about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/misc/private-gpt.nix121
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/private-gpt.nix27
-rw-r--r--pkgs/applications/audio/feishin/default.nix8
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names1
-rw-r--r--pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/packages.nix45
-rw-r--r--pkgs/by-name/ca/catppuccin-sddm/package.nix80
-rw-r--r--pkgs/by-name/fi/files-cli/package.nix6
-rw-r--r--pkgs/by-name/fo/forbidden/package.nix10
-rw-r--r--pkgs/by-name/pr/private-gpt/package.nix17
-rw-r--r--pkgs/by-name/ti/tinymist/Cargo.lock100
-rw-r--r--pkgs/by-name/ti/tinymist/package.nix6
-rw-r--r--pkgs/by-name/tr/troubadix/package.nix4
-rw-r--r--pkgs/development/python-modules/adext/default.nix39
-rw-r--r--pkgs/development/python-modules/apprise/default.nix49
-rw-r--r--pkgs/development/python-modules/courlan/default.nix56
-rw-r--r--pkgs/development/python-modules/hawkauthlib/default.nix37
-rw-r--r--pkgs/development/python-modules/html-text/default.nix40
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix4
-rw-r--r--pkgs/development/python-modules/private-gpt/default.nix119
-rw-r--r--pkgs/development/python-modules/pybrowserid/default.nix34
-rw-r--r--pkgs/development/python-modules/pyfxa/default.nix8
-rw-r--r--pkgs/development/python-modules/pyinsteon/default.nix48
-rw-r--r--pkgs/development/python-modules/python-roborock/default.nix4
-rw-r--r--pkgs/development/python-modules/trafilatura/default.nix72
-rw-r--r--pkgs/development/tools/misc/terramate/default.nix9
-rw-r--r--pkgs/development/tools/yq-go/default.nix6
-rw-r--r--pkgs/servers/x11/xorg/xwayland.nix12
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix2
-rw-r--r--pkgs/top-level/python-packages.nix2
35 files changed, 735 insertions, 257 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index edb4f243cc102..99c182b8340e0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5919,6 +5919,12 @@
     githubId = 1365692;
     name = "Will Fancher";
   };
+  elysasrc = {
+    name = "Elysa";
+    github = "ElysaSrc";
+    githubId = 101974839;
+    email = "elysasrc@proton.me";
+  };
   emantor = {
     email = "rouven+nixos@czerwinskis.de";
     github = "Emantor";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 39d1f3c378633..a43e8f26cabe7 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -209,6 +209,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).
 
+- [private-gpt](https://github.com/zylon-ai/private-gpt), a service to interact with your documents using the power of LLMs, 100% privately, no data leaks. Available as [services.private-gpt](#opt-services.private-gpt.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 76ccf5a341094..3cbb4617517aa 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -776,6 +776,7 @@
   ./services/misc/polaris.nix
   ./services/misc/portunus.nix
   ./services/misc/preload.nix
+  ./services/misc/private-gpt.nix
   ./services/misc/prowlarr.nix
   ./services/misc/pufferpanel.nix
   ./services/misc/pykms.nix
diff --git a/nixos/modules/services/misc/private-gpt.nix b/nixos/modules/services/misc/private-gpt.nix
new file mode 100644
index 0000000000000..9a3e5317cdb14
--- /dev/null
+++ b/nixos/modules/services/misc/private-gpt.nix
@@ -0,0 +1,121 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  inherit (lib) types;
+
+  format = pkgs.formats.yaml { };
+  cfg = config.services.private-gpt;
+in
+{
+  options = {
+    services.private-gpt = {
+      enable = lib.mkEnableOption "private-gpt for local large language models";
+      package = lib.mkPackageOption pkgs "private-gpt" { };
+
+      stateDir = lib.mkOption {
+        type = types.path;
+        default = "/var/lib/private-gpt";
+        description = "State directory of private-gpt.";
+      };
+
+      settings = lib.mkOption {
+        type = format.type;
+        default = {
+          llm = {
+            mode = "ollama";
+            tokenizer = "";
+          };
+          embedding = {
+            mode = "ollama";
+          };
+          ollama = {
+            llm_model = "llama3";
+            embedding_model = "nomic-embed-text";
+            api_base = "http://localhost:11434";
+            embedding_api_base = "http://localhost:11434";
+            keep_alive = "5m";
+            tfs_z = 1;
+            top_k = 40;
+            top_p = 0.9;
+            repeat_last_n = 64;
+            repeat_penalty = 1.2;
+            request_timeout = 120;
+          };
+          vectorstore = {
+            database = "qdrant";
+          };
+          qdrant = {
+            path = "/var/lib/private-gpt/vectorstore/qdrant";
+          };
+          data = {
+            local_data_folder = "/var/lib/private-gpt";
+          };
+          openai = { };
+          azopenai = { };
+        };
+        description = ''
+          settings-local.yaml for private-gpt
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.private-gpt = {
+      description = "Interact with your documents using the power of GPT, 100% privately, no data leaks";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      preStart =
+        let
+          config = format.generate "settings-local.yaml" (cfg.settings // { server.env_name = "local"; });
+        in
+        ''
+          mkdir -p ${cfg.stateDir}/{settings,huggingface,matplotlib,tiktoken_cache}
+          cp ${cfg.package.cl100k_base.tiktoken} ${cfg.stateDir}/tiktoken_cache/9b5ad71b2ce5302211f9c61530b329a4922fc6a4
+          cp ${pkgs.python3Packages.private-gpt}/${pkgs.python3.sitePackages}/private_gpt/settings.yaml ${cfg.stateDir}/settings/settings.yaml
+          cp "${config}" "${cfg.stateDir}/settings/settings-local.yaml"
+          chmod 600 "${cfg.stateDir}/settings/settings-local.yaml"
+        '';
+
+      environment = {
+        PGPT_PROFILES = "local";
+        PGPT_SETTINGS_FOLDER = "${cfg.stateDir}/settings";
+        HF_HOME = "${cfg.stateDir}/huggingface";
+        TRANSFORMERS_OFFLINE = "1";
+        HF_DATASETS_OFFLINE = "1";
+        MPLCONFIGDIR = "${cfg.stateDir}/matplotlib";
+      };
+
+      serviceConfig = {
+        ExecStart = lib.getExe cfg.package;
+        WorkingDirectory = cfg.stateDir;
+        StateDirectory = "private-gpt";
+        RuntimeDirectory = "private-gpt";
+        RuntimeDirectoryMode = "0755";
+        PrivateTmp = true;
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ drupol ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9af07688c03cb..f9e81f2bbd8d6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -757,6 +757,7 @@ in {
   pretix = runTest ./web-apps/pretix.nix;
   printing-socket = handleTest ./printing.nix { socket = true; };
   printing-service = handleTest ./printing.nix { socket = false; };
+  private-gpt = handleTest ./private-gpt.nix {};
   privoxy = handleTest ./privoxy.nix {};
   prometheus = handleTest ./prometheus.nix {};
   prometheus-exporters = handleTest ./prometheus-exporters.nix {};
diff --git a/nixos/tests/private-gpt.nix b/nixos/tests/private-gpt.nix
new file mode 100644
index 0000000000000..d19e167cc303c
--- /dev/null
+++ b/nixos/tests/private-gpt.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  mainPort = "8001";
+in
+{
+  name = "private-gpt";
+  meta = with lib.maintainers; {
+    maintainers = [ drupol ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.private-gpt = {
+        enable = true;
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("private-gpt.service")
+    machine.wait_for_open_port(${mainPort})
+
+    machine.succeed("curl http://127.0.0.1:${mainPort}")
+  '';
+})
diff --git a/pkgs/applications/audio/feishin/default.nix b/pkgs/applications/audio/feishin/default.nix
index e0e35bae6df09..90561314fec90 100644
--- a/pkgs/applications/audio/feishin/default.nix
+++ b/pkgs/applications/audio/feishin/default.nix
@@ -11,13 +11,13 @@
 }:
 let
   pname = "feishin";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Nj8GwrH49ph14xvJldj5GQR4mlt9unCPEcgLrsH/sx8=";
+    hash = "sha256-eNGHrSF/MgRHh0CVc0l8denZIbAnPXwFCZJZcvF+Xtc=";
   };
 
