Merge 798f303659 into haskell-updates

ci/eval/compare/utils.nix

@@ -212,13 +212,25 @@ rec {
             else if rebuildCount <= 500 then
               [ "101-500" ]
             else if rebuildCount <= 1000 then
-              [ "501-1000" ]
+              [
+                "501-1000"
+                "501+"
+              ]
             else if rebuildCount <= 2500 then
-              [ "1001-2500" ]
+              [
+                "1001-2500"
+                "501+"
+              ]
             else if rebuildCount <= 5000 then
-              [ "2501-5000" ]
+              [
+                "2501-5000"
+                "501+"
+              ]
             else
-              [ "5001+" ];
+              [
+                "5001+"
+                "501+"
+              ];
         in
         lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
       ) rebuildCountByKernel

doc/doc-support/package.nix

@@ -110,7 +110,7 @@ stdenvNoCC.mkDerivation (
       shell =
         let
           devmode' = devmode.override {
-            buildArgs = "./.";
+            buildArgs = toString ../.;
             open = "/share/doc/nixpkgs/manual.html";
           };
           nixos-render-docs-redirects' = writeShellScriptBin "redirects" "${lib.getExe nixos-render-docs-redirects} --file ${toString ../redirects.json} $@";

maintainers/maintainer-list.nix

@@ -2243,11 +2243,6 @@
     github = "auchter";
     githubId = 1190483;
   };
-  aucub = {
-    name = "aucub";
-    github = "aucub";
-    githubId = 78630225;
-  };
   augustebaum = {
     email = "auguste.apple@gmail.com";
     github = "augustebaum";
@@ -6178,6 +6173,13 @@
     githubId = 20759788;
     name = "JP Lippold";
   };
+  DrakeTDL = {
+    name = "Drake";
+    email = "draketdl@mailbox.org";
+    matrix = "@draketdl:matrix.org";
+    github = "DrakeTDL";
+    githubId = 22124013;
+  };
   dramaturg = {
     email = "seb@ds.ag";
     github = "dramaturg";
@@ -13187,6 +13189,12 @@
     githubId = 74221543;
     name = "Moritz Goltdammer";
   };
+  linuxmobile = {
+    email = "bdiez19@gmail.com";
+    github = "linuxmobile";
+    githubId = 10554636;
+    name = "Braian A. Diez";
+  };
   lionello = {
     email = "lio@lunesu.com";
     github = "lionello";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -118,6 +118,8 @@
 
 - [Zipline](https://zipline.diced.sh/), a ShareX/file upload server that is easy to use, packed with features, and with an easy setup. Available as [services.zipline](#opt-services.zipline.enable).
 
+- [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
+
 - [Fider](https://fider.io/), an open platform to collect and prioritize feedback. Available as [services.fider](#opt-services.fider.enable).
 
 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
@@ -175,6 +177,9 @@
   to review the new defaults and description of
   [](#opt-services.nextcloud.poolSettings).
 
+- The `services.locate` module does no longer support findutil's `locate` due to its inferior performance compared to `mlocate` and `plocate`. The new default is `plocate`.
+  As the `service.locate.localuser` option only applied when using findutil's `locate`, it has also been removed.
+
 - `kmonad` is now hardened by default using common `systemd` settings.
   If KMonad is used to execute shell commands, hardening may make some of them fail.  In that case, you can disable hardening using {option}`services.kmonad.keyboards.<name>.enableHardening` option.
 
@@ -229,6 +234,8 @@
 
 - `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
 
+- `services.mongodb.initialRootPassword` has been replaced with the more secure option [`services.mongodb.initialRootPasswordFile`](#opt-services.mongodb.initialRootPasswordFile)
+
 - `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.
 
 - `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.
@@ -389,6 +396,8 @@
 
 - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
 
+- [`services.mongodb`](#opt-services.mongodb.enable) is now compatible with the `mongodb-ce` binary package. To make use of it, set [`services.mongodb.package`](#opt-services.mongodb.package) to `pkgs.mongodb-ce`.
+
 - [`services.jupyter`](#opt-services.jupyter.enable) is now compatible with `Jupyter Notebook 7`. See [the migration guide](https://jupyter-notebook.readthedocs.io/en/latest/migrate_to_notebook7.html) for details.
 
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
@@ -401,6 +410,8 @@
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
+- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
+
 - The paperless module now has an option for regular automatic export of
   documents data using the integrated document exporter.
 

nixos/doc/manual/shell.nix

@@ -7,7 +7,7 @@ let
   common = import ./common.nix;
   inherit (common) outputPath indexPath;
   devmode = pkgs.devmode.override {
-    buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
+    buildArgs = ''${toString ../../release.nix} -A manualHTML.${builtins.currentSystem}'';
     open = "/${outputPath}/${indexPath}";
   };
   nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" "${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file ${toString ./redirects.json} $@";

nixos/modules/misc/locate.nix

@@ -9,14 +9,15 @@ let
   cfg = config.services.locate;
   isMLocate = lib.hasPrefix "mlocate" cfg.package.name;
   isPLocate = lib.hasPrefix "plocate" cfg.package.name;
-  isMorPLocate = isMLocate || isPLocate;
-  isFindutils = lib.hasPrefix "findutils" cfg.package.name;
 in
 {
   imports = [
     (lib.mkRenamedOptionModule [ "services" "locate" "period" ] [ "services" "locate" "interval" ])
     (lib.mkRenamedOptionModule [ "services" "locate" "locate" ] [ "services" "locate" "package" ])
     (lib.mkRemovedOptionModule [ "services" "locate" "includeStore" ] "Use services.locate.prunePaths")
+    (lib.mkRemovedOptionModule [ "services" "locate" "localuser" ]
+      "The services.locate.localuser option has been removed because support for findutils locate has been removed."
+    )
   ];
 
   options.services.locate = {
@@ -29,7 +30,7 @@ in
       '';
     };
 
-    package = lib.mkPackageOption pkgs [ "findutils" "locate" ] {
+    package = lib.mkPackageOption pkgs [ "plocate" ] {
       example = "mlocate";
     };
 
@@ -65,15 +66,6 @@ in
       '';
     };
 
