Merge staging-next into staging

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -314,6 +314,13 @@
           <link linkend="opt-services.alps.enable">services.alps</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/skeeto/endlessh">endlessh</link>,
+          an SSH tarpit. Available as
+          <link linkend="opt-services.endlessh.enable">services.endlessh</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/shizunge/endlessh-go">endlessh-go</link>,

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -109,6 +109,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).
 
+- [endlessh](https://github.com/skeeto/endlessh), an SSH tarpit. Available as [services.endlessh](#opt-services.endlessh.enable).
+
 - [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).
 
 - [Garage](https://garagehq.deuxfleurs.fr/), a simple object storage server for geodistributed deployments, alternative to MinIO. Available as [services.garage](#opt-services.garage.enable).

nixos/modules/module-list.nix

@@ -1012,6 +1012,7 @@
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix
   ./services/security/clamav.nix
+  ./services/security/endlessh.nix
   ./services/security/endlessh-go.nix
   ./services/security/fail2ban.nix
   ./services/security/fprintd.nix

nixos/modules/security/pam.nix

@@ -615,12 +615,12 @@ let
           optionalString cfg.setLoginUid ''
             session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so
           '' +
-          optionalString cfg.ttyAudit.enable ''
-            session required ${pkgs.pam}/lib/security/pam_tty_audit.so
-                open_only=${toString cfg.ttyAudit.openOnly}
-                ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"}
-                ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
-          '' +
+          optionalString cfg.ttyAudit.enable (concatStringsSep " \\\n  " ([
+            "session required ${pkgs.pam}/lib/security/pam_tty_audit.so"
+          ] ++ optional cfg.ttyAudit.openOnly "open_only"
+          ++ optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"
+          ++ optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"
+          )) +
           optionalString cfg.makeHomeDir ''
             session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0077
           '' +

nixos/modules/services/networking/syncthing.nix

@@ -55,8 +55,8 @@ let
 
     # generate the new config by merging with the NixOS config options
     new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c '. * {
-        "devices": (${builtins.toJSON devices}${optionalString (! cfg.overrideDevices) " + .devices"}),
-        "folders": (${builtins.toJSON folders}${optionalString (! cfg.overrideFolders) " + .folders"})
+        "devices": (${builtins.toJSON devices}${optionalString (cfg.devices == {} || ! cfg.overrideDevices) " + .devices"}),
+        "folders": (${builtins.toJSON folders}${optionalString (cfg.folders == {} || ! cfg.overrideFolders) " + .folders"})
     } * ${builtins.toJSON cfg.extraOptions}')
 
     # send the new config

nixos/modules/services/security/endlessh.nix

@@ -0,0 +1,99 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.endlessh;
+in
+{
+  options.services.endlessh = {
+    enable = mkEnableOption (mdDoc "endlessh service");
+
+    port = mkOption {
+      type = types.port;
+      default = 2222;
+      example = 22;
+      description = mdDoc ''
+        Specifies on which port the endlessh daemon listens for SSH
+        connections.
+
+        Setting this to `22` may conflict with {option}`services.openssh`.
+      '';
+    };
+
+    extraOptions = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "-6" "-d 9000" "-v" ];
+      description = mdDoc ''
+        Additional command line options to pass to the endlessh daemon.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to open a firewall port for the SSH listener.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.endlessh = {
+      description = "SSH tarpit";
+      requires = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig =
+        let
+          needsPrivileges = cfg.port < 1024;
+          capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];
+          rootDirectory = "/run/endlessh";
+        in
+        {
+          Restart = "always";
+          ExecStart = with cfg; concatStringsSep " " ([
+            "${pkgs.endlessh}/bin/endlessh"
+            "-p ${toString port}"
+          ] ++ extraOptions);
+          DynamicUser = true;
+          RootDirectory = rootDirectory;
+          BindReadOnlyPaths = [ builtins.storeDir ];
+          InaccessiblePaths = [ "-+${rootDirectory}" ];
+          RuntimeDirectory = baseNameOf rootDirectory;
+          RuntimeDirectoryMode = "700";
+          AmbientCapabilities = capabilities;
+          CapabilityBoundingSet = capabilities;
+          UMask = "0077";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = !needsPrivileges;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          ProtectProc = "noaccess";
+          ProcSubset = "pid";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+        };
+    };
+
+    networking.firewall.allowedTCPPorts = with cfg;
+      optionals openFirewall [ port ];
+  };
+
+  meta.maintainers = with maintainers; [ azahi ];
+}

nixos/modules/services/web-apps/invoiceplane.nix

@@ -36,10 +36,10 @@ let
     version = src.version;
     src = pkgs.invoiceplane;
 
-    patchPhase = ''
+    postPhase = ''
       # Patch index.php file to load additional config file
       substituteInPlace index.php \
-        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = new \Dotenv\Dotenv(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
     '';
 
     installPhase = ''

nixos/modules/virtualisation/vmware-guest.nix

@@ -16,7 +16,8 @@ in
     enable = mkEnableOption (lib.mdDoc "VMWare Guest Support");
     headless = mkOption {
       type = types.bool;
-      default = false;
+      default = !config.services.xserver.enable;
+      defaultText = "!config.services.xserver.enable";
       description = lib.mdDoc "Whether to disable X11-related features.";
     };
   };

nixos/tests/all-tests.nix

@@ -183,6 +183,7 @@ in {
   ejabberd = handleTest ./xmpp/ejabberd.nix {};
   elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
   emacs-daemon = handleTest ./emacs-daemon.nix {};
+  endlessh = handleTest ./endlessh.nix {};
   endlessh-go = handleTest ./endlessh-go.nix {};
   engelsystem = handleTest ./engelsystem.nix {};
   enlightenment = handleTest ./enlightenment.nix {};

nixos/tests/endlessh.nix

@@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+{
+  name = "endlessh";
+  meta.maintainers = with lib.maintainers; [ azahi ];
+
+  nodes = {
+    server = { ... }: {
+      services.endlessh = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      specialisation = {
+        unprivileged.configuration.services.endlessh.port = 2222;
+
+        privileged.configuration.services.endlessh.port = 22;
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ curl netcat ];
+    };
+  };
+
+  testScript = ''
+    def activate_specialisation(name: str):
+        server.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+    start_all()
+
+    with subtest("Unprivileged"):
+        activate_specialisation("unprivileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(2222)
+        client.succeed("nc -dvW5 server 2222")
+
+    with subtest("Privileged"):
+        activate_specialisation("privileged")
+        server.wait_for_unit("endlessh.service")
+        server.wait_for_open_port(22)
+        client.succeed("nc -dvW5 server 22")
+  '';
+})

nixos/tests/invoiceplane.nix

@@ -13,12 +13,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
       services.invoiceplane.webserver = "caddy";
       services.invoiceplane.sites = {
         "site1.local" = {
-          #database.name = "invoiceplane1";
+          database.name = "invoiceplane1";
           database.createLocally = true;
           enable = true;
         };
         "site2.local" = {
-          #database.name = "invoiceplane2";
+          database.name = "invoiceplane2";
           database.createLocally = true;
           enable = true;
         };

pkgs/applications/audio/musikcube/default.nix

@@ -27,26 +27,15 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.98.0";
+  version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bnwOxEcvRXWPuqtkv8YlpclvH/6ZtQvyvHy4mqJCwik=";
+    sha256 = "sha256-pnAdlCCqWzR0W8dF9CE48K8yHMVIx3egZlXvibxU18A=";
   };
 
