
-            "rolbypassrls"
-          "FROM pg_roles"
-          "WHERE rolname = '${user}'"
-          ") row;"
-        ];
-    in ''
-      import json
-      machine.start()
-      machine.wait_for_unit("postgresql")
-
-      with subtest("All user permissions are set according to the ensureClauses attr"):
-          clauses = json.loads(
-            machine.succeed(
-                "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
-            )
-          )
-          print(clauses)
-          assert clauses['rolsuper'], 'expected user with clauses to have superuser clause'
-          assert clauses['rolinherit'], 'expected user with clauses to have inherit clause'
-          assert clauses['rolcreaterole'], 'expected user with clauses to have create role clause'
-          assert clauses['rolcreatedb'], 'expected user with clauses to have create db clause'
-          assert clauses['rolcanlogin'], 'expected user with clauses to have login clause'
-          assert clauses['rolreplication'], 'expected user with clauses to have replication clause'
-          assert clauses['rolbypassrls'], 'expected user with clauses to have bypassrls clause'
-
-      with subtest("All user permissions default when ensureClauses is not provided"):
-          clauses = json.loads(
-            machine.succeed(
-                "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
-            )
-          )
-          assert not clauses['rolsuper'], 'expected user with no clauses set to have default superuser clause'
-          assert clauses['rolinherit'], 'expected user with no clauses set to have default inherit clause'
-          assert not clauses['rolcreaterole'], 'expected user with no clauses set to have default create role clause'
-          assert not clauses['rolcreatedb'], 'expected user with no clauses set to have default create db clause'
-          assert clauses['rolcanlogin'], 'expected user with no clauses set to have default login clause'
-          assert not clauses['rolreplication'], 'expected user with no clauses set to have default replication clause'
-          assert not clauses['rolbypassrls'], 'expected user with no clauses set to have default bypassrls clause'
-
-      machine.shutdown()
-    '';
-  };
-in
-  concatMapAttrs (name: package: {
-    ${name} = make-postgresql-test name package false;
-    ${name + "-backup-all"} = make-postgresql-test "${name + "-backup-all"}" package true;
-    ${name + "-clauses"} = mk-ensure-clauses-test name package;
-  }) postgresql-versions

nixos/tests/postgresql/anonymizer.nix

@@ -0,0 +1,116 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "postgresql_anonymizer-${package.name}";
+      meta.maintainers = lib.teams.flyingcircus.members;
+
+      nodes.machine =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = [ pkgs.pg-dump-anon ];
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extraPlugins = ps: [ ps.anonymizer ];
+            settings.shared_preload_libraries = [ "anon" ];
+          };
+        };
+
+      testScript = ''
+        start_all()
+        machine.wait_for_unit("multi-user.target")
+        machine.wait_for_unit("postgresql.service")
+
+        with subtest("Setup"):
+            machine.succeed("sudo -u postgres psql --command 'create database demo'")
+            machine.succeed(
+                "sudo -u postgres psql -d demo -f ${pkgs.writeText "init.sql" ''
+                  create extension anon cascade;
+                  select anon.init();
+                  create table player(id serial, name text, points int);
+                  insert into player(id,name,points) values (1,'Foo', 23);
+                  insert into player(id,name,points) values (2,'Bar',42);
+                  security label for anon on column player.name is 'MASKED WITH FUNCTION anon.fake_last_name();';
+                  security label for anon on column player.points is 'MASKED WITH VALUE NULL';
+                ''}"
+            )
+
+        def get_player_table_contents():
+            return [
+                x.split(',') for x in machine.succeed("sudo -u postgres psql -d demo --csv --command 'select * from player'").splitlines()[1:]
+            ]
+
+        def check_anonymized_row(row, id, original_name):
+            assert row[0] == id, f"Expected first row to have ID {id}, but got {row[0]}"
+            assert row[1] != original_name, f"Expected first row to have a name other than {original_name}"
+            assert not bool(row[2]), "Expected points to be NULL in first row"
+
+        def find_xsv_in_dump(dump, sep=','):
+            """
+            Expecting to find a CSV (for pg_dump_anon) or TSV (for pg_dump) structure, looking like
+
+                COPY public.player ...
+                1,Shields,
+                2,Salazar,
+                \.
+
+            in the given dump (the commas are tabs in case of pg_dump).
+                  Extract the CSV lines and split by `sep`.
+            """
+
+            try:
+                from itertools import dropwhile, takewhile
+                return [x.split(sep) for x in list(takewhile(
+                    lambda x: x != "\\.",
+                    dropwhile(
+                        lambda x: not x.startswith("COPY public.player"),
+                        dump.splitlines()
+                    )
+                ))[1:]]
+            except:
+                print(f"Dump to process: {dump}")
+                raise
+
+        def check_original_data(output):
+            assert output[0] == ['1','Foo','23'], f"Expected first row from player table to be 1,Foo,23; got {output[0]}"
+            assert output[1] == ['2','Bar','42'], f"Expected first row from player table to be 2,Bar,42; got {output[1]}"
+
+        def check_anonymized_rows(output):
+            check_anonymized_row(output[0], '1', 'Foo')
+            check_anonymized_row(output[1], '2', 'Bar')
+
+        with subtest("Check initial state"):
+            check_original_data(get_player_table_contents())
+
+        with subtest("Anonymous dumps"):
+            check_original_data(find_xsv_in_dump(
+                machine.succeed("sudo -u postgres pg_dump demo"),
+                sep='\t'
+            ))
+            check_anonymized_rows(find_xsv_in_dump(
+                machine.succeed("sudo -u postgres pg_dump_anon -U postgres -h /run/postgresql -d demo"),
+                sep=','
+            ))
+
+        with subtest("Anonymize"):
+            machine.succeed("sudo -u postgres psql -d demo --command 'select anon.anonymize_database();'")
+            check_anonymized_rows(get_player_table_contents())
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.anonymizer.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/default.nix

@@ -0,0 +1,26 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../../.. { inherit system config; },
+}:
+
+with import ../../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  importWithArgs = path: import path { inherit pkgs makeTest; };
+in
+{
+  # postgresql
+  postgresql = importWithArgs ./postgresql.nix;
+  postgresql-jit = importWithArgs ./postgresql-jit.nix;
+  postgresql-wal-receiver = importWithArgs ./postgresql-wal-receiver.nix;
+  postgresql-tls-client-cert = importWithArgs ./postgresql-tls-client-cert.nix;
+
+  # extensions
+  anonymizer = importWithArgs ./anonymizer.nix;
+  pgjwt = importWithArgs ./pgjwt.nix;
+  pgvecto-rs = importWithArgs ./pgvecto-rs.nix;
+  timescaledb = importWithArgs ./timescaledb.nix;
+  tsja = importWithArgs ./tsja.nix;
+  wal2json = importWithArgs ./wal2json.nix;
+}

nixos/tests/postgresql/pgjwt.nix

@@ -0,0 +1,57 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "pgjwt-${package.name}";
+      meta = with lib.maintainers; {
+        maintainers = [
+          spinus
+          willibutz
+        ];
+      };
+
+      nodes.master =
+        { ... }:
+        {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extraPlugins =
+              ps: with ps; [
+                pgjwt
+                pgtap
+              ];
+          };
+        };
+
+      testScript =
+        { nodes, ... }:
+        let
+          sqlSU = "${nodes.master.services.postgresql.superUser}";
+          pgProve = "${pkgs.perlPackages.TAPParserSourceHandlerpgTAP}";
+          inherit (nodes.master.services.postgresql.package.pkgs) pgjwt;
+        in
+        ''
+          start_all()
+          master.wait_for_unit("postgresql")
+          master.succeed(
+              "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
+          )
+        '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.pgjwt.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/pgvecto-rs.nix

@@ -0,0 +1,81 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  # Test cases from https://docs.pgvecto.rs/use-cases/hybrid-search.html
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE EXTENSION vectors;
+
+    CREATE TABLE items (
+      id bigserial PRIMARY KEY,
+      content text NOT NULL,
+      embedding vectors.vector(3) NOT NULL -- 3 dimensions
+    );
+
+    INSERT INTO items (content, embedding) VALUES
+      ('a fat cat sat on a mat and ate a fat rat', '[1, 2, 3]'),
+      ('a fat dog sat on a mat and ate a fat rat', '[4, 5, 6]'),
+      ('a thin cat sat on a mat and ate a thin rat', '[7, 8, 9]'),
+      ('a thin dog sat on a mat and ate a thin rat', '[10, 11, 12]');
+  '';
+
+  makeTestFor =
+    postgresqlPackage:
+    makeTest {
+      name = "pgvecto-rs-${postgresqlPackage.name}";
+      meta = with lib.maintainers; {
+        maintainers = [ diogotcorreia ];
+      };
+
+      nodes.machine =
+        { ... }:
+        {
+          services.postgresql = {
+            enable = true;
+            package = postgresqlPackage;
+            extraPlugins =
+              ps: with ps; [
+                pgvecto-rs
+              ];
+            settings.shared_preload_libraries = "vectors";
+          };
+        };
+
+      testScript =
+        { nodes, ... }:
+        let
+          inherit (nodes.machine.services.postgresql.package.pkgs) pgvecto-rs;
+        in
+        ''
+          def check_count(statement, lines):
+              return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
+                  statement, lines
+              )
+
+
+          machine.start()
+          machine.wait_for_unit("postgresql")
+
+          with subtest("Postgresql with extension vectors is available just after unit start"):
+              machine.succeed(check_count("SELECT * FROM pg_available_extensions WHERE name = 'vectors' AND default_version = '${pgvecto-rs.version}';", 1))
+
+          machine.succeed("sudo -u postgres psql -f ${test-sql}")
+
+          machine.succeed(check_count("SELECT content, embedding FROM items WHERE to_tsvector('english', content) @@ 'cat & rat'::tsquery;", 2))
+
+          machine.shutdown()
+        '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.pgvecto-rs.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/postgresql-jit.nix

@@ -0,0 +1,58 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "postgresql-jit-${package.name}";
+      meta.maintainers = with lib.maintainers; [ ma27 ];
+
+      nodes.machine =
+        { pkgs, ... }:
+        {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            enableJIT = true;
+            initialScript = pkgs.writeText "init.sql" ''
+              create table demo (id int);
+              insert into demo (id) select generate_series(1, 5);
+            '';
+          };
+        };
+
+      testScript = ''
+        machine.start()
+        machine.wait_for_unit("postgresql.service")
+
+        with subtest("JIT is enabled"):
+            machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
+
+        with subtest("Test JIT works fine"):
+            output = machine.succeed(
+                "cat ${pkgs.writeText "test.sql" ''
+                  set jit_above_cost = 1;
+                  EXPLAIN ANALYZE SELECT CONCAT('jit result = ', SUM(id)) FROM demo;
+                  SELECT CONCAT('jit result = ', SUM(id)) from demo;
+                ''} | sudo -u postgres psql"
+            )
+            assert "JIT:" in output
+            assert "jit result = 15" in output
+
+        machine.shutdown()
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (n: _: lib.hasSuffix "_jit" n) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -0,0 +1,135 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  runWithOpenSSL =
+    file: cmd:
+    pkgs.runCommand file {
+      buildInputs = [ pkgs.openssl ];
+    } cmd;
+  caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+  caCert = runWithOpenSSL "ca.crt" ''
+    openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
+  '';
+  serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+  serverKeyPath = "/var/lib/postgresql";
+  serverCert = runWithOpenSSL "server.crt" ''
+    openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
+    openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
+      -CAcreateserial -out $out -days 36500 -sha256
+  '';
+  clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
+  clientCert = runWithOpenSSL "client.crt" ''
+    openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
+    openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
+      -CAcreateserial -out $out -days 36500 -sha256
+  '';
+  clientKeyPath = "/root";
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "postgresql-tls-client-cert-${package.name}";
+      meta.maintainers = with lib.maintainers; [ erictapen ];
+
+      nodes.server =
+        { ... }:
+        {
+          system.activationScripts = {
+            keyPlacement.text = ''
+              mkdir -p '${serverKeyPath}'
+              cp '${serverKey}' '${serverKeyPath}/server.key'
+              chown postgres:postgres '${serverKeyPath}/server.key'
+              chmod 600 '${serverKeyPath}/server.key'
+            '';
+          };
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            enableTCPIP = true;
+            ensureUsers = [
+              {
+                name = "test";
+                ensureDBOwnership = true;
+              }
+            ];
+            ensureDatabases = [ "test" ];
+            settings = {
+              ssl = "on";
+              ssl_ca_file = toString caCert;
+              ssl_cert_file = toString serverCert;
+              ssl_key_file = "${serverKeyPath}/server.key";
+            };
+            authentication = ''
+              hostssl test test ::/0 cert clientcert=verify-full
+            '';
+          };
+          networking = {
+            interfaces.eth1 = {
+              ipv6.addresses = [
+                {
+                  address = "fc00::1";
+                  prefixLength = 120;
+                }
+              ];
+            };
+            firewall.allowedTCPPorts = [ 5432 ];
+          };
+        };
+
+      nodes.client =
+        { ... }:
+        {
+          system.activationScripts = {
+            keyPlacement.text = ''
+              mkdir -p '${clientKeyPath}'
+              cp '${clientKey}' '${clientKeyPath}/client.key'
+              chown root:root '${clientKeyPath}/client.key'
+              chmod 600 '${clientKeyPath}/client.key'
+            '';
+          };
+          environment = {
+            variables = {
+              PGHOST = "db.test.example";
+              PGPORT = "5432";
+              PGDATABASE = "test";
+              PGUSER = "test";
+              PGSSLMODE = "verify-full";
+              PGSSLCERT = clientCert;
+              PGSSLKEY = "${clientKeyPath}/client.key";
+              PGSSLROOTCERT = caCert;
+            };
+            systemPackages = [ package ];
+          };
+          networking = {
+            interfaces.eth1 = {
+              ipv6.addresses = [
+                {
+                  address = "fc00::2";
+                  prefixLength = 120;
+                }
+              ];
+            };
+            hosts = {
+              "fc00::1" = [ "db.test.example" ];
+            };
+          };
+        };
+
+      testScript = ''
+        server.wait_for_unit("multi-user.target")
+        client.wait_for_unit("multi-user.target")
+        client.succeed("psql -c \"SELECT 1;\"")
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -0,0 +1,115 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    let
+      postgresqlDataDir = "/var/lib/postgresql/${package.psqlSchema}";
+      replicationUser = "wal_receiver_user";
+      replicationSlot = "wal_receiver_slot";
+      replicationConn = "postgresql://${replicationUser}@localhost";
+      baseBackupDir = "/var/cache/wals/pg_basebackup";
+      walBackupDir = "/var/cache/wals/pg_wal";
+      recoveryFile = pkgs.writeTextDir "recovery.signal" "";
+    in
+    makeTest {
+      name = "postgresql-wal-receiver-${package.name}";
+      meta.maintainers = with lib.maintainers; [ pacien ];
+
+      nodes.machine =
+        { ... }:
+        {
+          systemd.tmpfiles.rules = [
+            "d /var/cache/wals 0750 postgres postgres - -"
+          ];
+
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            settings = {
+              max_replication_slots = 10;
+              max_wal_senders = 10;
+              recovery_end_command = "touch recovery.done";
+              restore_command = "cp ${walBackupDir}/%f %p";
+              wal_level = "archive"; # alias for replica on pg >= 9.6
+            };
+            authentication = ''
+              host replication ${replicationUser} all trust
+            '';
+            initialScript = pkgs.writeText "init.sql" ''
+              create user ${replicationUser} replication;
+              select * from pg_create_physical_replication_slot('${replicationSlot}');
+            '';
+          };
+
+          services.postgresqlWalReceiver.receivers.main = {
+            postgresqlPackage = package;
+            connection = replicationConn;
+            slot = replicationSlot;
+            directory = walBackupDir;
+          };
+          # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
+          # default 60sec is fine for real system, but is too much for a test
+          systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+          systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
+        };
+
+      testScript = ''
+        # make an initial base backup
+        machine.wait_for_unit("postgresql")
+        machine.wait_for_unit("postgresql-wal-receiver-main")
+        # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
+        # required only for 9.4
+        machine.sleep(5)
+        machine.succeed(
+            "${package}/bin/pg_basebackup --dbname=${replicationConn} --pgdata=${baseBackupDir}"
+        )
+
+        # create a dummy table with 100 records
+        machine.succeed(
+            "sudo -u postgres psql --command='create table dummy as select * from generate_series(1, 100) as val;'"
+        )
+
+        # stop postgres and destroy data
+        machine.systemctl("stop postgresql")
+        machine.systemctl("stop postgresql-wal-receiver-main")
+        machine.succeed("rm -r ${postgresqlDataDir}/{base,global,pg_*}")
+
+        # restore the base backup
+        machine.succeed(
+            "cp -r ${baseBackupDir}/* ${postgresqlDataDir} && chown postgres:postgres -R ${postgresqlDataDir}"
+        )
+
+        # prepare WAL and recovery
+        machine.succeed("chmod a+rX -R ${walBackupDir}")
+        machine.execute(
+            "for part in ${walBackupDir}/*.partial; do mv $part ''${part%%.*}; done"
+        )  # make use of partial segments too
+        machine.succeed(
+            "cp ${recoveryFile}/* ${postgresqlDataDir}/ && chmod 666 ${postgresqlDataDir}/recovery*"
+        )
+
+        # replay WAL
+        machine.systemctl("start postgresql")
+        machine.wait_for_file("${postgresqlDataDir}/recovery.done")
+        machine.systemctl("restart postgresql")
+        machine.wait_for_unit("postgresql")
+
+        # check that our records have been restored
+        machine.succeed(
+            "test $(sudo -u postgres psql --pset='pager=off' --tuples-only --command='select count(distinct val) from dummy;') -eq 100"
+        )
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/postgresql.nix