-    localuser = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = "nobody";
-      description = ''
-        The user to search non-network directories as, using
-        {command}`su`.
-      '';
-    };
-
     pruneFS = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [
@@ -180,7 +172,7 @@ in
 
     pruneNames = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = lib.optionals (!isFindutils) [
+      default = [
         ".bzr"
         ".cache"
         ".git"
@@ -229,7 +221,7 @@ in
           source = "${cfg.package}/bin/plocate";
         };
       in
-      lib.mkIf isMorPLocate {
+      {
         locate = lib.mkMerge [
           common
           mlocate
@@ -253,59 +245,31 @@ in
       '';
 
       systemPackages = [ cfg.package ];
-
-      variables = lib.mkIf isFindutils {
-        LOCATE_PATH = cfg.output;
-      };
     };
 
-    warnings =
-      lib.optional (isMorPLocate && cfg.localuser != null)
-        "mlocate and plocate do not support the services.locate.localuser option. updatedb will run as root. Silence this warning by setting services.locate.localuser = null."
-      ++ lib.optional (
-        isFindutils && cfg.pruneNames != [ ]
-      ) "findutils locate does not support pruning by directory component"
-      ++ lib.optional (
-        isFindutils && cfg.pruneBindMounts
-      ) "findutils locate does not support skipping bind mounts";
-
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
-      path = lib.mkIf (!isMorPLocate) [ pkgs.su ];
 
       # mlocate's updatedb takes flags via a configuration file or
       # on the command line, but not by environment variable.
       script =
-        if isMorPLocate then
-          let
-            toFlags =
-              x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
-            args = lib.concatLists (
-              map toFlags [
-                "pruneFS"
-                "pruneNames"
-                "prunePaths"
-              ]
-            );
-          in
-          ''
-            exec ${cfg.package}/bin/updatedb \
-              --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-              --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \
-              ${lib.concatStringsSep " " cfg.extraFlags}
-          ''
-        else
-          ''
-            exec ${cfg.package}/bin/updatedb \
-              ${lib.optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"} \
-              --output=${toString cfg.output} ${lib.concatStringsSep " " cfg.extraFlags}
-          '';
-      environment = lib.optionalAttrs (!isMorPLocate) {
-        PRUNEFS = lib.concatStringsSep " " cfg.pruneFS;
-        PRUNEPATHS = lib.concatStringsSep " " cfg.prunePaths;
-        PRUNENAMES = lib.concatStringsSep " " cfg.pruneNames;
-        PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";
-      };
+        let
+          toFlags =
+            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
+          args = lib.concatLists (
+            map toFlags [
+              "pruneFS"
+              "pruneNames"
+              "prunePaths"
+            ]
+          );
+        in
+        ''
+          exec ${cfg.package}/bin/updatedb \
+            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
+            --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"} \
+            ${lib.concatStringsSep " " cfg.extraFlags}
+        '';
       serviceConfig = {
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;

nixos/modules/module-list.nix

@@ -1577,6 +1577,7 @@
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/sogo.nix
   ./services/web-apps/stirling-pdf.nix
+  ./services/web-apps/stash.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/vikunja.nix

nixos/modules/programs/pay-respects.nix

@@ -8,11 +8,11 @@ let
   inherit (lib)
     getExe
     isBool
+    listToAttrs
     literalExpression
     maintainers
     mkEnableOption
     mkIf
-    mkMerge
     mkOption
     mkPackageOption
     optionalString
@@ -169,16 +169,19 @@ in
           "url"
           "model"
         ];
-    environment = mkMerge (
-      [
-        {
-          systemPackages = [ finalPackage ];
-        }
-      ]
-      ++ map (rule: {
-        etc."xdg/pay-respects/rules/${rule.command}.toml".source = generate "${rule.command}.toml" rule;
-      }) cfg.runtimeRules
-    );
+
+    environment = {
+      etc = listToAttrs (
+        map (rule: {
+          name = "xdg/pay-respects/rules/${rule.command}.toml";
+          value = {
+            source = generate "${rule.command}.toml" rule;
+          };
+        }) cfg.runtimeRules
+      );
+
+      systemPackages = [ finalPackage ];
+    };
 
     programs = {
       bash.interactiveShellInit = initScript "bash";

nixos/modules/services/databases/foundationdb.md

@@ -18,7 +18,7 @@ To enable FoundationDB, add the following to your
 ```nix
 {
   services.foundationdb.enable = true;
-  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.r3.x
+  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.3.x
 }
 ```
 

nixos/modules/services/databases/mongodb.nix

@@ -10,6 +10,8 @@ let
 
   mongodb = cfg.package;
 
+  mongoshExe = lib.getExe cfg.mongoshPackage;
+
   mongoCnf =
     cfg:
     pkgs.writeText "mongodb.conf" ''
@@ -25,6 +27,13 @@ let
 in
 
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mongodb"
+      "initialRootPassword"
+    ] "Use services.mongodb.initialRootPasswordFile to securely provide the initial root password.")
+  ];
 
   ###### interface
 
@@ -34,7 +43,11 @@ in
 
       enable = lib.mkEnableOption "the MongoDB server";
 
-      package = lib.mkPackageOption pkgs "mongodb" { };
+      package = lib.mkPackageOption pkgs "mongodb" {
+        example = "pkgs.mongodb-ce";
+      };
+
+      mongoshPackage = lib.mkPackageOption pkgs "mongosh" { };
 
       user = lib.mkOption {
         type = lib.types.str;
@@ -60,10 +73,10 @@ in
         description = "Enable client authentication. Creates a default superuser with username root!";
       };
 
-      initialRootPassword = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      initialRootPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        description = "Password for the root user if auth is enabled.";
+        description = "Path to the file containing the password for the root user if auth is enabled.";
       };
 
       dbpath = lib.mkOption {
@@ -112,8 +125,8 @@ in
   config = lib.mkIf config.services.mongodb.enable {
     assertions = [
       {
-        assertion = !cfg.enableAuth || cfg.initialRootPassword != null;
-        message = "`enableAuth` requires `initialRootPassword` to be set.";
+        assertion = !cfg.enableAuth || cfg.initialRootPasswordFile != null;
+        message = "`enableAuth` requires `initialRootPasswordFile` to be set.";
       }
     ];
 
@@ -125,8 +138,6 @@ in
     };
     users.groups.mongodb = lib.mkIf (cfg.user == "mongodb") { };
 
-    environment.systemPackages = [ mongodb ];
-
     systemd.services.mongodb = {
       description = "MongoDB server";
 
@@ -164,14 +175,15 @@ in
           if ! test -e "${cfg.dbpath}/.auth_setup_complete"; then
             systemd-run --unit=mongodb-for-setup --uid=${cfg.user} ${mongodb}/bin/mongod --config ${mongoCnf cfg_}
             # wait for mongodb
-            while ! ${mongodb}/bin/mongo --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
+            while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
 