-  patches = []
-    ++ lib.optionals stdenv.isDarwin [
-      # Fix pending upstream inclusion for Darwin nixpkgs builds:
-      # https://github.com/clangen/musikcube/pull/531
-      (fetchpatch {
-        name = "darwin-build.patch";
-        url = "https://github.com/clangen/musikcube/commit/9077bb9fa6ddfe93ebb14bb8feebc8a0ef9b7ee4.patch";
-        sha256 = "sha256-Am9AGKDGMN5z+JJFJKdsBLrHf2neHFovgF/8I5EXLDA=";
-      })
-    ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1047,6 +1047,7 @@ https://github.com/milkypostman/vim-togglelist/,,
 https://github.com/cespare/vim-toml/,,
 https://github.com/vimpostor/vim-tpipeline/,,
 https://github.com/bronson/vim-trailing-whitespace/,,
+https://github.com/tridactyl/vim-tridactyl/,HEAD,
 https://github.com/ianks/vim-tsx/,,
 https://github.com/lumiliet/vim-twig/,,
 https://github.com/sodapopcan/vim-twiggy/,,

pkgs/applications/networking/instant-messengers/feishu/default.nix

@@ -84,6 +84,7 @@ stdenv.mkDerivation rec {
     cups
     libXdamage
     libdrm
+    libgcrypt
     libxshmfence
     mesa
     nspr

pkgs/development/compilers/go/1.18.nix

@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.18.7";
+  version = "1.18.8";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-lGfjO4Gfcb67IfsO4d1nlP0iRK6UkHqYQoZxL5g5qUQ=";
+    sha256 = "sha256-H3mAIwUBVHnnfYxkFTC8VOyZRlfVxSceAXLrcRg0ahI=";
   };
 
   strictDeps = true;

pkgs/development/compilers/go/1.19.nix

@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.2";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    sha256 = "sha256-LOkw1wqTHeZg/a8nHXAZJ5OxskAnJkW/AnV3n2cE32s=";
+    sha256 = "sha256-GKwmPjkhC89o2F9DcOl/sXNBZplaH2P7OLT24H2Q0hI=";
   };
 
   strictDeps = true;

pkgs/development/libraries/argparse/default.nix

@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-vbf4kePi5gfg9ub4aP1cCK1jtiA65bUS9+5Ghgvxt/E=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace '$'{CMAKE_INSTALL_LIBDIR_ARCHIND} '$'{CMAKE_INSTALL_LIBDIR}
+    substituteInPlace packaging/pkgconfig.pc.in \
+      --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
+  '';
+
   nativeBuildInputs = [
     cmake
   ];

pkgs/development/mobile/androidenv/ndk-bundle/default.nix

@@ -13,7 +13,7 @@ deployAndroidPackage {
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   autoPatchelfIgnoreMissingDeps = true;
   buildInputs = lib.optionals (os == "linux") [ pkgs.zlib ];
-  patchInstructions = lib.optionalString (os == "linux") (''
+  patchInstructions = ''
     patchShebangs .
 
     # TODO: allow this stuff
@@ -37,9 +37,11 @@ deployAndroidPackage {
         addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/linux-x86_64/lib64
     fi
 
-    find toolchains -type d -name bin -or -name lib64 | while read dir; do
-        autoPatchelf "$dir"
-    done
+    if [ -d toolchains/llvm/prebuilt/linux-x86_64 ]; then
+        find toolchains/llvm/prebuilt/linux-x86_64 -type d -name bin -or -name lib64 | while read dir; do
+            autoPatchelf "$dir"
+        done
+    fi
 
     # fix ineffective PROGDIR / MYNDKDIR determination
     for progname in ndk-build; do
@@ -47,7 +49,9 @@ deployAndroidPackage {
     done
 
     # Patch executables
-    autoPatchelf prebuilt/linux-x86_64
+    if [ -d prebuild/linux-x86_64 ]; then
+        autoPatchelf prebuilt/linux-x86_64
+    fi
 
     # wrap
     for progname in ndk-build; do
@@ -59,6 +63,6 @@ deployAndroidPackage {
     for progname in ndk-build; do
         ln -sf ../libexec/android-sdk/ndk-bundle/$progname $out/bin/$progname
     done
-  '');
+  '';
   noAuditTmpdir = true; # Audit script gets invoked by the build/ component in the path for the make standalone script
 }

pkgs/development/node-packages/node-packages.json

@@ -71,6 +71,7 @@
 , "coc-jest"
 , "coc-json"
 , "coc-lists"
+, "coc-ltex"
 , "coc-markdownlint"
 , "coc-metals"
 , "coc-pairs"

pkgs/development/node-packages/node-packages.nix

@@ -92407,6 +92407,24 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  coc-ltex = nodeEnv.buildNodePackage {
+    name = "coc-ltex";
+    packageName = "coc-ltex";
+    version = "13.0.1";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/coc-ltex/-/coc-ltex-13.1.0.tgz";
+      sha512 = "SnwfsF5dnU0T12bSe9sq2rdR/EoAqK4MxVljQM58YXpQKTps/HsCD6kiprk8oK/VMH8KaDwEEcxf2pVXq6yECQ==";
+    };
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Ltex extension for coc.nvim";
+      homepage = "https://valentjn.github.io/ltex/";
+      license = "MPL-2.0";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   coc-markdownlint = nodeEnv.buildNodePackage {
     name = "coc-markdownlint";
     packageName = "coc-markdownlint";

pkgs/development/python-modules/aeppl/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "aeppl";
-  version = "0.0.35";
+  version = "0.0.38";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "aesara-devs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HUcLa/9fTUBJYszo1SiG08t7DQiNSd8EsINkJpAeLsY=";
+    hash = "sha256-B9ZZEzGW4i0RRUaTAYiQ7+7pe4ArpSGcp/x4B6G7EYo=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/aesara/default.nix

@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "aesara-devs";
     repo = "aesara";
     rev = "refs/tags/rel-${version}";
-    hash = "sha256-Mt1IweQkPqxv+ynezdFHTJXU/oTOwhPkY49GzFJpPaM=";
+    hash = "sha256-xtnz+qKW2l8ze0EXdL9mkx0MzfAnmauC9042W2cVc5o=";
   };
 
   nativeBuildInputs = [
@@ -74,14 +74,15 @@ buildPythonPackage rec {
     "tests/scan/"
     "tests/tensor/"
     "tests/sandbox/"
+    "tests/sparse/sandbox/"
   ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
     description = "Python library to define, optimize, and efficiently evaluate mathematical expressions involving multi-dimensional arrays";
     homepage = "https://github.com/aesara-devs/aesara";
     changelog = "https://github.com/aesara-devs/aesara/releases";
     license = licenses.bsd3;
     maintainers = with maintainers; [ Etjean ];
+    broken = (stdenv.isLinux && stdenv.isAarch64);
   };
 }

pkgs/development/python-modules/ansible-compat/default.nix

@@ -61,6 +61,6 @@ buildPythonPackage rec {
     description = "A python package containing functions that help interacting with various versions of Ansible";
     homepage = "https://github.com/ansible/ansible-compat";
     license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/ansible-lint/default.nix