   electron = electron_27;
@@ -26,7 +26,7 @@ buildNpmPackage {
   inherit pname version;
 
   inherit src;
-  npmDepsHash = "sha256-+pr9fWg/9kxkYMmthtqhjgF6MOomSQxVCO5V8tHHRdE=";
+  npmDepsHash = "sha256-7oh5bl5APAvzb/TxHMUP/saRWLwuP9xqGvn7/RDhFk8=";
 
   npmFlags = [ "--legacy-peer-deps" ];
   makeCacheWritable = true;
@@ -60,7 +60,7 @@ buildNpmPackage {
         inherit version;
 
         src = "${src}/release/app";
-        npmDepsHash = "sha256-MRwKxe1hoFs5bPXT6K/UspSDs9XBdcRJGvxGlTKExp4=";
+        npmDepsHash = "sha256-NgWPr3mctn7f6X2JFsbdNNHkN84RRlLAywqfbyahCQw=";
 
         npmFlags = [ "--ignore-scripts" ];
         dontNpmBuild = true;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 616d46e65190f..5bd533dd11fcc 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15376,6 +15376,18 @@ final: prev:
     meta.homepage = "https://github.com/mhinz/vim-signify/";
   };
 
+  vim-sile = buildVimPlugin {
+    pname = "vim-sile";
+    version = "2022-09-03";
+    src = fetchFromGitHub {
+      owner = "sile-typesetter";
+      repo = "vim-sile";
+      rev = "7856f66d5e552eb18596f0162b81d8d14a4cbc16";
+      sha256 = "0xik91854jqmv3sa8af988w8xirm1vqql1ifjqxi61v00z0z00j7";
+    };
+    meta.homepage = "https://github.com/sile-typesetter/vim-sile/";
+  };
+
   vim-simpledb = buildVimPlugin {
     pname = "vim-simpledb";
     version = "2020-10-02";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 71da655f81ad1..acdd809e54387 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1295,6 +1295,7 @@ https://github.com/tpope/vim-sexp-mappings-for-regular-people/,,
 https://github.com/itspriddle/vim-shellcheck/,,
 https://github.com/kshenoy/vim-signature/,,
 https://github.com/mhinz/vim-signify/,,
+https://github.com/sile-typesetter/vim-sile/,HEAD,
 https://github.com/ivalkeen/vim-simpledb/,,
 https://github.com/junegunn/vim-slash/,,
 https://github.com/tpope/vim-sleuth/,,
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index b3f9d1916835a..b8281e83c564b 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     publisher = "myriad-dreamin";
     # Please update the corresponding binary (tinymist) when updating
     # this extension.
-    version = "0.11.7";
-    hash = "sha256-pL61pu8xTsjOOn4vYBwrWc6JKhrzRyNjQmJmrezUcyk=";
+    version = "0.11.8";
+    hash = "sha256-ELqk94xhPJwHlxQ0ie9DMBNOiqszpi3mYF+wHxoY2xw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 0a272c42d4785..bb987de7326c3 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -1,47 +1,8 @@
-{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu, fetchpatch2 }:
+{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu, fetchpatch2, config }:
 
 rec {
   thunderbird = thunderbird-115;
 
