Merge master into staging-next

nixos/modules/services/web-servers/caddy/default.nix

@@ -36,6 +36,7 @@ let
             ${cfg.globalConfig}
           }
           ${cfg.extraConfig}
+          ${concatMapStringsSep "\n" mkVHostConf virtualHosts}
         '';
 
         Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
@@ -340,7 +341,6 @@ in
       groups = config.users.groups;
     }) acmeHosts;
 
-    services.caddy.extraConfig = concatMapStringsSep "\n" mkVHostConf virtualHosts;
     services.caddy.globalConfig = ''
       ${optionalString (cfg.email != null) "email ${cfg.email}"}
       ${optionalString (cfg.acmeCA != null) "acme_ca ${cfg.acmeCA}"}

pkgs/applications/audio/aucatctl/default.nix

@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, sndio, libbsd }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aucatctl";
   version = "0.1";
 
   src = fetchurl {
-    url = "http://www.sndio.org/${pname}-${version}.tar.gz";
+    url = "http://www.sndio.org/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = "524f2fae47db785234f166551520d9605b9a27551ca438bd807e3509ce246cf0";
   };
 
@@ -27,11 +27,10 @@ stdenv.mkDerivation rec {
     '';
 
   meta = with lib; {
-    description =
+    description = "The aucatctl utility sends MIDI messages to control sndiod and/or aucat volumes";
-      "The aucatctl utility sends MIDI messages to control sndiod and/or aucat volumes";
     homepage = "http://www.sndio.org";
     license = licenses.isc;
     maintainers = with maintainers; [ sna ];
     platforms = platforms.unix;
   };
-}
+})

pkgs/applications/audio/monkeys-audio/default.nix

@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "10.20";
+  version = "10.22";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." version)}_SDK.zip";
-    sha256 = "sha256-RBrWz0iGVny1YC6H9NJbFb2HhlAxRiFrTBg1Evm85B8=";
+    sha256 = "sha256-JmDH9IudtuJdu1kSDI1RNaYiIgmPgH4RT2Myz9ihQH4=";
     stripRoot = false;
   };
   nativeBuildInputs = [

pkgs/applications/misc/pagefind/default.nix

@@ -0,0 +1,110 @@
+{ lib
+, callPackage
+, rustPlatform
+, fetchFromGitHub
+, fetchNpmDeps
+, npmHooks
+, binaryen
+, gzip
+, nodejs
+, rustc-wasm32
+, wasm-bindgen-cli
+, wasm-pack
+}:
+
+let
+
+  wasm-bindgen-84 = wasm-bindgen-cli.override {
+    version = "0.2.84";
+    hash = "sha256-0rK+Yx4/Jy44Fw5VwJ3tG243ZsyOIBBehYU54XP/JGk=";
+    cargoHash = "sha256-vcpxcRlW1OKoD64owFF6mkxSqmNrvY+y3Ckn5UwEQ50=";
+  };
+
+in
+
+rustPlatform.buildRustPackage rec {
+  pname = "pagefind";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "cloudcannon";
+    repo = "pagefind";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vQbLaZug3gySMIbMdNqU7XcL4GZ7XqZ3ZkwdDBC5T9o=";
+  };
+
+  cargoHash = "sha256-ubuzO/67HguWPqd3y/IapO07L2pg2Q4vo1yTpEthdoU=";
+
+  env.npmDeps_web_js = fetchNpmDeps {
+    name = "npm-deps-web-js";
+    src = "${src}/pagefind_web_js";
+    hash = "sha256-pGE4lUFZ4dA++8kBklcMBoaN/1Z92dfOzQKhukbuEyc=";
+  };
+  env.npmDeps_ui_default = fetchNpmDeps {
+    name = "npm-deps-ui-default";
+    src = "${src}/pagefind_ui/default";
+    hash = "sha256-voCs49JneWYE1W9U7aB6G13ypH6JqathVDeF58V57U8=";
+  };
+  env.npmDeps_ui_modular = fetchNpmDeps {
+    name = "npm-deps-ui-modular";
+    src = "${src}/pagefind_ui/modular";
+    hash = "sha256-O0RqZUsRFtByxMQdwNGNcN38Rh+sDqqNo9YlBcrnsF4=";
+  };
+
+  postPatch = ''
+    # Tricky way to run npmConfigHook multiple times
+    (
+      local postPatchHooks=() # written to by npmConfigHook
+      source ${npmHooks.npmConfigHook}/nix-support/setup-hook
+      npmRoot=pagefind_web_js     npmDeps=$npmDeps_web_js     npmConfigHook
+      npmRoot=pagefind_ui/default npmDeps=$npmDeps_ui_default npmConfigHook
+      npmRoot=pagefind_ui/modular npmDeps=$npmDeps_ui_modular npmConfigHook
+    )
+  '';
+
+  nativeBuildInputs = [
+    binaryen
+    gzip
+    nodejs
+    rustc-wasm32
+    rustc-wasm32.llvmPackages.lld
+    wasm-bindgen-84
+    wasm-pack
+  ];
+
+  # build wasm and js assets
+  # based on "test-and-build" in https://github.com/CloudCannon/pagefind/blob/main/.github/workflows/release.yml
+  preBuild = ''
+    export HOME=$(mktemp -d)
+    (
+      cd pagefind_web_js
+      npm run build-coupled
+    )
+
+    (
+      cd pagefind_web
+      export RUSTFLAGS="-C linker=lld"
+      bash ./local_build.sh
+    )
+
+    (
+      cd pagefind_ui/default
+      npm run build
+    )
+
+    (
+      cd pagefind_ui/modular
+      npm run build
+    )
+  '';
+
+  buildFeatures = [ "extended" ];
+
+  meta = with lib; {
+    description = "Generate low-bandwidth search index for your static website";
+    homepage = "https://pagefind.app/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbsds ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/talosctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-HYIk1oZbtcnHLap+4AMwoQN0k44zjiiwDzGcNW+9qqM=";
+    hash = "sha256-CEalMrXdLa/pGok1uB60PmxYmmDnSas38cUxvOpkoGk=";
   };
 