@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "ansible-lint";
-  version = "6.8.2";
+  version = "6.8.5";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-F9+ssNkTmkNczyCVI04gSR1Vb3rbl97diRtAVm4xZVM=";
+    sha256 = "sha256-r+lWJWLp5tGxehhltUDU9xZb8Bz+8q0DA9HK1q05f4g=";
   };
 
   postPatch = ''

pkgs/development/python-modules/arviz/default.nix

@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.12.1";
+  version = "0.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "arviz-devs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5P6EXXAAS1Q2eNQuj/5JrDg0lPHfA5K4WaYfKaaXm9s=";
+    hash = "sha256-DGTGUMnkEQcwGR44WhmBpTBMcRcAtVIpM4YVnnlakE8=";
   };
 
   propagatedBuildInputs = [
@@ -90,6 +90,10 @@ buildPythonPackage rec {
     "test_plot_separation"
     "test_plot_trace_legend"
     "test_cov"
+    # countourpy is not available at the moment
+    "test_plot_kde"
+    "test_plot_kde_2d"
+    "test_plot_pair"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/asdf/default.nix

@@ -3,7 +3,8 @@
 , asdf-transform-schemas
 , astropy
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, fetchpatch
 , importlib-resources
 , jmespath
 , jsonschema
@@ -25,11 +26,33 @@ buildPythonPackage rec {
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MuKmmlPRcB/EYW6AD7Pa/4G7rYAYMqe/Vj47Ycn+Pf4=";
+  src = fetchFromGitHub {
+    owner = "asdf-format/";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-u8e7ot5NDRqQFH0eLVnGinBQmQD73BlR5K9HVjA7SIg=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  patches = [
+    # Fix default validation, https://github.com/asdf-format/asdf/pull/1203
+    (fetchpatch {
+      name = "default-validation.patch";
+      url = "https://github.com/asdf-format/asdf/commit/6f79f620b4632e20178d9bd53528702605d3e976.patch";
+      sha256 = "sha256-h/dYhXRCf5oIIC+u6+8C91mJnmEzuNmlEzqc0UEhLy0=";
+      excludes = [
+          "CHANGES.rst"
+      ];
+    })
+  ];
+
+  postPatch = ''
+    # https://github.com/asdf-format/asdf/pull/1203
+    substituteInPlace pyproject.toml \
+      --replace "'jsonschema >=4.0.1, <4.10.0'," "'jsonschema >=4.0.1',"
+  '';
+
   nativeBuildInputs = [
     setuptools-scm
   ];
@@ -62,6 +85,10 @@ buildPythonPackage rec {
     "asdf"
   ];
 
+  disabledTests = [
+    "config.rst"
+  ];
+
   meta = with lib; {
     description = "Python tools to handle ASDF files";
     homepage = "https://github.com/asdf-format/asdf";

pkgs/development/python-modules/bleach/default.nix

@@ -5,14 +5,16 @@
 , six
 , html5lib
 , setuptools
+, tinycss2
 , packaging
 , pythonOlder
+, webencodings
 }:
 
 buildPythonPackage rec {
   pname = "bleach";
   version = "5.0.1";
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
@@ -20,12 +22,19 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [
-    packaging
-    six
     html5lib
+    packaging
     setuptools
+    six
+    webencodings
   ];
 
+  passthru.optional-dependencies = {
+    css = [
+      tinycss2
+    ];
+  };
+
   checkInputs = [
     pytestCheckHook
   ];
@@ -35,7 +44,9 @@ buildPythonPackage rec {
     "protocols"
   ];
 
-  pythonImportsCheck = [ "bleach" ];
+  pythonImportsCheck = [
+    "bleach"
+  ];
 
   meta = with lib; {
     description = "An easy, HTML5, whitelisting HTML sanitizer";

pkgs/development/python-modules/blis/default.nix

@@ -5,17 +5,27 @@
 , hypothesis
 , numpy
 , pytest
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "blis";
   version = "0.9.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-fOrEZoAfnZfss04Q3e2MJM9eCSfqfoNNocydLtP8Nm8=";
+    hash = "sha256-fOrEZoAfnZfss04Q3e2MJM9eCSfqfoNNocydLtP8Nm8=";
   };
 
+  postPatch = ''
+    # See https://github.com/numpy/numpy/issues/21079
+    substituteInPlace blis/benchmark.py \
+      --replace "numpy.__config__.blas_ilp64_opt_info" "numpy.__config__.blas_opt_info"
+  '';
+
   nativeBuildInputs = [
     cython
   ];
@@ -24,16 +34,20 @@ buildPythonPackage rec {
     numpy
   ];
 
-
   checkInputs = [
     hypothesis
     pytest
   ];
 
+  pythonImportsCheck = [
+    "blis"
+  ];
+
   meta = with lib; {
     description = "BLAS-like linear algebra library";
     homepage = "https://github.com/explosion/cython-blis";
     license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
     platforms = platforms.x86_64;
   };
 }

pkgs/development/python-modules/cma/default.nix

@@ -3,17 +3,21 @@
 , fetchFromGitHub
 , numpy
 , python
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "cma";
   version = "3.2.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "CMA-ES";
     repo = "pycma";
     rev = "refs/tags/r${version}";
-    sha256 = "sha256-STF7jtLqI2KiWvvI9/reRjP1XyW8l4/qy9uAPpE9mTs=";
+    hash = "sha256-STF7jtLqI2KiWvvI9/reRjP1XyW8l4/qy9uAPpE9mTs=";
   };
 
   propagatedBuildInputs = [
@@ -21,13 +25,18 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    ${python.executable} -m cma.test
+    # At least one doctest fails, thus only limited amount of files is tested
+    ${python.executable} -m cma.test interfaces.py purecma.py logger.py optimization_tools.py transformations.py
   '';
 
+  pythonImportsCheck = [
+    "cma"
+  ];
+
   meta = with lib; {
-    description = "CMA-ES, Covariance Matrix Adaptation Evolution Strategy for non-linear numerical optimization in Python";
+    description = "Library for Covariance Matrix Adaptation Evolution Strategy for non-linear numerical optimization";
     homepage = "https://github.com/CMA-ES/pycma";
     license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }

pkgs/development/python-modules/duo-client/default.nix

@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, freezegun
 , mock
 , nose2
 , pytz
@@ -10,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "duo-client";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "duosecurity";
     repo = "duo_client_python";
     rev = version;
-    sha256 = "sha256-2sodExb66+Y+aPvm+DkibPt0Bvwqjii+EoBWaopdq+E=";
+    sha256 = "sha256-9ADFtCrSJ4Y2QQY5YC/BMvoVZs2vaYHkhIM/rBlZm4I=";
   };
 
   postPatch = ''
@@ -31,6 +32,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    freezegun
     mock
     nose2
     pytz

pkgs/development/python-modules/hstspreload/default.nix

@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "hstspreload";
-  version = "2022.10.1";
+  version = "2022.11.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "sethmlarson";
     repo = pname;
     rev = version;
-    sha256 = "sha256-P9aVJUkGUpghAHcJ3OQSbpx3TpkhJU7Lxp0n/RsJBYI=";
+    sha256 = "sha256-4GirKCe84sYV+28ODPipixV3cl7wIV/NOd+iM0Cec4I=";
   };
 