-  thunderbird-102 = (buildMozillaMach rec {
-    pname = "thunderbird";
-    version = "102.14.0";
-    application = "comm/mail";
-    applicationName = "Mozilla Thunderbird";
-    binaryName = pname;
-    src = fetchurl {
-      url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      hash = "sha512-SuPyFoM67FVCH4J9VbwbX8LwrU/v7LJ3JKW+MxjDUd8k0wpIl7kk5zPtLjmVvihLbRNQSdRgARQ/sclh/vwYMA==";
-    };
-    extraPatches = [
-      # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
-      ./no-buildconfig.patch
-    ];
-
-    meta = with lib; {
-      changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
-      description = "A full-featured e-mail client";
-      homepage = "https://thunderbird.net/";
-      mainProgram = "thunderbird";
-      maintainers = with maintainers; [ eelco lovesegfault pierron vcunat ];
-      platforms = platforms.unix;
-      badPlatforms = platforms.darwin;
-      broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
-                                             # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
-      license = licenses.mpl20;
-      knownVulnerabilities = [ "Thunderbird 102 support has ended" ];
-    };
-    updateScript = callPackage ./update.nix {
-      attrPath = "thunderbird-unwrapped";
-      versionPrefix = "102";
-    };
-  }).override {
-    geolocationSupport = false;
-    webrtcSupport = false;
-
-    pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
-  };
-
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
     version = "115.10.2";
@@ -91,3 +52,7 @@ rec {
     });
   };
 }
+ // lib.optionalAttrs config.allowAliases {
+  thunderbird-102 = throw "Thunderbird 102 support ended in September 2023";
+}
+
diff --git a/pkgs/by-name/ca/catppuccin-sddm/package.nix b/pkgs/by-name/ca/catppuccin-sddm/package.nix
new file mode 100644
index 0000000000000..1daab09ae646d
--- /dev/null
+++ b/pkgs/by-name/ca/catppuccin-sddm/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  just,
+  kdePackages,
+  flavor ? "mocha",
+  font ? "Noto Sans",
+  fontSize ? "9",
+  background ? null,
+  loginBackground ? false,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "catppuccin-sddm";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "catppuccin";
+    repo = "sddm";
+    rev = "v${version}";
+    hash = "sha256-SdpkuonPLgCgajW99AzJaR8uvdCPi4MdIxS5eB+Q9WQ=";
+  };
+
+  dontWrapQtApps = true;
+
+  nativeBuildInputs = [
+    just
+  ];
+
+  propagatedBuildInputs = [
+    kdePackages.qtsvg
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    just build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/sddm/themes/"
+    cp -r dist/catppuccin-${flavor} "$out/share/sddm/themes/catppuccin-${flavor}"
+
+    configFile=$out/share/sddm/themes/catppuccin-${flavor}/theme.conf
+
+    substituteInPlace $configFile \
+      --replace-fail 'Font="Noto Sans"' 'Font="${font}"' \
+      --replace-fail 'FontSize=9' 'FontSize=${fontSize}'
+
+    ${lib.optionalString (background != null) ''
+      substituteInPlace $configFile \
+        --replace-fail 'Background="backgrounds/wall.jpg"' 'Background="${background}"' \
+        --replace-fail 'CustomBackground="false"' 'CustomBackground="true"'
+    ''}
+
+    ${lib.optionalString loginBackground ''
+      substituteInPlace $configFile \
+        --replace-fail 'LoginBackground="false"' 'LoginBackground="true"'
+    ''}
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo ${kdePackages.qtsvg} >> $out/nix-support/propagated-user-env-packages
+  '';
+
+  meta = {
+    description = "Soothing pastel theme for SDDM";
+    homepage = "https://github.com/catppuccin/sddm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [elysasrc];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index adb9b6694024e..886bf6297c858 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.13.27";
+  version = "2.13.41";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-UbABURsoQkTwYvQqR7Eg8ti56JQKnIcAm78Tmu+W+ls=";
+    hash = "sha256-WW6E0K3HOi8gtBwcmN9syV4wM73BPGyXbv3t4ZJjoIc=";
   };
 
-  vendorHash = "sha256-8xiIMl4eAFMvMsN5Y+ruw04BtdA+mrCnqxsoekyr4Bo=";
+  vendorHash = "sha256-LdebAbdbiUX0xw1EJKCzK1jdt5+FgoZQBPI0apZkcsc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fo/forbidden/package.nix b/pkgs/by-name/fo/forbidden/package.nix
index adbd83ada4b08..a3f57a4a05ddc 100644
--- a/pkgs/by-name/fo/forbidden/package.nix
+++ b/pkgs/by-name/fo/forbidden/package.nix
@@ -5,23 +5,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "forbidden";
-  version = "10.8";
+  version = "10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ivan-sincek";
     repo = "forbidden";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jitmgN+We6m5CTgRc1NYwZkg5GYvD6ZlJ8FKtTa+rAY=";
+    hash = "sha256-LggF9giKKKO2F65zS0lPCshaDauy+s6YyRGr3BL0tJU=";
   };
 
