15 files changed, 145 insertions, 67 deletions
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 4981f5938de21..8beaffa75e384 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bind";
-  version = "9.18.25";
+  version = "9.18.26";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-WkpwQyoz0Anw5unbsyiq56XidQfpjii/PAxrJQzLKrM=";
+    hash = "sha256-df/uUnMelgTISbZY3ynpJ/HE8B1aceo+vL62NwLLZlE=";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
diff --git a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
index 8afef1211f80c..75aa54f9c9c28 100644
--- a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
+++ b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
@@ -11,7 +11,7 @@ Subject: [PATCH 1/2] Define configs with env vars
  4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/app.php b/app.php
-index bc5b1b39..26f7687e 100644
+index bc5b1b3..26f7687 100644
 --- a/app.php
 +++ b/app.php
 @@ -12,7 +12,7 @@ use Slim\Views\Blade;
@@ -41,11 +41,24 @@ index bc5b1b39..26f7687e 100644
  
  ob_clean(); // No response output before here
  $app->run();
+diff --git a/controllers/BaseApiController.php b/controllers/BaseApiController.php
+index 5941e348..e5b02af4 100644
+--- a/controllers/BaseApiController.php
++++ b/controllers/BaseApiController.php
+@@ -162,7 +162,7 @@ class BaseApiController extends BaseController
+ 		if (self::$htmlPurifierInstance == null)
+ 		{
+ 			$htmlPurifierConfig = \HTMLPurifier_Config::createDefault();
+-			$htmlPurifierConfig->set('Cache.SerializerPath', GROCY_DATAPATH . '/viewcache');
++			$htmlPurifierConfig->set('Cache.SerializerPath', getenv('GROCY_CACHE_DIR'));
+ 			$htmlPurifierConfig->set('HTML.Allowed', 'div,b,strong,i,em,u,a[href|title|target],iframe[src|width|height|frameborder],ul,ol,li,p[style],br,span[style],img[style|width|height|alt|src],table[border|width|style],tbody,tr,td,th,blockquote,*[style|class|id],h1,h2,h3,h4,h5,h6');
+ 			$htmlPurifierConfig->set('Attr.EnableID', true);
+ 			$htmlPurifierConfig->set('HTML.SafeIframe', true);
 diff --git a/services/DatabaseService.php b/services/DatabaseService.php
-index 4a05bda1..ce41ed17 100644
+index ba79a73..12a851a 100644
 --- a/services/DatabaseService.php
 +++ b/services/DatabaseService.php
-@@ -125,6 +125,6 @@ class DatabaseService
+@@ -137,6 +137,6 @@ class DatabaseService
  			return GROCY_DATAPATH . '/grocy_' . $dbSuffix . '.db';
  		}
  
@@ -54,7 +67,7 @@ index 4a05bda1..ce41ed17 100644
  	}
  }
 diff --git a/services/FilesService.php b/services/FilesService.php
-index 7d070350..a6dd4b08 100644
+index 7d07035..a6dd4b0 100644
 --- a/services/FilesService.php
 +++ b/services/FilesService.php
 @@ -10,7 +10,7 @@ class FilesService extends BaseService
@@ -67,18 +80,18 @@ index 7d070350..a6dd4b08 100644
  		{
  			mkdir($this->StoragePath);
 diff --git a/services/StockService.php b/services/StockService.php
-index 7265e82b..13af591a 100644
+index 9f034a5..fd3c0b7 100644
 --- a/services/StockService.php
 +++ b/services/StockService.php
-@@ -1761,7 +1761,7 @@ class StockService extends BaseService
+@@ -1707,7 +1707,7 @@ class StockService extends BaseService
  			throw new \Exception('No barcode lookup plugin defined');
  		}
  
 -		$path = GROCY_DATAPATH . "/plugins/$pluginName.php";
 +		$path = getenv('GROCY_PLUGIN_DIR') . "/$pluginName.php";
- 
  		if (file_exists($path))
  		{
+ 			require_once $path;
 -- 
-2.41.0
+2.42.0
 
diff --git a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
index f239ca06dd099..24050f782c485 100644
--- a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
+++ b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
@@ -8,10 +8,10 @@ Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
  1 file changed, 1 deletion(-)
 
 diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
-index da431b4b..6b878627 100644
+index 8e12a5c..37b433d 100644
 --- a/helpers/PrerequisiteChecker.php
 +++ b/helpers/PrerequisiteChecker.php
-@@ -17,7 +17,6 @@ class PrerequisiteChecker
+@@ -18,7 +18,6 @@ class PrerequisiteChecker
  	public function checkRequirements()
  	{
  		self::checkForPhpVersion();
@@ -20,5 +20,4 @@ index da431b4b..6b878627 100644
  		self::checkForComposer();
  		self::checkForPhpExtensions();
 -- 
-2.41.0
-
+2.42.0
\ No newline at end of file
diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
index 296aba9e1fb39..dbca9773ab653 100644
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@@ -1,40 +1,71 @@
-{ lib, stdenv, fetchurl, unzip, nixosTests }:
+{ lib
+, fetchFromGitHub
+, fetchYarnDeps
+, php
+, yarn
+, fixup-yarn-lock
+, nixosTests
+}:
 
-stdenv.mkDerivation rec {
+php.buildComposerProject (finalAttrs: {
   pname = "grocy";
-  version = "4.0.3";
+  version = "4.2.0";
 
-  src = fetchurl {
-    url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    hash = "sha256-KBTsi634SolgA01eRthMuWx7DIF7rhvJSPxiHyuKSR8=";
+  src = fetchFromGitHub {
+    owner = "grocy";
+    repo = "grocy";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-aX3DMy9Jv8rNp1/VIvUtNXYXGBrCgBMs5GsDf4XXSj0=";
   };
 
-  nativeBuildInputs = [ unzip ];
-  unpackPhase = ''
-    unzip ${src} -d .
-  '';
+  vendorHash = "sha256-KaYvA0Rd4pd1s/L8QbVUgkE+SjH+jv4+6RvIaGOpews=";
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-UvWY8+qSRvzJbm7z3CmLyeUHxemzNUB7dHYP95ZVtcI=";
+  };
+
+  nativeBuildInputs = [
+    yarn
+    fixup-yarn-lock
+  ];
+
+  # Upstream composer.json file is missing the name, description and license fields
+  composerStrictValidation = false;
 
   # NOTE: if patches are created from a git checkout, those should be modified
-  # with `unixdos` to make sure those apply here.
+  # with `unix2dos` to make sure those apply here.
   patches = [
     ./0001-Define-configs-with-env-vars.patch
     ./0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
   ];
-  patchFlags = [ "--binary" "-p1" ];
 
-  dontBuild = true;
+  configurePhase = ''
+    runHook preConfigure
 
-  passthru.tests = { inherit (nixosTests) grocy; };
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup-yarn-lock yarn.lock
+    yarn install --offline --frozen-lockfile --no-progress --non-interactive
+
+    runHook postConfigure
+  '';
 
   installPhase = ''
-    mkdir -p $out/
-    cp -R . $out/
+    runHook preInstall
+
+    mv $out/share/php/grocy/* $out
+    rm -r $out/share
+
+    runHook postInstall
   '';
 
+  passthru.tests = { inherit (nixosTests) grocy; };
+
   meta = with lib; {
     license = licenses.mit;
     maintainers = with maintainers; [ n0emis ];
     description = "ERP beyond your fridge - grocy is a web-based self-hosted groceries & household management solution for your home";
     homepage = "https://grocy.info/";
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/intents.nix b/pkgs/servers/home-assistant/intents.nix
index b7b1578033e25..744adc8b49739 100644
--- a/pkgs/servers/home-assistant/intents.nix
+++ b/pkgs/servers/home-assistant/intents.nix
@@ -1,33 +1,67 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pythonOlder
 
 # build-system
 , setuptools
+
+# codegen
+, hassil
+, python
+, pyyaml
+, voluptuous
+, regex
+, jinja2
+
+# tests
+, pytest-xdist
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "home-assistant-intents";
   version = "2024.4.3";
-  format = "wheel";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit version format;
-    pname = "home_assistant_intents";
-    dist = "py3";
-    python = "py3";
-    hash = "sha256-GraYVtioKIoKlPRBhhhzlbBfI6heXAaA1MQpUqAgEDQ=";
+  src = fetchFromGitHub {
+    owner = "home-assistant";
+    repo = "intents-package";
+    rev = "refs/tags/${version}";
+    hash = "sha256-hcstD1qkngZAl/jKLez+4qDs/ZIandkVkY2jrvZqph8=";
+    fetchSubmodules = true;
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools~=62.3" "setuptools" \
+      --replace-fail "wheel~=0.37.1" "wheel"
+  '';
+
   build-system = [
     setuptools
+
+    # build-time codegen; https://github.com/home-assistant/intents/blob/main/requirements.txt#L1-L5
+    hassil
+    pyyaml
+    voluptuous
+    regex
+    jinja2
   ];
 