   # Tests require network connection

pkgs/development/python-modules/mezzanine/default.nix

@@ -24,7 +24,7 @@ buildPythonPackage rec {
   version = "6.0.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6" || isPyPy;
+  disabled = pythonOlder "3.7" || isPyPy;
 
   src = fetchPypi {
     pname = "Mezzanine";
@@ -50,10 +50,11 @@ buildPythonPackage rec {
     requests
     requests-oauthlib
     tzlocal
-  ];
+  ] ++ bleach.optional-dependencies.css;
 
   # Tests Fail Due to Syntax Warning, Fixed for v3.1.11+
   doCheck = false;
+
   # sed calls will be unecessary in v3.1.11+
   preConfigure = ''
     sed -i 's/==/>=/' setup.py

pkgs/development/python-modules/nsz/default.nix

@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pycryptodome, enlighten, zstandard
+, withGUI ? true
+, kivy
+}:
+
+buildPythonPackage rec {
+  pname = "nsz";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "nicoboss";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-tdngXV+VUOAkg3lF2NOmw0mBeSEE+YpUfuKukTKcPnM=";
+  };
+
+  propagatedBuildInputs = [pycryptodome enlighten zstandard ]
+    ++ lib.optional withGUI kivy;
+
+  # do not check, as nsz requires producation keys
+  # dumped from a Nintendo Switch.
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/nicoboss/nsz";
+    description = "NSZ - Homebrew compatible NSP/XCI compressor/decompressor";
+    license = licenses.mit;
+    maintainers = with maintainers; [ eyjhb ];
+  };
+}

pkgs/development/python-modules/nvchecker/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.9";
+  version = "2.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "lilydjwg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BlprjNfw/oas4mnnGWPpuHmdJihEGjDdKPiAWuE7m8k=";
+    hash = "sha256-NxHeHT56JCu8Gn/B4IcvPtgGcWH8V9CUQkJeKFcGk/Q=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pwntools/default.nix

@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , debugger
 , fetchPypi
@@ -77,7 +78,7 @@ buildPythonPackage rec {
     installShellCompletion --bash extra/bash_completion.d/shellcraft
   '';
 
-  postFixup = ''
+  postFixup = lib.optionalString (!stdenv.isDarwin) ''
     mkdir -p "$out/bin"
     makeWrapper "${debugger}/bin/${debuggerName}" "$out/bin/pwntools-gdb"
   '';

pkgs/development/python-modules/pylsp-mypy/default.nix

@@ -1,39 +1,49 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, mock
 , mypy
 , pytestCheckHook
 , python-lsp-server
 , pythonOlder
+, toml
 }:
 
 buildPythonPackage rec {
   pname = "pylsp-mypy";
   version = "0.6.3";
-  disabled = pythonOlder "3.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Richardk2n";
     repo = "pylsp-mypy";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-fZ2bPPjBK/H2jMI4S3EhvWJaNl4tK7HstxcHSAkoFW4=";
+    hash = "sha256-fZ2bPPjBK/H2jMI4S3EhvWJaNl4tK7HstxcHSAkoFW4=";
   };
 
+  propagatedBuildInputs = [
+    mypy
+    python-lsp-server
+    toml
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pylsp_mypy"
+  ];
+
   disabledTests = [
-    "test_multiple_workspaces"
+    # Tests wants to call dmypy
     "test_option_overrides_dmypy"
   ];
 
-  checkInputs = [ pytestCheckHook mock ];
-
-  propagatedBuildInputs = [ mypy python-lsp-server ];
-
-  pythonImportsCheck = [ "pylsp_mypy" ];
-
   meta = with lib; {
-    homepage = "https://github.com/Richardk2n/pylsp-mypy";
     description = "Mypy plugin for the Python LSP Server";
+    homepage = "https://github.com/Richardk2n/pylsp-mypy";
     license = licenses.mit;
     maintainers = with maintainers; [ cpcloud ];
   };

pkgs/development/python-modules/pymc/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pymc";
-  version = "4.1.3";
+  version = "4.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pymc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fqhtfMGopzVgonF5+qyFhm72KV0hX8QE95slI/HBZYU=";
+    hash = "sha256-pkeAcsdVBDc7eKC03+FDJCYT48PaVcXT8K8U8T4gGKo=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pytest-doctestplus/default.nix

@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , packaging
 , pytest
@@ -11,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-doctestplus";
-  version = "0.11.2";
+  version = "0.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f393adf659709a5f111d6ca190871c61808a6f3611bd0a132e27e93b24dd3448";
+    hash = "sha256-epeeS+mdkRbgesBmxfANRfOHZ319d5877zDG/6jHkYE=";
   };
 
   nativeBuildInputs = [
@@ -37,15 +36,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  patches = [
-    # Removal of distutils, https://github.com/astropy/pytest-doctestplus/pull/172
-    (fetchpatch {
-      name = "distutils-removal.patch";
-      url = "https://github.com/astropy/pytest-doctestplus/commit/ae2ee14cca0cde0fab355936995fa083529b00ff.patch";
-      sha256 = "sha256-uryKV7bWw2oz0glyh2lpGqtDPFvRTo8RmI1N1n15/d4=";
-    })
-  ];
-
   disabledTests = [
     # ERROR: usage: __main__.py [options] [file_or_dir] [file_or_dir] [...]
     # __main__.py: error: unrecognized arguments: --remote-data

pkgs/development/python-modules/python-box/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-box";
-  version = "6.0.2";
+  version = "6.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "cdgriffith";
     repo = "Box";
-    rev = version;
-    hash = "sha256-IE2qyRzvrOTymwga+hCwE785sAVTqQtcN1DL/uADpbQ=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-42VDZ4aASFFWhRY3ApBQ4dq76eD1flZtxUM9hpA9iiI=";
   };
 
   passthru.optional-dependencies = {

pkgs/development/python-modules/python-lsp-server/default.nix

@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , autopep8
 , buildPythonPackage
 , fetchFromGitHub
@@ -21,19 +22,10 @@
 , rope
 , setuptools
 , setuptools-scm
-, stdenv
 , ujson
+, websockets
 , whatthepatch
 , yapf
-, withAutopep8 ? true
-, withFlake8 ? true
-, withMccabe ? true
-, withPycodestyle ? true
-, withPydocstyle ? true
-, withPyflakes ? true
-, withPylint ? true
-, withRope ? true
-, withYapf ? true
 }:
 
 buildPythonPackage rec {
@@ -54,7 +46,11 @@ buildPythonPackage rec {
     substituteInPlace pyproject.toml \
       --replace "--cov-report html --cov-report term --junitxml=pytest.xml" "" \
       --replace "--cov pylsp --cov test" "" \
-      --replace "mccabe>=0.6.0,<0.7.0" "mccabe"
+      --replace "autopep8>=1.6.0,<1.7.0" "autopep8" \
+      --replace "flake8>=4.0.0,<4.1.0" "flake8" \
+      --replace "mccabe>=0.6.0,<0.7.0" "mccabe" \
+      --replace "pycodestyle>=2.8.0,<2.9.0" "pycodestyle" \
+      --replace "pyflakes>=2.4.0,<2.5.0" "pyflakes"
   '';
 