-          ${mongodb}/bin/mongo <<EOF
-            use admin
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
+          ${mongoshExe} <<EOF
+            use admin;
             db.createUser(
               {
                 user: "root",
-                pwd: "${cfg.initialRootPassword}",
+                pwd: "$initialRootPassword",
                 roles: [
                   { role: "userAdminAnyDatabase", db: "admin" },
                   { role: "dbAdminAnyDatabase", db: "admin" },
@@ -187,7 +199,8 @@ in
       postStart = ''
         if test -e "${cfg.dbpath}/.first_startup"; then
           ${lib.optionalString (cfg.initialScript != null) ''
-            ${mongodb}/bin/mongo ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
+            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p $initialRootPassword"} admin "${cfg.initialScript}"
           ''}
           rm -f "${cfg.dbpath}/.first_startup"
         fi

nixos/modules/services/home-automation/wyoming/faster-whisper.nix

@@ -275,18 +275,13 @@ in
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-faster-whisper";
-            StateDirectory = [
-              "wyoming/faster-whisper"
-              "wyoming/faster-whisper/models"
-            ];
+            StateDirectory = [ "wyoming/faster-whisper" ];
             # https://github.com/home-assistant/addons/blob/master/whisper/rootfs/etc/s6-overlay/s6-rc.d/whisper/run
             ExecStart = escapeSystemdExecArgs (
               [
                 (lib.getExe cfg.package)
                 "--data-dir"
                 "/var/lib/wyoming/faster-whisper"
-                "--download-dir"
-                "/var/lib/wyoming/faster-whisper/models"
                 "--uri"
                 options.uri
                 "--device"

nixos/modules/services/home-automation/wyoming/openwakeword.nix

@@ -126,22 +126,14 @@ in
             "--trigger-level"
             cfg.triggerLevel
           ]
-          ++ concatMap (
-            model:
-            [
-              "--preload-model"
-              model
-            ]
-              cfg.preloadModels
-          )
-          ++ concatMap (
-            dir:
-            [
-              "--custom-model-dir"
-              (toString dir)
-            ]
-              cfg.customModelsDirectories
-          )
+          ++ (concatMap (model: [
+            "--preload-model"
+            model
+          ]) cfg.preloadModels)
+          ++ (concatMap (dir: [
+            "--custom-model-dir"
+            (toString dir)
+          ]) cfg.customModelsDirectories)
           ++ cfg.extraArgs
         );
         CapabilityBoundingSet = "";

nixos/modules/services/home-automation/wyoming/piper.nix

@@ -136,18 +136,13 @@ in
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-piper";
-            StateDirectory = [
-              "wyoming/piper"
-              "wyoming/piper/models"
-            ];
+            StateDirectory = [ "wyoming/piper" ];
             # https://github.com/home-assistant/addons/blob/master/piper/rootfs/etc/s6-overlay/s6-rc.d/piper/run
             ExecStart = escapeSystemdExecArgs (
               [
                 (lib.getExe cfg.package)
                 "--data-dir"
                 "/var/lib/wyoming/piper"
-                "--download-dir"
-                "/var/lib/wyoming/piper/models"
                 "--uri"
                 options.uri
                 "--piper"

nixos/modules/services/mail/public-inbox.nix

@@ -84,14 +84,7 @@ let
           ++ filter (x: x != null) [
             cfg.${proto}.cert or null
             cfg.${proto}.key or null
-          ]
-          ++
-            # Without confinement the whole Nix store
-            # is made available to the service
-            optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [
-              "${pkgs.dash}/bin/dash:/bin/sh"
-              builtins.storeDir
-            ];
+          ];
         # The following options are only for optimizing:
         # systemd-analyze security public-inbox-'*'
         AmbientCapabilities = "";
@@ -108,7 +101,7 @@ let
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectProc = "invisible";
-        #ProtectSystem = "strict";
+        ProtectSystem = "strict";
         RemoveIPC = true;
         RestrictAddressFamilies =
           [ "AF_UNIX" ]
@@ -130,28 +123,9 @@ let
           # Not removing @timer because git upload-pack needs it.
         ];
         SystemCallArchitectures = "native";
-
-        # The following options are redundant when confinement is enabled
-        RootDirectory = "/var/empty";
-        TemporaryFileSystem = "/";
-        PrivateMounts = true;
-        MountAPIVFS = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectControlGroups = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
       };
       confinement = {
-        # Until we agree upon doing it directly here in NixOS
-        # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447
-        # let the user choose to enable the confinement with:
-        # systemd.services.public-inbox-httpd.confinement.enable = true;
-        # systemd.services.public-inbox-imapd.confinement.enable = true;
-        # systemd.services.public-inbox-init.confinement.enable = true;
-        # systemd.services.public-inbox-nntpd.confinement.enable = true;
-        #enable = true;
+        enable = true;
         mode = "full-apivfs";
         # Inline::C needs a /bin/sh, and dash is enough
         binSh = "${pkgs.dash}/bin/dash";

nixos/modules/services/misc/paperless.nix

@@ -259,7 +259,7 @@ in
       directory = lib.mkOption {
         type = lib.types.str;
         default = cfg.dataDir + "/export";
-        defaultText = "\${dataDir}/export";
+        defaultText = lib.literalExpression "\${config.services.paperless.dataDir}/export";
         description = "Directory to store export.";
       };
 

nixos/modules/services/monitoring/netdata.nix

@@ -48,6 +48,13 @@ let
   defaultUser = "netdata";
 
   isThereAnyWireGuardTunnels = config.networking.wireguard.enable || lib.any (c: lib.hasAttrByPath [ "netdevConfig" "Kind" ] c && c.netdevConfig.Kind == "wireguard") (builtins.attrValues config.systemd.network.netdevs);
+
+  extraNdsudoPathsEnv = pkgs.buildEnv {
+    name = "netdata-ndsudo-env";
+    paths = cfg.extraNdsudoPackages;
+    pathsToLink = [ "/bin" ];
+  };
+
 in {
   options = {
     services.netdata = {
@@ -131,6 +138,27 @@ in {
         '';
       };
 