@@ -0,0 +1,244 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    lib.recurseIntoAttrs {
+      postgresql = makeTestForWithBackupAll package false;
+      postgresql-backup-all = makeTestForWithBackupAll package true;
+      postgresql-clauses = makeEnsureTestFor package;
+    };
+
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
+    CREATE TABLE sth (
+      id int
+    );
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    CREATE TABLE xmltest ( doc xml );
+    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
+  '';
+
+  makeTestForWithBackupAll =
+    package: backupAll:
+    makeTest {
+      name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
+      meta = with lib.maintainers; {
+        maintainers = [ zagy ];
+      };
+
+      nodes.machine =
+        { ... }:
+        {
+          services.postgresql = {
+            inherit (package) ;
+            enable = true;
+          };
+
+          services.postgresqlBackup = {
+            enable = true;
+            databases = lib.optional (!backupAll) "postgres";
+          };
+        };
+
+      testScript =
+        let
+          backupName = if backupAll then "all" else "postgres";
+          backupService = if backupAll then "postgresqlBackup" else "postgresqlBackup-postgres";
+          backupFileBase = "/var/backup/postgresql/${backupName}";
+        in
+        ''
+          def check_count(statement, lines):
+              return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
+                  statement, lines
+              )
+
+
+          machine.start()
+          machine.wait_for_unit("postgresql")
+
+          with subtest("Postgresql is available just after unit start"):
+              machine.succeed(
+                  "cat ${test-sql} | sudo -u postgres psql"
+              )
+
+          with subtest("Postgresql survives restart (bug #1735)"):
+              machine.shutdown()
+              import time
+              time.sleep(2)
+              machine.start()
+              machine.wait_for_unit("postgresql")
+
+          machine.fail(check_count("SELECT * FROM sth;", 3))
+          machine.succeed(check_count("SELECT * FROM sth;", 5))
+          machine.fail(check_count("SELECT * FROM sth;", 4))
+          machine.succeed(check_count("SELECT xpath('/test/text()', doc) FROM xmltest;", 1))
+
+          with subtest("Backup service works"):
+              machine.succeed(
+                  "systemctl start ${backupService}.service",
+                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                  "ls -hal /var/backup/postgresql/ >/dev/console",
+                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+              )
+          with subtest("Backup service removes prev files"):
+              machine.succeed(
+                  # Create dummy prev files.
+                  "touch ${backupFileBase}.prev.sql{,.gz,.zstd}",
+                  "chown postgres:postgres ${backupFileBase}.prev.sql{,.gz,.zstd}",
+
+                  # Run backup.
+                  "systemctl start ${backupService}.service",
+                  "ls -hal /var/backup/postgresql/ >/dev/console",
+
+                  # Since nothing has changed in the database, the cur and prev files
+                  # should match.
+                  "zcat ${backupFileBase}.sql.gz | grep '<test>ok</test>'",
+                  "cmp ${backupFileBase}.sql.gz ${backupFileBase}.prev.sql.gz",
+
+                  # The prev files with unused suffix should be removed.
+                  "[ ! -f '${backupFileBase}.prev.sql' ]",
+                  "[ ! -f '${backupFileBase}.prev.sql.zstd' ]",
+
+                  # Both cur and prev file should only be accessible by the postgres user.
+                  "stat -c '%a' ${backupFileBase}.sql.gz | grep 600",
+                  "stat -c '%a' '${backupFileBase}.prev.sql.gz' | grep 600",
+              )
+          with subtest("Backup service fails gracefully"):
+              # Sabotage the backup process
+              machine.succeed("rm /run/postgresql/.s.PGSQL.5432")
+              machine.fail(
+                  "systemctl start ${backupService}.service",
+              )
+              machine.succeed(
+                  "ls -hal /var/backup/postgresql/ >/dev/console",
+                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+                  "stat ${backupFileBase}.in-progress.sql.gz",
+              )
+              # In a previous version, the second run would overwrite prev.sql.gz,
+              # so we test a second run as well.
+              machine.fail(
+                  "systemctl start ${backupService}.service",
+              )
+              machine.succeed(
+                  "stat ${backupFileBase}.in-progress.sql.gz",
+                  "zcat ${backupFileBase}.prev.sql.gz | grep '<test>ok</test>'",
+              )
+
+
+          with subtest("Initdb works"):
+              machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
+
+          machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+
+          machine.shutdown()
+        '';
+    };
+
+  makeEnsureTestFor =
+    package:
+    makeTest {
+      name = "postgresql-clauses-${package.name}";
+      meta = with lib.maintainers; {
+        maintainers = [ zagy ];
+      };
+
+      nodes.machine =
+        { ... }:
+        {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            ensureUsers = [
+              {
+                name = "all-clauses";
+                ensureClauses = {
+                  superuser = true;
+                  createdb = true;
+                  createrole = true;
+                  "inherit" = true;
+                  login = true;
+                  replication = true;
+                  bypassrls = true;
+                };
+              }
+              {
+                name = "default-clauses";
+              }
+            ];
+          };
+        };
+
+      testScript =
+        let
+          getClausesQuery =
+            user:
+            lib.concatStringsSep " " [
+              "SELECT row_to_json(row)"
+              "FROM ("
+              "SELECT"
+              "rolsuper,"
+              "rolinherit,"
+              "rolcreaterole,"
+              "rolcreatedb,"
+              "rolcanlogin,"
+              "rolreplication,"
+              "rolbypassrls"
+              "FROM pg_roles"
+              "WHERE rolname = '${user}'"
+              ") row;"
+            ];
+        in
+        ''
+          import json
+          machine.start()
+          machine.wait_for_unit("postgresql")
+
+          with subtest("All user permissions are set according to the ensureClauses attr"):
+              clauses = json.loads(
+                machine.succeed(
+                    "sudo -u postgres psql -tc \"${getClausesQuery "all-clauses"}\""
+                )
+              )
+              print(clauses)
+              assert clauses['rolsuper'], 'expected user with clauses to have superuser clause'
+              assert clauses['rolinherit'], 'expected user with clauses to have inherit clause'
+              assert clauses['rolcreaterole'], 'expected user with clauses to have create role clause'
+              assert clauses['rolcreatedb'], 'expected user with clauses to have create db clause'
+              assert clauses['rolcanlogin'], 'expected user with clauses to have login clause'
+              assert clauses['rolreplication'], 'expected user with clauses to have replication clause'
+              assert clauses['rolbypassrls'], 'expected user with clauses to have bypassrls clause'
+
+          with subtest("All user permissions default when ensureClauses is not provided"):
+              clauses = json.loads(
+                machine.succeed(
+                    "sudo -u postgres psql -tc \"${getClausesQuery "default-clauses"}\""
+                )
+              )
+              assert not clauses['rolsuper'], 'expected user with no clauses set to have default superuser clause'
+              assert clauses['rolinherit'], 'expected user with no clauses set to have default inherit clause'
+              assert not clauses['rolcreaterole'], 'expected user with no clauses set to have default create role clause'
+              assert not clauses['rolcreatedb'], 'expected user with no clauses set to have default create db clause'
+              assert clauses['rolcanlogin'], 'expected user with no clauses set to have default login clause'
+              assert not clauses['rolreplication'], 'expected user with no clauses set to have default replication clause'
+              assert not clauses['rolbypassrls'], 'expected user with no clauses set to have default bypassrls clause'
+
+          machine.shutdown()
+        '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/timescaledb.nix

@@ -0,0 +1,100 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  test-sql = pkgs.writeText "postgresql-test" ''
+    CREATE EXTENSION timescaledb;
+    CREATE EXTENSION timescaledb_toolkit;
+
+    CREATE TABLE sth (
+      time TIMESTAMPTZ NOT NULL,
+      value DOUBLE PRECISION
+    );
+
+    SELECT create_hypertable('sth', 'time');
+
+    INSERT INTO sth (time, value) VALUES
+    ('2003-04-12 04:05:06 America/New_York', 1.0),
+    ('2003-04-12 04:05:07 America/New_York', 2.0),
+    ('2003-04-12 04:05:08 America/New_York', 3.0),
+    ('2003-04-12 04:05:09 America/New_York', 4.0),
+    ('2003-04-12 04:05:10 America/New_York', 5.0)
+    ;
+
+    WITH t AS (
+      SELECT
+        time_bucket('1 day'::interval, time) AS dt,
+        stats_agg(value) AS stats
+      FROM sth
+      GROUP BY time_bucket('1 day'::interval, time)
+    )
+    SELECT
+      average(stats)
+    FROM t;
+
+    SELECT * FROM sth;
+  '';
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "timescaledb-${package.name}";
+      meta = with lib.maintainers; {
+        maintainers = [ typetetris ];
+      };
+
+      nodes.machine =
+        { ... }:
+        {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extraPlugins =
+              ps: with ps; [
+                timescaledb
+                timescaledb_toolkit
+              ];
+            settings = {
+              shared_preload_libraries = "timescaledb, timescaledb_toolkit";
+            };
+          };
+        };
+
+      testScript = ''
+        def check_count(statement, lines):
+            return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
+                statement, lines
+            )
+
+
+        machine.start()
+        machine.wait_for_unit("postgresql")
+
+        with subtest("Postgresql with extensions timescaledb and timescaledb_toolkit is available just after unit start"):
+            machine.succeed(
+                "sudo -u postgres psql -f ${test-sql}"
+            )
+
+        machine.fail(check_count("SELECT * FROM sth;", 3))
+        machine.succeed(check_count("SELECT * FROM sth;", 5))
+        machine.fail(check_count("SELECT * FROM sth;", 4))
+
+        machine.shutdown()
+      '';
+    };
+in
+# Not run by default, because this requires allowUnfree.
+# To run these tests:
+#   NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.postgresql.timescaledb
+lib.dontRecurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.timescaledb.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/tsja.nix

@@ -0,0 +1,50 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "tsja-${package.name}";
+      meta = {
+        maintainers = with lib.maintainers; [ chayleaf ];
+      };
+
+      nodes.master =
+        { ... }:
+        {
+          services.postgresql = {
+            inherit package;
+            enable = true;
+            extraPlugins =
+              ps: with ps; [
+                tsja
+              ];
+          };
+        };
+
+      testScript = ''
+        start_all()
+        master.wait_for_unit("postgresql")
+        master.succeed("sudo -u postgres psql -f /run/current-system/sw/share/postgresql/extension/libtsja_dbinit.sql")
+        # make sure "日本語" is parsed as a separate lexeme
+        master.succeed("""
+          sudo -u postgres \\
+            psql -c "SELECT * FROM ts_debug('japanese', 'PostgreSQLで日本語のテキスト検索ができます。')" \\
+              | grep "{日本語}"
+        """)
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.tsja.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/postgresql/wal2json.nix