-  vendorHash = "sha256-Aefwa8zdKWV9TE9rwNA4pzKZekTurkD0pTDm3QfKdUQ=";
+  vendorHash = "sha256-JDhpRXYnNhVJ5BBKdUmCponRpckH54gMRoKLQ+wx5zM=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/networking/cluster/timoni/default.nix

@@ -23,6 +23,8 @@ buildGoModule rec {
   # Some tests require running Kubernetes instance
   doCheck = false;
 
+  passthru.updateScript = ./update.sh;
+
   ldflags = [
     "-s"
     "-w"

pkgs/applications/networking/cluster/timoni/update.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix jq
+set -euo pipefail
+
+PKG_DIR=$(dirname "${BASH_SOURCE[@]}")
+FILE="$PKG_DIR/default.nix"
+NIXPKGS_ROOT=$(cd $PKG_DIR && git rev-parse --show-toplevel)
+ATTR="timoni"
+
+PREV_VERSION=$(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.version)
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/stefanprodan/timoni/releases/latest | jq -r '.tag_name')
+NEXT_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
+
+# update version
+sed -i "s|$PREV_VERSION|$NEXT_VERSION|" "$FILE"
+
+# update hash
+PREV_HASH=$(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.outputHash)
+NEXT_HASH=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack --type sha256 $(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.url)))
+sed -i "s|$PREV_HASH|$NEXT_HASH|" "$FILE"
+
+# update vendor hash
+PREV_VENDOR_HASH=$(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.vendorHash)
+EMPTY_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+sed -i "s|$PREV_VENDOR_HASH|$EMPTY_HASH|" "$FILE"
+
+set +e
+NEXT_VENDOR_HASH=$(nix-build $NIXPKGS_ROOT --no-out-link -A $ATTR 2>&1 | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+set -e
+
+if [ -z "${NEXT_VENDOR_HASH:-}" ]; then
+    echo "Update failed. NEXT_VENDOR_HASH is empty." >&2
+    exit 1
+fi
+
+sed -i "s|$EMPTY_HASH|$NEXT_VENDOR_HASH|" "$FILE"
+
+cat <<EOF
+[{
+    "attrPath": "$ATTR",
+    "oldVersion": "$PREV_VERSION",
+    "newVersion": "$NEXT_VERSION",
+    "files": ["$PWD/default.nix.nix"]
+}]
+EOF

pkgs/applications/networking/mailreaders/meli/default.nix

@@ -0,0 +1,79 @@
+{ stdenv
+, lib
+, fetchgit
+, rustPlatform
+
+# native build inputs
+, pkg-config
+, installShellFiles
+, makeWrapper
+, mandoc
+, rustfmt
+, file
+
+# build inputs
+, openssl
+, dbus
+, sqlite
+
+# runtime deps
+, gnum4
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "meli";
+  version = "0.8.1";
+
+  src = fetchgit {
+    url = "https://git.meli.delivery/meli/meli.git";
+    rev = "v${version}";
+    hash = "sha256-sHpW2yjqYz4ePR6aQFUBD6BZwgDt3DT22/kWuKr9fAc=";
+  };
+
+  cargoSha256 = "sha256-Pg3V6Bd+drFPiJtUwsoKxu6snN88KvM+lsvnWBK/rvk=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+    makeWrapper
+    mandoc
+    (rustfmt.override { asNightly = true; })
+  ];
+
+  buildInputs = [
+    openssl
+    dbus
+    sqlite
+  ];
+
+  nativeCheckInputs = [
+    file
+  ];
+
+  postInstall = ''
+    installManPage meli/docs/*.{1,5,7}
+
+    wrapProgram $out/bin/meli \
+      --prefix PATH : ${lib.makeBinPath [ gnum4 ]}
+  '';
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  checkFlags = [
+    "--skip=conf::test_config_parse"        # panicking due to sandbox
+    "--skip=smtp::test::test_smtp"          # requiring network
+    "--skip=utils::xdg::query_default_app"  # doesn't build
+    "--skip=utils::xdg::query_mime_info"    # doesn't build
+  ];
+
+  meta = with lib; {
+    broken = (stdenv.isLinux && stdenv.isAarch64);
+    description = "Terminal e-mail client and e-mail client library";
+    homepage = "https://meli.delivery";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ _0x4A6F matthiasbeyer ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/networking/termius/default.nix

@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "termius";
-  version = "7.56.1";
+  version = "8.1.2";
 
   src = fetchurl {
     # find the latest version with
@@ -22,8 +22,8 @@ stdenv.mkDerivation rec {
     # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_url' -r
     # and the sha512 with
     # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_sha512' -r
-    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_144.snap";
+    url = "https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_167.snap";
-    sha512 = "aad9ab72ad3dcbb897fa99139b83993770c243f49e8784c34ac38603f0d76578374723e756c4f51ea2d0a39f6b9c7738e7ce070a8ddfa11f8cf831260563f6d9";
+    hash = "sha512-M/cyLfSnoCFJcdGXlA5/kH/MuyRpYcfBoyp6y6KSsTyh8Goq6niGZAQcCdIjNX8KVUvmcTWISsx8so4W5BrkCw==";
   };
 
   desktopItem = makeDesktopItem {

pkgs/applications/science/biology/blast/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "blast";
-  version = "2.14.0";
+  version = "2.14.1";
 
   src = fetchurl {
     url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-src.tar.gz";
-    sha256 = "sha256-v0d/Gww7gvC3pwlL8AOpqD4347BxbB33mQYMT+qxdQA=";
+    sha256 = "sha256-cSwtvfD7E8wcLU9O9d0c5LBsO1fpbf6o8j5umfWxZQ4=";
   };
 
   sourceRoot = "ncbi-blast-${version}+-src/c++";

pkgs/applications/version-management/gitui/default.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitui";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "extrawurst";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sqYG27TImVpsoG0PH5AQrAyFTHOXOJnWEqG9RxLbkLo=";
+    hash = "sha256-mT5toF4mKRP0dlwlfKHjmFFQJ/cWSb2vwg1uZbhZRhI=";
   };
 