-  pythonRemoveDeps = [
-    # https://github.com/ivan-sincek/forbidden/pull/3
-    "argparse"
-  ];
-
   build-system = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/pr/private-gpt/package.nix b/pkgs/by-name/pr/private-gpt/package.nix
new file mode 100644
index 0000000000000..1b717cc2bfb83
--- /dev/null
+++ b/pkgs/by-name/pr/private-gpt/package.nix
@@ -0,0 +1,17 @@
+{ python3Packages
+, makeBinaryWrapper
+}:
+
+python3Packages.toPythonApplication (python3Packages.private-gpt.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeBinaryWrapper ];
+
+  passthru.cl100k_base = {
+    inherit (python3Packages.private-gpt.cl100k_base) tiktoken;
+  };
+
+  postInstall = ''
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/private-gpt \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --add-flags "-m private_gpt"
+  '';
+}))
diff --git a/pkgs/by-name/ti/tinymist/Cargo.lock b/pkgs/by-name/ti/tinymist/Cargo.lock
index b561b67c1088d..d841971169afe 100644
--- a/pkgs/by-name/ti/tinymist/Cargo.lock
+++ b/pkgs/by-name/ti/tinymist/Cargo.lock
@@ -29,6 +29,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
 name = "aho-corasick"
 version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -38,6 +50,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
+[[package]]
 name = "android-tzdata"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -122,6 +140,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
+[[package]]
 name = "arrayref"
 version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1468,7 +1492,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash",
+ "ahash 0.7.8",
 ]
 
 [[package]]
@@ -1476,6 +1500,19 @@ name = "hashbrown"
 version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+dependencies = [
+ "ahash 0.8.11",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.3",
+]
 
 [[package]]
 name = "hayagriva"
@@ -3681,7 +3718,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "insta",
  "lsp-server",
@@ -3778,7 +3815,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3829,9 +3866,10 @@ dependencies = [
 
 [[package]]
 name = "tinymist-query"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "anyhow",
+ "biblatex",
  "comemo 0.4.0",
  "ecow 0.2.2",
  "ena",
@@ -3854,7 +3892,9 @@ dependencies = [
  "rust_iso639",
  "serde",
  "serde_json",
+ "serde_yaml",
  "sha2",
+ "siphasher 1.0.1",
  "strum 0.26.2",
  "toml 0.8.12",
  "ttf-parser",
@@ -3863,11 +3903,12 @@ dependencies = [
  "typst-ts-core",
  "unscanny",
  "walkdir",
+ "yaml-rust2",
 ]
 
 [[package]]
 name = "tinymist-render"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "base64 0.22.0",
  "log",
@@ -4131,7 +4172,7 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 [[package]]
 name = "typst"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "az",
  "bitflags 2.5.0",
@@ -4198,7 +4239,7 @@ checksum = "f13f85360328da54847dd7fefaf272dfa5b6d1fdeb53f32938924c39bf5b2c6c"
 [[package]]
 name = "typst-macros"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "heck 0.4.1",
  "proc-macro2",
@@ -4209,7 +4250,7 @@ dependencies = [
 [[package]]
 name = "typst-pdf"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "base64 0.22.0",
  "bytemuck",
@@ -4269,7 +4310,7 @@ dependencies = [
 [[package]]
 name = "typst-render"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "bytemuck",
  "comemo 0.4.0",
@@ -4289,7 +4330,7 @@ dependencies = [
 [[package]]
 name = "typst-svg"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "base64 0.22.0",
  "comemo 0.4.0",
@@ -4322,7 +4363,7 @@ dependencies = [
 [[package]]
 name = "typst-syntax"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "comemo 0.4.0",
  "ecow 0.2.2",
@@ -4338,7 +4379,7 @@ dependencies = [
 [[package]]
 name = "typst-timing"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "parking_lot",
  "serde",
@@ -4458,9 +4499,9 @@ dependencies = [
 
 [[package]]
 name = "typstyle"
-version = "0.11.14"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f701eb3c275c8250b3e5e18c3c081e36861cdd5b2e78538ff4984735cbfd9591"
+checksum = "b25283094eca3cf1200a2105bb339f367e1fb127e69b22ae106d7e706d7eb08d"
 dependencies = [
  "anyhow",
  "clap",
@@ -5133,6 +5174,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "yaml-rust2"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498f4d102a79ea1c9d4dd27573c0fc96ad74c023e8da38484e47883076da25fb"
+dependencies = [
+ "arraydeque",
+ "encoding_rs",
+ "hashlink",
+]
+
+[[package]]
 name = "yoke"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5157,6 +5209,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.55",
+]
+
+[[package]]
 name = "zerofrom"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index da21891455818..9849b56f1eef0 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -13,19 +13,19 @@ rustPlatform.buildRustPackage rec {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.11.6";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     rev = "v${version}";
-    hash = "sha256-7YG15kt+pIxAK22QYiTApu5lBV6Afe3Jss6L5dTGsGI=";
+    hash = "sha256-1mgtyOXSvovO2f4XSdirzTIcUlbFoT9t/UFa2uW5CpI=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "typst-0.11.0" = "sha256-UzZ0tbC6Dhn178GQDyLl70WTp3h5WdaBCsEKgLisZ2M=";
+      "typst-0.11.0" = "sha256-J3oSrxylR00r3Tc4KDmuW6ungQkoYJiI7cZEpbyyNsc=";
       "typst-syntax-0.7.0" = "sha256-yrtOmlFAKOqAmhCP7n0HQCOQpU3DWyms5foCdUb9QTg=";
       "typstfmt_lib-0.2.7" = "sha256-LBYsTCjZ+U+lgd7Z3H1sBcWwseoHsuepPd66bWgfvhI=";
     };
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 9575a83ce48f4..d70553604bc38 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.4.1";
+  version = "24.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+JrMUog04SS24ZKiBFB46AyYTDzVu7d4IdoX9SRMhpk=";
+    hash = "sha256-kA+9zcP3unNb2tE3OU8J/3xHX+pRZ/06lEQtH/0QEk4=";
   };
 