@@ -0,0 +1,52 @@
+{
+  pkgs,
+  makeTest,
+}:
+
+let
+  inherit (pkgs) lib;
+
+  makeTestFor =
+    package:
+    makeTest {
+      name = "wal2json-${package.name}";
+      meta.maintainers = with pkgs.lib.maintainers; [ euank ];
+
+      nodes.machine = {
+        services.postgresql = {
+          inherit package;
+          enable = true;
+          extraPlugins = with package.pkgs; [ wal2json ];
+          settings = {
+            wal_level = "logical";
+            max_replication_slots = "10";
+            max_wal_senders = "10";
+          };
+        };
+      };
+
+      testScript = ''
+        machine.wait_for_unit("postgresql")
+        machine.succeed(
+            "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
+        )
+        machine.succeed(
+            "diff ${./wal2json/example2.out} /tmp/example2.out"
+        )
+        machine.succeed(
+            "sudo -u postgres psql -qAt -f ${./wal2json/example3.sql} postgres > /tmp/example3.out"
+        )
+        machine.succeed(
+            "diff ${./wal2json/example3.out} /tmp/example3.out"
+        )
+      '';
+    };
+in
+lib.recurseIntoAttrs (
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: !p.pkgs.wal2json.meta.broken) pkgs.postgresqlVersions
+  )
+  // {
+    passthru.override = p: makeTestFor p;
+  }
+)

nixos/tests/timescaledb.nix

@@ -1,93 +0,0 @@
-# mostly copied from ./postgresql.nix as it seemed unapproriate to
-# test additional extensions for postgresql there.
-
-{ system ? builtins.currentSystem
-, config ? { }
-, pkgs ? import ../.. { inherit system config; }
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
-  postgresql-versions = import ../../pkgs/servers/sql/postgresql pkgs;
-  test-sql = pkgs.writeText "postgresql-test" ''
-    CREATE EXTENSION timescaledb;
-    CREATE EXTENSION timescaledb_toolkit;
-
-    CREATE TABLE sth (
-      time TIMESTAMPTZ NOT NULL,
-      value DOUBLE PRECISION
-    );
-
-    SELECT create_hypertable('sth', 'time');
-
-    INSERT INTO sth (time, value) VALUES
-    ('2003-04-12 04:05:06 America/New_York', 1.0),
-    ('2003-04-12 04:05:07 America/New_York', 2.0),
-    ('2003-04-12 04:05:08 America/New_York', 3.0),
-    ('2003-04-12 04:05:09 America/New_York', 4.0),
-    ('2003-04-12 04:05:10 America/New_York', 5.0)
-    ;
-
-    WITH t AS (
-      SELECT
-        time_bucket('1 day'::interval, time) AS dt,
-        stats_agg(value) AS stats
-      FROM sth
-      GROUP BY time_bucket('1 day'::interval, time)
-    )
-    SELECT
-      average(stats)
-    FROM t;
-  '';
-  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
-    name = postgresql-name;
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ typetetris ];
-    };
-
-    nodes.machine = { ... }:
-      {
-        services.postgresql = {
-          enable = true;
-          package = postgresql-package;
-          extraPlugins = ps: with ps; [
-            timescaledb
-            timescaledb_toolkit
-          ];
-          settings = { shared_preload_libraries = "timescaledb, timescaledb_toolkit"; };
-        };
-      };
-
-    testScript = ''
-      def check_count(statement, lines):
-          return 'test $(sudo -u postgres psql postgres -tAc "{}"|wc -l) -eq {}'.format(
-              statement, lines
-          )
-
-
-      machine.start()
-      machine.wait_for_unit("postgresql")
-
-      with subtest("Postgresql with extensions timescaledb and timescaledb_toolkit is available just after unit start"):
-          machine.succeed(
-              "sudo -u postgres psql -f ${test-sql}"
-          )
-
-      machine.fail(check_count("SELECT * FROM sth;", 3))
-      machine.succeed(check_count("SELECT * FROM sth;", 5))
-      machine.fail(check_count("SELECT * FROM sth;", 4))
-
-      machine.shutdown()
-    '';
-
-  };
-  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "14") postgresql-versions;
-in
-mapAttrs'
-  (name: package: {
-    inherit name;
-    value = make-postgresql-test name package;
-  })
-  applicablePostgresqlVersions

nixos/tests/tsja.nix

@@ -1,32 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ...} : {
-  name = "tsja";
-  meta = {
-    maintainers = with lib.maintainers; [ chayleaf ];
-  };
-
-  nodes = {
-    master =
-      { config, ... }:
-
-      {
-        services.postgresql = {
-          enable = true;
-          extraPlugins = ps: with ps; [
-            tsja
-          ];
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-    master.wait_for_unit("postgresql")
-    master.succeed("sudo -u postgres psql -f /run/current-system/sw/share/postgresql/extension/libtsja_dbinit.sql")
-    # make sure "日本語" is parsed as a separate lexeme
-    master.succeed("""
-      sudo -u postgres \\
-        psql -c "SELECT * FROM ts_debug('japanese', 'PostgreSQLで日本語のテキスト検索ができます。')" \\
-          | grep "{日本語}"
-    """)
-  '';
-})

pkgs/applications/virtualization/virt-manager/default.nix

@@ -97,6 +97,7 @@ python3.pkgs.buildPythonApplication rec {
     "test_misc_nonpredicatble_generate"
     "test_disk_dir_searchable"  # does something strange with permissions
     "testCLI0001virt_install_many_devices"  # expects /var to exist
+    "testCLI0263virt_xml"  # depends on a specific libvirt version
   ];
 
   preCheck = ''

pkgs/by-name/cf/cfn-nag/Gemfile

@@ -1,5 +1,5 @@
-# frozen_string_literal: true
-
 source 'https://rubygems.org'
-
+gem 'cfn-nag'
-gemspec
+gem 'logger'
+gem 'ostruct'
+gem 'syslog'

pkgs/by-name/cf/cfn-nag/Gemfile.lock

@@ -1,6 +1,25 @@
-PATH
+GEM
-  remote: .
+  remote: https://rubygems.org/
   specs:
+    aws-eventstream (1.3.0)
+    aws-partitions (1.1001.0)
+    aws-sdk-core (3.211.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-kms (1.95.0)
+      aws-sdk-core (~> 3, >= 3.210.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.169.0)
+      aws-sdk-core (~> 3, >= 3.210.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.10.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    cfn-model (0.6.6)
+      kwalify (= 0.7.2)
+      psych (~> 3)
     cfn-nag (0.8.10)
       aws-sdk-s3 (~> 1.76)
       cfn-model (= 0.6.6)
@@ -9,98 +28,30 @@ PATH
       netaddr (~> 2.0.4)
       optimist (~> 3.0.0)
       rexml
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    ast (2.4.2)
-    aws-eventstream (1.3.0)
-    aws-partitions (1.982.0)
-    aws-sdk-core (3.209.1)
-      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.9)
-      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.94.0)
-      aws-sdk-core (~> 3, >= 3.207.0)
-      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.166.0)
-      aws-sdk-core (~> 3, >= 3.207.0)
-      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.10.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-    cfn-model (0.6.6)
-      kwalify (= 0.7.2)
-      psych (~> 3)
-    diff-lcs (1.5.1)
-    docile (1.4.1)
     jmespath (1.6.2)
-    json (2.7.2)
     kwalify (0.7.2)
-    language_server-protocol (3.17.0.3)
     lightly (0.3.3)
     little-plugger (1.1.4)
+    logger (1.6.1)
     logging (2.2.2)
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
     multi_json (1.15.0)
     netaddr (2.0.6)
     optimist (3.0.1)
-    parallel (1.26.3)
+    ostruct (0.6.0)
-    parser (3.3.5.0)
-      ast (~> 2.4.1)
-      racc
     psych (3.3.4)
-    racc (1.8.1)
+    rexml (3.3.9)
-    rainbow (3.1.1)
+    syslog (0.1.2)
-    rake (13.2.1)
-    regexp_parser (2.9.2)
-    rexml (3.3.8)
-    rspec (3.13.0)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.1)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.1)
-    rubocop (1.66.1)
-      json (~> 2.3)
-      language_server-protocol (>= 3.17.0)
-      parallel (~> 1.10)
-      parser (>= 3.3.0.2)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.4, < 3.0)
-      rubocop-ast (>= 1.32.2, < 2.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.32.3)
-      parser (>= 3.3.1.0)
-    ruby-progressbar (1.13.0)
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.1)
-    simplecov_json_formatter (0.1.4)
-    unicode-display_width (2.6.0)
 
 PLATFORMS
-  arm64-darwin-23
   ruby
 
 DEPENDENCIES
-  cfn-nag!
+  cfn-nag
-  rake
+  logger
-  rspec (~> 3.4)
+  ostruct
-  rubocop
+  syslog
-  simplecov (~> 0.21)
 
 BUNDLED WITH
-   2.5.11
+   2.3.27

pkgs/by-name/cf/cfn-nag/gemset.nix

@@ -1,17 +1,4 @@
 {
-  ast = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "04nc8x27hlzlrr5c2gn7mar4vdr0apw5xg22wp6m8dx3wqr04a0y";
-      type = "gem";
-    };
-    version = "2.4.2";
-  };
   aws-eventstream = {
     groups = [ "default" ];
     platforms = [ ];
@@ -27,10 +14,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "075y2zwfqwg7qb7w34bfvp8dkjcmiz6hx5a3rbhpqglnlkav7ir4";
+      sha256 = "01w3b84d129q9b6bg2cm8p4cn8pl74l343sxsc47ax9sglqz6y99";
       type = "gem";
     };
-    version = "1.982.0";
+    version = "1.1001.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -43,10 +30,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06mrp7g24ndg55w85ndyrvxfx2v6hnkh5fj32w9s6w3xsc8v5kqq";
+      sha256 = "16mvscjhxdyhlvk2rpbxdzqmyikcf64xavb35grk4dkh0pg390rk";
       type = "gem";
     };
-    version = "3.209.1";
+    version = "3.211.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -57,10 +44,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1acx3bhqkhni3kbl7xnjdgy8raq5y7p0zyniq61bsihzkwcj7imh";
+      sha256 = "0ppxhw2qyj69achpmksp1sh2y6k0x44928ln2am9pifx8b30ir9a";
       type = "gem";
     };
-    version = "1.94.0";
+    version = "1.95.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -72,10 +59,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zpww3lxpjg8smmznz2nbx5hrpnkzflbasllxjwprkqr56rrrjap";
+      sha256 = "1jnf9k9d91ki3yvy12q4kph5wvd8l3ziwwh0qsmar5xhyb7zbwrz";
       type = "gem";
     };
-    version = "1.166.0";
+    version = "1.169.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -83,10 +70,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "176zh13m1vhwgys0drlqiw79ljmmx84vva036shsb7rzr4yi36qm";
+      sha256 = "1fq3lbvkgm1vk5wa8l7vdnq3vjnlmsnyf4bbd0jq3qadyd9hf54a";
       type = "gem";
     };
-    version = "1.10.0";
+    version = "1.10.1";
   };
   cfn-model = {
     dependencies = [
@@ -115,37 +102,12 @@
     groups = [ "default" ];
     platforms = [ ];
     source = {
-      path = ./.;
+      remotes = [ "https://rubygems.org" ];
-      type = "path";
+      sha256 = "0cyk4pimz1g5lqf4vw2p9kf8ji3v53zfi8jix8sgz4ndy81ylah5";
+      type = "gem";
     };
     version = "0.8.10";
   };
-  diff-lcs = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1znxccz83m4xgpd239nyqxlifdb7m8rlfayk6s259186nkgj6ci7";
-      type = "gem";
-    };
-    version = "1.5.1";
-  };
-  docile = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "07pj4z3h8wk4fgdn6s62vw1lwvhj0ac0x10vfbdkr9xzk7krn5cn";
-      type = "gem";
-    };
-    version = "1.4.1";
-  };
   jmespath = {
     groups = [ "default" ];
     platforms = [ ];
@@ -156,19 +118,6 @@
     };
     version = "1.6.2";
   };
-  json = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0b4qsi8gay7ncmigr0pnbxyb17y3h8kavdyhsh7nrlqwr35vb60q";
-      type = "gem";
-    };
-    version = "2.7.2";
-  };
   kwalify = {
     groups = [ "default" ];
     platforms = [ ];
@@ -179,19 +128,6 @@
     };
     version = "0.7.2";
   };
-  language_server-protocol = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gvb1j8xsqxms9mww01rmdl78zkd72zgxaap56bhv8j45z05hp1x";
-      type = "gem";
-    };
-    version = "3.17.0.3";
-  };
   lightly = {
     groups = [ "default" ];
     platforms = [ ];
@@ -212,6 +148,16 @@
     };
     version = "1.1.4";
   };
+  logger = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
   logging = {
     dependencies = [
       "little-plugger"
@@ -256,35 +202,15 @@
     };
     version = "3.0.1";
   };
-  parallel = {
+  ostruct = {
-    groups = [
+    groups = [ "default" ];
-      "default"
-      "development"
-    ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vy7sjs2pgz4i96v5yk9b7aafbffnvq7nn419fgvw55qlavsnsyq";
+      sha256 = "11dsv71gfbhy92yzj3xkckjzdai2bsz5a4fydgimv62dkz4kc5rv";
       type = "gem";
     };
-    version = "1.26.3";
+    version = "0.6.0";
-  };
-  parser = {
-    dependencies = [
-      "ast"
-      "racc"
-    ];
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cqs31cyg2zp8yx2zzm3zkih0j93q870wasbviy2w343nxqvn3pk";
-      type = "gem";
-    };
-    version = "3.3.5.0";
   };
   psych = {
     groups = [ "default" ];
@@ -296,241 +222,24 @@
     };
     version = "3.3.4";
   };
-  racc = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
-      type = "gem";
-    };
-    version = "1.8.1";
-  };
-  rainbow = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
-      type = "gem";
-    };
-    version = "3.1.1";
-  };
-  rake = {
-    groups = [ "development" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
-      type = "gem";
-    };
-    version = "13.2.1";
-  };
-  regexp_parser = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ik40vcv7mqigsfpqpca36hpmnx0536xa825ai5qlkv3mmkyf9ss";
-      type = "gem";
-    };
-    version = "2.9.2";
-  };
   rexml = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rr145mvjgc4n28lfy0gw87aw3ab680h83bdi5i102ik8mixk3zn";
+      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
       type = "gem";
     };
-    version = "3.3.8";
+    version = "3.3.9";
   };
-  rspec = {
+  syslog = {
-    dependencies = [
+    groups = [ "default" ];
-      "rspec-core"
-      "rspec-expectations"
-      "rspec-mocks"
-    ];
-    groups = [ "development" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14xrp8vq6i9zx37vh0yp4h9m0anx9paw200l1r5ad9fmq559346l";
+      sha256 = "12xqgjrnjpc1c7shajyz2h96bw2nlgb4lkaypj58dp6rch7s36sr";
       type = "gem";
     };
-    version = "3.13.0";
+    version = "0.1.2";
-  };
-  rspec-core = {
-    dependencies = [ "rspec-support" ];
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0s688wfw77fjldzayvczg8bgwcgh6bh552dw7qcj1rhjk3r4zalx";
-      type = "gem";
-    };
-    version = "3.13.1";
-  };
-  rspec-expectations = {
-    dependencies = [
-      "diff-lcs"
-      "rspec-support"
-    ];
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0n3cyrhsa75x5wwvskrrqk56jbjgdi2q1zx0irllf0chkgsmlsqf";
-      type = "gem";
-    };
-    version = "3.13.3";
-  };
-  rspec-mocks = {
-    dependencies = [
-      "diff-lcs"
-      "rspec-support"
-    ];
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0f3vgp43hajw716vmgjv6f4ar6f97zf50snny6y3fy9kkj4qjw88";
-      type = "gem";
-    };
-    version = "3.13.1";
-  };
-  rspec-support = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "03z7gpqz5xkw9rf53835pa8a9vgj4lic54rnix9vfwmp2m7pv1s8";
-      type = "gem";
-    };
-    version = "3.13.1";
-  };
-  rubocop = {
-    dependencies = [
-      "json"
-      "language_server-protocol"
-      "parallel"
-      "parser"
-      "rainbow"
-      "regexp_parser"
-      "rubocop-ast"
-      "ruby-progressbar"
-      "unicode-display_width"
-    ];
-    groups = [ "development" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rsyxrl647bz49gpa4flh8igg6wy7qxyh2jrp01x0kqnn5iw4y86";
-      type = "gem";
-    };
-    version = "1.66.1";
-  };
-  rubocop-ast = {
-    dependencies = [ "parser" ];
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "03zywfpm4540q6hw8srhi8pzp0gg51w65ir8jkaw58vk3j31w820";
-      type = "gem";
-    };
-    version = "1.32.3";
-  };
-  ruby-progressbar = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
-      type = "gem";
-    };
-    version = "1.13.0";
-  };
-  simplecov = {
-    dependencies = [
-      "docile"
-      "simplecov-html"
-      "simplecov_json_formatter"
-    ];
-    groups = [ "development" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "198kcbrjxhhzca19yrdcd6jjj9sb51aaic3b0sc3pwjghg3j49py";
-      type = "gem";
-    };
-    version = "0.22.0";
-  };
-  simplecov-html = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "02zi3rwihp7rlnp9x18c9idnkx7x68w6jmxdhyc0xrhjwrz0pasx";
-      type = "gem";
-    };
-    version = "0.13.1";
-  };
-  simplecov_json_formatter = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0a5l0733hj7sk51j81ykfmlk2vd5vaijlq9d5fn165yyx3xii52j";
-      type = "gem";
-    };
-    version = "0.1.4";
-  };
-  unicode-display_width = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0nkz7fadlrdbkf37m0x7sw8bnz8r355q3vwcfb9f9md6pds9h9qj";
-      type = "gem";
-    };
-    version = "2.6.0";
   };
 }

pkgs/by-name/cf/cfn-nag/package.nix

@@ -17,8 +17,12 @@ bundlerEnv {
   meta = {
     description = "Linting tool for CloudFormation templates";
     homepage = "https://github.com/stelligent/cfn_nag";
+    mainProgram = "cfn_nag";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = with lib.maintainers; [
+      momeemt
+      mathstlouis
+    ];
     platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/cl/clickhouse-backup/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-t9sRhcNKFvTTysornYf/7JQ7mkasTunnzKR4pYCAOk0=";
+    hash = "sha256-431bdyE2MEWwgl9xDVsRHKpjrv/cIjaOQpg25qDlvPk=";
   };
 