-  cargoHash = "sha256-Dlvr+lwCj68CSa2G2lc4dNShCfj56h9FqA9UZUOq+IQ=";
+  cargoHash = "sha256-8j0NtJB2ErrpljPHSMRD/4IGZuqA8wLuzPnuQqxaXRg=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Blazing fast terminal-ui for Git written in Rust";
     homepage = "https://github.com/extrawurst/gitui";
-    changelog = "https://github.com/extrawurst/gitui/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/extrawurst/gitui/blob/v${version}/CHANGELOG.md";
     mainProgram = "gitui";
     license = licenses.mit;
     maintainers = with maintainers; [ Br1ght0ne yanganto mfrw ];

pkgs/development/interpreters/wasmer/default.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "4.0.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vpIvoKvIqXgJ6MtuqM3dryR8nxLB/diLyQYcuGkZDLU=";
+    hash = "sha256-7E/of0WP28VM7ceDCBsSCb6ot3FEYUZkHVk0H/LcbGk=";
   };
 
-  cargoHash = "sha256-1Gx8MLPAA/LV9jdK8gkztcsjltju0ousETLEiTEAaEo=";
+  cargoHash = "sha256-1YlwYgnZzkYjY2yQlSZTs3JrUnIeZgpCDZBevqlj4WM=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

pkgs/development/libraries/nuspell/default.nix

@@ -2,24 +2,23 @@
 
 stdenv.mkDerivation rec {
   pname = "nuspell";
-  version = "5.1.2";
+  version = "5.1.3";
 
   src = fetchFromGitHub {
     owner = "nuspell";
     repo = "nuspell";
     rev = "v${version}";
-    sha256 = "sha256-nGC8Um9GutJZXlUcUCK0IiHxMaZmeoe4febw/jC2dRU=";
+    hash = "sha256-ww7Kqzlnf7065i9RZLeFDUOPBMCVgV/6sBnN0+WvBTk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ catch2 ];
   propagatedBuildInputs = [ icu ];
 
-  outputs = [ "out" "lib" "dev" ];
+  cmakeFlags = [ "-DBUILD_TESTING=YES" ];
+  doCheck = true;
 
-  postPatch = ''
+  outputs = [ "out" "lib" "dev" ];
-    rm -rf external/Catch2
-    ln -sf ${catch2.src} external/Catch2
-  '';
 
   meta = with lib; {
     description = "Free and open source C++ spell checking library";

pkgs/development/python-modules/fschat/default.nix

@@ -0,0 +1,102 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, aiohttp
+, fastapi
+, httpx
+, markdown2
+, nh3
+, numpy
+, prompt-toolkit
+, pydantic
+, requests
+, rich
+, shortuuid
+, tiktoken
+, uvicorn
+, anthropic
+, openai
+, ray
+, wandb
+, einops
+, gradio
+, accelerate
+, peft
+, sentencepiece
+, torch
+, transformers
+, protobuf
+}:
+let
+  version = "0.2.28";
+in
+buildPythonPackage {
+  pname = "fschat";
+  inherit version;
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "lm-sys";
+    repo = "FastChat";
+    rev = "v${version}";
+    hash = "sha256-nTP4zY6mJykzKb6LBWosg77mwE33vq9eiYSpAlZU5NI=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    fastapi
+    httpx
+    markdown2
+    nh3
+    numpy
+    prompt-toolkit
+    pydantic
+    requests
+    rich
+    shortuuid
+    tiktoken
+    uvicorn
+  # ] ++ markdown2.optional-dependencies.all;
+  ];
+
+  passthru.optional-dependencies = {
+    llm_judge = [
+      anthropic
+      openai
+      ray
+    ];
+    train = [
+      # flash-attn
+      wandb
+      einops
+    ];
+    webui = [
+      gradio
+    ];
+    model_worker = [
+      accelerate
+      peft
+      sentencepiece
+      torch
+      transformers
+      protobuf
+    ];
+  };
+
+  pythonImportsCheck = [ "fastchat" ];
+
+  # tests require networking
+  doCheck = false;
+
+  meta = with lib; {
+    description = "An open platform for training, serving, and evaluating large language models. Release repo for Vicuna and Chatbot Arena";
+    homepage = "https://github.com/lm-sys/FastChat";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}

pkgs/development/python-modules/osc/default.nix

@@ -1,16 +1,23 @@
-{ stdenv, lib, buildPythonPackage, fetchFromGitHub, bashInteractive
+{ stdenv
-, rpm, urllib3, cryptography, diffstat
+, bashInteractive
+, buildPythonPackage
+, cryptography
+, diffstat
+, fetchFromGitHub
+, lib
+, rpm
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "osc";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "osc";
     rev = version;
-    sha256 = "sha256-gHcPqo3AuSrVprYUGLenC0kw9hKNmjabZ1m6YVMsNPs=";
+    sha256 = "sha256-pywSXGM3IX3cTr1uJIP7pNGIYE/skMIoJeoaMU75zwc=";
   };
 