-  # sdist/wheel do not ship tests
-  doCheck = false;
+  postInstall = ''
+    # https://github.com/home-assistant/intents-package/blob/main/script/package#L23-L24
+    PACKAGE_DIR=$out/${python.sitePackages}/home_assistant_intents
+    ${python.pythonOnBuildForHost.interpreter} script/merged_output.py $PACKAGE_DIR/data
+    ${python.pythonOnBuildForHost.interpreter} script/write_languages.py $PACKAGE_DIR/data > $PACKAGE_DIR/languages.py
+  '';
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
 
   pytestFlagsArray = [
     "intents/tests"
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 93c5784c9c1bf..16b0b50a8f6e1 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -1,8 +1,8 @@
 {
   "invidious": {
-    "rev": "08390acd0c17875fddb84cabba54197a5b5740e4",
-    "hash": "sha256-75C/ImX/PYikVdSO4rZM/aYyEgx6pU90BHNeRFfcsDM=",
-    "version": "0.20.1-unstable-2024-03-31"
+    "rev": "b673695aa2704b880562399ac78659ad23b7940d",
+    "hash": "sha256-2vYCQNAf+o1Z2HFMk4sIlKNBFAsiLZe0Iw34oThC2Vs=",
+    "version": "0.20.1-unstable-2024-04-10"
   },
   "videojs": {
     "hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="
diff --git a/pkgs/servers/jellyseerr/package.json b/pkgs/servers/jellyseerr/package.json
index 6892a3bd80858..39613efb5fad5 100644
--- a/pkgs/servers/jellyseerr/package.json
+++ b/pkgs/servers/jellyseerr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jellyseerr",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "private": true,
   "scripts": {
     "dev": "nodemon -e ts --watch server --watch overseerr-api.yml -e .json,.ts,.yml -x ts-node -r tsconfig-paths/register --files --project server/tsconfig.json server/index.ts",
diff --git a/pkgs/servers/jellyseerr/pin.json b/pkgs/servers/jellyseerr/pin.json
index 7905d006ee849..715f91a73b31c 100644
--- a/pkgs/servers/jellyseerr/pin.json
+++ b/pkgs/servers/jellyseerr/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.7.0",
-  "srcHash": "sha256-9ILP2HH7p8ELwrQOBnqPbvHdUnNrqEkA4OmxOuhNbEc=",
-  "yarnSha256": "1ygb8pmwra570wmdkn7mxv9j90cgjh063b9cl0wl9hsmg687sk9h"
+  "version": "1.8.1",
+  "srcHash": "sha256-B8Hnpi4XwK0WrHRgj7OSVUh49oRH9SVEHdzGbnDa8p8=",
+  "yarnSha256": "ME19kHlVw0Q5oCytYQCUj4Ek0+712NkqB6eozOtF6/k="
 }
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index edc4a139c76ad..f71d3442e2d27 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -32,20 +32,20 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.105.0";
+  version = "1.105.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-MydtP7jtTx9phmnoAajWvDI0sSqw+TScj+9n485L5qc=";
+    hash = "sha256-sul9wz9NXz87ZIbvSHWYQabTW/PlwAJJ2keaO0NbHHU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-yj3biat5znDqsen0mc8MNkXKhUftpb26VT7utWdpxvc=";
+    hash = "sha256-Cp1Bnf96invtmYayGfBVGwxW2jk/nRVCzueubd9HIG4=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
index 68f75d734bd7f..0fe78286dc5e0 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-hookshot",
-  "version": "5.2.1",
+  "version": "5.3.0",
   "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
   "main": "lib/app.js",
   "repository": "https://github.com/matrix-org/matrix-hookshot",
@@ -55,6 +55,7 @@
     "cors": "^2.8.5",
     "express": "^4.18.2",
     "figma-js": "^1.14.0",
+    "helmet": "^7.1.0",
     "http-status-codes": "^2.2.0",
     "ioredis": "^5.2.3",
     "jira-client": "^8.2.2",
@@ -114,6 +115,6 @@
     "ts-jest": "^29.1.1",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3",
-    "vite": "^5.0.12"
+    "vite": "^5.0.13"
   }
 }
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
index 08607edb95055..5ab03440fc91e 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "5.2.1",
-  "srcHash": "sha256-yh8erXI1r9BqdJvEdk2WuBojXUK7VQf9bc4GQ2a2vIo=",
-  "yarnHash": "0nps2wbpkaivi9wb9zcqsrg77w9mm7inls9jqsx7xmyn4ashbs1p",
-  "cargoHash": "sha256-3euxhE9Y3N9bxo5S+l2mhYF575EoC/A5pH/mD+Ey86g="
+  "version": "5.3.0",
+  "srcHash": "sha256-saniKtauX+9lZxPZOtGLlk4//ht0njgWfnOIJsdQlOQ=",
+  "yarnHash": "1a52j61mb5hq62wd681zqpw7fkjhabqicdyvmam4jdd2qz2vh0w1",
+  "cargoHash": "sha256-ffjAsYOML+mDBToaVVuxjLUUEpGmBzWB0nN4jzOO098="
 }
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index af59e6eec7a04..92cb7dee4ec4b 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.30.1";
+  version = "1.30.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-cBEPNPeezh4X817Iq8Bo41/KX58I9HL2GA0lAU7+ISE=";
+    hash = "sha256-y9FfCCOUl0IWwcol1aDG+1m7270wWc3akhZzaK/KItY=";
   };
 
