Merge release-24.11 into staging-next-24.11

2024-11-23 00:17:54 +00:00 · 2024-11-23 00:17:54 +00:00 · b1e0f78e7e
commit b1e0f78e7e
parent f19d68694c e9406b9d3f
28 changed files with 248 additions and 138 deletions
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@ -329,6 +329,7 @@ rec {
  ucrtAarch64 = {
    config = "aarch64-w64-mingw32";
    libc = "ucrt";
+    rust.rustcTarget = "aarch64-pc-windows-gnullvm";
    useLLVM = true;
  };

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -41,6 +41,8 @@
 - `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
  This release also deprecates some configuration keys which are likely to be removed in version 5.0.0.

+- `netbird` has been updated to 0.31.1. This adds a built-in relay server which is not yet supported by the NixOS module, as well as a metrics endpoint for both the management and signal services. The default metrics port for the `signal` service has been changed from `9090` to `9091` to prevent a port conflict with the management server. This can be changed with their respective `metricsPort` as needed. Refer to the [release notes](https://github.com/netbirdio/netbird/releases/tag/v0.31.1) and [this pull request](https://github.com/NixOS/nixpkgs/pull/354032#issuecomment-2480925927) for more information.
+
 - `compressDrv` can compress selected files in a derivation. `compressDrvWeb` compresses files for common web server usage (`.gz` with `zopfli`, `.br` with `brotli`).

 - [`hardware.display`](#opt-hardware.display.edid.enable) is a new module implementing workarounds for misbehaving monitors
--- a/nixos/modules/services/networking/netbird/management.nix
+++ b/nixos/modules/services/networking/netbird/management.nix
@ -196,6 +196,12 @@ in
      description = "Internal port of the management server.";
    };

+    metricsPort = mkOption {
+      type = port;
+      default = 9090;
+      description = "Internal port of the metrics server.";
+    };
+
    extraOptions = mkOption {
      type = listOf str;
      default = [ ];
@ -360,6 +366,13 @@ in
          }
        ];

+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
    systemd.services.netbird-management = {
      description = "The management server for Netbird, a wireguard VPN";
      documentation = [ "https://netbird.io/docs/" ];
@ -387,6 +400,9 @@ in
            # Port to listen on
            "--port"
            cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
            # Log to stdout
            "--log-file"
            "console"
--- a/nixos/modules/services/networking/netbird/signal.nix
+++ b/nixos/modules/services/networking/netbird/signal.nix
@ -15,7 +15,12 @@ let
    mkOption
    ;

-  inherit (lib.types) enum port str;
+  inherit (lib.types)
+    listOf
+    enum
+    port
+    str
+    ;

  inherit (utils) escapeSystemdExecArgs;

@ -41,6 +46,20 @@ in
      description = "Internal port of the signal server.";
    };

+    metricsPort = mkOption {
+      type = port;
+      default = 9091;
+      description = "Internal port of the metrics server.";
+    };
+
+    extraOptions = mkOption {
+      type = listOf str;
+      default = [ ];
+      description = ''
+        Additional options given to netbird-signal as commandline arguments.
+      '';
+    };
+
    logLevel = mkOption {
      type = enum [
        "ERROR"
@ -54,24 +73,38 @@ in
  };

  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.port != cfg.metricsPort;
+        message = "The primary listen port cannot be the same as the listen port for the metrics endpoint";
+      }
+    ];
+
    systemd.services.netbird-signal = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      serviceConfig = {
-        ExecStart = escapeSystemdExecArgs [
-          (getExe' cfg.package "netbird-signal")
-          "run"
-          # Port to listen on
-          "--port"
-          cfg.port
-          # Log to stdout
-          "--log-file"
-          "console"
-          # Log level
-          "--log-level"
-          cfg.logLevel
-        ];
+        ExecStart = escapeSystemdExecArgs (
+          [
+            (getExe' cfg.package "netbird-signal")
+            "run"
+            # Port to listen on
+            "--port"
+            cfg.port
+            # Port the internal prometheus server listens on
+            "--metrics-port"
+            cfg.metricsPort
+            # Log to stdout
+            "--log-file"
+            "console"
+            # Log level
+            "--log-level"
+            cfg.logLevel
+          ]
+          ++ cfg.extraOptions
+        );