   buildInputs = [ bashInteractive ]; # needed for bash-completion helper

pkgs/development/python-modules/simple-websocket/default.nix

@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, setuptools
+, wheel
+, wsproto
+}:
+
+buildPythonPackage rec {
+  pname = "simple-websocket";
+  version = "0.9.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "miguelgrinberg";
+    repo = "simple-websocket";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-pGPHS3MbDZgXBOtsZ87ULlkGdHHfaOSDLTNN4l5wKhE=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    wsproto
+  ];
+
+  pythonImportsCheck = [
+    "simple_websocket"
+  ];
+
+  meta = with lib; {
+    description = "Simple WebSocket server and client for Python";
+    homepage = "https://github.com/miguelgrinberg/simple-websocket";
+    changelog = "https://github.com/miguelgrinberg/simple-websocket/blob/${version}/CHANGES.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/simplefix/default.nix

@@ -1,24 +1,41 @@
-{ lib, python, buildPythonPackage, fetchFromGitHub }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, unittestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "simplefix";
-  version = "1.0.16";
+  version = "1.0.17";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     repo = "simplefix";
     owner = "da4089";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dkwmWCOeTAoeSY8+1wg7RWX/d57JWc8bGagzrEPMAIU=";
+    hash = "sha256-D85JW3JRQ1xErw6krMbAg94WYjPi76Xqjv/MGNMY5ZU=";
   };
 
-  checkPhase = ''
+  nativeCheckInputs = [
-    cd test
+    unittestCheckHook
-    ${python.interpreter} -m unittest all
+  ];
-  '';
+
+  pythonImportsCheck = [
+    "simplefix"
+  ];
+
+  unittestFlagsArray = [
+    "-s"
+    "test"
+  ];
 
   meta = with lib; {
     description = "Simple FIX Protocol implementation for Python";
     homepage = "https://github.com/da4089/simplefix";
+    changelog = "https://github.com/da4089/simplefix/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ catern ];
   };

pkgs/development/python-modules/spsdk/default.nix

@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, dos2unix
 , pythonRelaxDepsHook
 , asn1crypto
 , astunparse
@@ -29,6 +28,8 @@
 , pyserial
 , ruamel-yaml
 , sly
+, spsdk
+, testers
 , typing-extensions
 , pytestCheckHook
 , voluptuous
@@ -80,6 +81,7 @@ buildPythonPackage rec {
     deepmerge
     fastjsonschema
     hexdump
+    importlib-metadata
     jinja2
     libusbsio
     oscrypto
@@ -94,7 +96,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    importlib-metadata
     pyftdi
     pytestCheckHook
     voluptuous
@@ -102,11 +103,14 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "spsdk" ];
 
+  passthru.tests.version = testers.testVersion { package = spsdk; };
+
   meta = with lib; {
     changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.rev}/docs/release_notes.rst";
     description = "NXP Secure Provisioning SDK";
     homepage = "https://github.com/nxp-mcuxpresso/spsdk";
     license = licenses.bsd3;
     maintainers = with maintainers; [ frogamic sbruder ];
+    mainProgram = "spsdk";
   };
 }

pkgs/development/python-modules/types-pytz/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-pytz";
-  version = "2023.3.0.1";
+  version = "2023.3.1.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GnuNSqxwmBz6JEeKQerfzZagh8mG1vFQ13486zwr36s=";
+    hash = "sha256-jn0hmMukSnLfdiiIfJD2ilaOFEXxTbZGMa9Qw8q4wJA=";
   };
 
   # Modules doesn't have tests

pkgs/development/tools/database/liquibase/default.nix

@@ -25,11 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "4.23.1";
+  version = "4.23.2";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-uWZ9l6C6QlVHqp/ma6/sz07zuCHpGucy7GhNDq8v1/U=";
+    hash = "sha256-/H0qn6l9kSA9Y5tmRxXUCVPGyRVaUiWg3cTIB5uaNkE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/rust/cargo-binstall/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-uT8nSsC8QstjbyO5Ve2jSug3Bd/DuUNoGzquDPVl++o=";
+    hash = "sha256-BuJpxsB7tF/MSF8g17cHOyHIwbd2JmlQYe1uG9qJGt8=";
   };
 
-  cargoHash = "sha256-rxQKU73ANokxLb42u3Zom+5Wbv/ayiQJaM9NsTWW8fU=";
+  cargoHash = "sha256-H+svFw/JEYB8fbmX/5WWGb7qQnm1WBNCuqgJZYDWD00=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/development/web/bun/default.nix

@@ -3,6 +3,7 @@
 , fetchurl
 , autoPatchelfHook
 , unzip
+, installShellFiles
 , openssl
 , writeShellScript
 , curl
@@ -17,7 +18,7 @@ stdenvNoCC.mkDerivation rec {
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
 
   strictDeps = true;
-  nativeBuildInputs = [ unzip ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = [ unzip installShellFiles ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ];
   buildInputs = [ openssl ];
 
   dontConfigure = true;
@@ -31,6 +32,21 @@ stdenvNoCC.mkDerivation rec {
 
     runHook postInstall
   '';
+
+  postPhases = [ "postPatchelf" ];
+  postPatchelf = lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+    completions_dir=$(mktemp -d)
+
+    SHELL="bash" $out/bin/bun completions $completions_dir
+    SHELL="zsh" $out/bin/bun completions $completions_dir
+    SHELL="fish" $out/bin/bun completions $completions_dir
+
+    installShellCompletion --name bun \
+      --bash $completions_dir/bun.completion.bash \
+      --zsh $completions_dir/_bun \
+      --fish $completions_dir/bun.fish
+  '';
+
   passthru = {
     sources = {
       "aarch64-darwin" = fetchurl {