-  vendorHash = "sha256-n3rlijycZ5qZtR/e+Z/UPCcr47p4wN3kFgfWr+73WAQ=";
+  vendorHash = "sha256-D1sjizuyHnfNplZtuw3zqRjFl/r1h478N+iGyF2OAyc=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/co/compose2nix/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "compose2nix";
-  version = "0.2.3";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "aksiksi";
     repo = "compose2nix";
     rev = "v${version}";
-    hash = "sha256-qN7MFw6JKBbzwiqURkZ3or/8hT29mRpfITovSHdzDEY=";
+    hash = "sha256-rFnnbRVVv/N5021Al3vmjFAui1cTp8NBZDBNQo8CsXM=";
   };
 
-  vendorHash = "sha256-yGBdsej6DjRMWzS13WyqCLaY5M/N9BrMARAM3oHsc+s=";
+  vendorHash = "sha256-kiUXgbXJg4x89k2SXf/1e1DLB04ETS+Qp2gx8uJA2DU=";
 
   passthru.tests = {
     version = testers.testVersion {

pkgs/by-name/co/containerlab/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "containerlab";
-  version = "0.58.0";
+  version = "0.59.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     rev = "v${version}";
-    hash = "sha256-yToqJnL2T9qTGCl1MgUkg/JSWV/kEibF59lk85tAX44=";
+    hash = "sha256-4YSnAoQkjDpSRBMqYW8D3TzipE5Co892y5PXkcz+8xA=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-Qg6mFd5+Crsn2Xx4yg930Iueo0vfxkzrIHO4vrNFTNc=";
+  vendorHash = "sha256-PJQrQn7QPtUSzdlf2BYY8ARcmH6pzZgpl1oQbc98M4Y=";
 
   ldflags = [
     "-s"

pkgs/by-name/da/dashy-ui/package.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  yq-go,
+  settings ? { },
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dashy-ui";
+  # This is like 3.1.1 but the latest working yarn.lock.
+  # All other changes are for docs with the exception of 768d746cbfcf365c58ad1194c5ccc74c14f3ed3a, which simply adds no-referrer meta tag
+  version = "3.1.1-unstable-2024-07-14";
+  src = fetchFromGitHub {
+    owner = "lissy93";
+    repo = "dashy";
+    rev = "0b1af9db483f80323e782e7834da2a337393e111";
+    hash = "sha256-lRJ3lI9UUIaw9GWPEy81Dbf4cu6rClA4VjdWejVQN+g=";
+  };
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-KVAZIBM47yp1NWYc2esvTwfoAev4q7Wgi0c73PUZRNw=";
+  };
+  # - If no settings are passed, use the default config provided by upstream
+  # - Despite JSON being valid YAML (and the JSON passing the config validator),
+  # there seem to be some issues with JSON in the final build - potentially due to
+  # the way the client parses things
+  # - Instead, we use `yq-go` to convert it to yaml
+  # Config validation needs to happen after yarnConfigHook, since it's what sets the yarn offline cache
+  postYarnConfigHook = lib.optional (settings != { }) ''
+    echo "Writing settings override..."
+    yq --output-format yml '${builtins.toFile "conf.json" ''${builtins.toJSON settings}''}' > user-data/conf.yml
+    yarn validate-config --offline
+  '';
+  installPhase = ''
+    mkdir $out
+    cp -R dist/* $out
+  '';
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+    # For yaml parsing
+    yq-go
+  ];
+  doDist = false;
+  meta = {
+    description = "dashy";
+    homepage = "https://dashy.to";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.therealgramdalf ];
+  };
+})

pkgs/by-name/db/dbmate/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.21.0";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RX8ocfXHoo1imjx7SRml6Ao6KjNK7xp43pVmth2zfPc=";
+    hash = "sha256-stemIBwUYW1TsDUBrgQLq858kPBiaHaXaRIr65lnWQo=";
   };
 
-  vendorHash = "sha256-lov0Ye+pmI5eyILepN87okZDDA9OPz4cTzK1KluHQuI=";
+  vendorHash = "sha256-xJIY0vaN7gw/EhqeepKQPhaKISXNNPnaAMbowmHSUz4=";
 
   doCheck = false;
 

pkgs/by-name/do/dotenvx/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.14.2";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SlZ18ToGbC+c5ffuYFGeOy30w90ukBO0qKxD+HNVt3E=";
+    hash = "sha256-i6181Ot40t2IlAGpj0pES9nPFB1dZrcypgs4qLQ05hE=";
   };
 
-  npmDepsHash = "sha256-KaqSCtraMmQHe7Tcs/2CVaQcmazgHkV5K4T64lHEVP4=";
+  npmDepsHash = "sha256-wo+Gtq2gdcIWY0yDzf5vrxEHfFzMfpgIjG+/MBdvz1U=";
 
   dontNpmBuild = true;
 

pkgs/by-name/er/erg/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "erg";
-  version = "0.6.45";
+  version = "0.6.47";
 
   src = fetchFromGitHub {
     owner = "erg-lang";
     repo = "erg";
     rev = "v${version}";
-    hash = "sha256-P6AIe3IadY64ydGShlRmgZ1pITiAA8G59Oe8P2ktDqM=";
+    hash = "sha256-DcoADVQGiCjPgawMLSvH5tCnOCHmykazsRoF1UXbPNs=";
   };
 
-  cargoHash = "sha256-5h/0MqaRmjFkeg50Y7WpEDl+VWpR0d4NnqIzoZHeKZ8=";
+  cargoHash = "sha256-Uzv+hSarIAXRXDZ3sa3zd3Xdo8ZVrDCP+72cAlJOyvw=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/by-name/gl/glfw3/package.nix

@@ -1,8 +1,23 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkg-config
+{ stdenv
-, libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
+, lib
-, darwin, fixDarwinDylibNames
+, fetchFromGitHub
+, cmake
+, pkg-config
+, libGL
+, vulkan-loader
+, libXrandr
+, libXinerama
+, libXcursor
+, libX11
+, libXi
+, libXext
+, darwin
+, fixDarwinDylibNames
 , wayland
-, wayland-scanner, wayland-protocols, libxkbcommon, libdecor
+, wayland-scanner
+, wayland-protocols
+, libxkbcommon
+, libdecor
 , withMinecraftPatch ? false
 }:
 let
@@ -51,6 +66,7 @@ stdenv.mkDerivation {
   ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) [
     "-DCMAKE_C_FLAGS=-D_GLFW_GLX_LIBRARY='\"${lib.getLib libGL}/lib/libGL.so.1\"'"
     "-DCMAKE_C_FLAGS=-D_GLFW_EGL_LIBRARY='\"${lib.getLib libGL}/lib/libEGL.so.1\"'"
+    "-DCMAKE_C_FLAGS=-D_GLFW_VULKAN_LIBRARY='\"${lib.getLib vulkan-loader}/lib/libvulkan.so.1\"'"
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/by-name/go/go-mockery/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.46.0";
+  version = "2.46.3";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-qPE4hzdu5soGVfw6mLJLWvjiXxdkUAT+kpOCWMO1sL8=";
+    sha256 = "sha256-KgQ5EV7tnIZGmM8vrP7Sed2jm7ghgORCgkFR9TOXx6Y=";
   };
 
   preCheck = ''
@@ -24,7 +24,7 @@ buildGoModule rec {
   CGO_ENABLED = false;
 
   proxyVendor = true;
-  vendorHash = "sha256-1SzdVM1Ncpym6bPg1aSyfoAM1YiUGal3Glw0paz+buk=";
+  vendorHash = "sha256-fxh0WaopHKHuOjXXYNmO30/jB1zwtf5HhhtRGnCl7fM=";
 
   subPackages = [ "." ];
 

pkgs/by-name/gt/gtree/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gtree";
-  version = "1.10.11";
+  version = "1.10.12";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
     rev = "v${version}";
-    hash = "sha256-wxN4bvSSeCTPGjIIDLotr0XsiCf0u0GochEo1SPyopM=";
+    hash = "sha256-dtKT2T8GNcR5ux1whFrXgJ08XHJWS76M/wmAtBHDLUI=";
   };
 
-  vendorHash = "sha256-s3GsqrXd84VVGuxY18ielAt0BZGMyl1tNavlD66rWoA=";
+  vendorHash = "sha256-wiPHK5RjMBMLHx3Vv2zWoZc1wWJ1IVxu8dIbO9fPaPQ=";
 
   subPackages = [
     "cmd/gtree"

pkgs/by-name/ja/jan/package.nix

@@ -5,10 +5,10 @@
 
 let
   pname = "jan";
-  version = "0.5.6";
+  version = "0.5.7";
   src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-PkRizjF4RVhCH7YOPABb+SpZlO3aKT5W6b0YBuKTNWk=";
+    hash = "sha256-mWmqvyX9n79uCtCZimU7B1jFE+0Ucwe+RGw0oSQaSB4=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/ja/jasp-desktop/package.nix

@@ -2,9 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   buildEnv,
   linkFarm,
-  substituteAll,
+  replaceVars,
   R,
   rPackages,
   cmake,
@@ -58,10 +59,15 @@ stdenv.mkDerivation {
 
   patches = [
     # remove unused cmake deps, ensure boost is dynamically linked, patch readstat path
-    (substituteAll {
+    (replaceVars ./cmake.patch {
-      src = ./cmake.patch;
       inherit readstat;
     })
+
+    (fetchpatch {
+      name = "fix-qt-6.8-crash.patch";
+      url = "https://github.com/jasp-stats/jasp-desktop/commit/d96a35d262312f72081ac3f96ae8c2ae7c796b0.patch";
+      hash = "sha256-KcsFy1ImPTHwDKN5Umfoa9CbtQn7B3FNu/Srr0dEJGA=";
+    })
   ];
 
   cmakeFlags = [

pkgs/by-name/ki/kine/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kine";
-  version = "0.13.2";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "k3s-io";
     repo = "kine";
     rev = "v${version}";
-    hash = "sha256-KMyO9zZvQFyRaMtQ/d2Zgg6pG1SFIYWkzZgSZIqhiOQ=";
+    hash = "sha256-xct2CkU+EeEfyhZNp1UiLY7kJnv4pbWMA4xgHGQI898=";
   };
 
-  vendorHash = "sha256-kbMwLNBPJwFbUSZdYiWWdIZM8fclHDnRnxTTIXTIuHU=";
+  vendorHash = "sha256-EYtkhB8MZKKh6Rf91Ru/ldnP/iQsAw6W2U82mO/7L+g=";
 
   ldflags = [
     "-s"

pkgs/by-name/ko/komga/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-kn1sjz6sbvoTMB9eEUaDqa+JhgV1Kd/s6muS04VGwsk=";
+    sha256 = "sha256-KUNF6TPqr85rm9XOcoaCGtK8VHfevRFgkl+lTfJEdbA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ku/kube-state-metrics/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kube-state-metrics";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kube-state-metrics";
     rev = "v${version}";
-    hash = "sha256-7lI1RRC/Lw3OcYs3RA3caNvLYS7xEaCoxCM/ioa0goY=";
+    hash = "sha256-qLn+2znmfIdBkoVkCJ0tFAPVRYc+qAJWKbDP2FqMocg=";
   };
 
-  vendorHash = "sha256-Db7GTIC594yfp9gNn+hochpafqiRkLQIM/MTkX2S6E0=";
+  vendorHash = "sha256-KyEGmtSQO0EERLb0I7NBmxv1Jz+bYMrCZVwjJ1Jt+Ik=";
 
   excludedPackages = [
     "./tests/e2e"

pkgs/by-name/li/libvirt-glib/package.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -28,6 +29,14 @@ stdenv.mkDerivation rec {
     sha256 = "m/7DRjgkFqNXXYcpm8ZBsqRkqlGf2bEofjGKpDovO4s=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "relax-max-stack-size-limit.patch";
+      url = "https://gitlab.com/libvirt/libvirt-glib/-/commit/062f21ccaa810087637ae24e0eb69f1a0f0a45f5.patch";
+      hash = "sha256-6mvINDd1HYS7oZsyNiyEwdNJfK5I5nPx86TRMq2RevA=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja

pkgs/by-name/ne/nest-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "nest-cli";
-  version = "10.4.5";
+  version = "10.4.7";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = pname;
     rev = version;
-    hash = "sha256-F/Oi7ra+UE4YKXHZalH5qFk4coaGfHRpWaxamYunRuw=";
+    hash = "sha256-DVLmB4WE+8p2i2l2aq7u/YefeEykKd3B7ekaq5vKUjI=";
   };
 
-  npmDepsHash = "sha256-6yh8TKfq3fuq4QcnA4uM49/G0Kp1sccRyTcV5s9dVck=";
+  npmDepsHash = "sha256-bgnbf2YyjndJQ4jX08gW6htGPLV+znARuaJBuh8Kwa8=";
 
   env = {
     npm_config_build_from_source = true;

pkgs/by-name/nw/nwg-drawer/package.nix

@@ -12,16 +12,16 @@
 
 let
   pname = "nwg-drawer";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-drawer";
     rev = "v${version}";
-    hash = "sha256-0ksvat0NDC2P+T0TyDAKh7YNLYhH+znxqLCqQ/5GDj8=";
+    hash = "sha256-A/Rg7iUk8qpJ5lxumv4JNNJG1vN8wJIabJupp2c+nsw=";
   };
 