   pythonRelaxDeps = [ "validators" ];
diff --git a/pkgs/development/python-modules/adext/default.nix b/pkgs/development/python-modules/adext/default.nix
index c5a05d19bee85..8a7345613de79 100644
--- a/pkgs/development/python-modules/adext/default.nix
+++ b/pkgs/development/python-modules/adext/default.nix
@@ -1,40 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools-scm
-, alarmdecoder
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools-scm,
+  alarmdecoder,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "adext";
-  version = "0.4.2";
-  format = "setuptools";
+  version = "0.4.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ajschmidt8";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0h5k9kzms2f0r48pdhsgv8pimk0vsxw8vs0k6880mank8ij914wr";
+    repo = "adext";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-y8BvcSc3vD0FEWiyzW2Oh6PBS2Itjs2sz+9Dzh5yqSg=";
   };
 
-  nativeBuildInputs = [
-    setuptools-scm
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
-    alarmdecoder
-  ];
+  dependencies = [ alarmdecoder ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "adext" ];
 
   meta = with lib; {
     description = "Python extension for AlarmDecoder";
     homepage = "https://github.com/ajschmidt8/adext";
+    changelog = "https://github.com/ajschmidt8/adext/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 8b7dcea1f3525..b29ddeedad7fe 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -1,38 +1,37 @@
-{ lib
-, babel
-, buildPythonPackage
-, click
-, cryptography
-, fetchPypi
-, gntp
-, installShellFiles
-, markdown
-, paho-mqtt
-, pytest-mock
-, pytest-xdist
-, pytestCheckHook
-, pythonOlder
-, pyyaml
-, requests
-, requests-oauthlib
-, setuptools
+{
+  lib,
+  babel,
+  buildPythonPackage,
+  click,
+  cryptography,
+  fetchPypi,
+  gntp,
+  installShellFiles,
+  markdown,
+  paho-mqtt,
+  pytest-mock,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  requests,
+  requests-oauthlib,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "1.7.6";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B38JMJzIpskGPb1hSzQ4B9Un1UZpO3/o/FpEM1Av6mw=";
+    hash = "sha256-6PWM6/6ho09WnLTGiAmjF1voDsBvCi7Ec1IrkgIyEsU=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   build-system = [
     babel
@@ -70,9 +69,7 @@ buildPythonPackage rec {
     installManPage packaging/man/apprise.1
   '';
 
-  pythonImportsCheck = [
-    "apprise"
-  ];
+  pythonImportsCheck = [ "apprise" ];
 
   meta = with lib; {
     description = "Push Notifications that work with just about every platform";
diff --git a/pkgs/development/python-modules/courlan/default.nix b/pkgs/development/python-modules/courlan/default.nix
index bd73aad1977d8..fd2cfc01b6e8d 100644
--- a/pkgs/development/python-modules/courlan/default.nix
+++ b/pkgs/development/python-modules/courlan/default.nix
@@ -1,56 +1,58 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, langcodes
-, pytestCheckHook
-, tld
-, urllib3
-, pythonOlder
+{
+  lib,
+  babel,
+  buildPythonPackage,
+  fetchPypi,
+  langcodes,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  tld,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "courlan";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PDVRHDZSXLL5Qc1nCbejp0LtlfC55WyX7sDBb9wDUYM=";
+    hash = "sha256-1wZoQzTxi+StofvVfyaArfADZkj22ECFL3pIItOt/Y0=";
   };
 
-  propagatedBuildInputs = [
+  # Tests try to write to /tmp directly. use $TMPDIR instead.
+  postPatch = ''
+    substituteInPlace tests/unit_tests.py \
+      --replace-fail "\"courlan --help\"" "\"$out/bin/courlan --help\"" \
+      --replace-fail "courlan_bin = \"courlan\"" "courlan_bin = \"$out/bin/courlan\"" \
+      --replace-fail "/tmp" "$TMPDIR"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    babel
     langcodes
     tld
     urllib3
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   # disable tests that require an internet connection
-  disabledTests = [
-    "test_urlcheck"
-  ];
-
-  # tests try to write to /tmp directly. use $TMPDIR instead.
-  postPatch = ''
-    substituteInPlace tests/unit_tests.py \
-      --replace "\"courlan --help\"" "\"$out/bin/courlan --help\"" \
-      --replace "courlan_bin = \"courlan\"" "courlan_bin = \"$out/bin/courlan\"" \
-      --replace "/tmp" "$TMPDIR"
-  '';
+  disabledTests = [ "test_urlcheck" ];
 
   pythonImportsCheck = [ "courlan" ];
 