pkgs/os-specific/linux/pam_rssh/default.nix

@@ -1,25 +1,32 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, coreutils
 , pkg-config
 , openssl
 , pam
 , openssh
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "pam_rssh";
   version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "z4yx";
     repo = "pam_rssh";
-    rev = "92c240bd079e9711c7afa8bacfcf01de48f42577";
+    rev = "v${version}";
-    hash = "sha256-mIQeItPh6RrF3cFbAth2Kmb2E/Xj+lOgatvjcLE4Yag=";
+    hash = "sha256-SDtMqGy2zhq9jEQVwSEl4EwRp2jgXfTVLrCX7k/kBeU=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-QMyMqsjZ91WimIaaSCXtbRScS3BoB+yFtHjx3xViq7U=";
+  cargoHash = "sha256-gNy1tcHDUOG1XduGAIMapvx5dlq+U1LitUQkccGfb9o=";
+
+  postPatch = ''
+    substituteInPlace src/auth_keys.rs \
+      --replace '/bin/echo' '${coreutils}/bin/echo' \
+      --replace '/bin/false' '${coreutils}/bin/false'
+  '';
 
   nativeBuildInputs = [
     pkg-config

pkgs/servers/ldap/lldap/default.nix

@@ -7,6 +7,7 @@
 , nixosTests
 , rustPlatform
 , rustc
+, rustc-wasm32
 , stdenv
 , wasm-bindgen-cli
 , wasm-pack
@@ -15,23 +16,6 @@
 
 let
 
-  # replace with upstream wasm rustc, after resolution of
-  # https://github.com/NixOS/nixpkgs/issues/89426
-  rustc-wasm = (rustc.override {
-    stdenv = stdenv.override {
-      targetPlatform = stdenv.targetPlatform // {
-        parsed = {
-          cpu.name = "wasm32";
-          vendor.name = "unknown";
-          kernel.name = "unknown";
-          abi.name = "unknown";
-        };
-      };
-    };
-  }).overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags ++ ["--set=build.docs=false"];
-  });
-
   wasm-bindgen-84 = wasm-bindgen-cli.override {
     version = "0.2.84";
     hash = "sha256-0rK+Yx4/Jy44Fw5VwJ3tG243ZsyOIBBehYU54XP/JGk=";
@@ -64,7 +48,7 @@ let
     pname = commonDerivationAttrs.pname + "-frontend";
 
     nativeBuildInputs = [
-      wasm-pack wasm-bindgen-84 binaryen which rustc-wasm rustc-wasm.llvmPackages.lld
+      wasm-pack wasm-bindgen-84 binaryen which rustc-wasm32 rustc-wasm32.llvmPackages.lld
     ];
 
     buildPhase = ''

pkgs/servers/static-web-server/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "static-web-server";
-  version = "2.21.1";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "static-web-server";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-odt9ztEjb+ppi1e+SI7T6BGtSWVG4EM14lyuVoz5gOM=";
+    hash = "sha256-KZHz+oSvjqFZaKvy+HfPoMQlwQ5ZTyPQV7hMlPBIujE=";
   };
 
-  cargoHash = "sha256-HWiMaMnco4xkskjRroqgy11D/Plg/1VDZwn/IpNG6LM=";
+  cargoHash = "sha256-y67i3p0EImmJquEVJ1U7R83/hMz+Ex3NDnRjrHJvYE4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security

pkgs/tools/admin/trivy/default.nix

@@ -26,7 +26,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=main.version=v${version}"
+    "-X=github.com/aquasecurity/trivy/pkg/version.ver=v${version}"
   ];
 
   # Tests require network access
@@ -37,7 +37,7 @@ buildGoModule rec {
   passthru.tests.version = testers.testVersion {
     package = trivy;
     command = "trivy --version";
-    version = "v${version}";
+    version = "Version: v${version}";
   };
 
   meta = with lib; {

pkgs/tools/misc/urlencode/default.nix

@@ -0,0 +1,24 @@
+{ fetchFromGitHub
+, lib
+, rustPlatform
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "urlencode";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "dead10ck";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-LvLUbtMPVbYZMUb9vWhTscYfZPtEM5GrZme3azvVlPE=";
+  };
+
+  cargoSha256 = "sha256-UPw+/wVOEM+kciOr70P+gdMCxtCKQ/SXsNAWA44v4v8=";
+
+  meta = with lib; {
+    description = "A CLI utility for URL-encoding or -decoding strings";
+    homepage = "https://github.com/dead10ck/urlencode";
+    license = licenses.mit;
+    maintainers = with maintainers; [ l0b0 ];
+  };
+}

pkgs/tools/networking/bandwhich/default.nix

@@ -1,37 +1,28 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, Security, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "bandwhich";
-  version = "0.20.0";
+  version = "unstable-2023-09-11";
 
   src = fetchFromGitHub {
     owner = "imsnif";
     repo = pname;
-    rev = version;
+    rev = "eba356220cc06254b96cd3241bc80ab7a0ab017b";
-    hash = "sha256-lggeJrPfZTpUEydFJ9XXgbbS3pmrGqTef2ROsPOmiwQ=";
+    hash = "sha256-qrVGUbVbURXSKJy28mhpwVkzSGgct8PPOnwb0FdVWtE=";
   };
 
-  cargoHash = "sha256-kGRsF+THNQahEoD3vY+XcPrr9cHjchtg86tMvcIdHPk=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "packet-builder-0.7.0" = "sha256-KxNrnLZ/z3JJ3E1pCTJF9tNXI7XYNRc6ooTUz3avpjw=";
+    };
+  };
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
   # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
   doCheck = !stdenv.isDarwin;
 