-  vendorHash = "sha256-KULOXphc6GWIGP79C9sgfAIRMoqwcjaVp4jVyF6of/E=";
+  vendorHash = "sha256-r4DtY06z0ZcPoHba4pqpCWqxYo7RbwCKi2g4jdoN1kg=";
 in
 buildGoModule {
   inherit pname version src vendorHash;

pkgs/by-name/oc/octoprint/package.nix

@@ -120,13 +120,13 @@ let
       (self: super: {
         octoprint = self.buildPythonPackage rec {
           pname = "OctoPrint";
-          version = "1.10.2";
+          version = "1.10.3";
 
           src = fetchFromGitHub {
             owner = "OctoPrint";
             repo = "OctoPrint";
             rev = version;
-            hash = "sha256-vISMps2v18A7MkF24SyIcK5yOQsTxBQLnKybVd8R2FU=";
+            hash = "sha256-BToW1/AcQ01OK7RWZrkstX2M4+uKuL/wFB6HGkVUflk=";
           };
 
           propagatedBuildInputs =

pkgs/by-name/op/openlibm/package.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openlibm";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "JuliaLang";
     repo = "openlibm";
     rev = "v${version}";
-    sha256 = "sha256-WSf4mcZXiEL3nKTLQh3Oi1MxeH9MOFRe7DU5zFT2aQE=";
+    sha256 = "sha256-JhyF93XU2Yd6Ia+JtYvF7Dr+d90r6xMZj/fWDwCNeWY=";
   };
 
   makeFlags = [ "prefix=$(out)" "CC=${stdenv.cc.targetPrefix}cc" ];

pkgs/by-name/ox/ox/package.nix

@@ -1,19 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, darwin }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ox";
-  version = "0.6.7";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "curlpipe";
     repo = pname;
     rev = version;
-    hash = "sha256-UFNOW/INV/65C6UysKi9lGw+PIj2NXF6ejG5UY702/I=";
+    hash = "sha256-7PaAcVatm/gqeZRuzCjoF6ZGDP6mIjDTuhmJQ5wt7x8=";
   };
 
-  cargoHash = "sha256-sy/RNMXJn5k9qw0ghCQA7PqZokpDw0xns4abwa938Gk=";
+  cargoHash = "sha256-2Jk8uDiTGUQqLOOQVlYm5R7qQXIqP0PkFvv5E5qTzT0=";
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
 
   meta = with lib; {
     description = "Independent Rust text editor that runs in your terminal";

pkgs/by-name/pg/pg-dump-anon/package.nix

@@ -14,7 +14,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-CwU1zoIayxvfnGL9kPdummPJiV+ECfSz4+q6gZGb8pw=";
 
-  passthru.tests = { inherit (nixosTests) pg_anonymizer; };
+  passthru.tests = { inherit (nixosTests.postgresql) anonymizer; };
 
   nativeBuildInputs = [ makeWrapper ];
   postInstall = ''

pkgs/by-name/pi/pik/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pik";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "jacek-kurlit";
     repo = "pik";
     rev = version;
-    hash = "sha256-YAnMSVQu/E+OyhHX3vugfBocyi++aGwG9vF6zL8T2RU=";
+    hash = "sha256-q1nNQC9qGa7nUNIaDdqW3wIrfzH7JKS/yZAe9KNmX3k=";
   };
 
-  cargoHash = "sha256-a7mqtxZMJl8zR8oCfuGNAiT5MEAmNpbDLSgi8A6FfPA=";
+  cargoHash = "sha256-gqzt3cFOS4uzIstIvmPS0n18aFUt0YnoTRz7EVTV7sA=";
 
   passthru.tests.version = testers.testVersion { package = pik; };
 

pkgs/by-name/po/positron-bin/package.nix

@@ -72,11 +72,7 @@ stdenv.mkDerivation {
     (lib.getLib systemd)
   ];
 
-  unpackPhase = ''
+  postUnpack = lib.optionalString stdenv.hostPlatform.isLinux ''dpkg-deb --fsys-tarfile "$src" | tar -x --no-same-owner'';
-    runHook preUnpack
-    ${lib.optionalString stdenv.hostPlatform.isLinux ''dpkg-deb --fsys-tarfile "$src" | tar -x --no-same-owner''}
-    runHook postUnpack
-  '';
 
   installPhase =
     if stdenv.hostPlatform.isDarwin then

pkgs/by-name/re/regripper/package.nix

@@ -1,29 +1,27 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchFromGitHub
+  stdenv,
-, perl
+  fetchFromGitHub,
-, perlPackages
+  perl,
-, runtimeShell
+  perlPackages,
+  runtimeShell,
 }:
 
 stdenv.mkDerivation rec {
   pname = "regripper";
-  version = "unstable-2023-07-23";
+  version = "0-unstable-2024-11-02";
 
   src = fetchFromGitHub {
     owner = "keydet89";
     repo = "RegRipper3.0";
-    rev = "cee174fb6f137b14c426e97d17945ddee0d31051";
+    rev = "89f3cac57e10bce1a79627e6038353e8e8a0c378";
-    hash = "sha256-vejIRlcVjxQJpxJabJJcljODYr+lLJjYINVtAPObvkQ=";
+    hash = "sha256-dW3Gr4HQH484i47Bg+CEnBYoGQQRMBJr88+YeuU+iV4=";
   };
 
-  propagatedBuildInputs = [ perl perlPackages.ParseWin32Registry ];
+  propagatedBuildInputs = [
-
+    perl
-  postPatch = ''
+    perlPackages.ParseWin32Registry
-    substituteInPlace rip.pl rr.pl \
+  ];
-      --replace \"plugins/\" \"$out/share/regripper/plugins/\" \
-      --replace \"plugins\" \"$out/share/regripper/plugins\"
-  '';
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/st/stardust-xr-kiara/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stardust-xr-kiara";
-  version = "0-unstable-2024-07-07";
+  version = "0-unstable-2024-07-13";
 
   src = fetchFromGitHub {
     owner = "stardustxr";
     repo = "kiara";
-    rev = "7daaa0a2e3822d949e6c4abf93af159eae9a544a";
+    rev = "186b00a460c9dd8179f9af42fb9a420506ac3aff";
-    hash = "sha256-5j83e2kcCStPgbwAkr3OFjOpJIErXAPJ6z06BlmtuHE=";
+    hash = "sha256-e89/x66S+MpJFtqat1hYEyRVUYFjef62LDN2hQPjNVw=";
   };
 
   cargoLock = {

pkgs/by-name/su/surreal-engine/package.nix

@@ -0,0 +1,75 @@
+{
+  alsa-lib,
+  cmake,
+  dbus,
+  fetchFromGitHub,
+  lib,
+  libffi,
+  makeWrapper,
+  openal,
+  pkg-config,
+  SDL2,
+  stdenv,
+  vulkan-loader,
+  wayland,
+  waylandpp,
+  libxkbcommon,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "surreal-engine";
+  version = "0-unstable-2024-11-08";
+
+  src = fetchFromGitHub {
+    owner = "dpjudas";
+    repo = "SurrealEngine";
+    rev = "087fa2af7fd0ce51702dd4024b4ae15a88222678";
+    hash = "sha256-AEIBhTkkRq4+L4ycx82GE29dM7zNgE0oHOkwEH9ezUg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    libffi
+    openal
+    SDL2
+    vulkan-loader
+    wayland
+    waylandpp
+    libxkbcommon
+  ];
+
+  postPatch = ''
+    substituteInPlace SurrealEngine/UI/WidgetResourceData.cpp --replace-fail /usr/share $out/share
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out/bin Surreal{Debugger,Editor,Engine}
+    install -Dt $out/share/surrealengine SurrealEngine.pk3
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    for bin in $out/bin/Surreal{Debugger,Editor,Engine}; do
+      wrapProgram $bin --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}
+    done
+  '';
+
+  meta = with lib; {
+    description = "Reimplementation of the original Unreal Engine";
+    mainProgram = "SurrealEngine";
+    homepage = "https://github.com/dpjudas/SurrealEngine";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ hughobrien ];
+    platforms = platforms.linux;
+  };
+})

pkgs/by-name/va/vassal/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.7.14";
+  version = "3.7.15";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-3P3f6X2c5lF1AizEs9z59MhLy0Ntg203rkPAkv+SBtw=";
+    sha256 = "sha256-eFFzUssElsLkCLgbojF6VQ8hzn15NYljBH/I7k98LMk=";
   };
 
   buildInputs = [

pkgs/by-name/wa/waylock/build.zig.zon.nix

@@ -1,20 +1,107 @@
-# generated by zon2nix (https://github.com/nix-community/zon2nix)
+# generated by zon2nix (https://github.com/Cloudef/zig2nix)
 
-{ linkFarm, fetchzip }:
+{
+  lib,
+  linkFarm,
+  fetchurl,
+  fetchgit,
+  runCommandLocal,
+  zig,
+  name ? "zig-packages",
+}:
 
-linkFarm "zig-packages" [
+with builtins;
+with lib;
+
+let
+  unpackZigArtifact =
+    { name, artifact }:
+    runCommandLocal name
+      {
+        nativeBuildInputs = [ zig ];
+      }
+      ''
+        hash="$(zig fetch --global-cache-dir "$TMPDIR" ${artifact})"
+        mv "$TMPDIR/p/$hash" "$out"
+        chmod 755 "$out"
+      '';
+
+  fetchZig =
+    {
+      name,
+      url,
+      hash,
+    }:
+    let
+      artifact = fetchurl { inherit url hash; };
+    in
+    unpackZigArtifact { inherit name artifact; };
+
+  fetchGitZig =
+    {
+      name,
+      url,
+      hash,
+    }:
+    let
+      parts = splitString "#" url;
+      url_base = elemAt parts 0;
+      url_without_query = elemAt (splitString "?" url_base) 0;
+      rev_base = elemAt parts 1;
+      rev = if match "^[a-fA-F0-9]{40}$" rev_base != null then rev_base else "refs/heads/${rev_base}";
+    in
+    fetchgit {
+      inherit name rev hash;
+      url = url_without_query;
+      deepClone = false;
+    };
+
+  fetchZigArtifact =
+    {
+      name,
+      url,
+      hash,
+    }:
+    let
+      parts = splitString "://" url;
+      proto = elemAt parts 0;
+      path = elemAt parts 1;
+      fetcher = {
+        "git+http" = fetchGitZig {
+          inherit name hash;
+          url = "http://${path}";
+        };
+        "git+https" = fetchGitZig {
+          inherit name hash;
+          url = "https://${path}";
+        };
+        http = fetchZig {
+          inherit name hash;
+          url = "http://${path}";
+        };
+        https = fetchZig {
+          inherit name hash;
+          url = "https://${path}";
+        };
+      };
+    in
+    fetcher.${proto};
+in
+linkFarm name [
   {
     name = "1220687c8c47a48ba285d26a05600f8700d37fc637e223ced3aa8324f3650bf52242";
-    path = fetchzip {
+    path = fetchZigArtifact {
+      name = "zig-wayland";
       url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.2.0.tar.gz";
-      hash = "sha256-dvit+yvc0MnipqWjxJdfIsA6fJaJZOaIpx4w4woCxbE=";
+      hash = "sha256-gxzkHLCq2NqX3l4nEly92ARU5dqP1SqnjpGMDgx4TXA=";
     };
   }
   {
     name = "1220c90b2228d65fd8427a837d31b0add83e9fade1dcfa539bb56fd06f1f8461605f";
-    path = fetchzip {
+    path = fetchZigArtifact {
+      name = "zig-xkbcommon";
       url = "https://codeberg.org/ifreund/zig-xkbcommon/archive/v0.2.0.tar.gz";
-      hash = "sha256-T+EZiStBfmxFUjaX05WhYkFJ8tRok/UQtpc9QY9NxZk=";
+      hash = "sha256-f5oEJU5i2qeVN3GBrnQcqzEJCiOT7l4ak7GQ6gw5cH0=";
     };
   }
 ]

pkgs/by-name/wa/waylock/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waylock";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "waylock";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-i1Nd39666xrkzi7r08ZRIXJXvK9wmzb8zdmvmWEQaHE=";
+    hash = "sha256-jfMSar+Y3inu1Cly6rIDw+akBJIQ6huL0smAstgQmEo=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace pam.d/waylock --replace-fail "system-auth" "login"
   '';
 
-  passthru.updateScript = ./update.nu;
+  passthru.updateScript = ./update.sh;
 
   meta = {
     homepage = "https://codeberg.org/ifreund/waylock";

pkgs/by-name/wa/waylock/update.nu

@@ -1,8 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts zon2nix
-
-let latest_tag = list-git-tags --url=https://codeberg.org/ifreund/waylock | lines | sort --natural | str replace v '' | last
-update-source-version waylock $latest_tag
-
-http get $"https://codeberg.org/ifreund/waylock/raw/tag/v($latest_tag)/build.zig.zon" | save build.zig.zon
-zon2nix > pkgs/by-name/wa/waylock/build.zig.zon.nix

pkgs/by-name/wa/waylock/update.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style zon2nix
+
+latest_tag=$(list-git-tags --url=https://codeberg.org/ifreund/waylock | sed 's/^v//' | tail -n 1)
+
+update-source-version waylock "$latest_tag"
+
+wget "https://codeberg.org/ifreund/waylock/raw/tag/v${latest_tag}/build.zig.zon"
+nix --extra-experimental-features 'nix-command flakes' run github:Cloudef/zig2nix#zon2nix -- build.zig.zon >pkgs/by-name/wa/waylock/build.zig.zon.nix
+# strip file protocol
+sed -i '\|file = unpackZigArtifact { inherit name; artifact = /. + path; };|d' pkgs/by-name/wa/waylock/build.zig.zon.nix
+nixfmt pkgs/by-name/wa/waylock/build.zig.zon.nix
+
+rm -f build.zig.zon build.zig.zon2json-lock

pkgs/by-name/wi/wit-bindgen/package.nix

@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wit-bindgen";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${version}";
-    hash = "sha256-+3tWqNdDZagJa9cLSz1OBaPtCr2F1joYyzB//BPqV34=";
+    hash = "sha256-ZnMQpIfKN6ByEZasvy+UM12ZBsrhTM1s3TN1dF/3YMY=";
   };
 
-  cargoHash = "sha256-3TrnSU7qXC8INlEZMbYTNwZsqiKMZ6j7tdGmz3DFl1g=";
+  cargoHash = "sha256-eF1qJ0fH3ODG1u9tUD3dj/2i7+0BJ4fJPlaYjS3XiGU=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.

pkgs/by-name/ze/zed-editor/package.nix

@@ -34,6 +34,8 @@
   git,
   apple-sdk_15,
   darwinMinVersionHook,
+  makeWrapper,
+  nodePackages_latest,
 
   withGLES ? false,
 }:
@@ -138,7 +140,8 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs =
+    [
       clang
       cmake
       copyDesktopItems
@@ -148,7 +151,9 @@ rustPlatform.buildRustPackage rec {
       protobuf
       rustPlatform.bindgenHook
       cargo-about
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cargo-bundle ];
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ cargo-bundle ];
 
   dontUseCmakeConfigure = true;
 
@@ -212,6 +217,9 @@ rustPlatform.buildRustPackage rec {
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf --add-rpath ${gpu-lib}/lib $out/libexec/*
     patchelf --add-rpath ${wayland}/lib $out/libexec/*
+    wrapProgram $out/libexec/zed-editor --suffix PATH : ${
+      lib.makeBinPath [ nodePackages_latest.nodejs ]
+    }
   '';
 
   preCheck = ''

pkgs/desktops/lomiri/development/u1db-qt/default.nix

@@ -10,6 +10,7 @@
   pkg-config,
   qtbase,
   qtdeclarative,
+  qttools,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -26,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
+    "doc"
     "examples"
   ];
 