        Restart = "always";
        RuntimeDirectory = "netbird-mgmt";
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@ -515,13 +515,13 @@ in
              };

              originUrl = mkOption {
-                description = "The origin URL of the service. OAuth2 redirects will only be allowed to sites under this origin. Must end with a slash.";
+                description = "The redirect URL of the service. These need to exactly match the OAuth2 redirect target";
                type =
                  let
-                    originStrType = types.strMatching ".*://.*/$";
+                    originStrType = types.strMatching ".*://.*$";
                  in
                  types.either originStrType (types.nonEmptyListOf originStrType);
-                example = "https://someservice.example.com/";
+                example = "https://someservice.example.com/auth/login";
              };

              originLanding = mkOption {
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@ -298,13 +298,13 @@ in {
          # This mostly correspond to upstream NetBox's 'upgrade.sh' script.
          versionFile="${cfg.dataDir}/version"

-          if [[ -e "$versionFile" && "$(cat "$versionFile")" == "${cfg.package.version}" ]]; then
+          if [[ -h "$versionFile" && "$(readlink -- "$versionFile")" == "${cfg.package}" ]]; then
            exit 0
          fi

          ${pkg}/bin/netbox migrate
          ${pkg}/bin/netbox trace_paths --no-input
-          ${pkg}/bin/netbox collectstatic --no-input
+          ${pkg}/bin/netbox collectstatic --clear --no-input
          ${pkg}/bin/netbox remove_stale_contenttypes --no-input
          ${pkg}/bin/netbox reindex --lazy
          ${pkg}/bin/netbox clearsessions
@ -314,7 +314,7 @@ in {
            (lib.versionOlder cfg.package.version "3.7.0")
            "${pkg}/bin/netbox clearcache"}

-          echo "${cfg.package.version}" > "$versionFile"
+          ln -sfn "${cfg.package}" "$versionFile"
        '';

        serviceConfig = defaultServiceConfig // {
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -3,23 +3,23 @@
 {
  "kicad" = {
    kicadVersion = {
-      version =			"8.0.5";
+      version =			"8.0.6";
      src = {
-        rev =			"1413b8bfab256aa09ae3f23027b9ffe278161ca6";
-        sha256 =		"1g0w3g1gq6p72gg0jikdrh5mczcv5y16jmqi79bkp6nfl8gbx4l5";
+        rev =			"16c59e4e71dab2a0ed2f9e61f990b69657b4bfe2";
+        sha256 =		"1vc9igk8id2c34shilg7lh361psvwiqxpsn2yq7cwnwgaq7v1swq";
      };
    };
    libVersion = {
-      version =			"8.0.5";
+      version =			"8.0.6";
      libSources = {
-        symbols.rev =		"3bd95a02b135941ba00e5e4671e7c3ebc7672db4";
-        symbols.sha256 =	"12v8g48fgbalp0xrlgn3vm3ld79ymmwccv5aib6jz2qycdjxmznf";
-        templates.rev =		"4644b7570ba73dfe03a06a674c98d3fe2a7fe1e4";
+        symbols.rev =		"5fab56fc44319fed1d159cd7fa48e4468b0a5dad";
+        symbols.sha256 =	"1ahzx14bmjgpvifsl2xm8c76zagkj2spc9cpb8ms4jlda92lp078";
+        templates.rev =		"2343281a4df1ffbd4e0c6fcb9856f81adbbc201e";
        templates.sha256 =	"03idwrk3vj9h2az8j8lqpbdbnfxdbkzh4db68kq3644yj3cnlcza";
-        footprints.rev =	"4d2be8bf917b9c31f0510fa953532b88ef8b8be8";
-        footprints.sha256 =	"0ixfiraahi09gvszzxsdz21mdr9wsxyby5qp3n57pzid42gs35a1";
-        packages3d.rev =	"2f3ea516116cc553c9d488424fbb196f4e65ef29";
-        packages3d.sha256 =	"03yicqv36zx0wrb0njpkk45l4ysvv3dlsjlpi4j8j75gla060mai";
+        footprints.rev =	"2e76906e448f352228a8f6bc06f77ae959a57975";
+        footprints.sha256 =	"1fv0liwbl2blwd2xy9whwinkczi98ah83rwi4v6bvm9d9318vbig";
+        packages3d.rev =	"005244f418b0d014e2907ca42df5ab85a1e29466";
+        packages3d.sha256 =	"1i6ypl7lw7hnifl943z3lwv4sy00mfwgqi001bj9qh547kf9rxd4";
      };
    };
  };
--- a/pkgs/by-name/al/algia/package.nix
+++ b/pkgs/by-name/al/algia/package.nix
@ -0,0 +1,28 @@
+{
+  pkgs,
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "algia";
+  version = "0.0.74";
+
+  src = fetchFromGitHub {
+    owner = "mattn";
+    repo = "algia";
+    rev = "v${version}";
+    hash = "sha256-t6XDw40FTa7QkZmOkgAufWV1aFjQrLWmycp+zcVYQWs=";
+  };
+
+  vendorHash = "sha256-fko9WC/Rh5fmoypqBuFKiuIuIJYMbKV+1uQKf5tFil0=";
+
+  meta = {
+    description = "CLI application for nostr";
+    homepage = "https://github.com/mattn/algia";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ haruki7049 ];
+    mainProgram = "algia";
+  };
+}
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@ -136,6 +136,7 @@ buildGoModule rec {
  checkFlags = [
    # Skip time dependent/flaky test
    "-skip=TestSendStreamDataMessageWithStreamDataSequenceNumberMutexLocked"
+    "-skip=TestParallelAccessOfQueue"
  ];