   meta = with lib; {
     description = "Clean, filter and sample URLs to optimize data collection";
-    mainProgram = "courlan";
     homepage = "https://github.com/adbar/courlan";
     changelog = "https://github.com/adbar/courlan/blob/v${version}/HISTORY.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ jokatzke ];
+    mainProgram = "courlan";
   };
 }
diff --git a/pkgs/development/python-modules/hawkauthlib/default.nix b/pkgs/development/python-modules/hawkauthlib/default.nix
index 9df850b788297..b7c6c73820a25 100644
--- a/pkgs/development/python-modules/hawkauthlib/default.nix
+++ b/pkgs/development/python-modules/hawkauthlib/default.nix
@@ -1,28 +1,45 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, requests
-, webob
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  webob,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "hawkauthlib";
   version = "0.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mozilla-services";
-    repo = pname;
+    repo = "hawkauthlib";
     rev = "refs/tags/v${version}";
-    sha256 = "0mr1mpx4j9q7sch9arwfvpysnpf2p7ijy7072wilxm8pnj0bwvsi";
+    hash = "sha256-UW++gLQX1U4jFwccL+O5wl2r/d2OZ5Ug0wcnSfqtIVc=";
   };
 
-  propagatedBuildInputs = [ requests webob ];
+  postPatch = ''
+    substituteInPlace hawkauthlib/tests/* \
+        --replace-warn 'assertEquals' 'assertEqual'
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    webob
+  ];
+
+  pythonImportsCheck = [ "hawkauthlib" ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://github.com/mozilla-services/hawkauthlib";
     description = "Hawk Access Authentication protocol";
     license = licenses.mpl20;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/html-text/default.nix b/pkgs/development/python-modules/html-text/default.nix
index 00d2fb426d381..43d7ca228bb0e 100644
--- a/pkgs/development/python-modules/html-text/default.nix
+++ b/pkgs/development/python-modules/html-text/default.nix
@@ -1,37 +1,43 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, lxml
-, six
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lxml,
+  lxml-html-clean,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "html-text";
-  version = "0.5.2";
-  format = "setuptools";
+  version = "0.6.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
-    owner = "TeamHG-Memex";
+    owner = "zytedata";
     repo = "html-text";
-    rev = version;
-    hash = "sha256-jw/hpz0QfcgP5OEJcmre0h1OzOfpPtaROxHm+YUqces=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-e9gkibQv8mn1Jbt77UmpauOeTqhJQhY9R5Sge/iYi+U=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     lxml
+    lxml-html-clean
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    six
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "html_text" ];
 
   meta = with lib; {
     description = "Extract text from HTML";
-    homepage = "https://github.com/TeamHG-Memex/html-text";
+    homepage = "https://github.com/zytedata/html-text";
+    changelog = "https://github.com/zytedata/html-text/blob/${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 8dad1316c1a7f..b312b78a2bfb2 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.19.1";
+  version = "2.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pipdeptree";
     rev = "refs/tags/${version}";
-    hash = "sha256-kXRz78UHQtVyHFFnURSjOOXX8Me2I5tG2bX+u2yGyzY=";
+    hash = "sha256-Mng5YUM2+T3OFrr4uGVvq5mP0aq10r21pp46tw6lLno=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/private-gpt/default.nix b/pkgs/development/python-modules/private-gpt/default.nix
new file mode 100644
index 0000000000000..226489d046cb4
--- /dev/null
+++ b/pkgs/development/python-modules/private-gpt/default.nix
@@ -0,0 +1,119 @@
+{ lib
+, buildPythonPackage
+, python
+, fetchFromGitHub
+, poetry-core
+, fastapi
+, injector
+, llama-index-core
+, llama-index-readers-file
+, huggingface-hub
+, python-multipart
+, pyyaml
+, transformers
+, uvicorn
+, watchdog
+, gradio
+, fetchurl
+, fetchpatch
+}:
+
+buildPythonPackage rec {
+  pname = "private-gpt";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "zylon-ai";
+    repo = "private-gpt";
+    rev = "v${version}";
+    hash = "sha256-bjydzJhOJjmbflcJbuMyNsmby7HtNPFW3MY2Tw12cHw=";
+  };
+
+  patches = [
+    # Fix a vulnerability, to be removed in the next bump version
+    # See https://github.com/zylon-ai/private-gpt/pull/1890
+    (fetchpatch {
+      url = "https://github.com/zylon-ai/private-gpt/commit/86368c61760c9cee5d977131d23ad2a3e063cbe9.patch";
+      hash = "sha256-4ysRUuNaHW4bmNzg4fn++89b430LP6AzYDoX2HplVH0=";
+    })
+  ];
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    fastapi
+    injector
+    llama-index-core
+    llama-index-readers-file
+    python-multipart
+    pyyaml
+    transformers
+    uvicorn
+    watchdog
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  # This is needed for running the tests and the service in offline mode,
+  # See related issue at https://github.com/zylon-ai/private-gpt/issues/1870
+  passthru.cl100k_base.tiktoken = fetchurl {
+    url = "https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken";
+    hash = "sha256-Ijkht27pm96ZW3/3OFE+7xAPtR0YyTWXoRO8/+hlsqc=";
+  };
+
+  passthru.optional-dependencies = with python.pkgs; {
+    embeddings-huggingface = [
+      huggingface-hub
+      llama-index-embeddings-huggingface
+    ];
+    embeddings-ollama = [
+      llama-index-embeddings-ollama
+    ];
+    embeddings-openai = [
+      llama-index-embeddings-openai
+    ];
+    embeddings-sagemaker = [
+      boto3
+    ];
+    llms-ollama = [
+      llama-index-llms-ollama
+    ];
+    llms-openai = [
+      llama-index-llms-openai
+    ];
+    llms-openai-like = [
+      llama-index-llms-openai-like
+    ];
+    llms-sagemaker = [
+      boto3
+    ];
+    ui = [
+      gradio
+    ];
+    vector-stores-chroma = [
+      llama-index-vector-stores-chroma
+    ];
+    vector-stores-postgres = [
+      llama-index-vector-stores-postgres
+    ];
+    vector-stores-qdrant = [
+      llama-index-vector-stores-qdrant
+    ];
+  };
+
+  postInstall = ''
+    cp settings*.yaml $out/${python.sitePackages}/private_gpt/
+  '';
+
+  pythonImportsCheck = [ "private_gpt" ];
+
+  meta = {
+    changelog = "https://github.com/zylon-ai/private-gpt/blob/${src.rev}/CHANGELOG.md";
+    description = "Interact with your documents using the power of GPT, 100% privately, no data leaks";
+    homepage = "https://github.com/zylon-ai/private-gpt";
+    license = lib.licenses.asl20;
+    mainProgram = "private-gpt";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/python-modules/pybrowserid/default.nix b/pkgs/development/python-modules/pybrowserid/default.nix
index 1a4cd7c43058c..10346ee04cc3d 100644
--- a/pkgs/development/python-modules/pybrowserid/default.nix
+++ b/pkgs/development/python-modules/pybrowserid/default.nix
@@ -1,24 +1,44 @@
-{ lib, buildPythonPackage, fetchPypi
-, requests, mock }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+  unittestCheckHook,
+  mock,
+}:
 