-  vendorHash = "sha256-jTw5YLGgHs3uvihI6KPZg+cNrnNixUznJsH0CtIVe6I=";
+  vendorHash = "sha256-7X2k/fpr9zQNXfyd+18VpRTcmYvPBvQzPNolNfmIZG8=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/roadrunner/default.nix b/pkgs/servers/roadrunner/default.nix
index c1754e3ac9587..0141a90093967 100644
--- a/pkgs/servers/roadrunner/default.nix
+++ b/pkgs/servers/roadrunner/default.nix
@@ -6,12 +6,12 @@
 
 buildGoModule rec {
   pname = "roadrunner";
-  version = "2023.3.12";
+  version = "2024.1.0";
   src = fetchFromGitHub {
     repo = "roadrunner";
     owner = "roadrunner-server";
     rev = "v${version}";
-    hash = "sha256-d/GXZ0rQ8prkOgvkx8/TBwP2zwISef5ClMGy1pkW7g4=";
+    hash = "sha256-K5ZN5HHz2PEBOQ5ke7FUCjMihORfxxjLUtBJgd/1jAA=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ buildGoModule rec {
       --replace "127.0.0.1:0" "127.0.0.1:55554"
   '';
 
-  vendorHash = "sha256-GNWd+SFjAeIkIkPSh+UtQwoWfQ9lUATXfnkWbqwQfsY=";
+  vendorHash = "sha256-fAFErw5+oR4MEme5v3iMyLqwwsR4O6OxeVcVDVlKpdI=";
 
   meta = {
     changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/servers/sql/rqlite/default.nix b/pkgs/servers/sql/rqlite/default.nix
index 8a46f4bfe0aa2..32ddb8ac6b515 100644
--- a/pkgs/servers/sql/rqlite/default.nix
+++ b/pkgs/servers/sql/rqlite/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.23.1";
+  version = "8.23.2";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vBBxLUS6BSPJnJqxXVC6brKd70na7JPkA6F4mtEqXZw=";
+    sha256 = "sha256-/u817cYaa8Qfq2cbyBIJZdGpqHQFtPhrHTRSSpz8658=";
   };
 
   vendorHash = "sha256-CXwcz4L5Y0HbOdQm62YQGFtguk3X+dYx5Gc6E55PhjM=";
diff --git a/pkgs/servers/uxplay/default.nix b/pkgs/servers/uxplay/default.nix
index 0eecf8e8c59cc..01b0361e29e8d 100644
--- a/pkgs/servers/uxplay/default.nix
+++ b/pkgs/servers/uxplay/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxplay";
-  version = "1.68.2";
+  version = "1.68.3";
 
   src = fetchFromGitHub {
     owner = "FDH2";
     repo = "UxPlay";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ax2RhIIWb7BvBvE8GQlR3lwTSA5P5Qpj45cOc8xZNtY=";
+    hash = "sha256-Ev+VXI37zLRQ3yqllJVo1JZK/U82HeB65Hi9+c0O8Ks=";
   };
 
   postPatch = ''