  postFixup = ''
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "arc-browser";
-  version = "1.69.0-55816";
+  version = "1.70.0-56062";

  src = fetchurl {
    url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-v9tZE0/Kv90yR1vrflPAZH6n25bdI5AHskUSHz91USU=";
+    hash = "sha256-x+QHlBsZGkmJm05VeZx43XFxpRJR1crLjEqNIQJwitQ=";
  };

  nativeBuildInputs = [ undmg ];
--- a/pkgs/by-name/gh/ghc_filesystem/package.nix
+++ b/pkgs/by-name/gh/ghc_filesystem/package.nix
@ -1,22 +1,39 @@
-{ stdenv, lib, cmake, fetchFromGitHub }:
+{
+  lib,
+  stdenv,
+  apple-sdk_11,
+  cmake,
+  fetchFromGitHub,
+  nix-update-script,
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "filesystem";
  version = "1.5.14";

  src = fetchFromGitHub {
    owner = "gulrak";
    repo = "filesystem";
-    rev = "v${version}";
+    rev = "refs/tags/v${finalAttrs.version}";
    hash = "sha256-XZ0IxyNIAs2tegktOGQevkLPbWHam/AOFT+M6wAWPFg=";
  };

  nativeBuildInputs = [ cmake ];

-  meta = with lib; {
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
    description = "header-only single-file C++ std::filesystem compatible helper library";
    homepage = "https://github.com/gulrak/filesystem";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bbjubjub ];
+    changelog = "https://github.com/gulrak/filesystem/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      bbjubjub
+      getchoo
+    ];
  };
-}
+})
--- a/pkgs/by-name/im/immich-machine-learning/package.nix
+++ b/pkgs/by-name/im/immich-machine-learning/package.nix
@ -17,10 +17,6 @@ python.pkgs.buildPythonApplication rec {
  src = "${immich.src}/machine-learning";
  pyproject = true;