 buildPythonPackage rec {
   pname = "pybrowserid";
   version = "0.14.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyBrowserID";
     inherit version;
-    sha256 = "1qvi79kfb8x9kxkm5lw2mp42hm82cpps1xknmsb5ghkwx1lpc8kc";
+    hash = "sha256-bCJ2aeh8wleWrnb2oO9lAlUoyK2C01Jnn6mj5WY6ceM=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  postPatch = ''
+    substituteInPlace browserid/tests/* \
+        --replace-warn 'assertEquals' 'assertEqual'
+  '';
 
-  nativeCheckInputs = [ mock ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  pythonImportsCheck = [ "browserid" ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+    mock
+  ];
 
   meta = with lib; {
     description = "Python library for the BrowserID Protocol";
-    homepage    = "https://github.com/mozilla/PyBrowserID";
-    license     = licenses.mpl20;
+    homepage = "https://github.com/mozilla/PyBrowserID";
+    license = licenses.mpl20;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyfxa/default.nix b/pkgs/development/python-modules/pyfxa/default.nix
index 39794d592103c..259370299db2e 100644
--- a/pkgs/development/python-modules/pyfxa/default.nix
+++ b/pkgs/development/python-modules/pyfxa/default.nix
@@ -18,7 +18,7 @@
 buildPythonPackage rec {
   pname = "pyfxa";
   version = "0.7.8";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,7 +28,11 @@ buildPythonPackage rec {
     hash = "sha256-DMFZl1hbYNaScOTWkAbK2nKti6wD5SS5A30q7TW5vO4=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     cryptography
     hawkauthlib
     pybrowserid
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index 22242ee62bf49..0f52f3dbf45ce 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -1,23 +1,24 @@
-{ lib
-, aiofiles
-, aiohttp
-, async-timeout
-, async-generator
-, buildPythonPackage
-, fetchFromGitHub
-, pypubsub
-, pyserial
-, pyserial-asyncio
-, pytestCheckHook
-, pythonAtLeast
-, pythonOlder
-, setuptools
-, voluptuous
+{
+  lib,
+  aiofiles,
+  aiohttp,
+  async-timeout,
+  async-generator,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pypubsub,
+  pyserial,
+  pyserial-asyncio,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  setuptools,
+  voluptuous,
 }:
 
 buildPythonPackage rec {
   pname = "pyinsteon";
-  version = "1.5.3";
+  version = "1.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,12 +27,10 @@ buildPythonPackage rec {
     owner = "pyinsteon";
     repo = "pyinsteon";
     rev = "refs/tags/${version}";
-    hash = "sha256-9d6QbekUv63sjKdK+ZogYOkGfFXVW+JB6ITHnehLwtM=";
+    hash = "sha256-s8YRDu+UpU1sisdscd87CpcLl3csOUDdIuKqx48GZsw=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiofiles
@@ -48,14 +47,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # RuntimeError: BUG: Dead Listener called, still subscribed!
+    "test_linking_with_i1_device"
+  ];
+
   disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
     # Tests are blocking or failing
     "tests/test_handlers/"
   ];
 
-  pythonImportsCheck = [
-    "pyinsteon"
-  ];
+  pythonImportsCheck = [ "pyinsteon" ];
 