+      extraNdsudoPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        description = ''
+          Extra packages to add to `PATH` to make available to `ndsudo`.
+          ::: {.warning}
+          `ndsudo` has SUID privileges, be careful what packages you list here.
+          :::
+
+          ::: {.note}
+          `cfg.package` must be built with `withNdsudo = true`
+          :::
+        '';
+        example = ''
+          [
+            pkgs.smartmontools
+            pkgs.nvme-cli
+          ]
+        '';
+      };
+
       config = lib.mkOption {
         type = lib.types.attrsOf lib.types.attrs;
         default = {};
@@ -221,6 +249,31 @@ in {
     environment.etc."netdata/netdata.conf".source = configFile;
     environment.etc."netdata/conf.d".source = configDirectory;
 
+
+    systemd.tmpfiles.settings = lib.mkIf cfg.package.withNdsudo {
+      "95-netdata-ndsudo" = {
+        "/var/lib/netdata/ndsudo" = {
+          "d" = {
+            mode = "0550";
+            user = cfg.user;
+            group = cfg.group;
+          };
+        };
+
+        "/var/lib/netdata/ndsudo/ndsudo" = {
+          "L+" = {
+            argument = "/run/wrappers/bin/ndsudo";
+          };
+        };
+
+        "/var/lib/netdata/ndsudo/runtime-dependencies" = {
+          "L+" = {
+            argument = "${extraNdsudoPathsEnv}/bin";
+          };
+        };
+      };
+    };
+
     systemd.services.netdata = {
       description = "Real time performance monitoring";
       after = [ "network.target" "suid-sgid-wrappers.service" ];
@@ -394,6 +447,14 @@ in {
         group = cfg.group;
         permissions = "u+rx,g+x,o-rwx";
       };
+    } // lib.optionalAttrs (cfg.package.withNdsudo) {
+      "ndsudo" = {
+        source = "${cfg.package}/libexec/netdata/plugins.d/ndsudo.org";
+        setuid = true;
+        owner = "root";
+        group = cfg.group;
+        permissions = "u+rx,g+x,o-rwx";
+      };
     };
 
     security.pam.loginLimits = [

nixos/modules/services/networking/gdomap.nix

@@ -24,8 +24,8 @@
       description = "gdomap server";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      path = [ pkgs.gnustep.base ];
-      serviceConfig.ExecStart = "${pkgs.gnustep.base}/bin/gdomap -f";
+      path = [ pkgs.gnustep-base ];
+      serviceConfig.ExecStart = "${pkgs.gnustep-base}/bin/gdomap -f";
     };
   };
 }

nixos/modules/services/networking/squid.nix

@@ -6,8 +6,19 @@ let
 
   cfg = config.services.squid;
 
+  configWriter =
+    if cfg.validateConfig then
+      (
+        content:
+        pkgs.writers.makeScriptWriter {
+          check = "${cfg.package}/bin/squid -k parse -f";
+          interpreter = "${cfg.package}/bin/squid";
+        } "squid.conf" content
+      )
+    else
+      (content: pkgs.writeText "squid.conf" content);
 
-  squidConfig = pkgs.writeText "squid.conf"
+  squidConfig = configWriter
     (if cfg.configText != null then cfg.configText else
     ''
     #
@@ -111,6 +122,12 @@ in
         description = "Whether to run squid web proxy.";
       };
 
+      validateConfig = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Validate config syntax.";
+      };
+
       package = mkPackageOption pkgs "squid" { };
 
       proxyAddress = mkOption {

nixos/modules/services/networking/wpa_supplicant.nix

@@ -220,8 +220,6 @@ in
             Whether to allow configuring networks "imperatively" (e.g. via
             `wpa_supplicant_gui`) and declaratively via
             [](#opt-networking.wireless.networks).
-
-            Please note that this adds a custom patch to `wpa_supplicant`.
           '';
         };
 

nixos/modules/services/networking/xray.nix

@@ -80,9 +80,12 @@ with lib;
       description = "xray Daemon";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      script = ''
+        exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json"
+      '';
       serviceConfig = {
         DynamicUser = true;
-        ExecStart = "${cfg.package}/bin/xray -config ${settingsFile}";
+        LoadCredential = "config.json:${settingsFile}";
         CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
         AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
         NoNewPrivileges = true;

nixos/modules/services/web-apps/pixelfed.nix

@@ -40,7 +40,7 @@ in {
     pixelfed = {
       enable = mkEnableOption "a Pixelfed instance";
       package = mkPackageOption pkgs "pixelfed" { };
-      phpPackage = mkPackageOption pkgs "php82" { };
+      phpPackage = mkPackageOption pkgs "php83" { };
 
       user = mkOption {
         type = types.str;

nixos/modules/services/web-apps/simplesamlphp.nix

@@ -97,7 +97,7 @@ in
       description = "Instances of SimpleSAMLphp. This module is designed to work with already existing PHP-FPM pool and NGINX virtualHost.";
     };
 
-  config = {
+  config = lib.mkIf (cfg != { }) {
     services.phpfpm.pools = lib.mapAttrs' (
       phpfpmName: opts:
       lib.nameValuePair opts.phpfpmPool { phpEnv.SIMPLESAMLPHP_CONFIG_DIR = "${generateConfig opts}"; }