-  postPatch = ''
-    substituteInPlace pyproject.toml --replace-fail 'fastapi-slim' 'fastapi'
-  '';
-
  pythonRelaxDeps = [
    "pillow"
    "pydantic-settings"
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@ -152,7 +152,7 @@ buildNpmPackage' {
    # pg_dumpall fails without database root access
    # see https://github.com/immich-app/immich/issues/13971
    substituteInPlace src/services/backup.service.ts \
-      --replace-fail '`pg_dumpall`' '`pg_dump`'
+      --replace-fail '`/usr/lib/postgresql/''${databaseMajorVersion}/bin/pg_dumpall`' '`pg_dump`'
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@ -1,22 +1,22 @@
 {
-  "version": "1.120.1",
-  "hash": "sha256-FKPs6BHOXmqnHh2yH+PPBFQoK5ykP716dNvES/45t4g=",
+  "version": "1.121.0",
+  "hash": "sha256-3Rk/0LtbRIrtnPBhG6TzYFcPlZqlkZoyO01jIL4gzC8=",
  "components": {
    "cli": {
-      "npmDepsHash": "sha256-5JmcDjLAVXhF3TH0M88dKLYPDsSctcOGPz9nV1n3k9c=",
-      "version": "2.2.30"
+      "npmDepsHash": "sha256-LsStgf6iJMpqCYZoZoP7cNnHbuzawTQ02wvJ5q/2RyU=",
+      "version": "2.2.32"
    },
    "server": {
-      "npmDepsHash": "sha256-u2ZQv+z8uyn7z52V+7hNRWgnHVm4xMdhjspPqsLHYek=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-9xyl+8YItzHSHcgUi1X9MwNtmZpdDGtg4DUa2YZv08I=",
+      "version": "1.121.0"
    },
    "web": {
-      "npmDepsHash": "sha256-EAFUOhcmE1TfUBN0uxzuNkHibdaDRn8Lxvma70UJqDE=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-vHmiNWVLl4len6SnJ/NmiRVLLc4uUUWF/25LiOMnvf0=",
+      "version": "1.121.0"
    },
    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-AJcK5NE+ZNAK2FJblY32jtYxY0Z9npH92A3htcPes4A=",
-      "version": "1.120.1"
+      "npmDepsHash": "sha256-jiwUoWrMH/mDO+GPi13Q+Z87NAtDx95h6igI0NuPhnc=",
+      "version": "1.121.0"
    }
  }
 }
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub, stdenv, nodejs, pnpm, buildGoModule, mage, writeShellScriptBin, nixosTests }:

 let
-  version = "0.24.4";
+  version = "0.24.5";
  src = fetchFromGitHub {
    owner = "go-vikunja";
    repo = "vikunja";
    rev = "v${version}";
-    hash = "sha256-h3Jz28HYQYZC+oWGXNeKv2iNsrU0gbBRfWgOvuKijtw=";
+    hash = "sha256-P5H+NfjE8wTmPD1VOI72hPi2DlDb4pCyq0nphK1VGK0=";
  };

  frontend = stdenv.mkDerivation (finalAttrs: {
@ -67,7 +67,7 @@ buildGoModule {
    in
    [ fakeGit mage ];

-  vendorHash = "sha256-d2BNzsBeWlpZGbU7PkXWO5e9FLJA/Wda5ImXwqh/WV4=";
+  vendorHash = "sha256-OsKejno8QGg7HzRsrftngiWGiWHFc1jDLi5mQ9/NjI4=";

  inherit frontend;

--- a/pkgs/by-name/zl/zls/package.nix
+++ b/pkgs/by-name/zl/zls/package.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , zig_0_13
 , callPackage
+, apple-sdk_11,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -23,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ zig_0_13.hook ];

+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ];
+
  postPatch = ''
    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
  '';
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@ -49,23 +49,23 @@ let
  # and often with different versions.  We write them on three lines
  # like this (rather than using {}) so that the updater script can
  # find where to edit them.
-  versions.aarch64-darwin = "6.2.5.41699";
-  versions.x86_64-darwin = "6.2.5.41699";
-  versions.x86_64-linux = "6.2.5.2440";
+  versions.aarch64-darwin = "6.2.10.43047";
+  versions.x86_64-darwin = "6.2.10.43047";
+  versions.x86_64-linux = "6.2.10.4983";

  srcs = {
    aarch64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
      name = "zoomusInstallerFull.pkg";
-      hash = "sha256-GD3WS4O8Xg2EKYS+CirXWHVjNkn3tQ6Ee5u15x218yA=";
+      hash = "sha256-i6ZO6Gp0PL200oklp7NJ56jGKF/nvuo54EazyfBU0Eo=";
    };
    x86_64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-8yEkB7hpvat33VCxuScsLD+zPKvqeTfK4Wx0vjyA9yY=";
+      hash = "sha256-lqmRjIre20VG9gkd7ISosABwYdLaHQDnSPYFKJZKh4Q=";
    };
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-h+kt+Im0xv1zoLTvE+Ac9sfw1VyoAnvqFThf5/MwjHU=";
+      hash = "sha256-lPUKxkXI3yB/fCY05kQSJhTGSsU6v+t8nq5H6FLwhrk=";
    };
  };