@@ -56,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     qtdeclarative # qmlplugindump
+    qttools # qdoc
   ];
 
   buildInputs = [
@@ -66,8 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeCheckInputs = [ dbus-test-runner ];
 
   cmakeFlags = [
-    # Needs qdoc, see https://github.com/NixOS/nixpkgs/pull/245379
+    (lib.cmakeBool "BUILD_DOCS" true)
-    (lib.cmakeBool "BUILD_DOCS" false)
   ];
 
   dontWrapQtApps = true;
@@ -101,6 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Qt5 binding and QtQuick2 plugin for U1DB";
     homepage = "https://gitlab.com/ubports/development/core/u1db-qt";
+    changelog = "https://gitlab.com/ubports/development/core/u1db-qt/-/blob/${finalAttrs.version}/ChangeLog";
     license = lib.licenses.lgpl3Only;
     maintainers = lib.teams.lomiri.members;
     platforms = lib.platforms.linux;

pkgs/desktops/lomiri/qml/lomiri-action-api/default.nix

@@ -1,15 +1,18 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitLab
+  lib,
-, gitUpdater
+  fetchFromGitLab,
-, testers
+  gitUpdater,
-, cmake
+  testers,
-, dbus
+  cmake,
-, dbus-test-runner
+  dbus,
-, pkg-config
+  dbus-test-runner,
-, qtbase
+  doxygen,
-, qtdeclarative
+  pkg-config,
-, validatePkgConfig
+  qtbase,
+  qtdeclarative,
+  qttools,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -26,20 +29,27 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
+    "doc"
   ];
 
   postPatch = ''
     # Queries QMake for broken Qt variable: '/build/qtbase-<commit>/$(out)/$(qtQmlPrefix)'
     substituteInPlace qml/Lomiri/Action/CMakeLists.txt \
-      --replace 'exec_program(''${QMAKE_EXECUTABLE} ARGS "-query QT_INSTALL_QML" OUTPUT_VARIABLE QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
+      --replace-fail 'exec_program(''${QMAKE_EXECUTABLE} ARGS "-query QT_INSTALL_QML" OUTPUT_VARIABLE QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
+
+    # Fix section labels
+    substituteInPlace documentation/qml/pages/* \
+      --replace-warn '\part' '\section1'
   '';
 
   strictDeps = true;
 
   nativeBuildInputs = [
     cmake
+    doxygen
     pkg-config
     qtdeclarative
+    qttools # qdoc
     validatePkgConfig
   ];
 
@@ -55,10 +65,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "GENERATE_DOCUMENTATION" true)
     # Use vendored libhud2, TODO package libhud2 separately?
     (lib.cmakeBool "use_libhud2" false)
-    # QML docs need qdoc, https://github.com/NixOS/nixpkgs/pull/245379
-    (lib.cmakeBool "GENERATE_DOCUMENTATION" false)
   ];
 
   dontWrapQtApps = true;
@@ -82,8 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.lgpl3Only;
     maintainers = teams.lomiri.members;
     platforms = platforms.linux;
-    pkgConfigModules = [
+    pkgConfigModules = [ "lomiri-action-qt-1" ];
-      "lomiri-action-qt-1"
-    ];
   };
 })

pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix

@@ -1,36 +1,46 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitLab
+  lib,
-, gitUpdater
+  fetchFromGitLab,
-, substituteAll
+  gitUpdater,
-, testers
+  substituteAll,
-, dbus-test-runner
+  testers,
-, dpkg
+  dbus-test-runner,
-, gdb
+  dpkg,
-, glib
+  gdb,
-, lttng-ust
+  glib,
-, perl
+  lttng-ust,
-, pkg-config
+  perl,
-, python3
+  pkg-config,
-, qmake
+  python3,
-, qtbase
+  qmake,
-, qtdeclarative
+  qtbase,
-, qtfeedback
+  qtdeclarative,
-, qtgraphicaleffects
+  qtfeedback,
-, qtpim
+  qtgraphicaleffects,
-, qtquickcontrols2
+  qtpim,
-, qtsvg
+  qtquickcontrols2,
-, qtsystems
+  qtsvg,
-, suru-icon-theme
+  qtsystems,
-, validatePkgConfig
+  qttools,
-, wrapQtAppsHook
+  suru-icon-theme,
-, xvfb-run
+  validatePkgConfig,
+  wrapQtAppsHook,
+  xvfb-run,
 }:
 
 let
   listToQtVar = suffix: lib.makeSearchPathOutput "bin" suffix;
-  qtPluginPaths = listToQtVar qtbase.qtPluginPrefix [ qtbase qtpim qtsvg ];
+  qtPluginPaths = listToQtVar qtbase.qtPluginPrefix [
-  qtQmlPaths = listToQtVar qtbase.qtQmlPrefix [ qtdeclarative qtfeedback qtgraphicaleffects ];
+    qtbase
+    qtpim
+    qtsvg
+  ];
+  qtQmlPaths = listToQtVar qtbase.qtQmlPrefix [
+    qtdeclarative
+    qtfeedback
+    qtgraphicaleffects
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-ui-toolkit";
@@ -43,10 +53,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-r+wUCl+ywFcgFYo7BjBoXiulQptd1Zd3LJchXiMtx4I=";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
 
   patches = [
     ./2001-Mark-problematic-tests.patch
+
     (substituteAll {
       src = ./2002-Nixpkgs-versioned-QML-path.patch.in;
       name = "2002-Nixpkgs-versioned-QML-path.patch";
@@ -67,6 +82,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace apicheck/apicheck.pro \
       --replace-fail "\''$\''$[QT_INSTALL_LIBS]/lomiri-ui-toolkit" "$out/bin"
 
+    substituteInPlace documentation/documentation.pro \
+      --replace-fail '/usr/share/doc' '$$PREFIX/share/doc' \
+      --replace-fail '$$[QT_INSTALL_DOCS]' '$$PREFIX/share/doc/lomiri-ui-toolkit'
+
     # Causes redefinition error with our own fortify hardening
     sed -i '/DEFINES += _FORTIFY_SOURCE/d' features/lomiri_common.prf
 
@@ -105,6 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     python3
     qmake
+    qttools # qdoc, qhelpgenerator
     validatePkgConfig
     wrapQtAppsHook
   ];
@@ -133,8 +153,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   qmakeFlags = [
-    # docs require Qt5's qdoc, which we don't have before https://github.com/NixOS/nixpkgs/pull/245379
-    "CONFIG+=no_docs"
     # Ubuntu UITK compatibility, for older / not-yet-migrated applications
     "CONFIG+=ubuntu-uitk-compat"
     "QMAKE_PKGCONFIG_PREFIX=${placeholder "out"}"
@@ -201,7 +219,7 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = gitUpdater { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "QML components to ease the creation of beautiful applications in QML";
     longDescription = ''
       This project consists of a set of QML components to ease the creation of beautiful applications in QML for Lomiri.
@@ -219,9 +237,12 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit";
     changelog = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/blob/${finalAttrs.version}/ChangeLog";
-    license = with licenses; [ gpl3Only cc-by-sa-30 ];
+    license = with lib.licenses; [
-    maintainers = teams.lomiri.members;
+      gpl3Only
-    platforms = platforms.linux;
+      cc-by-sa-30
+    ];
+    maintainers = lib.teams.lomiri.members;
+    platforms = lib.platforms.linux;
     pkgConfigModules = [
       "LomiriGestures"
       "LomiriMetrics"

pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix

@@ -1,30 +1,32 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitLab
+  lib,
-, gitUpdater
+  fetchFromGitLab,
-, testers
+  gitUpdater,
-, cmake
+  testers,
-, cmake-extras
+  cmake,
-, dbus-test-runner
+  cmake-extras,
-, gettext
+  dbus-test-runner,
-, glib
+  gettext,
-, gsettings-qt
+  glib,
-, gtest
+  gsettings-qt,
-, libapparmor
+  gtest,
-, libnotify
+  libapparmor,
-, lomiri-api
+  libnotify,
-, lomiri-app-launch
+  lomiri-api,
-, lomiri-download-manager
+  lomiri-app-launch,
-, lomiri-ui-toolkit
+  lomiri-download-manager,
-, pkg-config
+  lomiri-ui-toolkit,
-, properties-cpp
+  pkg-config,
-, qtbase
+  properties-cpp,
-, qtdeclarative
+  qtbase,
-, qtfeedback
+  qtdeclarative,
-, qtgraphicaleffects
+  qtfeedback,
-, validatePkgConfig
+  qtgraphicaleffects,
-, wrapGAppsHook3
+  qttools,
-, xvfb-run
+  validatePkgConfig,
+  wrapGAppsHook3,
+  xvfb-run,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -41,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
+    "doc"
     "examples"
   ];
 
@@ -64,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     pkg-config
     qtdeclarative # qmlplugindump
+    qttools # qdoc
     validatePkgConfig
     wrapGAppsHook3
   ];
@@ -90,9 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
   ];
 
-  checkInputs = [
+  checkInputs = [ gtest ];
-    gtest
-  ];
 
   dontWrapQtApps = true;
 
@@ -100,16 +102,26 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "ENABLE_DOC" false) # needs Qt5 qdoc: https://github.com/NixOS/nixpkgs/pull/245379
+    (lib.cmakeBool "ENABLE_DOC" true)
     (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" true) # in case something still depends on it
   ];
 
-  preBuild = let
+  preBuild =
-    listToQtVar = list: suffix: lib.strings.concatMapStringsSep ":" (drv: "${lib.getBin drv}/${suffix}") list;
+    let
-  in ''
+      listToQtVar =
+        list: suffix: lib.strings.concatMapStringsSep ":" (drv: "${lib.getBin drv}/${suffix}") list;
+    in
+    ''
       # Executes qmlplugindump
       export QT_PLUGIN_PATH=${listToQtVar [ qtbase ] qtbase.qtPluginPrefix}
-    export QML2_IMPORT_PATH=${listToQtVar [ qtdeclarative lomiri-ui-toolkit qtfeedback qtgraphicaleffects ] qtbase.qtQmlPrefix}
+      export QML2_IMPORT_PATH=${
+        listToQtVar [
+          qtdeclarative
+          lomiri-ui-toolkit
+          qtfeedback
+          qtgraphicaleffects
+        ] qtbase.qtQmlPrefix
+      }
     '';
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
@@ -145,7 +157,10 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://gitlab.com/ubports/development/core/lomiri-content-hub";
     changelog = "https://gitlab.com/ubports/development/core/lomiri-content-hub/-/blob/${finalAttrs.version}/ChangeLog";
-    license = with lib.licenses; [ gpl3Only lgpl3Only ];
+    license = with lib.licenses; [
+      gpl3Only
+      lgpl3Only
+    ];
     mainProgram = "lomiri-content-hub-service";
     maintainers = lib.teams.lomiri.members;
     platforms = lib.platforms.linux;

pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix

@@ -1,28 +1,29 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitLab
+  lib,
-, fetchpatch
+  fetchFromGitLab,
-, gitUpdater
+  fetchpatch,
-, testers
+  gitUpdater,
-, boost
+  testers,
-, cmake
+  boost,
-, cmake-extras
+  cmake,
-, dbus
+  cmake-extras,
-, dbus-test-runner
+  dbus,
-# Needs qdoc, https://github.com/NixOS/nixpkgs/pull/245379
+  dbus-test-runner,
-, withDocumentation ? false
+  withDocumentation ? true,
-, doxygen
+  doxygen,
-, glog
+  glog,
-, graphviz
+  graphviz,
-, gtest
+  gtest,
-, lomiri-api
+  lomiri-api,
-, pkg-config
+  pkg-config,
-, python3
+  python3,
-, qtbase
+  qtbase,
-, qtdeclarative
+  qtdeclarative,
-, validatePkgConfig
+  qttools,
-, wrapQtAppsHook
+  validatePkgConfig,
-, xvfb-run
+  wrapQtAppsHook,
+  xvfb-run,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -39,9 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
-  ] ++ lib.optionals withDocumentation [
+  ] ++ lib.optionals withDocumentation [ "doc" ];
-    "doc"
-  ];
 
   patches = [
     # This change seems incomplete, potentially breaks things on systems that don't use AppArmor mediation
@@ -69,14 +68,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [
+  nativeBuildInputs =
+    [
       cmake
       pkg-config
       validatePkgConfig
       wrapQtAppsHook
-  ] ++ lib.optionals withDocumentation [
+    ]
+    ++ lib.optionals withDocumentation [
       doxygen
       graphviz
+      qttools # qdoc
     ];
 
   buildInputs = [
@@ -95,9 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     xvfb-run
   ];
 
-  checkInputs = [
+  checkInputs = [ gtest ];
-    gtest
-  ];
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_DOC" withDocumentation)
@@ -106,11 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_WERROR" false)
   ];
 
-  makeTargets = [
+  makeTargets = [ "all" ] ++ lib.optionals withDocumentation [ "doc" ];
-    "all"
-  ] ++ lib.optionals withDocumentation [
-    "doc"
-  ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
@@ -127,13 +123,13 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = gitUpdater { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Performs uploads and downloads from a centralized location";
     homepage = "https://gitlab.com/ubports/development/core/lomiri-download-manager";
     changelog = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/blob/${finalAttrs.version}/ChangeLog";
-    license = licenses.lgpl3Only;
+    license = lib.licenses.lgpl3Only;
-    maintainers = teams.lomiri.members;
+    maintainers = lib.teams.lomiri.members;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     pkgConfigModules = [
       "ldm-common"
       "lomiri-download-manager-client"

pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix

@@ -28,6 +28,7 @@
   python3,
   qtdeclarative,
   qtbase,
+  qttools,
   validatePkgConfig,
 }:
 
@@ -74,6 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     intltool
     pkg-config
     qtdeclarative
+    qttools # qdoc
     validatePkgConfig
   ];
 
@@ -106,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" true) # just in case something needs it
-    (lib.cmakeBool "BUILD_DOC" true) # lacks QML docs, needs qdoc: https://github.com/NixOS/nixpkgs/pull/245379
+    (lib.cmakeBool "BUILD_DOC" true)
   ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

pkgs/development/libraries/accounts-qml-module/default.nix

@@ -1,19 +1,22 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, fetchFromGitLab
+  lib,
-, accounts-qt
+  fetchFromGitLab,
-, dbus-test-runner
+  unstableGitUpdater,
-, pkg-config
+  accounts-qt,
-, qmake
+  dbus-test-runner,
-, qtbase
+  pkg-config,
-, qtdeclarative
+  qmake,
-, signond
+  qtbase,
-, xvfb-run
+  qtdeclarative,
+  qttools,
+  signond,
+  xvfb-run,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "accounts-qml-module";
-  version = "0.7-unstable-2022-10-28";
+  version = "0.7-unstable-2023-10-28";
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
@@ -22,15 +25,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ZpnkZauowLPBnO3DDDtG/x07XoQGVNqEF8AQB5TZK84=";
   };
 