nixos/modules/services/web-apps/stash.nix

@@ -0,0 +1,585 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    toUpper
+    types
+    ;
+
+  cfg = config.services.stash;
+
+  stashType = types.submodule {
+    options = {
+      path = mkOption {
+        type = types.path;
+        description = "location of your media files";
+      };
+      excludevideo = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude video files from being scanned into Stash";
+      };
+      excludeimage = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude image files from being scanned into Stash";
+      };
+    };
+  };
+  stashBoxType = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        description = "The name of the Stash Box";
+      };
+      endpoint = mkOption {
+        type = types.str;
+        description = "URL to the Stash Box graphql api";
+      };
+      apikey = mkOption {
+        type = types.str;
+        description = "Stash Box API key";
+      };
+    };
+  };
+
+  recentlyReleased = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_released_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "date";
+    direction = "DESC";
+  };
+  recentlyAdded = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_added_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "created_at";
+    direction = "DESC";
+  };
+  uiPresets = {
+    recentlyReleasedScenes = recentlyReleased "Scenes";
+    recentlyAddedScenes = recentlyAdded "Scenes";
+    recentlyReleasedGalleries = recentlyReleased "Galleries";
+    recentlyAddedGalleries = recentlyAdded "Galleries";
+    recentlyAddedImages = recentlyAdded "Images";
+    recentlyReleasedMovies = recentlyReleased "Movies";
+    recentlyAddedMovies = recentlyAdded "Movies";
+    recentlyAddedStudios = recentlyAdded "Studios";
+    recentlyAddedPerformers = recentlyAdded "Performers";
+  };
+
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "config.yml" cfg.settings;
+  settingsType = types.submodule {
+    freeformType = settingsFormat.type;
+
+    options = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        example = "::1";
+        description = "The ip address that Stash should bind to.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 9999;
+        example = 1234;
+        description = "The port that Stash should listen on.";
+      };
+
+      stash = mkOption {
+        type = types.listOf stashType;
+        description = ''
+          Add directories containing your adult videos and images.
+          Stash will use these directories to find videos and/or images during scanning.
+        '';
+        example = literalExpression ''
+          {
+            stash = [
+              {
+                Path = "/media/drive/videos";
+                ExcludeImage = true;
+              }
+            ];
+          }
+        '';
+      };
+      stash_boxes = mkOption {
+        type = types.listOf stashBoxType;
+        default = [ ];
+        description = ''Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames'';
+        example = literalExpression ''
+          {
+            stash_boxes = [
+              {
+                name = "StashDB";
+                endpoint = "https://stashdb.org/graphql";
+                apikey = "aaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbb.cccccccccccccc";
+              }
+            ];
+          }
+        '';
+      };
+      ui.frontPageContent = mkOption {
+        description = "Search filters to display on the front page.";
+        type = types.either (types.listOf types.attrs) (types.functionTo (types.listOf types.attrs));
+        default = presets: [
+          presets.recentlyReleasedScenes
+          presets.recentlyAddedStudios
+          presets.recentlyReleasedMovies
+          presets.recentlyAddedPerformers
+          presets.recentlyReleasedGalleries
+        ];
+        example = literalExpression ''
+          presets: [
+            # To get the savedFilterId, you can query `{ findSavedFilters(mode: <FilterMode>) { id name } }` on localhost:9999/graphql
+            {
+              __typename = "SavedFilter";
+              savedFilterId = 1;
+            }
+            # basic custom filter
+            {
+              __typename = "CustomFilter";
+              title = "Random Scenes";
+              mode = "SCENES";
+              sortBy = "random";
+              direction = "DESC";
+            }
+            presets.recentlyAddedImages
+          ]
+        '';
+        apply = type: if builtins.isFunction type then (type uiPresets) else type;
+      };
+      blobs_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/blobs";
+        description = "Path to blobs";
+      };
+      cache = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/cache";
+        description = "Path to cache";
+      };
+      database = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/go.sqlite";
+        description = "Path to the SQLite database";
+      };
+      generated = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/generated";
+        description = "Path to generated files";
+      };
+      plugins_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/plugins";
+        description = "Path to scrapers";
+      };
+      scrapers_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/scrapers";
+        description = "Path to scrapers";
+      };
+
+      blobs_storage = mkOption {
+        type = types.enum [
+          "FILESYSTEM"
+          "DATABASE"
+        ];
+        default = "FILESYSTEM";
+        description = "Where to store blobs";
+      };
+      calculate_md5 = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to calculate MD5 checksums for scene video files";
+      };
+      create_image_clip_from_videos = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Create Image Clips from Video extensions when Videos are disabled in Library";
+      };
+      dangerous_allow_public_without_auth = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      gallery_cover_regex = mkOption {
+        type = types.str;
+        default = "(poster|cover|folder|board)\.[^\.]+$";
+        description = "Regex used to identify images as gallery covers";
+      };
+      no_proxy = mkOption {
+        type = types.str;
+        default = "localhost,127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12";
+        description = "A list of domains for which the proxy must not be used";
+      };
+      nobrowser = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should not auto-open a browser window on startup";
+      };
+      notifications_enabled = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should send notifications to the desktop";
+      };
+      parallel_tasks = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Number of parallel tasks to start during scan/generate";
+      };
+      preview_audio = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Include audio stream in previews";
+      };
+      preview_exclude_end = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of start of video to exclude when generating previews";
+      };
+      preview_exclude_start = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of end of video to exclude when generating previews";
+      };
+      preview_segment_duration = mkOption {
+        type = types.float;
+        default = 0.75;
+        description = "Preview segment duration, in seconds";
+      };
+      preview_segments = mkOption {
+        type = types.int;
+        default = 12;
+        description = "Number of segments in a preview file";
+      };
+      security_tripwire_accessed_from_public_internet = mkOption {
+        type = types.nullOr types.str;
+        default = "";
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      sequential_scanning = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Modifies behaviour of the scanning functionality to generate support files (previews/sprites/phash) at the same time as fingerprinting/screenshotting";
+      };
+      show_one_time_moved_notification = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray";
+      };
+      sound_on_preview = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable sound on mouseover previews";
+      };
+      theme_color = mkOption {
+        type = types.str;
+        default = "#202b33";
+        description = "Sets the `theme-color` property in the UI";