   preBuild = ''
@@ -68,15 +64,53 @@ buildPythonPackage rec {
     setuptools
     setuptools-scm
     ujson
-  ] ++ lib.optional withAutopep8 autopep8
-  ++ lib.optional withFlake8 flake8
-  ++ lib.optional withMccabe mccabe
-  ++ lib.optional withPycodestyle pycodestyle
-  ++ lib.optional withPydocstyle pydocstyle
-  ++ lib.optional withPyflakes pyflakes
-  ++ lib.optional withPylint pylint
-  ++ lib.optional withRope rope
-  ++ lib.optionals withYapf [ whatthepatch yapf ];
+  ];
+
+  passthru.optional-dependencies = {
+    all = [
+      autopep8
+      flake8
+      mccabe
+      pycodestyle
+      pydocstyle
+      pyflakes
+      pylint
+      rope
+      whatthepatch
+      yapf
+    ];
+    autopep8 = [
+      autopep8
+    ];
+    flake8 = [
+      flake8
+    ];
+    mccabe = [
+      mccabe
+    ];
+    pycodestyle = [
+      pycodestyle
+    ];
+    pydocstyle = [
+      pydocstyle
+    ];
+    pyflakes = [
+      pyflakes
+    ];
+    pylint = [
+      pylint
+    ];
+    rope = [
+      rope
+    ];
+    yapf = [
+      whatthepatch
+      yapf
+    ];
+    websockets = [
+      websockets
+    ];
+  };
 
   checkInputs = [
     flaky
@@ -84,26 +118,20 @@ buildPythonPackage rec {
     numpy
     pandas
     pytestCheckHook
-  ]
+  ] ++ passthru.optional-dependencies.all
   # pyqt5 is broken on aarch64-darwin
-  ++ lib.optionals (!stdenv.isDarwin || !stdenv.isAarch64) [ pyqt5 ];
+  ++ lib.optionals (!stdenv.isDarwin || !stdenv.isAarch64) [
+    pyqt5
+  ];
 
   disabledTests = [
-    "test_numpy_completions" # https://github.com/python-lsp/python-lsp-server/issues/243
-  ] ++ lib.optional (!withPycodestyle) "test_workspace_loads_pycodestyle_config"
-  # pyqt5 is broken on aarch64-darwin
-  ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) "test_pyqt_completion";
-
-  disabledTestPaths = lib.optional (!withAutopep8) "test/plugins/test_autopep8_format.py"
-    ++ lib.optional (!withRope) "test/plugins/test_completion.py"
-    ++ lib.optional (!withFlake8) "test/plugins/test_flake8_lint.py"
-    ++ lib.optional (!withMccabe) "test/plugins/test_mccabe_lint.py"
-    ++ lib.optional (!withPycodestyle) "test/plugins/test_pycodestyle_lint.py"
-    ++ lib.optional (!withPydocstyle) "test/plugins/test_pydocstyle_lint.py"
-    ++ lib.optional (!withPyflakes) "test/plugins/test_pyflakes_lint.py"
-    ++ lib.optional (!withPylint) "test/plugins/test_pylint_lint.py"
-    ++ lib.optional (!withRope) "test/plugins/test_rope_rename.py"
-    ++ lib.optional (!withYapf) "test/plugins/test_yapf_format.py";
+    # https://github.com/python-lsp/python-lsp-server/issues/243
+    "test_numpy_completions"
+    "test_workspace_loads_pycodestyle_config"
+  ] ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) [
+    # pyqt5 is broken on aarch64-darwin
+    "test_pyqt_completion"
+  ];
 
   preCheck = ''
     export HOME=$(mktemp -d);

pkgs/development/python-modules/qcelemental/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "qcelemental";
-  version = "0.25.0";
+  version = "0.25.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v1yu6yBEtgVsheku/8YaIaXrsVgMzcFlWAuySPhYgyQ=";
+    hash = "sha256-4+DlP+BH0UdWcYRBBApdc3E18L2zPvsdY6GTW5WCGnQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/regenmaschine/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "regenmaschine";
-  version = "2022.10.0";
+  version = "2022.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-HJgAQnBhoGo7PDwDl0XNXpSVRM8L9SFHM90kycCK0rE=";
+    sha256 = "sha256-BOJ2dFZ4CFII6OXzQU3Q9Mah6kRZPC5+b6ekx8ueYc4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/rpyc/default.nix

@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , hatchling
@@ -50,6 +51,8 @@ buildPythonPackage rec {
     "rpyc"
   ];
 
+  doCheck = !stdenv.isDarwin;
+
   meta = with lib; {
     description = "Remote Python Call (RPyC), a transparent and symmetric RPC library";
     homepage = "https://rpyc.readthedocs.org";

pkgs/development/python-modules/siobrultech-protocols/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "siobrultech-protocols";
-  version = "0.6.0";
+  version = "0.7.0";
 
   disabled = pythonOlder "3.8";
 
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "sdwilsh";
     repo = "siobrultech-protocols";
-    rev = "v${version}";
-    hash = "sha256-d4zAwcSCyC78dJZtxFkpdYurxDRon2cRgzInllP2qJQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-t8is68WrvLj57tNeM5AKuuvpn7kWbhbvoRnCI3+q4uE=";
   };
 
   checkInputs = [

pkgs/development/python-modules/spacy-transformers/default.nix

@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "transformers>=3.4.0,<4.18.0" "transformers>=3.4.0 # ,<4.18.0"
+      --replace "transformers>=3.4.0,<4.22.0" "transformers>=3.4.0 # ,<4.22.0"
   '';
 
   # Test fails due to missing arguments for trfs2arrays().

pkgs/development/python-modules/spacy/default.nix

@@ -69,7 +69,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace "pydantic>=1.7.4,!=1.8,!=1.8.1,<1.9.0" "pydantic~=1.2"
+      --replace "typer>=0.3.0,<0.5.0" "typer>=0.3.0"
   '';
 
   checkInputs = [

pkgs/development/python-modules/spyder/default.nix

@@ -41,21 +41,23 @@
 , textdistance
 , three-merge
 , watchdog
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "spyder";
   version = "5.3.3";
+  format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-vWhwn07zgHX7/7uAz0ekNwnAiKLECCBzBq47TtTaHfE=";
+    hash = "sha256-vWhwn07zgHX7/7uAz0ekNwnAiKLECCBzBq47TtTaHfE=";
   };
 
-  nativeBuildInputs = [ pyqtwebengine.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    pyqtwebengine.wrapQtAppsHook
+  ];
 
   propagatedBuildInputs = [
     atomicwrites
@@ -63,19 +65,16 @@ buildPythonPackage rec {
     cloudpickle
     cookiecutter
     diff-match-patch
-    flake8
     intervaltree
     jedi
     jellyfish
     keyring
     matplotlib
-    mccabe
     nbconvert
     numpy
     numpydoc
     psutil
     pygments
-    pylint
     pyls-spyder
     pyopengl
     pyqtwebengine
@@ -83,7 +82,6 @@ buildPythonPackage rec {
     python-lsp-server
     pyxdg
     pyzmq
-    pycodestyle
     qdarkstyle
     qstylizer
     qtawesome
@@ -96,7 +94,7 @@ buildPythonPackage rec {
     textdistance
     three-merge
     watchdog
-  ];
+  ] ++ python-lsp-server.optional-dependencies.all;
 