-  postPatch = ''
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  postPatch =
+    ''
       substituteInPlace src/src.pro \
         --replace '$$[QT_INSTALL_BINS]/qmlplugindump' 'qmlplugindump' \
         --replace '$$[QT_INSTALL_QML]' '${placeholder "out"}/${qtbase.qtQmlPrefix}'
 
+      # Find qdoc
+      substituteInPlace doc/doc.pri \
+        --replace-fail 'QDOC = $$[QT_INSTALL_BINS]/qdoc' 'QDOC = qdoc'
+
       # Don't install test binary
       sed -i tests/tst_plugin.pro \
         -e '/TARGET = tst_plugin/a INSTALLS -= target'
-  '' + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
+    ''
+    + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
       sed -i accounts-qml-module.pro -e '/tests/d'
     '';
 
@@ -41,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     qmake
     qtdeclarative # qmlplugindump
+    qttools # qdoc
   ];
 
   buildInputs = [
@@ -57,11 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapQtApps = true;
 
-  qmakeFlags = [
-    # Needs qdoc, https://github.com/NixOS/nixpkgs/pull/245379
-    "CONFIG+=no_docs"
-  ];
-
   postConfigure = ''
     make qmake_all
   '';
@@ -78,11 +88,19 @@ stdenv.mkDerivation (finalAttrs: {
     export QT_PLUGIN_PATH=${lib.getBin qtbase}/${qtbase.qtPluginPrefix}
   '';
 
-  meta = with lib; {
+  postFixup = ''
+    moveToOutput share/accounts-qml-module/doc $doc
+  '';
+
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "VERSION_";
+  };
+
+  meta = {
     description = "QML bindings for libaccounts-qt + libsignon-qt";
     homepage = "https://gitlab.com/accounts-sso/accounts-qml-module";
-    license = licenses.lgpl21Only;
+    license = lib.licenses.lgpl21Only;
-    maintainers = with maintainers; [ OPNA2608 ];
+    maintainers = with lib.maintainers; [ OPNA2608 ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 })

pkgs/development/libraries/libvirt/default.nix

@@ -34,7 +34,7 @@
 , stdenv
 , substituteAll
 , xhtml1
-, yajl
+, json_c
 , writeScript
 , nixosTests
 
@@ -114,13 +114,13 @@ stdenv.mkDerivation rec {
   # NOTE: You must also bump:
   # <nixpkgs/pkgs/development/python-modules/libvirt/default.nix>
   # SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
-  version = "10.5.0";
+  version = "10.9.0";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Nku4l1f34NOUr23KWDH9uZu72OgMK3KfYjsRRbuTvf8=";
+    hash = "sha256-LYQYA5UIKYs+8rSNZDymmrxuTWsgmukP5Y17lGB5UQs=";
     fetchSubmodules = true;
   };
 
@@ -163,6 +163,9 @@ stdenv.mkDerivation rec {
     sed -i '/qemuvhostusertest/d' tests/meson.build
     sed -i '/qemuxml2xmltest/d' tests/meson.build
     sed -i '/domaincapstest/d' tests/meson.build
+    # virshtest frequently times out on Darwin
+    substituteInPlace tests/meson.build \
+      --replace-fail "data.get('timeout', 30)" "data.get('timeout', 120)"
   '' + lib.optionalString enableXen ''
     # Has various hardcoded paths that don't exist outside of a Xen dom0.
     sed -i '/libxlxml2domconfigtest/d' tests/meson.build
@@ -202,7 +205,7 @@ stdenv.mkDerivation rec {
     python3
     readline
     xhtml1
-    yajl
+    json_c
   ] ++ lib.optionals isLinux [
     acl
     attr
@@ -312,7 +315,7 @@ stdenv.mkDerivation rec {
       (feat "ssh_proxy" isLinux)
       (feat "tests" true)
       (feat "udev" isLinux)
-      (feat "yajl" true)
+      (feat "json_c" true)
 
       (driver "ch" isLinux)
       (driver "esx" true)

pkgs/development/python-modules/aiogram/default.nix

@@ -28,16 +28,16 @@
 
 buildPythonPackage rec {
   pname = "aiogram";
-  version = "3.13.1";
+  version = "3.14.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "aiogram";
     repo = "aiogram";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uTFh1ncIPF9SmAEVGeBnXEKrYzgifZan1sxk5UiG92U=";
+    hash = "sha256-SEq88e5MLNqssJhxPPwI2ZdpNdTCBomNpI0xmbmz3Pw=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/androidtv/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "androidtv";
-  version = "0.0.74";
+  version = "0.0.75";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "JeffLIrion";
     repo = "python-androidtv";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aURHor+7E0Z4DyN/s1/BMBJo/FmvAlRsKs9Q0Thelyc=";
+    hash = "sha256-2WFfGGEZkM3fWyTo5P6H3ha04Qyx2OiYetlGWv0jXac=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/bsdiff4/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "bsdiff4";
-  version = "1.2.4";
+  version = "1.2.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HXEpqBIYYHMejM4pAdMYPhSuxwJE9k6PdFYyddw4gGc=";
+    hash = "sha256-zdg/gg7Ljx72ek5fCxUsYdMnyver81qpp2NBORWyE2g=";
   };
 
   pythonImportsCheck = [ "bsdiff4" ];

pkgs/development/python-modules/chess/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "chess";
-  version = "1.11.0";
+  version = "1.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "niklasf";
     repo = "python-${pname}";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+YNEm1QppXeeIjOKfCSQoQmuSzBsW4ws0ej/whjTAPg=";
+    hash = "sha256-OAYQ/XtM4AHfbpA+gVa/AjB3tyMtvgykpHc39WaU2CI=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/dinghy/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "dinghy";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "nedbat";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-0U08QHQuNm7qaxhU8sNxeN0fZ4S8N0RYRsWjFUqhZSU=";
+    hash = "sha256-fn8SRzhFJyyr2Wr9/cp8Sm6kbVARq2LEeKSE0HU9V74=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/kornia/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "kornia";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-iEg27b2JVLtAYLFncaSqIh5FyvmmitKAKP7Tl0WWNdk=";
+    hash = "sha256-Ecps1KniiL1WOGk+i/UAVuXJ2W7cgHSzAKCkZokyWIM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/libvirt/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "10.5.0";
+  version = "10.9.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "libvirt";
     repo = "libvirt-python";
     rev = "v${version}";
-    hash = "sha256-dPjT9PRoUzNrY79yejAW/sbkMr0fpLif7IKZIW/K3KI=";
+    hash = "sha256-/kjpB19X90btIewW+hjLjLagJvI5X2oIHXpcSZVtu2I=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/morecantile/default.nix

@@ -17,15 +17,15 @@
 
 buildPythonPackage rec {
   pname = "morecantile";
-  version = "5.4.2";
+  version = "6.0.0";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "developmentseed";
     repo = "morecantile";
-    rev = version;
+    rev = "refs/tags/${version}";
-    hash = "sha256-kUAde+6IUu95tFHFCB6kWoYsRf9GxR+gRJki/tvhIaY=";
+    hash = "sha256-l+fQQXOrhqRanB695nR4okfmPYP05NdrGOvgG+jK2uo=";
   };
 
   nativeBuildInputs = [ flit ];

pkgs/development/python-modules/polars/default.nix

@@ -2,98 +2,304 @@
   lib,
   stdenv,
   buildPythonPackage,
-  rustPlatform,
+  cargo,
   cmake,
-  libiconv,
+  darwin,
   fetchFromGitHub,
+  pkg-config,
+  pkgs, # zstd hidden by python3Packages.zstd
+  pytestCheckHook,
+  pytest-codspeed ? null, # Not in Nixpkgs
+  pytest-cov,
+  pytest-xdist,
+  pytest-benchmark,
+  rustc,
+  rustPlatform,
+  runCommand,
+
+  mimalloc,
   jemalloc,
   rust-jemalloc-sys,
-  darwin,
+  # Another alternative is to try `mimalloc`
+  polarsMemoryAllocator ? mimalloc, # polarsJemalloc,
+  polarsJemalloc ?
+    let
+      jemalloc' = rust-jemalloc-sys.override {
+        jemalloc = jemalloc.override {
+          # "libjemalloc.so.2: cannot allocate memory in static TLS block"
+
+          # https://github.com/pola-rs/polars/issues/5401#issuecomment-1300998316
+          disableInitExecTls = true;
+        };
+      };
+    in
+    assert builtins.elem "--disable-initial-exec-tls" jemalloc'.configureFlags;
+    jemalloc',
+
+  polars,
+  python,
 }:
 
 let
-  rust-jemalloc-sys' = rust-jemalloc-sys.override {
+  version = "1.12.0";
-    jemalloc = jemalloc.override { disableInitExecTls = true; };
+
-  };
+  # Hide symbols to prevent accidental use
+  rust-jemalloc-sys = throw "polars: use polarsMemoryAllocator over rust-jemalloc-sys";
+  jemalloc = throw "polars: use polarsMemoryAllocator over jemalloc";
 in
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "polars";
-  version = "1.7.1";
+  inherit version;
-  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
-    rev = "refs/tags/py-${version}";
+    rev = "py-${version}";
-    hash = "sha256-vbligrFrCd7BiPV8n1iRIlurPNirJKOiD4/P5qEpirg=";
+    hash = "sha256-q//vt8FvVKY9N/BOIoOwxaSB/F/tNX1Zl/9jd0AzSH4=";
   };
 
-  # Cargo.lock file is sometimes behind actual release which throws an error,
+  # Do not type-check assertions because some of them use unstable features (`is_none_or`)
-  # thus the `sed` command
+  postPatch = ''
-  # Make sure to check that the right substitutions are made when updating the package
+    while IFS= read -r -d "" path ; do
-  preBuild = ''
+      sed -i 's \(\s*\)debug_assert! \1#[cfg(debug_assertions)]\n\1debug_assert! ' "$path"
-    #sed -i 's/version = "0.18.0"/version = "${version}"/g' Cargo.lock
+    done < <( find -iname '*.rs' -print0 )
   '';
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "numpy-0.21.0" = "sha256-u0Z+6L8pXSPaA3cE1sUpY6sCoaU1clXUcj/avnNzmsw=";
+      "polars-parquet-format-2.10.0" = "sha256-iB3KZ72JSp7tJCLn9moukpDEGf9MUos04rIQ9rDGWfI=";
     };
   };
 
-  buildAndTestSubdir = "py-polars";
+  requiredSystemFeatures = [ "big-parallel" ];
 
-  # Revisit this whenever package or Rust is upgraded
+  build-system = [ rustPlatform.maturinBuildHook ];
-  RUSTC_BOOTSTRAP = 1;
 
-  # trick taken from the polars repo since there seems to be a problem
+  nativeBuildInputs = [
-  # with simd enabled with our stable rust (instead of nightly).
+    cargo
-  maturinBuildFlags = [
+    pkg-config
-    "--no-default-features"
+    cmake # libz-ng-sys
-    "--all-features"
+    rustPlatform.cargoSetupHook
+    rustPlatform.cargoBuildHook
+    rustPlatform.cargoInstallHook
+    rustc
   ];
 
+  buildInputs =
+    [
+      polarsMemoryAllocator
+      (pkgs.__splicedPackages.zstd or pkgs.zstd)
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.AppKit
+      darwin.apple_sdk.frameworks.IOKit
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+
+    # https://github.com/NixOS/nixpkgs/blob/5c38beb516f8da3a823d94b746dd3bf3c6b9bbd7/doc/languages-frameworks/rust.section.md#using-community-maintained-rust-toolchains-using-community-maintained-rust-toolchains
+    # https://discourse.nixos.org/t/nixpkgs-rustplatform-and-nightly/22870
+    RUSTC_BOOTSTRAP = true;
+
+    # Several `debug_assert!` statements use the unstable `Option::is_none_or` method
+    RUSTFLAGS = lib.concatStringsSep " " (
+      [
+        "-Cdebug_assertions=n"
+      ]
+      ++ lib.optionals (polarsMemoryAllocator.pname == "mimalloc") [
+        "--cfg use_mimalloc"
+      ]
+    );
+    RUST_BACKTRACE = true;
+  };
+
   dontUseCmakeConfigure = true;
 
-  nativeBuildInputs =
+  maturinBuildFlags = [
-    [
+    "-m"
-      # needed for libz-ng-sys
+    "py-polars/Cargo.toml"
-      # TODO: use pkgs.zlib-ng
-      cmake
-    ]
-    ++ (with rustPlatform; [
-      cargoSetupHook
-      maturinBuildHook
-    ]);
-
-  buildInputs =
-    [ rust-jemalloc-sys' ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libiconv
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
-  # nativeCheckInputs = [
+  postInstall = ''
-  #   pytestCheckHook
+    # Move polars.abi3.so -> polars.so
-  #   fixtures
+    local polarsSo=""
-  #   graphviz
+    local soName=""
-  #   matplotlib
+    while IFS= read -r -d "" p ; do
-  #   networkx
+      polarsSo=$p
-  #   numpy
+      soName="$(basename "$polarsSo")"
-  #   pydot
+      [[ "$soName" == polars.so ]] && break
-  # ];
+    done < <( find "$out" -iname "polars*.so" -print0 )
+    [[ -z "''${polarsSo:-}" ]] && echo "polars.so not found" >&2 && exit 1
+    if [[ "$soName" != polars.so ]] ; then
+      mv "$polarsSo" "$(dirname "$polarsSo")/polars.so"
+    fi
+  '';
 