+      };
+      video_file_naming_algorithm = mkOption {
+        type = types.enum [
+          "OSHASH"
+          "MD5"
+        ];
+        default = "OSHASH";
+        description = "Hash algorithm to use for generated file naming";
+      };
+      write_image_thumbnails = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Write image thumbnails to disk when generating on the fly";
+      };
+    };
+  };
+
+  pluginType =
+    kind:
+    mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      description = ''
+        The ${kind} Stash should be started with.
+      '';
+      apply =
+        srcs:
+        optionalString (srcs != [ ]) (
+          pkgs.runCommand "stash-${kind}"
+            {
+              inherit srcs;
+              nativeBuildInputs = [ pkgs.yq-go ];
+              preferLocalBuild = true;
+            }
+            ''
+              find $srcs -mindepth 1 -name '*.yml' | while read plugin_file; do
+                grep -q "^#pkgignore" "$plugin_file" && continue
+
+                plugin_dir=$(dirname $plugin_file)
+                out_path=$out/$(basename $plugin_dir)
+                mkdir -p $out_path
+                ls $plugin_dir | xargs -I{} ln -sf "$plugin_dir/{}" $out_path
+
+                env \
+                  plugin_id=$(basename $plugin_file .yml) \
+                  plugin_name="$(yq '.name' $plugin_file)" \
+                  plugin_description="$(yq '.description' $plugin_file)" \
+                  plugin_version="$(yq '.version' $plugin_file)" \
+                  plugin_files="$(find -L $out_path -mindepth 1 -type f -printf "%P\n")" \
+                  yq -n '
+                    .id = strenv(plugin_id) |
+                    .name = strenv(plugin_name) |
+                    (
+                      strenv(plugin_description) as $desc |
+                      with(select($desc == "null"); .metadata = {}) |
+                      with(select($desc != "null"); .metadata.description = $desc)
+                    ) |
+                    (
+                      strenv(plugin_version) as $ver |
+                      with(select($ver == "null"); .version = "Unknown") |
+                      with(select($ver != "null"); .version = $ver)
+                    ) |
+                    .date = (now | format_datetime("2006-01-02 15:04:05")) |
+                    .files = (strenv(plugin_files) | split("\n"))
+                  ' > $out_path/manifest
+              done
+            ''
+        );
+    };
+in
+{
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = with lib.maintainers; [ DrakeTDL ];
+  };
+
+  options = {
+    services.stash = {
+      enable = mkEnableOption "stash";
+
+      package = mkPackageOption pkgs "stash" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "User under which Stash runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "Group under which Stash runs.";
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/stash";
+        description = "The directory where Stash stores its files.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Stash web interface.";
+      };
+
+      username = mkOption {
+        type = types.nullOr types.nonEmptyStr;
+        default = null;
+        example = "admin";
+        description = ''
+          Username for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.username`
+          ::
+
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/path/to/password/file";
+        description = ''
+          Path to file containing password for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.password`
+          ::
+
+        '';
+      };
+
+      jwtSecretKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret used to sign JWT tokens.";
+      };
+      sessionStoreKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret for session store.";
+      };
+
+      mutableSettings = mkOption {
+        description = ''
+          Whether the Stash config.yml is writeable by Stash.
+
+          If `false`, Any config changes done from within Stash UI will be temporary and reset to those defined in {option}`services.stash.settings` upon `Stash.service` restart.
+          If `true`, the {option}`services.stash.settings` will only be used to initialize the Stash configuration if it does not exist, and are subsequently ignored.
+        '';
+        type = types.bool;
+        default = true;
+      };
+      mutablePlugins = mkEnableOption "Whether plugins/themes can be installed, updated, uninstalled manually.";
+      mutableScrapers = mkEnableOption "Whether scrapers can be installed, updated, uninstalled manually.";
+      plugins = pluginType "plugins";
+      scrapers = pluginType "scrapers";
+
+      settings = mkOption {
+        type = settingsType;
+        description = "Stash configuration";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          !lib.xor (cfg.username != null || cfg.settings.username or null != null) (
+            cfg.passwordFile != null || cfg.settings.password or null != null
+          );
+        message = "You must set either both username and password, or neither.";
+      }
+    ];
+
+    services.stash.settings = {
+      username = mkIf (cfg.username != null) cfg.username;
+      plugins_path = mkIf (!cfg.mutablePlugins) cfg.plugins;
+      scrapers_path = mkIf (!cfg.mutableScrapers) cfg.scrapers;
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
+
+    users.users.${cfg.user} = {
+      inherit (cfg) group;
+      isSystemUser = true;
+      home = cfg.dataDir;
+    };
+    users.groups.${cfg.group} = { };
+
+    systemd = {
+      tmpfiles.settings."10-stash-datadir".${cfg.dataDir}."d" = {
+        inherit (cfg) user group;
+        mode = "0755";
+      };
+      services.stash = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        path = with pkgs; [
+          ffmpeg-full
+          python3
+          ruby
+        ];
+        environment.STASH_CONFIG_FILE = "${cfg.dataDir}/config.yml";
+        serviceConfig = {
+          DynamicUser = false;
+          User = cfg.user;
+          Group = cfg.group;
+          Restart = "on-failure";
+          WorkingDirectory = cfg.dataDir;
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/stash") (baseNameOf cfg.dataDir);
+          ExecStartPre = pkgs.writers.writeBash "stash-setup.bash" (
+            ''
+              install -d ${cfg.settings.generated}
+              if [[ ! -z "${toString cfg.mutableSettings}" || ! -f ${cfg.dataDir}/config.yml ]]; then
+                env \
+                  password=$(< ${cfg.passwordFile}) \
+                  jwtSecretKeyFile=$(< ${cfg.jwtSecretKeyFile}) \
+                  sessionStoreKeyFile=$(< ${cfg.sessionStoreKeyFile}) \
+                  ${lib.getExe pkgs.yq-go} '
+                    .jwt_secret_key = strenv(jwtSecretKeyFile) |
+                    .session_store_key = strenv(sessionStoreKeyFile) |
+                    (
+                      strenv(password) as $password |
+                      with(select($password != ""); .password = $password)
+                    )
+                  ' ${settingsFile} > ${cfg.dataDir}/config.yml
+              fi
+            ''
+            + optionalString cfg.mutablePlugins ''
+              install -d ${cfg.settings.plugins_path}
+              ls ${cfg.plugins} | xargs -I{} ln -sf '${cfg.plugins}/{}' ${cfg.settings.plugins_path}
+            ''
+            + optionalString cfg.mutableScrapers ''
+              install -d ${cfg.settings.scrapers_path}
+              ls ${cfg.scrapers} | xargs -I{} ln -sf '${cfg.scrapers}/{}' ${cfg.settings.scrapers_path}
+            ''
+          );
+          ExecStart = getExe cfg.package;
+
+          ProtectHome = "tmpfs";
+          BindReadOnlyPaths = mkIf (cfg.settings != { }) (map (stash: "${stash.path}") cfg.settings.stash);
+
+          # hardening
+
+          DevicePolicy = "auto"; # needed for hardware acceleration
+          PrivateDevices = false; # needed for hardware acceleration
+          AmbientCapabilities = [ "" ];
+          CapabilityBoundingSet = [ "" ];
+          ProtectSystem = "full";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProcSubset = "pid";
+          ProtectProc = "invisible";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@cpu-emulation"
+            "~@debug"
+            "~@mount"
+            "~@obsolete"
+            "~@privileged"
+          ];
+        };
+      };
+    };
+  };
+}