   # There is no test for spyder
   doCheck = false;
@@ -112,15 +110,16 @@ buildPythonPackage rec {
   };
 
   postPatch = ''
-    # remove dependency on pyqtwebengine
-    # this is still part of the pyqt 5.11 version we have in nixpkgs
+    # Remove dependency on pyqtwebengine
+    # This is still part of the pyqt 5.11 version we have in nixpkgs
     sed -i /pyqtwebengine/d setup.py
     substituteInPlace setup.py \
+      --replace "qdarkstyle>=3.0.2,<3.1.0" "qdarkstyle" \
       --replace "ipython>=7.31.1,<8.0.0" "ipython"
   '';
 
   postInstall = ''
-    # add Python libs to env so Spyder subprocesses
+    # Add Python libs to env so Spyder subprocesses
     # created to run compute kernels don't fail with ImportErrors
     wrapProgram $out/bin/spyder --prefix PYTHONPATH : "$PYTHONPATH"
 
@@ -147,7 +146,7 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/spyder-ide/spyder/releases";
     changelog = "https://github.com/spyder-ide/spyder/blob/master/CHANGELOG.md";
     license = licenses.mit;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ gebner ];
+    platforms = platforms.linux;
   };
 }

pkgs/development/python-modules/thinc/default.nix

@@ -1,27 +1,28 @@
 { lib
 , stdenv
-, buildPythonPackage
-, python
-, fetchPypi
-, pytestCheckHook
-, blis
-, catalogue
-, cymem
-, cython
-, contextvars
-, dataclasses
 , Accelerate
+, blis
+, buildPythonPackage
+, catalogue
+, confection
+, contextvars
 , CoreFoundation
 , CoreGraphics
 , CoreVideo
+, cymem
+, cython
+, dataclasses
+, fetchPypi
 , hypothesis
 , mock
 , murmurhash
 , numpy
 , plac
-, pythonOlder
 , preshed
 , pydantic
+, pytestCheckHook
+, python
+, pythonOlder
 , srsly
 , tqdm
 , typing-extensions
@@ -37,14 +38,9 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-m5AoKYTzy6rJjgNn3xsa+eSDYjG8Bj361yQqnQ3VK80=";
+    hash = "sha256-m5AoKYTzy6rJjgNn3xsa+eSDYjG8Bj361yQqnQ3VK80=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pydantic>=1.7.4,!=1.8,!=1.8.1,<1.9.0" "pydantic"
-  '';
-
   buildInputs = [
     cython
   ] ++ lib.optionals stdenv.isDarwin [
@@ -57,14 +53,15 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     blis
     catalogue
+    confection
     cymem
     murmurhash
     numpy
     plac
     preshed
+    pydantic
     srsly
     tqdm
-    pydantic
     wasabi
   ] ++ lib.optionals (pythonOlder "3.8") [
     typing-extensions
@@ -93,7 +90,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Practical Machine Learning for NLP in Python";
+    description = "Library for NLP machine learning";
     homepage = "https://github.com/explosion/thinc";
     license = licenses.mit;
     maintainers = with maintainers; [ aborsu ];

pkgs/development/tools/analysis/actionlint/default.nix

@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "actionlint";
-  version = "1.6.21";
+  version = "1.6.22";
 
   subPackages = [ "cmd/actionlint" ];
 
@@ -18,7 +18,7 @@ buildGoModule rec {
     owner = "rhysd";
     repo = "actionlint";
     rev = "v${version}";
-    sha256 = "sha256-EbiyWDcDin11pGNIJtIVI44avNdZZ/4EmV5w22yx/YI=";
+    sha256 = "sha256-Gkhk6lI10pUuZN09BDhNWfTjVdc7kN6KQjgc3gFrobk=";
   };
 
   vendorSha256 = "sha256-vWU3tEC+ZlrrTnX3fbuEuZRoSg1KtfpgpXmK4+HWrNY=";

pkgs/development/tools/cloud-nuke/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hVRmMEdLB+vQnUrzMgEDBzoHLiB4hFyRGKFMXsvYXE4=";
+    sha256 = "sha256-DcR5pofMcV2Y5qVA2h3I5h/1qS25+deVAUQWIMLu/KI=";
   };
 
   vendorSha256 = "sha256-GRHyoKv05JRZiY0g3Xd11liDYPcA6rfE8vorZRCV1wI=";

pkgs/development/tools/memray/default.nix

@@ -8,17 +8,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "memray";
-  version = "1.3.1";
+  version = "1.4.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bloomberg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-zHdgVpe92OiwLC4jHVtT3oC+WnB30e5U3ZOHnmuo+Ao=";
+    hash = "sha256-NR6wziuER7Vm4Er0WSkQKGkDOrsFUT4gmHO36h9yRWw=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
   buildInputs = [
     libunwind
@@ -33,6 +35,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   checkInputs = with python3.pkgs; [
+    ipython
     pytestCheckHook
   ] ++ lib.optionals (pythonOlder "3.11") [
     greenlet
@@ -49,6 +52,7 @@ python3.pkgs.buildPythonApplication rec {
   disabledTests = [
     # Import issue
     "test_header_allocator"
+    "test_hybrid_stack_of_allocations_inside_ceval"
   ];
 
   disabledTestPaths = [

pkgs/development/tools/millet/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.5.10";
+  version = "0.5.12";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6TFXaVIbdHO6smM20I2olURdBPZfcPBQ4Pyk5hU9Mx8=";
+    sha256 = "sha256-COVWn8RTUQSCHkjUgD9I+lZ4u/M7wqAV6tnDW7HIytY=";
   };
 
-  cargoSha256 = "sha256-fsguAk77XXMaGokqyGEumngBW2G4lmSU3Q2HMo5EtKY=";
+  cargoSha256 = "sha256-/7I1RdDo2o2uMUVEMjSCltmU8eW39cCgpzHztePE3Kw=";
 
   postPatch = ''
     rm .cargo/config.toml

pkgs/development/tools/misc/hydra/unstable.nix

@@ -127,13 +127,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "hydra";
-  version = "2022-09-08";
+  version = "2022-10-22";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "d6cbf227cba90cf281f72f464393d75a45f2f3a8";
-    sha256 = "sha256-eMStY0/cS/blRGyyp1DUpP3N0SxYZrxah+hNJeKwDSw=";
+    rev = "312cb42275e593eea5c44d8430ab09375fdb2fdb";
+    sha256 = "sha256-ablHzPwN2Pvju0kyo8N5Wavqkl60gKHCPLnruwqvwTg=";
   };
 
   patches = [

pkgs/development/tools/rust/cargo-deny/default.nix

@@ -11,19 +11,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deny";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5/8ydKsYRsst4pwZgt7ST6Kzt+IeWnp46QNmh9jKwMI=";
+    sha256 = "sha256-5JQ4G8wyKf//KU5NRr3fLLDUKsla+965wLj3nWeaEOo=";
   };
 