--- a/pkgs/development/interpreters/php/8.4.nix
+++ b/pkgs/development/interpreters/php/8.4.nix
@ -1,14 +1,11 @@
-{ callPackage, fetchurl, ... }@_args:
+{ callPackage, ... }@_args:

 let
  base = callPackage ./generic.nix (
    _args
    // {
-      version = "8.4.0RC4";
-      phpSrc = fetchurl {
-        url = "https://downloads.php.net/~calvinb/php-8.4.0RC4.tar.xz";
-        hash = "sha256-s/ihnYRfSqVlAV/4YZZAfrUzKE60NlrFlT9edK5h3LA=";
-      };
+      version = "8.4.1";
+      hash = "sha256-74onARjtEot2X8MfGYx/RlDIFxQRsPajoaOroR/KzCM=";
    }
  );
 in
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -100,9 +100,9 @@ in {
      major = "3";
      minor = "14";
      patch = "0";
-      suffix = "a1";
+      suffix = "a2";
    };
-    hash = "sha256-PkZLDLt1NeLbNCYv0ZoKOT0OYr4PQ7FRPtmDebBU6tQ=";
+    hash = "sha256-L/nhAUc0Kz79afXNnMBuxGJQ8qBGWHWZ0Y4srGnAWSA=";
    inherit passthruFun;
  };
  # Minimal versions of Python (built without optional dependencies)
--- a/pkgs/development/ocaml-modules/janestreet/0.17.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix
@ -1869,7 +1869,8 @@ with self;

  typerep = janePackage {
    pname = "typerep";
-    hash = "sha256-0KwJdWtibgjxghFmOYKyPrcOAfoLpxYGBZm2KpH8tgA=";
+    version = "0.17.1";
+    hash = "sha256-hw03erwLx9IAbkBibyhZxofA5jIi12rFJOHNEVYpLSk=";
    meta.description = "Typerep is a library for runtime types";
    propagatedBuildInputs = [ base ];
  };
--- a/pkgs/development/php-packages/apcu/default.nix
+++ b/pkgs/development/php-packages/apcu/default.nix
@ -7,7 +7,7 @@
 }:

 let
-  version = "5.1.23";
+  version = "5.1.24";
 in
 buildPecl {
  inherit version;
@ -17,25 +17,9 @@ buildPecl {
    owner = "krakjoe";
    repo = "apcu";
    rev = "v${version}";
-    sha256 = "sha256-UDKLLCCnYJj/lCD8ZkkDf2WYZMoIbcP75+0/IXo4vdQ=";
+    sha256 = "sha256-g+Oo6y+24VOWHaDZ23iItkGwOa5bTtKMAjZOmAi6EOo=";
  };

-  patches = [
-    # Fix broken test (apc_entry_002) with PHP 8.4 alpha1
-    # See https://github.com/krakjoe/apcu/issues/510
-    (fetchpatch {
-      url = "https://github.com/krakjoe/apcu/commit/9dad016db50cc46321afec592ea9b49520c1cf13.patch";
-      hash = "sha256-8CPUNhEGCVVSXWYridN1+4N4JzCfXZbmUIsPYs/9jfk=";
-    })
-
-    # Fix ZTS detection in tests with PHP 8.4
-    # https://github.com/krakjoe/apcu/pull/511
-    (fetchpatch {
-      url = "https://github.com/krakjoe/apcu/commit/15766e615264620427c2db37061ca9614d3b7319.patch";
-      hash = "sha256-gbSkx47Uo9E28CfJJj4+3ydcw8cXW9NNN/3FuYYTVPY=";
-    })
-  ];
-
  buildInputs = [ pcre2 ];
  doCheck = true;
  makeFlags = [ "phpincludedir=$(dev)/include" ];
--- a/pkgs/development/python-modules/distutils/default.nix
+++ b/pkgs/development/python-modules/distutils/default.nix
@ -5,15 +5,18 @@
  setuptools-scm,
  setuptools,
  python,
+  docutils,
  jaraco-collections,
  jaraco-functools,
  jaraco-envs,
  jaraco-path,
  jaraco-text,
  more-itertools,
+  packaging,
  path,
  pyfakefs,
  pytestCheckHook,
+  stdenv,
 }:

 buildPythonPackage rec {
@ -24,13 +27,18 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "pypa";
    repo = "distutils";
-    rev = "378984e02edae91d5f49425da8436f8dd9152b8a"; # correlate commit from setuptools version
-    hash = "sha256-31sPPVY6tr+OwpiFiaKw82KyhDNBVW3Foea49dCa6pA=";
+    rev = "72837514c2b67081401db556be9aaaa43debe44f"; # correlate commit from setuptools version
+    hash = "sha256-Kx4Iudy9oZ0oQT96Meyq/m0k0BuexPLVxwvpNJehCW0=";
  };

  build-system = [ setuptools-scm ];

-  dependencies = [ jaraco-functools ];
+  dependencies = [
+    jaraco-collections
+    jaraco-functools
+    more-itertools
+    packaging
+  ];

  postInstall = ''
    rm -r $out/${python.sitePackages}/distutils
@ -40,7 +48,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "distutils" ];

  nativeCheckInputs = [
-    jaraco-collections
+    docutils
    jaraco-envs
    jaraco-path
    jaraco-text
@ -50,6 +58,9 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  # jaraco-path depends ob pyobjc
+  doCheck = !stdenv.isDarwin;
+
  meta = {
    description = "Distutils as found in cpython";
    homepage = "https://github.com/pypa/distutils";
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,61 +2,61 @@
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.10.229-hardened1.patch",
-            "sha256": "0bagy0x1kwm05x9mlgisjrlybk9yl91maxw6fai2si5m4xb3xv7n",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.229-hardened1/linux-hardened-v5.10.229-hardened1.patch"
+            "name": "linux-hardened-v5.10.230-hardened1.patch",
+            "sha256": "0z18m3q52kayrwgg0aaa46qvg4qnk31cwwdaxikl9sblq32020b2",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.230-hardened1/linux-hardened-v5.10.230-hardened1.patch"
        },
-        "sha256": "1q6di05rk4bsy91r03zw6vz14zzcpvv25dv7gw0yz1gzpgkbb9h8",
-        "version": "5.10.229"
+        "sha256": "0isbb0ixqg4yzlh3lmdvnax4m1ikf2q4wk0b9vgqc63p7gpm066d",
+        "version": "5.10.230"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.171-hardened1.patch",
-            "sha256": "08fbvra05rj0xcj9a8hd6mhv4lis2mhp57v7x4mw7rxxz2vim4bz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.171-hardened1/linux-hardened-v5.15.171-hardened1.patch"
+            "name": "linux-hardened-v5.15.173-hardened1.patch",
+            "sha256": "16pi07p3xgiqhzfw4y2shq70xwyrngyjj8mnzsdkyp88nja5d721",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.173-hardened1/linux-hardened-v5.15.173-hardened1.patch"
        },
-        "sha256": "0fra5zwcixgl6fg9hgdzlfcqng6pg09h2j7xqhi4qg0jv1jf0lr9",
-        "version": "5.15.171"
+        "sha256": "1a3x3ld6g7ny0hdfqfvj5j2i5sx5l5p236pdnsr0icn9ri3jljwa",
+        "version": "5.15.173"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.4.285-hardened1.patch",
-            "sha256": "1zm846mzvz1x88iskfw8513jkhlphxkd4v2qs86maxlgiz5zcxqp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.285-hardened1/linux-hardened-v5.4.285-hardened1.patch"
+            "name": "linux-hardened-v5.4.286-hardened1.patch",
+            "sha256": "0cqfqr5j7g6qq14r9mb5yzdfr71brvyb4xww9ir2sysa5i2qc2j6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.286-hardened1/linux-hardened-v5.4.286-hardened1.patch"
        },
-        "sha256": "1722sc365ajxmqyr4r49yp73mzdckay3rx5c2gx29xzny9zc6cmy",
-        "version": "5.4.285"
+        "sha256": "0z48n7vahg318bgkccy8xqgl87vfb8zmn995cqh7z38fvzrm81qq",
+        "version": "5.4.286"
    },
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.116-hardened1.patch",