nixos/modules/virtualisation/incus.nix

@@ -38,6 +38,7 @@ let
         libnvidia-container
         libxfs
         lvm2
+        lxcfs
         minio
         minio-client
         nftables
@@ -121,6 +122,7 @@ let
   environment = lib.mkMerge [
     {
       INCUS_EDK2_PATH = ovmf;
+      INCUS_LXC_HOOK = "${cfg.lxcPackage}/share/lxc/hooks";
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
       INCUS_USBIDS_PATH = "${pkgs.hwdata}/share/hwdata/usb.ids";
       PATH = lib.mkForce serverBinPath;
@@ -401,6 +403,7 @@ in
         "incus.socket"
       ];
       requires = [ "incus.socket" ];
+      wantedBy = config.systemd.services.incus.wantedBy;
 
       serviceConfig = {
         ExecStart = "${incus-startup} start";

nixos/modules/virtualisation/libvirtd.nix

@@ -515,6 +515,8 @@ in
 
     systemd.services.libvirt-guests = {
       wantedBy = [ "multi-user.target" ];
+      requires = [ "libvirtd.service" ];
+      after = [ "libvirtd.service" ];
       path = with pkgs; [ coreutils gawk cfg.package ];
       restartIfChanged = false;
 

nixos/tests/all-tests.nix

@@ -622,7 +622,11 @@ in {
   monado = handleTest ./monado.nix {};
   monetdb = handleTest ./monetdb.nix {};
   monica = handleTest ./web-apps/monica.nix {};
-  mongodb = handleTest ./mongodb.nix {};
+  mongodb = runTest ./mongodb.nix;
+  mongodb-ce = runTest ({ config, ... }: {
+    imports = [ ./mongodb.nix ];
+    defaults.services.mongodb.package = config.node.pkgs.mongodb-ce;
+  });
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
   mopidy = handleTest ./mopidy.nix {};
@@ -978,6 +982,7 @@ in {
   stalwart-mail = handleTest ./stalwart-mail.nix {};
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = handleTest ./starship.nix {};
+  stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix {};
   static-web-server = handleTest ./web-servers/static-web-server.nix {};
   step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
   stratis = handleTest ./stratis {};

nixos/tests/incus/incus-tests.nix

@@ -190,7 +190,7 @@ import ../make-test-python.nix (
 
         def cleanup():
             # avoid conflict between preseed and cleanup operations
-            machine.wait_for_unit("incus-preseed.service")
+            machine.execute("systemctl kill incus-preseed.service")
 
             instances = json.loads(machine.succeed("incus list --format json --all-projects"))
             with subtest("Stopping all running instances"):
@@ -228,39 +228,41 @@ import ../make-test-python.nix (
             alias = "nixos/container/${variant}"
             variant = "${variant}"
 
-            with subtest("Container image can be imported"):
+            with subtest("container image can be imported"):
                 machine.succeed(f"incus image import {metadata} {rootfs} --alias {alias}")
 
 
-            with subtest("Container can be launched and managed"):
+            with subtest("container can be launched and managed"):
                 machine.succeed(f"incus launch {alias} container-{variant}1")
                 wait_for_instance(f"container-{variant}1")
 
 
-            with subtest("Container mounts lxcfs overlays"):
+            with subtest("container mounts lxcfs overlays"):
                 machine.succeed(f"incus exec container-{variant}1 mount | grep 'lxcfs on /proc/cpuinfo type fuse.lxcfs'")
                 machine.succeed(f"incus exec container-{variant}1 mount | grep 'lxcfs on /proc/meminfo type fuse.lxcfs'")
 
 
-            with subtest("resource limits"):
-                with subtest("Container CPU limits can be managed"):
-                    set_config(f"container-{variant}1", "limits.cpu 1", restart=True)
-                    wait_incus_exec_success(f"container-{variant}1", "nproc | grep '^1$'", timeout=15)
-
-                with subtest("Container CPU limits can be hotplug changed"):
-                    set_config(f"container-{variant}1", "limits.cpu 2")
-                    wait_incus_exec_success(f"container-{variant}1", "nproc | grep '^2$'", timeout=15)
-
-                with subtest("Container memory limits can be managed"):
-                    set_config(f"container-{variant}1", "limits.memory 128MB", restart=True)
-                    wait_incus_exec_success(f"container-{variant}1", "grep 'MemTotal:[[:space:]]*125000 kB' /proc/meminfo", timeout=15)
-
-                with subtest("Container memory limits can be hotplug changed"):
-                    set_config(f"container-{variant}1", "limits.memory 256MB")
-                    wait_incus_exec_success(f"container-{variant}1", "grep 'MemTotal:[[:space:]]*250000 kB' /proc/meminfo", timeout=15)
+            with subtest("container CPU limits can be managed"):
+                set_config(f"container-{variant}1", "limits.cpu 1", restart=True)
+                wait_incus_exec_success(f"container-{variant}1", "nproc | grep '^1$'", timeout=90)
 
 
-            with subtest("virtual tpm can be configured"):
+            with subtest("container CPU limits can be hotplug changed"):
+                set_config(f"container-{variant}1", "limits.cpu 2")
+                wait_incus_exec_success(f"container-{variant}1", "nproc | grep '^2$'", timeout=90)
+
+
+            with subtest("container memory limits can be managed"):
+                set_config(f"container-{variant}1", "limits.memory 128MB", restart=True)
+                wait_incus_exec_success(f"container-{variant}1", "grep 'MemTotal:[[:space:]]*125000 kB' /proc/meminfo", timeout=90)
+
+
+            with subtest("container memory limits can be hotplug changed"):
+                set_config(f"container-{variant}1", "limits.memory 256MB")
+                wait_incus_exec_success(f"container-{variant}1", "grep 'MemTotal:[[:space:]]*250000 kB' /proc/meminfo", timeout=90)
+
+
+            with subtest("container software tpm can be configured"):
                 machine.succeed(f"incus config device add container-{variant}1 vtpm tpm path=/dev/tpm0 pathrm=/dev/tpmrm0")
                 machine.succeed(f"incus exec container-{variant}1 -- test -e /dev/tpm0")
                 machine.succeed(f"incus exec container-{variant}1 -- test -e /dev/tpmrm0")
@@ -268,7 +270,7 @@ import ../make-test-python.nix (
                 machine.fail(f"incus exec container-{variant}1 -- test -e /dev/tpm0")
 
 
-            with subtest("lxc-generator"):
+            with subtest("container lxc-generator compatibility"):
                 with subtest("lxc-container generator configures plain container"):
                     # default container is plain
                     machine.succeed(f"incus exec container-{variant}1 test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
@@ -293,14 +295,36 @@ import ../make-test-python.nix (
 
                     check_sysctl(f"container-{variant}2")
 