   # enable pkg-config feature of zstd
   cargoPatches = [ ./zstd-pkg-config.patch ];
 
-  cargoSha256 = "sha256-DTNKQICmt8MufHg/kN1uuWTfKi0/GPrwUWQWyZD5kPM=";
+  cargoSha256 = "sha256-dNFwPP/qCyL1JWeE8y8hJR+b30tj0AQFFa42s2XjSzg=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/development/tools/sentry-cli/default.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-4LbIzH+pFTKZWKY0QCd20V1ppJe4EIiGP0KD9VGlCtE=";
+    sha256 = "sha256-91nrxCqX4BJVP9gKcrWrEgjVkTnwkVKxFA8KjcFjaOs=";
   };
   doCheck = false;
 
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
   nativeBuildInputs = [ pkg-config ];
 
-  cargoSha256 = "sha256-U4Rpfiw/4pq9G+V/XUews+7Dt/7kqq/vYZ2t2ZO8/tM=";
+  cargoSha256 = "sha256-nWhqYvji53KurLGECsgE13Bwxng8CZUfdkv3mhHSl7Y=";
 
   meta = with lib; {
     homepage = "https://docs.sentry.io/cli/";

pkgs/development/web/flyctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.0.425";
+  version = "0.0.426";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    sha256 = "sha256-SIvJQbPCQhZ9zPQI5QSCOrJNlCNL+S9U2v41ik3h4HU=";
+    sha256 = "sha256-yZWQu3+nLcBC3s8QrP0jNWjJRaiGovAbovtSGB5xNCg=";
   };
 
   vendorSha256 = "sha256-wMVvDB/6ZDY3EwTWRJ1weCIlRZM+Ye24UnRl1YZzAcA=";

pkgs/games/factorio/versions.json

@@ -2,20 +2,20 @@
   "x86_64-linux": {
     "alpha": {
       "experimental": {
-        "name": "factorio_alpha_x64-1.1.69.tar.xz",
+        "name": "factorio_alpha_x64-1.1.70.tar.xz",
         "needsAuth": true,
-        "sha256": "0ckvcwnwv1hh946qavfgaywhspd3cyasf8v7w0qmbx359dsv6yb9",
+        "sha256": "1d0ahy34xmj9k79kd8imnzi576ivhcvf0qqvl6r9qdc8cmbmip18",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.69/alpha/linux64",
-        "version": "1.1.69"
+        "url": "https://factorio.com/get-download/1.1.70/alpha/linux64",
+        "version": "1.1.70"
       },
       "stable": {
-        "name": "factorio_alpha_x64-1.1.69.tar.xz",
+        "name": "factorio_alpha_x64-1.1.70.tar.xz",
         "needsAuth": true,
-        "sha256": "0ckvcwnwv1hh946qavfgaywhspd3cyasf8v7w0qmbx359dsv6yb9",
+        "sha256": "1d0ahy34xmj9k79kd8imnzi576ivhcvf0qqvl6r9qdc8cmbmip18",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.69/alpha/linux64",
-        "version": "1.1.69"
+        "url": "https://factorio.com/get-download/1.1.70/alpha/linux64",
+        "version": "1.1.70"
       }
     },
     "demo": {
@@ -38,20 +38,20 @@
     },
     "headless": {
       "experimental": {
-        "name": "factorio_headless_x64-1.1.69.tar.xz",
+        "name": "factorio_headless_x64-1.1.70.tar.xz",
         "needsAuth": false,
-        "sha256": "1rgspyynz8b8s1kwh67dwnn2mc53jrmmhy7bp7qi0vgbwpb5vhw3",
+        "sha256": "05bkawn394jb5d9if8xbf2xff3gnmd591axy41h7x1yg8sz94zw4",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.69/headless/linux64",
-        "version": "1.1.69"
+        "url": "https://factorio.com/get-download/1.1.70/headless/linux64",
+        "version": "1.1.70"
       },
       "stable": {
-        "name": "factorio_headless_x64-1.1.69.tar.xz",
+        "name": "factorio_headless_x64-1.1.70.tar.xz",
         "needsAuth": false,
-        "sha256": "1rgspyynz8b8s1kwh67dwnn2mc53jrmmhy7bp7qi0vgbwpb5vhw3",
+        "sha256": "05bkawn394jb5d9if8xbf2xff3gnmd591axy41h7x1yg8sz94zw4",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.69/headless/linux64",
-        "version": "1.1.69"
+        "url": "https://factorio.com/get-download/1.1.70/headless/linux64",
+        "version": "1.1.70"
       }
     }
   }

pkgs/misc/autotiling/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "autotiling";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-2zWuATgj92s3tPqvB4INPfucmJTWYmGBx12U10qXohw=";
+    sha256 = "sha256-4iiiiuXCHFXEeA99ikq/G3q2KXBZ7vwpfET7QtoDVds=";
   };
 
   propagatedBuildInputs = [ i3ipc importlib-metadata ];

pkgs/servers/endlessh/default.nix

@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, testers
+, endlessh
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "endlessh";
@@ -8,17 +14,25 @@ stdenv.mkDerivation rec {
     owner = "skeeto";
     repo = pname;
     rev = version;
-    sha256 = "0ziwr8j1frsp3dajr8h5glkm1dn5cci404kazz5w1jfrp0736x68";
+    hash = "sha256-yHQzDrjZycDL/2oSQCJjxbZQJ30FoixVG1dnFyTKPH4=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  passthru.tests = {
+    inherit (nixosTests) endlessh;
+    version = testers.testVersion {
+      package = endlessh;
+      command = "endlessh -V";
+    };
+  };
+
   meta = with lib; {
     description = "SSH tarpit that slowly sends an endless banner";
     homepage = "https://github.com/skeeto/endlessh";
     changelog = "https://github.com/skeeto/endlessh/releases/tag/${version}";
     license = licenses.unlicense;
-    maintainers = [ maintainers.marsam ];
+    maintainers = with maintainers; [ azahi marsam ];
     platforms = platforms.unix;
   };
 }

pkgs/servers/gemini/gmid/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gmid";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "omar-polo";
     repo = pname;
     rev = version;
-    hash = "sha256-WI3EJEhhd0UwtbOhRpt+8XEHuG6YrKAcT4mO1caZ+hE=";
+    hash = "sha256-XZcBcbSKfhXGlwAVkoXkEwASIghJfJIOebWPROy16Uo=";
   };
 
   nativeBuildInputs = [ bison ];

pkgs/servers/jellyfin/default.nix

@@ -29,13 +29,13 @@ let
 in
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.8.6"; # ensure that jellyfin-web has matching version
+  version = "10.8.7"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "nZt6/PdilKXK6Z/9NtoP3MnomduoRVkkJpbL70/MLTQ=";
+    sha256 = "GQPnQybDnWnqkA8mIBj3x69nfUkngJOJscjdZ/N08V4=";
   };
 
   patches = [

pkgs/servers/jellyfin/node-deps.nix

@@ -11817,8 +11817,8 @@ let
   args = {
     name = "jellyfin-web";
     packageName = "jellyfin-web";
-    version = "10.8.6";
-    src = ../../../../../../../nix/store/zk40h20vcx9jpz7kcc8fdcn5b9rbxs5p-source;
+    version = "10.8.7";
+    src = ../../../../../../../nix/store/krfjzr2qxxnvgafvq08if2lcf53asfxs-source;
     dependencies = [
       sources."@ampproject/remapping-2.1.2"
       (sources."@apideck/better-ajv-errors-0.3.3" // {

pkgs/servers/jellyfin/web.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jellyfin-web";
-  version = "10.8.6";
+  version = "10.8.7";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    sha256 = "6g00UjQyPaiimHNJBout/omyerqe2hCGChNkmojELOA=";
+    sha256 = "8WHXgNB7yay/LgKZWNKuPo30vbS7SEM9s+EPUMyhN/g=";
   };
 
   nativeBuildInputs = [

pkgs/servers/web-apps/invoiceplane/default.nix

@@ -2,51 +2,20 @@
 
 stdenv.mkDerivation rec {
   pname = "invoiceplane";
-  version = "1.5.11";
+  version = "1.6-beta-1";
 
   src = fetchurl {
     url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
-    sha256 = "137g0xps4kb3j7f5gz84ql18iggbya6d9dnrfp05g2qcbbp8kqad";
+    sha256 = "sha256-hIbk9zzqbwv2kSFClgPfTObB1YHj7KR4swKjGoN2v2E=";
   };
 