-            "sha256": "0q597vszhgj6bgq56j11nq01mjjxl0ws8kqcr839fzkcgn1h6xv9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.116-hardened1/linux-hardened-v6.1.116-hardened1.patch"
+            "name": "linux-hardened-v6.1.118-hardened1.patch",
+            "sha256": "0jk1ndy7xw6x425v1q945gawyi44bygryq71jxpf33z99xyqbyid",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.118-hardened1/linux-hardened-v6.1.118-hardened1.patch"
        },
-        "sha256": "109vhc1hcfx6sacw4553xmwbj1gqx3zqjq5zg11z7a72dqrnisqp",
-        "version": "6.1.116"
+        "sha256": "0k12d4l03ziiba1b4f6jfxv5ir0lrd6kshlasr62rhv1f6yq81q1",
+        "version": "6.1.118"
    },
    "6.11": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.11.7-hardened1.patch",
-            "sha256": "1rfvlhgl78ixsb75aah9173h8jp37c8i0hs7b4484vljmqv0khcy",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.11.7-hardened1/linux-hardened-v6.11.7-hardened1.patch"
+            "name": "linux-hardened-v6.11.9-hardened1.patch",
+            "sha256": "1w3c7vni6pwlyav796fanj5cx5k3w7gsdpwihnniskyy9j1pvi4g",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.11.9-hardened1/linux-hardened-v6.11.9-hardened1.patch"
        },
-        "sha256": "1cpbycx79nl517rz573mja52bgzm249mhqzp424r5mqp91jfrx8b",
-        "version": "6.11.7"
+        "sha256": "1d44yfk105bsf9f853f2fpnzqd0xbqn8drg1dv4ri5dxldx8lrbm",
+        "version": "6.11.9"
    },
    "6.6": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.60-hardened1.patch",
-            "sha256": "090bs6nvc9by5higmxfwmzlqjrhbhqs21gsmpxvm18p9l3s08dq3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.60-hardened1/linux-hardened-v6.6.60-hardened1.patch"
+            "name": "linux-hardened-v6.6.62-hardened1.patch",
+            "sha256": "1rk6plakzwa4bsi0cibl1l3g13bzry65533wk2khbgsikqnyi9fq",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.62-hardened1/linux-hardened-v6.6.62-hardened1.patch"
        },
-        "sha256": "1vsjb7ifmf6ic6zv16fbrxjvffqc1mkndza76hjr9aw2a0ny7yaj",
-        "version": "6.6.60"
+        "sha256": "0dlkgph6chvqrask746wjijqp62vmvrp3n2dkldr8d2mfw8mdhz2",
+        "version": "6.6.62"
    }
 }
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -4,8 +4,8 @@
        "hash": "sha256:1rsglb7zwbn4f6wv4g95jl8ra1wbs03k7xyfdlmwzl3vgzx3bnzv"
    },
    "6.1": {
-        "version": "6.1.118",
-        "hash": "sha256:0k12d4l03ziiba1b4f6jfxv5ir0lrd6kshlasr62rhv1f6yq81q1"
+        "version": "6.1.119",
+        "hash": "sha256:0y1j8bz99d5vkxklzpwhns5r77lpz2prszf6whfahi58s0wszkdf"
    },
    "5.15": {
        "version": "5.15.173",
@ -20,15 +20,15 @@
        "hash": "sha256:0z48n7vahg318bgkccy8xqgl87vfb8zmn995cqh7z38fvzrm81qq"
    },
    "6.6": {
-        "version": "6.6.62",
-        "hash": "sha256:0dlkgph6chvqrask746wjijqp62vmvrp3n2dkldr8d2mfw8mdhz2"
+        "version": "6.6.63",
+        "hash": "sha256:0d8q0vwv3lcix3wiq2n53rir3h298flg2l0ghpify4rlh2s4l1fi"
    },
    "6.11": {
-        "version": "6.11.9",
-        "hash": "sha256:1d44yfk105bsf9f853f2fpnzqd0xbqn8drg1dv4ri5dxldx8lrbm"
+        "version": "6.11.10",
+        "hash": "sha256:0xzynjyyr16my0wrla4ggpjbh4g7nsqixaimz5hrsqlhaa8q9hab"
    },
    "6.12": {
-        "version": "6.12",
-        "hash": "sha256:1sr58vsh39hdwk0z27lg14isqwn4g8m4r7a8z2rsyhkfwlmmd8mi"
+        "version": "6.12.1",
+        "hash": "sha256:06f6y37fi7galj001wwrq5pz3vhdl9nryydf3f4yqwnkdpcb34q1"
    }
 }
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "grafana";
-  version = "11.3.0+security-01";
+  version = "11.3.1";

  subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];

@ -16,7 +16,7 @@ buildGoModule rec {
    owner = "grafana";
    repo = "grafana";
    rev = "v${version}";
-    hash = "sha256-t8D5JHhWJdsnY+SR+eiHy+jHkasAg8b5+uQ38OEFyR4=";
+    hash = "sha256-r8+GdAI1W7Y4wLL8GTLzXUTaOzvLb/YQ4XWHmYs1biI=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@ -51,9 +51,9 @@ buildGoModule rec {
    dontFixup = true;
    outputHashMode = "recursive";
    outputHash = rec {
-      x86_64-linux = "sha256-8XuRhipddv28msoSpG5WjpHc7NUEh4/+wRutKrY9r1U=";
+      x86_64-linux = "sha256-s9PGuuGwB4Ixw0cekrg0oldQxRU6xmb3KjFrNPRiGLs=";
      aarch64-linux = x86_64-linux;
-      aarch64-darwin = "sha256-IOuE2QjZmeCOZdqA49RWoAtz2FROGqWo8Dp4wFnEkkk=";
+      aarch64-darwin = "sha256-NVx+ipUPova7yN56Ag0b13Jb6CsD0fwHfPpwyDbQs+Y=";
      x86_64-darwin = aarch64-darwin;
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@ -169,6 +169,16 @@
      "agpl"
    ]
  },
+  "news": {
+    "hash": "sha256-m2Q+vq7G5oPr9fwIX+65NReaxzcxXehQBQ52T4VrYfw=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.0.0/news.tar.gz",
+    "version": "25.0.0",
+    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
+    "homepage": "https://github.com/nextcloud/news",
+    "licenses": [
+      "agpl"
+    ]
+  },
  "notes": {
    "hash": "sha256-dpMCehjhPQoOA+MVdLeGc370hmqWzmsMczgV08m/cO4=",
    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.11.0/notes-v4.11.0.tar.gz",
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@ -169,6 +169,16 @@
      "agpl"
    ]
  },
+  "news": {
+    "hash": "sha256-m2Q+vq7G5oPr9fwIX+65NReaxzcxXehQBQ52T4VrYfw=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.0.0/news.tar.gz",
+    "version": "25.0.0",
+    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
+    "homepage": "https://github.com/nextcloud/news",
+    "licenses": [
+      "agpl"
+    ]
+  },
  "notes": {
    "hash": "sha256-dpMCehjhPQoOA+MVdLeGc370hmqWzmsMczgV08m/cO4=",
    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.11.0/notes-v4.11.0.tar.gz",
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@ -683,7 +683,7 @@ in {
              hash = "sha256-YC3I0BQi3o3+VmRu/UqpqPpaSC+ekPqzbORTHftbPvY=";
            })
          ]
-          ++ lib.optionals (lib.versionAtLeast php.version "8.3") [
+          ++ lib.optionals (lib.versionAtLeast php.version "8.3" && lib.versionOlder php.version "8.4") [
            # https://github.com/php/php-src/pull/16733 (fix soap test)
            (fetchpatch {
              url = "https://github.com/php/php-src/commit/5c308d61db104854e4ff84ab123e3ea56e1b4046.patch";