-  pythonImportsCheck = [ "polars" ];
+  pythonImportsCheck = [
+    "polars"
+  ];
+
+  passthru.tests.dynloading-1 =
+    runCommand "polars-dynloading-1"
+      {
+        nativeBuildInputs = [
+          (python.withPackages (ps: [
+            ps.pyarrow
+            polars
+          ]))
+        ];
+      }
+      ''
+        ((LD_DEBUG=libs python) |& tee $out | tail) << \EOF
+        import pyarrow
+        import polars
+        EOF
+        touch $out
+      '';
+  passthru.tests.dynloading-2 =
+    runCommand "polars-dynloading-2"
+      {
+        nativeBuildInputs = [
+          (python.withPackages (ps: [
+            ps.pyarrow
+            polars
+          ]))
+        ];
+        failureHook = ''
+          sed "s/^/    /" $out >&2
+        '';
+      }
+      ''
+        ((LD_DEBUG=libs python) |& tee $out | tail) << \EOF
+        import polars
+        import pyarrow
+        EOF
+      '';
+  passthru.tests.pytest = stdenv.mkDerivation {
+    pname = "${polars.pname}-pytest";
+
+    inherit (polars) version src;
+
+    requiredSystemFeatures = [ "big-parallel" ];
+
+    sourceRoot = "source/py-polars";
+    postPatch = ''
+      for f in * ; do
+        [[ "$f" == "tests" ]] || \
+        [[ "$f" == "pyproject.toml" ]] || \
+        rm -rf "$f"
+      done
+      for pat in "__pycache__" "*.pyc" ; do
+        find -iname "$pat" -exec rm "{}" ";"
+      done
+    '';
+    dontConfigure = true;
+    dontBuild = true;
+
+    doCheck = true;
+    checkPhase = "pytestCheckPhase";
+    nativeBuildInputs = [
+      (python.withPackages (ps: [
+        polars
+        ps.aiosqlite
+        ps.altair
+        ps.boto3
+        ps.deltalake
+        ps.flask
+        ps.flask-cors
+        ps.fsspec
+        ps.gevent
+        ps.hypothesis
+        ps.jax
+        ps.jaxlib
+        (ps.kuzu or null)
+        ps.moto
+        ps.nest-asyncio
+        ps.numpy
+        ps.openpyxl
+        ps.pandas
+        ps.pyarrow
+        ps.pydantic
+        (ps.pyiceberg or null)
+        ps.sqlalchemy
+        ps.torch
+        ps.xlsx2csv
+        ps.xlsxwriter
+        ps.zstandard
+        ps.cloudpickle
+      ]))
+    ];
+    nativeCheckInputs = [
+      pytestCheckHook
+      pytest-codspeed
+      pytest-cov
+      pytest-xdist
+      pytest-benchmark
+    ];
+
+    pytestFlagsArray = [
+      "-n auto"
+      "--dist loadgroup"
+      ''-m "slow or not slow"''
+    ];
+    disabledTests = [
+      "test_read_kuzu_graph_database" # kuzu
+      "test_read_database_cx_credentials" # connectorx
+
+      # adbc_driver_.*
+      "test_write_database_append_replace"
+      "test_write_database_create"
+      "test_write_database_create_quoted_tablename"
+      "test_write_database_adbc_temporary_table"
+      "test_write_database_create"
+      "test_write_database_append_replace"
+      "test_write_database_errors"
+      "test_write_database_errors"
+      "test_write_database_create_quoted_tablename"
+
+      # Internet access:
+      "test_read_web_file"
+
+      # Untriaged
+      "test_pickle_lazyframe_nested_function_udf"
+      "test_serde_udf"
+      "test_hash_struct"
+    ];
+    disabledTestPaths = [
+      "tests/benchmark"
+      "tests/docs"
+
+      "tests/unit/io/test_iceberg.py" # Package pyiceberg
+      "tests/unit/io/test_spreadsheet.py" # Package fastexcel
+
+      # Wrong altair version
+      "tests/unit/operations/namespaces/test_plot.py"
+
+      # adbc
+      "tests/unit/io/database/test_read.py"
+
+      # Untriaged
+      "tests/unit/cloud/test_prepare_cloud_plan.py"
+      "tests/unit/io/cloud/test_cloud.py"
+    ];
+
+    installPhase = "touch $out";
+  };
 
   meta = {
-    description = "Fast multi-threaded DataFrame library";
+    description = "Dataframes powered by a multithreaded, vectorized query engine, written in Rust";
     homepage = "https://github.com/pola-rs/polars";
-    changelog = "https://github.com/pola-rs/polars/releases/tag/py-${version}";
+    license = lib.licenses.mit;
-    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
-    maintainers = with lib.maintainers; [ happysalada ];
+      happysalada
+      SomeoneSerge
+    ];
+    mainProgram = "polars";
+    platforms = lib.platforms.all;
   };
 }

pkgs/development/python-modules/pyftgl/default.nix

@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   stdenv,
+  setuptools,
   boost,
   freetype,
   ftgl,
@@ -12,30 +13,31 @@
 }:
 
 let
-
   pythonVersion = with lib.versions; "${major python.version}${minor python.version}";
 in
-
 buildPythonPackage rec {
   pname = "pyftgl";
   version = "0.4b";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "umlaeute";
-    repo = "${pname}-${version}";
+    repo = "pyftgl";
-    rev = version;
+    rev = "refs/tags/${version}";
-    sha256 = "12zcjv4cwwjihiaf74kslrdmmk4bs47h7006gyqfwdfchfjdgg4r";
+    sha256 = "sha256-mbzXpIPMNe6wfwaAAw/Ri8xaW6Z6kuNUhFFyzsiW7Is=";
   };
 
-  postPatch = ''
+  build-system = [ setuptools ];
-    sed -i "s,'boost_python','boost_python${pythonVersion}',g" setup.py
+
+  postPatch =
+    ''
+      substituteInPlace setup.py \
+        --replace-fail boost_python boost_python${pythonVersion}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export NIX_CFLAGS_COMPILE+=" -L$SDKROOT/System/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries"
     '';
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-L${libGL}/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries";
-  };
-
   buildInputs = [
     boost
     freetype
@@ -44,8 +46,8 @@ buildPythonPackage rec {
     libGL
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Python bindings for FTGL (FreeType for OpenGL)";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
   };
 }

pkgs/development/python-modules/rio-tiler/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "rio-tiler";
-  version = "6.7.0";
+  version = "7.0.1";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "cogeotiff";
     repo = "rio-tiler";
     rev = "refs/tags/${version}";
-    hash = "sha256-i70Bh7RHPgLLaqBo9vHRrJylsNE3Ly3xJq9j12Ch58E=";
+    hash = "sha256-E8gKXPj1n9HZ+zvQPcG28+2Vuif4B6NBhtuS009x6rU=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/stravalib/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "stravalib";
-  version = "2.0";
+  version = "2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "stravalib";
     repo = "stravalib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uF29fK+ZSSO688zKYYiSEygBUJZ6NBcvdgGgz3I1I6Q=";
+    hash = "sha256-VEVy9BAAoLsBCwMNFpsCjhacFbsgNswYoJ5tTcOQccw=";
   };
 
   build-system = [

pkgs/development/python-modules/xml2rfc/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.23.2";
+  version = "3.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "ietf-tools";
     repo = "xml2rfc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KL3kIntydUAOS7qGq6ZDrShEcyME1Qwf2VjM/9mw96Q=";
+    hash = "sha256-cymClLsXPeuWsRMbFJHO55ASzEbau++XvYoBsquDv+Y=";
   };
 
   postPatch = ''

pkgs/servers/sql/postgresql/ext/anonymizer.nix

@@ -1,9 +1,9 @@
-{ lib, stdenv, pg-dump-anon, postgresql, runtimeShell, jitSupport, llvm, buildPostgresqlExtension }:
+{ lib, stdenv, pg-dump-anon, postgresql, runtimeShell, jitSupport, llvm, buildPostgresqlExtension, nixosTests }:
 
 buildPostgresqlExtension (finalAttrs: {
   pname = "postgresql_anonymizer";
 
-  inherit (pg-dump-anon) version src passthru;
+  inherit (pg-dump-anon) version src;
 
   nativeBuildInputs = [ postgresql ] ++ lib.optional jitSupport llvm;
 
@@ -19,6 +19,8 @@ buildPostgresqlExtension (finalAttrs: {
     EOF
   '';
 
+  passthru.tests = nixosTests.postgresql.anonymizer.passthru.override postgresql;
+
   meta = lib.getAttrs [ "homepage" "maintainers" "license" ] pg-dump-anon.meta // {
     description = "Extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database";
   };

pkgs/servers/sql/postgresql/ext/apache_datasketches.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, postgresql, boost182, nixosTests, buildPostgresqlExtension }:
+{ stdenv, lib, fetchFromGitHub, postgresql, boost182, postgresqlTestExtension, buildPostgresqlExtension }:
 
 let
   version = "1.7.0";
@@ -20,7 +20,7 @@ let
   };
 in
 
-buildPostgresqlExtension {
+buildPostgresqlExtension (finalAttrs: {
   pname = "apache_datasketches";
   inherit version;
 
@@ -36,7 +36,13 @@ buildPostgresqlExtension {
     runHook postPatch
   '';
 
-  passthru.tests.apache_datasketches = nixosTests.apache_datasketches;
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    sql = ''
+      CREATE EXTENSION datasketches;
+      SELECT hll_sketch_to_string(hll_sketch_build(1));
+    '';
+  };
 
   meta = {
     description = "PostgreSQL extension providing approximate algorithms for distinct item counts, quantile estimation and frequent items detection";
@@ -50,4 +56,4 @@ buildPostgresqlExtension {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mmusnjak ];
   };
-}
+})

pkgs/servers/sql/postgresql/ext/pgjwt.nix

@@ -13,8 +13,8 @@ buildPostgresqlExtension (finalAttrs: {
 
   passthru.updateScript = unstableGitUpdater { };
 
-  passthru.tests = {
+  passthru.tests = lib.recurseIntoAttrs {
-    inherit (nixosTests) pgjwt;
+    pgjwt = nixosTests.postgresql.pgjwt.passthru.override postgresql;
 
     extension = postgresqlTestExtension {
       inherit (finalAttrs) finalPackage;

pkgs/servers/sql/postgresql/ext/pgvecto-rs/default.nix

@@ -86,9 +86,7 @@ in
 
   passthru = {
     updateScript = nix-update-script { };
-    tests = {
+    tests = nixosTests.postgresql.pgvecto-rs.passthru.override postgresql;
-      pgvecto-rs = nixosTests.pgvecto-rs;
-    };
   };
 
   meta = with lib; {

pkgs/servers/sql/postgresql/ext/postgis.nix

@@ -18,7 +18,7 @@
   docbook5,
   cunit,
   pcre2,
-  nixosTests,
+  postgresqlTestExtension,
   jitSupport,
   llvm,
   buildPostgresqlExtension,
@@ -27,7 +27,7 @@
 let
   gdal = gdalMinimal;
 in
-buildPostgresqlExtension rec {
+buildPostgresqlExtension (finalAttrs: {
   pname = "postgis";
   version = "3.5.0";
 
@@ -37,7 +37,7 @@ buildPostgresqlExtension rec {
   ];
 
   src = fetchurl {
-    url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
+    url = "https://download.osgeo.org/postgis/source/postgis-${finalAttrs.version}.tar.gz";
     hash = "sha256-ymmKIswrKzRnrE4GO0OihBPzAE3dUFvczddMVqZH9RA=";
   };
 
@@ -105,19 +105,39 @@ buildPostgresqlExtension rec {
     rm $out/bin/postgres
 
     for prog in $out/bin/*; do # */
-      ln -s $prog $prog-${version}
+      ln -s $prog $prog-${finalAttrs.version}
     done
 
     mkdir -p $doc/share/doc/postgis
     mv doc/* $doc/share/doc/postgis/
   '';
 
-  passthru.tests.postgis = nixosTests.postgis;
+  passthru.tests.extension = postgresqlTestExtension {
+    inherit (finalAttrs) finalPackage;
+    sql =
+      let
+        expectedVersion = "${lib.versions.major finalAttrs.version}.${lib.versions.minor finalAttrs.version} USE_GEOS=1 USE_PROJ=1 USE_STATS=1";
+      in
+      ''
+        CREATE EXTENSION postgis;
+        CREATE EXTENSION postgis_raster;
+        CREATE EXTENSION postgis_topology;
+        select postgis_version();
+        do $$
+        begin
+          if postgis_version() <> '${expectedVersion}' then
+            raise '"%" does not match "${expectedVersion}"', postgis_version();
+          end if;
+        end$$;
+        -- st_makepoint goes through c code
+        select st_makepoint(1, 1);
+      '';
+  };
 
   meta = with lib; {
     description = "Geographic Objects for PostgreSQL";
     homepage = "https://postgis.net/";
-    changelog = "https://git.osgeo.org/gitea/postgis/postgis/raw/tag/${version}/NEWS";
+    changelog = "https://git.osgeo.org/gitea/postgis/postgis/raw/tag/${finalAttrs.version}/NEWS";
     license = licenses.gpl2Plus;
     maintainers =
       with maintainers;
@@ -128,4 +148,4 @@ buildPostgresqlExtension rec {
       ];
     inherit (postgresql.meta) platforms;
   };
-}
+})

pkgs/servers/sql/postgresql/ext/timescaledb.nix

@@ -32,7 +32,7 @@ buildPostgresqlExtension rec {
     done
   '';
 
-  passthru.tests = { inherit (nixosTests) timescaledb; };
+  passthru.tests = nixosTests.postgresql.timescaledb.passthru.override postgresql;
 
   meta = with lib; {
     description = "Scales PostgreSQL for time-series data via automatic partitioning across time and space";

pkgs/servers/sql/postgresql/ext/timescaledb_toolkit.nix

@@ -25,9 +25,7 @@
 
   passthru = {
     updateScript = nix-update-script { };
-    tests = {
+    tests = nixosTests.postgresql.timescaledb.passthru.override postgresql;
-      timescaledb_toolkit = nixosTests.timescaledb;
-    };
   };
 
   # tests take really long

pkgs/servers/sql/postgresql/ext/tsja.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     mv dbinit_libtsja.txt $out/share/postgresql/extension/libtsja_dbinit.sql
   '';
 
-  passthru.tests.tsja = nixosTests.tsja;
+  passthru.tests = nixosTests.postgresql.tsja.passthru.override postgresql;
 
   meta = with lib; {
     description = "PostgreSQL extension implementing Japanese text search";

pkgs/servers/sql/postgresql/ext/wal2json.nix

@@ -1,10 +1,9 @@
 {
   lib,
-  stdenv,
-  callPackage,
   fetchFromGitHub,
   postgresql,
   buildPostgresqlExtension,
+  nixosTests,
 }:
 
 buildPostgresqlExtension rec {
@@ -20,12 +19,7 @@ buildPostgresqlExtension rec {
 
   makeFlags = [ "USE_PGXS=1" ];
 
-  passthru.tests.wal2json = lib.recurseIntoAttrs (
+  passthru.tests = nixosTests.postgresql.wal2json.passthru.override postgresql;
-    callPackage ../../../../../nixos/tests/postgresql-wal2json.nix {
-      inherit (stdenv) system;
-      inherit postgresql;
-    }
-  );
 
   meta = with lib; {
     description = "PostgreSQL JSON output plugin for changeset extraction";

pkgs/servers/sql/postgresql/generic.nix

@@ -20,7 +20,7 @@ let
       , version, hash, muslPatches ? {}
 
       # for tests
-      , testers
+      , testers, nixosTests
 
       # JIT
       , jitSupport
@@ -313,18 +313,12 @@ let
                      };
 
       tests = {
-        postgresql-wal-receiver = import ../../../../nixos/tests/postgresql-wal-receiver.nix {
+        postgresql = nixosTests.postgresql.postgresql.passthru.override finalAttrs.finalPackage;
-          inherit (stdenv) system;
+        postgresql-tls-client-cert = nixosTests.postgresql.postgresql-tls-client-cert.passthru.override finalAttrs.finalPackage;
-          pkgs = self;
+        postgresql-wal-receiver = nixosTests.postgresql.postgresql-wal-receiver.passthru.override finalAttrs.finalPackage;
-          package = this;
-        };
         pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       } // lib.optionalAttrs jitSupport {
-        postgresql-jit = import ../../../../nixos/tests/postgresql-jit.nix {
+        postgresql-jit = nixosTests.postgresql.postgresql-jit.passthru.override finalAttrs.finalPackage;
-          inherit (stdenv) system;
-          pkgs = self;
-          package = this;
-        };
       };
     };
 

pkgs/top-level/all-packages.nix

@@ -12223,7 +12223,8 @@ with pkgs;
     asciidoc = asciidoc-full;
   };
 
-  inherit (import ../servers/sql/postgresql pkgs)
+  postgresqlVersions = import ../servers/sql/postgresql pkgs;
+  inherit (postgresqlVersions)
     postgresql_12
     postgresql_13
     postgresql_14