-  patches = [
-
-    # Fix CVE-2021-29024, unauthenticated directory listing
-    # Should be included in a later release > 1.5.11
-    # https://github.com/NixOS/nixpkgs/issues/166655
-    # https://github.com/InvoicePlane/InvoicePlane/pull/754
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/754.patch";
-      sha256 = "sha256-EHXw7Zqli/nA3tPIrhxpt8ueXvDtshz0XRzZT78sdQk=";
-    })
-
-    # Fix CVE-2021-29023, password reset rate-limiting
-    # Should be included in a later release > 1.5.11
-    # https://github.com/NixOS/nixpkgs/issues/166655
-    # https://github.com/InvoicePlane/InvoicePlane/pull/739
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/739.patch";
-      sha256 = "sha256-6ksJjW6awr3lZsDRxa22pCcRGBVBYyV8+TbhOp6HBq0=";
-    })
-
-    # Fix CVE-2021-29022, full path disclosure
-    # Should be included in a later release > 1.5.11
-    # https://github.com/NixOS/nixpkgs/issues/166655
-    # https://github.com/InvoicePlane/InvoicePlane/pull/767
-    #(fetchpatch {
-    #  url = "https://patch-diff.githubusercontent.com/raw/InvoicePlane/InvoicePlane/pull/767.patch";
-    #  sha256 = "sha256-rSWDH8KeHSRWLyQEa7RSwv+8+ja9etTz+6Q9XThuwUo=";
-    #})
-
-  ];
-
   nativeBuildInputs = [ unzip ];
 
   sourceRoot = ".";
 
   installPhase = ''
     mkdir -p $out/
-    cp -r . $out/
+    cp -r ip/. $out/
   '';
 
   passthru.tests = {

pkgs/tools/graphics/resvg/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "resvg";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cVrfyUtgPAyQvDEbQG88xrsjo0IoRtYZgJSjRWg/WCY=";
+    sha256 = "sha256-XD0FEvmTDrjRD72FY6fWdAKhYSBCYVThaI9O1ToSbrc=";
   };
 
-  cargoSha256 = "sha256-JR3lenTRthJmVC+dcsiX8S3iKhDbowMt9Eka5Yw/Svw=";
+  cargoSha256 = "sha256-gprXkLz4lvxopKHqmMNkkS4z6NTOKMAHNR1zemRNUMg=";
 
   meta = with lib; {
     description = "An SVG rendering library";

pkgs/tools/misc/fd/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    sha256 = "sha256-Vy5ERc4GZVEjNP0z2zZJeNwfhoL0nnOeii+TjRszrFw=";
+    sha256 = "sha256-FWnuV55xWL59lbLfs2IUi4QPolFGgsJDQdZCXx4PaKE=";
   };
 
-  cargoSha256 = "sha256-Iz8QP9NdjbBL8j/iUV6iS3U1ErPHuC5NYFHUMtR8MZg=";
+  cargoSha256 = "sha256-SD0olex4wDfdGHuuiNGQwjEV7AwmDIucLJbY+7E8hZg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/misc/flexoptix-app/default.nix

@@ -1,15 +1,15 @@
 { lib, appimageTools, fetchurl, nodePackages }: let
   pname = "flexoptix-app";
-  version = "5.12.2";
+  version = "5.13.0";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-XVswjIXnuWLRiXFc38lDhSvxYTQtYjs4V/AGdiNLX0g=";
+    hash = "sha256-PUGxrGHjebCxtN7Q0N/crqOHTeunWqy3wmWTGqCFYTw=";
   };
 
   udevRules = fetchurl {
-    url = "https://www.flexoptix.net/skin/udev_rules/99-tprogrammer.rules";
+    url = "https://www.flexoptix.net/static/frontend/Flexoptix/default/en_US/files/99-tprogrammer.rules";
     hash = "sha256-OZe5dV50xq99olImbo7JQxPjRd7hGyBIVwFvtR9cIVc=";
   };
 

pkgs/tools/networking/iperf/3.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iperf";
-  version = "3.11";
+  version = "3.12";
 
   src = fetchurl {
     url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz";
-    sha256 = "0pvy1cj92phpbldw0bdc0ds70n8irqcyn1ybyis0a6nnz84v936y";
+    sha256 = "sha256-cgNOz7an1tZ+OE4Z+27/8yNspPftTFGNfbZJxEfh/9Y=";
   };
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [ lksctp-tools ];

pkgs/tools/networking/stunnel/default.nix

@@ -1,24 +1,15 @@
-{ lib, stdenv, fetchurl, fetchpatch, openssl, nixosTests }:
+{ lib, stdenv, fetchurl, openssl, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "stunnel";
-  version = "5.65";
+  version = "5.66";
 
   src = fetchurl {
     url    = "https://www.stunnel.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "60c500063bd1feff2877f5726e38278c086f96c178f03f09d264a2012d6bf7fc";
+    sha256 = "558178704d1aa5f6883aac6cc5d6bbf2a5714c8a0d2e91da0392468cee9f579c";
     # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
-  patches = [
-    # Fixes compilation on darwin, patch is from
-    # https://github.com/mtrojnar/stunnel/pull/15.
-    (fetchpatch {
-        name = "stunnel_darwin_environ.patch";
-        url = "https://github.com/mtrojnar/stunnel/commit/d41932f6d55f639cc921007c2e180a55ef88bf00.patch";
-        sha256 = "sha256-d2K/BHE6GxvDCBIbttCHEVwH9SCu0jggNvhVHkC/qto=";
-      })
-  ];
 
   buildInputs = [ openssl ];
   configureFlags = [

pkgs/top-level/all-packages.nix

@@ -4652,6 +4652,8 @@ with pkgs;
 
   nsync = callPackage ../development/libraries/nsync { };
 
+  nsz = with python3.pkgs; toPythonApplication nsz;
+
   nwipe = callPackage ../tools/security/nwipe { };
 
   nx2elf = callPackage ../tools/compression/nx2elf { };

pkgs/top-level/python-packages.nix

@@ -6287,6 +6287,8 @@ self: super: with self; {
 
   nvidia-ml-py = callPackage ../development/python-modules/nvidia-ml-py { };
 
+  nsz = callPackage ../development/python-modules/nsz { };
+
   nxt-python = callPackage ../development/python-modules/nxt-python { };
 
   python-nvd3 = callPackage ../development/python-modules/python-nvd3 { };