   meta = with lib; {
     description = "Python library to support Insteon home automation projects";
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 31e730a0b9432..7d746131636e1 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "humbertogontijo";
     repo = "python-roborock";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/j7aJ34W7KP+O5ugl+xrA/X42SIjc+zfiBeSd1/4YZI=";
+    hash = "sha256-qyaERNaisfDWXW1IeyFMOV6nLqT+0O9QJ4U02LOyiuE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/trafilatura/default.nix b/pkgs/development/python-modules/trafilatura/default.nix
index 35212c3434438..a8183bf3f8411 100644
--- a/pkgs/development/python-modules/trafilatura/default.nix
+++ b/pkgs/development/python-modules/trafilatura/default.nix
@@ -1,35 +1,43 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytestCheckHook
-, pythonOlder
-, certifi
-, charset-normalizer
-, courlan
-, htmldate
-, justext
-, lxml
-, urllib3
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  certifi,
+  charset-normalizer,
+  courlan,
+  fetchPypi,
+  htmldate,
+  justext,
+  lxml,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "trafilatura";
-  version = "1.8.1";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a4eN/b1cXftV0Pgwfyt9wVrDRYBU90hh/5ihcvXjhyA=";
+    hash = "sha256-5oM9KauKE+2FOTfXyR5oaLxi774QIUrCsQZDbdI9FBI=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  # Patch out gui cli because it is not supported in this packaging and
+  # nixify path to the trafilatura binary in the test suite
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"trafilatura_gui=trafilatura.gui:main",' ""
+    substituteInPlace tests/cli_tests.py \
+      --replace-fail "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
+  '';
+
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     charset-normalizer
     courlan
@@ -39,34 +47,22 @@ buildPythonPackage rec {
     urllib3
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
     # Disable tests that require an internet connection
+    "test_cli_pipeline"
+    "test_crawl_page"
     "test_download"
     "test_fetch"
-    "test_redirection"
     "test_meta_redirections"
-    "test_crawl_page"
-    "test_whole"
     "test_probing"
-    "test_cli_pipeline"
+    "test_queue"
+    "test_redirection"
+    "test_whole"
   ];
 
-  # patch out gui cli because it is not supported in this packaging
-  # nixify path to the trafilatura binary in the test suite
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail '"trafilatura_gui=trafilatura.gui:main",' ""
-    substituteInPlace tests/cli_tests.py \
-      --replace-fail "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
-  '';
-
-  pythonImportsCheck = [
-    "trafilatura"
-  ];
+  pythonImportsCheck = [ "trafilatura" ];
 
   meta = with lib; {
     description = "Python package and command-line tool designed to gather text on the Web";
diff --git a/pkgs/development/tools/misc/terramate/default.nix b/pkgs/development/tools/misc/terramate/default.nix
index b6efe2732dcac..880183c8bdf60 100644
--- a/pkgs/development/tools/misc/terramate/default.nix
+++ b/pkgs/development/tools/misc/terramate/default.nix
@@ -6,22 +6,25 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.4.2";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-aOKUC1FtDDhdUbPUSLW6GrSwh6r29Y2ObC6y487W4Zc=";
+    hash = "sha256-jcmOS81iPzy1ul0Cj/SiJk84AUIq7mLI+CmspuPit+o=";
   };
 
-  vendorHash = "sha256-gl5xsaSkGXlh+MfieVBPHGAbYZVF3GBbIkmvVhlJvqw=";
+  vendorHash = "sha256-Na2XDPSwgwWTQrweslAtSOh2+B/ZFaPIdy8ssAFWkGs=";
 
   # required for version info
   nativeBuildInputs = [ git ];
 
   ldflags = [ "-extldflags" "-static" ];
 
+  # Disable failing E2E tests preventing the package from building
+  excludedPackages = [ "./cmd/terramate/e2etests/cloud" "./cmd/terramate/e2etests/core" ];
+
   meta = with lib; {
     description = "Adds code generation, stacks, orchestration, change detection, data sharing and more to Terraform";
     homepage = "https://github.com/terramate-io/terramate";
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index f4d8137c33eba..f54f77113e42e 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.43.1";
+  version = "4.44.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-AQOHVuDREp6OpwlPFwpCUOQACOsDRH0uM6WwKyEK4JI=";
+    hash = "sha256-5l948J0NTeWOeUMlcoEQZws8viqtARdkJsGch4c6Trw=";
   };
 
-  vendorHash = "sha256-9GCqZS0fguJo8GkVPMgbstEVzrjIS0kdbNQEaT1HSFI=";
+  vendorHash = "sha256-j5vcx5wW2v1kNc2QCPR11JEb1fTA9q4E4mbJ2VJC37A=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index a34e1285e3071..66a71c1fa3be6 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -1,6 +1,7 @@
 { egl-wayland
 , libepoxy
 , fetchurl
+, fetchpatch
 , fontutil
 , lib
 , libei
@@ -53,6 +54,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-HJo2a058ytug+b0xPFnq4S0jvXJUOyKibq+LIINc/G0=";
   };
 
+  patches = [
+    # Backport fix for libei scrolling
+    # Notably affects Steam Input, but also anything else using xtest
+    # FIXME: remove when merged
+    # Upstream PR: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1531
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/317712eb5a1aa4a1c3d737a8fcaee57add9981c9.patch";
+      hash = "sha256-TZo38Pyr9IJUF+3bqlmF4M84XGgo9G6WFTvbaP9r0XU=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index b8e49b37a8d2f..03078392264da 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -13,7 +13,7 @@ let
   pythonEnv = python.withPackages (p: with p; [
     cffi
     cryptography
-    openssl
+    pyopenssl
     crcmod
     numpy
   ] ++ lib.optional (with-gce) google-compute-engine);
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 399d87461a9a7..0c71baad6a6cb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9889,6 +9889,8 @@ self: super: with self; {
 
   ppdeep = callPackage ../development/python-modules/ppdeep { };
 
+  private-gpt = callPackage ../development/python-modules/private-gpt { };
+
   prodict = callPackage ../development/python-modules/prodict { };
 
   prometheus-pandas = callPackage ../development/python-modules/prometheus-pandas { };