-  cargoPatches = [
-    # FIXME: remove when the linked-hash-map dependency is bumped upstream
-    # https://github.com/imsnif/bandwhich/pull/222/
-    (fetchpatch {
-      name = "update-linked-hash-map.patch";
-      url = "https://github.com/imsnif/bandwhich/commit/be06905de2c4fb91afc22d50bf3cfe5a1e8003f5.patch";
-      hash = "sha256-FyZ7jUXK7ebXq7q/lvRSe7YdPnpYWKZE3WrSKLMjJeA=";
-    })
-
-    # Tweaked https://github.com/imsnif/bandwhich/pull/245 so that it merges
-    # cleanly with the earlier patch.
-    ./update-socket2-for-rust-1.64.diff
-  ];
-
   meta = with lib; {
     description = "A CLI utility for displaying current network utilization";
     longDescription = ''

pkgs/tools/networking/bandwhich/update-socket2-for-rust-1.64.diff

@@ -1,160 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index bcaf9da..7d9c97e 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -76,7 +76,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "924c76597f0d9ca25d762c25a4d369d51267536465dc5064bdf0eb073ed477ea"
- dependencies = [
-  "backtrace-sys",
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "libc",
-  "rustc-demangle",
- ]
-@@ -238,6 +238,12 @@ version = "0.1.9"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "b486ce3ccf7ffd79fdeb678eac06a9e6c09fc88d33836340becb8fffe87c5e33"
- 
-+[[package]]
-+name = "cfg-if"
-+version = "1.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-+
- [[package]]
- name = "chrono"
- version = "0.4.9"
-@@ -357,7 +363,7 @@ version = "1.2.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "ba125de2af0df55319f41944744ad91c71113bf74a4646efff39afe1f6842db1"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
- ]
- 
- [[package]]
-@@ -388,7 +394,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
- dependencies = [
-  "autocfg 1.0.1",
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "crossbeam-utils",
-  "lazy_static",
-  "maybe-uninit",
-@@ -403,7 +409,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
- dependencies = [
-  "autocfg 1.0.1",
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "lazy_static",
- ]
- 
-@@ -528,7 +534,7 @@ version = "1.0.17"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "766d0e77a2c1502169d4a93ff3b8c15a71fd946cd0126309752104e5f3c46d94"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "crc32fast",
-  "libc",
-  "miniz_oxide",
-@@ -683,7 +689,7 @@ version = "0.1.13"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "e7db7ca94ed4cd01190ceee0d8a8052f08a247aa1b469a7f68c6a3b71afcf407"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "libc",
-  "wasi",
- ]
-@@ -894,7 +900,7 @@ version = "0.4.8"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "14b6052be84e6b71ab17edffc2eeabf5c2c3ae1fdb464aae35ac50c67a44e1f7"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
- ]
- 
- [[package]]
-@@ -960,7 +966,7 @@ version = "0.6.21"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "302dec22bcf6bae6dfb69c647187f4b4d0fb6f535521f7bc022430ce8e12008f"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "fuchsia-zircon",
-  "fuchsia-zircon-sys",
-  "iovec",
-@@ -1033,7 +1039,7 @@ version = "0.2.33"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "42550d9fb7b6684a6d404d9fa7250c2eb2646df731d1c06afc06dcee9e1bcf88"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "libc",
-  "winapi 0.3.8",
- ]
-@@ -1120,7 +1126,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "8d575eff3665419f9b83678ff2815858ad9d11567e082f5ac1814baba4e2bcb4"
- dependencies = [
-  "bitflags 1.2.1",
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "foreign-types",
-  "lazy_static",
-  "libc",
-@@ -1176,7 +1182,7 @@ version = "0.7.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "d58c7c768d4ba344e3e8d72518ac13e259d7c7ade24167003b8488e10b6740a3"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "cloudabi",
-  "libc",
-  "redox_syscall",
-@@ -1840,13 +1846,12 @@ checksum = "4ecf3b85f68e8abaa7555aa5abdb1153079387e60b718283d732f03897fcfc86"
- 
- [[package]]
- name = "socket2"
--version = "0.3.11"
-+version = "0.3.19"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "e8b74de517221a2cb01a53349cf54182acdc31a074727d3079068448c0676d85"
-+checksum = "122e570113d28d773067fab24266b66753f6ea915758651696b6e35e49f88d6e"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 1.0.0",
-  "libc",
-- "redox_syscall",
-  "winapi 0.3.8",
- ]
- 
-@@ -1990,7 +1995,7 @@ version = "0.15.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "13816d558f404113dfdf855ed982f160cf697b3e573a68b2b798062032182212"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "doc-comment",
-  "libc",
-  "ntapi",
-@@ -2005,7 +2010,7 @@ version = "3.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "libc",
-  "rand 0.7.2",
-  "redox_syscall",
-@@ -2121,7 +2126,7 @@ version = "0.18.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "72d7df08b45f4d6d124cdae3c303f9908159a17b39e633e524349e91bc798d32"
- dependencies = [
-- "cfg-if",
-+ "cfg-if 0.1.9",
-  "failure",
-  "futures",
-  "ipconfig",

pkgs/tools/networking/pgrok/add_version_to_package.json.patch

@@ -0,0 +1,11 @@
+diff --git a/package.json b/package.json
+index 35d34c5..82eda74 100644
+--- a/package.json
++++ b/package.json
+@@ -1,5 +1,6 @@
+ {
+   "name": "pgrokd",
++  "version": "0.0.0",
+   "scripts": {
+     "dev": "vite",
+     "build": "tsc && vite build --outDir=../cli/dist --emptyOutDir",

pkgs/tools/networking/pgrok/default.nix

@@ -1,22 +1,25 @@
 { lib
 , buildGoModule
+, callPackage
 , fetchFromGitHub
-, nix-update-script
 }:
-
+let
-buildGoModule rec {
+  version = "1.4.0";
-  pname = "pgrok";
-  version = "1.3.4";
-
   src = fetchFromGitHub {
     owner = "pgrok";
     repo = "pgrok";
     rev = "v${version}";
-    hash = "sha256-lhcaJVIqZK7GnC/Q/+RDxTVFmgTana3vugDHr/SStFE=";
+    hash = "sha256-2k3XLXmf1Xnx4HvS7sD/aq+78Z4I7uY4djV958n5TX4=";
   };
-  vendorHash = "sha256-UzNx361cg4IDSQGlX5N9AxYZ8cYA0zsF5JF4Fe7efqM=";
+  web = callPackage ./web.nix { inherit src version; };
+in
+buildGoModule {
+  pname = "pgrok";
+  inherit version src;
 
-  outputs = [ "out" "server" ];
+  vendorHash = "sha256-M0xVHRh9NKPxmUEmx1dDQUZc8aXcdAfHisQAnt72RdY=";
+
+  outputs = [ "out" "server" "web" ];
 
   ldflags = [
     "-s"
@@ -26,11 +29,24 @@ buildGoModule rec {
     "-X main.date=unknown"
   ];
 
-  postInstall = ''
+  subPackages = [
-    moveToOutput bin/pgrokd $server
+    "pgrok/pgrok"
+    "pgrokd/pgrokd"
+  ];
+
+  postPatch = ''
+    # rename packages due to naming conflict
+    mv pgrok/cli/ pgrok/pgrok/
+    mv pgrokd/cli/ pgrokd/pgrokd/
+    cp -r ${web} pgrokd/pgrokd/dist
   '';
 
-  passthru.updateScript = nix-update-script { };
+  postInstall = ''
+    moveToOutput bin/pgrokd $server
+    cp -r ${web} $web
+  '';
+
+  passthru.updateScript = ./update.sh;
 
   meta = {
     description = "Selfhosted TCP/HTTP tunnel, ngrok alternative, written in Go";

pkgs/tools/networking/pgrok/update.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget nix-prefetch-github moreutils jq prefetch-npm-deps nodejs
+
+# adapted from https://github.com/NixOS/nixpkgs/blob/f4ffbe5ecb8039816f2dae60526e0a47f65a2b4e/pkgs/servers/memos/update.sh
+
+set -euo pipefail
+
+TARGET_VERSION_REMOTE=$(curl -s https://api.github.com/repos/pgrok/pgrok/releases/latest | jq -r ".tag_name")
+TARGET_VERSION=${TARGET_VERSION_REMOTE#v}
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
+  echo "pgrok is up-to-date: ${UPDATE_NIX_OLD_VERSION}"
+  exit 0
+fi
+
+extractVendorHash() {
+  original="${1?original hash missing}"
+  result="$(nix-build -A pgrok.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
+}
+
+replaceHash() {
+  old="${1?old hash missing}"
+  new="${2?new hash missing}"
+  awk -v OLD="$old" -v NEW="$new" '{
+    if (i=index($0, OLD)) {
+      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
+    }
+    print $0;
+  }' ./pkgs/tools/networking/pgrok/default.nix | sponge ./pkgs/tools/networking/pgrok/default.nix
+}
+
+# change version number
+sed -e "s/version =.*;/version = \"$TARGET_VERSION\";/g" \
+    -i ./pkgs/tools/networking/pgrok/default.nix
+
+# update hash
+SRC_HASH="$(nix-instantiate --eval -A pgrok.src.outputHash | tr -d '"')"
+NEW_HASH="$(nix-prefetch-github pgrok pgrok --rev v$TARGET_VERSION | jq -r .hash)"
+
+replaceHash "$SRC_HASH" "$NEW_HASH"
+
+GO_HASH="$(nix-instantiate --eval -A pgrok.vendorHash | tr -d '"')"
+EMPTY_HASH="$(nix-instantiate --eval -A lib.fakeHash | tr -d '"')"
+replaceHash "$GO_HASH" "$EMPTY_HASH"
+replaceHash "$EMPTY_HASH" "$(extractVendorHash "$GO_HASH")"
+
+# update src yarn lock
+SRC_FILE_BASE="https://raw.githubusercontent.com/pgrok/pgrok/v$TARGET_VERSION"
+
+pushd ./pkgs/tools/networking/pgrok
+wget -q "$SRC_FILE_BASE/pgrokd/web/package.json"
+npm install --package-lock-only
+rm package.json*
+NPM_HASH=$(prefetch-npm-deps ./package-lock.json)
+popd
+
+sed -i -E -e "s#npmDepsHash = \".*\"#npmDepsHash = \"$NPM_HASH\"#" ./pkgs/tools/networking/pgrok/web.nix

pkgs/tools/networking/pgrok/web.nix

@@ -0,0 +1,29 @@
+{ buildNpmPackage
+, src
+, version
+}:
+buildNpmPackage {
+    name = "pgrok-web";
+    inherit src version;
+    sourceRoot = "${src.name}/pgrokd/web";
+
+    npmDepsHash = "sha256-f4pDBoG6sTJE3aUknqUvHHpBR9KWo/B4YMrWHkGbvA8=";
+
+    # Upstream doesn't have a lockfile
+    postPatch = ''
+      cp ${./package-lock.json} ./package-lock.json
+      substituteInPlace ./package.json \
+        --replace "../cli/dist" "$out"
+    '';
+
+    patches = [
+      ./add_version_to_package.json.patch
+    ];
+
+    dontInstall = true;
+    dontFixup = true;
+
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmPackFlags = [ "--ignore-scripts" ];
+  }

pkgs/tools/security/grype/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.66.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oZSXUwWucSyd2JYx0TkYfxgP6NZjjA2bhTrlOJSNh8c=";
+    hash = "sha256-im7dEKkWs63AUxLa659ceKremmubK7eM2rSskEEKiww=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-Ur68es1eXsIldXqZjBbtMoK2fjvTIZ+ae2cWaiNzfBg=";
+  vendorHash = "sha256-r/1UlU0DU5gSX1aW7Jdk7BR6+rt/4/88eYp5ycLI9Wk=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -45,18 +45,18 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/anchore/grype/internal/version.version=${version}"
+    "-X=main.version=${version}"
-    "-X=github.com/anchore/grype/internal/version.gitDescription=v${version}"
+    "-X=main.gitDescription=v${version}"
-    "-X=github.com/anchore/grype/internal/version.gitTreeState=clean"
+    "-X=main.gitTreeState=clean"
   ];
 
   preBuild = ''
     # grype version also displays the version of the syft library used
     # we need to grab it from the go.sum and add an ldflag for it
     SYFT_VERSION="$(grep "github.com/anchore/syft" go.sum -m 1 | awk '{print $2}')"
-    ldflags+=" -X github.com/anchore/grype/internal/version.syftVersion=$SYFT_VERSION"
+    ldflags+=" -X main.syftVersion=$SYFT_VERSION"
-    ldflags+=" -X github.com/anchore/grype/internal/version.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X main.gitCommit=$(cat COMMIT)"
-    ldflags+=" -X github.com/anchore/grype/internal/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
+    ldflags+=" -X main.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
   preCheck = ''

pkgs/top-level/aliases.nix

@@ -1102,7 +1102,6 @@ mapAliases ({
   mcgrid = throw "mcgrid has been removed from nixpkgs, as it's not compatible with rivet 3"; # Added 2020-05-23
   mcomix3 = mcomix; # Added 2022-06-05
   mediatomb = throw "mediatomb is no longer maintained upstream, use gerbera instead"; # added 2022-01-04
-  meli = throw "'meli' has been removed as it requires an outdated version of openssl"; # added 2023-05-12
   meme = meme-image-generator; # Added 2021-04-21
   memtest86 = throw "'memtest86' has been renamed to/replaced by 'memtest86plus'"; # Converted to throw 2022-02-22
   mercurial_4 = throw "mercurial_4 has been removed as it's unmaintained"; # Added 2021-10-18

pkgs/top-level/all-packages.nix

@@ -8930,7 +8930,9 @@ with pkgs;
 
   gssdp-tools = callPackage ../development/libraries/gssdp/tools.nix { };
 
-  grype = callPackage ../tools/security/grype { };
+  grype = callPackage ../tools/security/grype {
+    buildGoModule = buildGo121Module;
+   };
 
   gt5 = callPackage ../tools/system/gt5 { };
 
@@ -11780,6 +11782,8 @@ with pkgs;
 
   PageEdit = libsForQt5.callPackage ../applications/office/PageEdit { };
 
+  pagefind = libsForQt5.callPackage ../applications/misc/pagefind { };
+
   paging-calculator  = callPackage ../development/tools/paging-calculator { };
 
   pagmo2 = callPackage ../development/libraries/pagmo2 { };
@@ -14290,6 +14294,8 @@ with pkgs;
 
   urdfdom-headers = callPackage ../development/libraries/urdfdom-headers { };
 
+  urlencode = callPackage ../tools/misc/urlencode {};
+
   uriparser = callPackage ../development/libraries/uriparser { };
 
   urlscan = callPackage ../applications/misc/urlscan { };
@@ -17163,6 +17169,22 @@ with pkgs;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
+  # https://github.com/NixOS/nixpkgs/issues/89426
+  rustc-wasm32 = (rustc.override {
+    stdenv = stdenv.override {
+      targetPlatform = stdenv.targetPlatform // {
+        parsed = {
+          cpu.name = "wasm32";
+          vendor.name = "unknown";
+          kernel.name = "unknown";
+          abi.name = "unknown";
+        };
+      };
+    };
+  }).overrideAttrs (old: {
+    configureFlags = old.configureFlags ++ ["--set=build.docs=false"];
+  });
+
   makeRustPlatform = callPackage ../development/compilers/rust/make-rust-platform.nix { };
 
   buildRustCrate = callPackage ../build-support/rust/build-rust-crate { };
@@ -33857,6 +33879,8 @@ with pkgs;
 
   meld = callPackage ../applications/version-management/meld { };
 
+  meli = callPackage ../applications/networking/mailreaders/meli { };
+
   melmatcheq.lv2 = callPackage ../applications/audio/melmatcheq.lv2 { };
 
   melody = callPackage ../tools/misc/melody { };

pkgs/top-level/python-packages.nix

@@ -4122,6 +4122,8 @@ self: super: with self; {
 
   fs-s3fs = callPackage ../development/python-modules/fs-s3fs { };
 
+  fschat = callPackage ../development/python-modules/fschat { };
+
   fsspec = callPackage ../development/python-modules/fsspec { };
 
   fst-pso = callPackage ../development/python-modules/fst-pso { };
@@ -11894,6 +11896,8 @@ self: super: with self; {
 
   simple-salesforce = callPackage ../development/python-modules/simple-salesforce { };
 
+  simple-websocket = callPackage ../development/python-modules/simple-websocket { };
+
   simple-websocket-server = callPackage ../development/python-modules/simple-websocket-server { };
 
   simplisafe-python = callPackage ../development/python-modules/simplisafe-python { };