+            with subtest("container supports per-instance lxcfs"):
+                machine.succeed(f"incus stop container-{variant}1")
+                machine.fail(f"pgrep -a lxcfs | grep 'incus/devices/container-{variant}1/lxcfs'")
 
-            with subtest("Instance remains running when softDaemonRestart is enabled and service is stopped"):
+                machine.succeed("incus config set instances.lxcfs.per_instance=true")
+
+                machine.succeed(f"incus start container-{variant}1")
+                wait_for_instance(f"container-{variant}1")
+                machine.succeed(f"pgrep -a lxcfs | grep 'incus/devices/container-{variant}1/lxcfs'")
+
+
+            with subtest("container can successfully restart"):
+                machine.succeed(f"incus restart container-{variant}1")
+                wait_for_instance(f"container-{variant}1")
+
+
+            with subtest("container remains running when softDaemonRestart is enabled and service is stopped"):
                 pid = machine.succeed(f"incus info container-{variant}1 | grep 'PID'").split(":")[1].strip()
                 machine.succeed(f"ps {pid}")
                 machine.succeed("systemctl stop incus")
                 machine.succeed(f"ps {pid}")
                 machine.succeed("systemctl start incus")
 
+                with subtest("containers stop with incus-startup.service"):
+                    pid = machine.succeed(f"incus info container-{variant}1 | grep 'PID'").split(":")[1].strip()
+                    machine.succeed(f"ps {pid}")
+                    machine.succeed("systemctl stop incus-startup.service")
+                    machine.wait_until_fails(f"ps {pid}", timeout=120)
+                    machine.succeed("systemctl start incus-startup.service")
+
 
             cleanup()
           ''
@@ -325,7 +349,7 @@ import ../make-test-python.nix (
                 machine.succeed(f"incus create {alias} vm-{variant}1 --vm --config limits.memory=512MB --config security.secureboot=false")
 
 
-            with subtest("virtual tpm can be configured"):
+            with subtest("virtual-machine software tpm can be configured"):
                 machine.succeed(f"incus config device add vm-{variant}1 vtpm tpm path=/dev/tpm0")
 
 
@@ -334,25 +358,30 @@ import ../make-test-python.nix (
                 wait_for_instance(f"vm-{variant}1")
 
 
-            with subtest("incus-agent is started"):
+            with subtest("virtual-machine incus-agent is started"):
                 machine.succeed(f"incus exec vm-{variant}1 systemctl is-active incus-agent")
 
 
-            with subtest("incus-agent has a valid path"):
+            with subtest("virtual-machine incus-agent has a valid path"):
                 machine.succeed(f"incus exec vm-{variant}1 -- bash -c 'true'")
 
 
-            with subtest("Container CPU limits can be managed"):
+            with subtest("virtual-machine CPU limits can be managed"):
                 set_config(f"vm-{variant}1", "limits.cpu 1", restart=True)
                 wait_incus_exec_success(f"vm-{variant}1", "nproc | grep '^1$'", timeout=90)
 
 
-            with subtest("Container CPU limits can be hotplug changed"):
+            with subtest("virtual-machine CPU limits can be hotplug changed"):
                 set_config(f"vm-{variant}1", "limits.cpu 2")
-                wait_incus_exec_success(f"vm-{variant}1", "nproc | grep '^2$'", timeout=15)
+                wait_incus_exec_success(f"vm-{variant}1", "nproc | grep '^2$'", timeout=90)
 
 
-            with subtest("Instance remains running when softDaemonRestart is enabled and service is stopped"):
+            with subtest("virtual-machine can successfully restart"):
+                machine.succeed(f"incus restart vm-{variant}1")
+                wait_for_instance(f"vm-{variant}1")
+
+
+            with subtest("virtual-machine remains running when softDaemonRestart is enabled and service is stopped"):
                 pid = machine.succeed(f"incus info vm-{variant}1 | grep 'PID'").split(":")[1].strip()
                 machine.succeed(f"ps {pid}")
                 machine.succeed("systemctl stop incus")
@@ -360,13 +389,21 @@ import ../make-test-python.nix (
                 machine.succeed("systemctl start incus")
 
 
+                with subtest("virtual-machines stop with incus-startup.service"):
+                    pid = machine.succeed(f"incus info vm-{variant}1 | grep 'PID'").split(":")[1].strip()
+                    machine.succeed(f"ps {pid}")
+                    machine.succeed("systemctl stop incus-startup.service")
+                    machine.wait_until_fails(f"ps {pid}", timeout=120)
+                    machine.succeed("systemctl start incus-startup.service")
+
+
             cleanup()
           ''
         ) "" initVariants)
         +
           # python
           ''
-            with subtest("Can launch CSM virtual machine"):
+            with subtest("virtual-machine can launch CSM (BIOS)"):
                 machine.succeed("incus init csm --vm --empty -c security.csm=true -c security.secureboot=false")
                 machine.succeed("incus start csm")
 

nixos/tests/mongodb.nix

@@ -1,59 +1,37 @@
-# This test start mongodb, runs a query using mongo shell
+# This test starts mongodb and runs a query using mongo shell
+{ config, lib, ... }:
+let
+  # required for test execution on darwin
+  pkgs = config.node.pkgs;
+  testQuery = pkgs.writeScript "nixtest.js" ''
+    db.greetings.insertOne({ "greeting": "hello" });
+    print(db.greetings.findOne().greeting);
+  '';
+  mongoshExe = lib.getExe pkgs.mongosh;
+in
+{
+  name = "mongodb";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    bluescreen303
+    offline
+    phile314
+    niklaskorz
+  ];
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testQuery = pkgs.writeScript "nixtest.js" ''
-      db.greetings.insert({ "greeting": "hello" });
-      print(db.greetings.findOne().greeting);
-    '';
+  nodes.mongodb = {
+    services.mongodb.enable = true;
+  };
 
-    runMongoDBTest = pkg: ''
-      node.execute("(rm -rf data || true) && mkdir data")
-      node.execute(
-          "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
-      )
-      node.wait_for_open_port(27017)
+  testScript = ''
+    start_all()
 
-      assert "hello" in node.succeed(
-          "${pkg}/bin/mongo ${testQuery}"
-      )
+    with subtest("start mongodb"):
+        mongodb.wait_for_unit("mongodb.service")
+        mongodb.wait_for_open_port(27017)
 
-      node.execute(
-          "${pkg}/bin/mongod --shutdown --dbpath data"
-      )
-      node.wait_for_closed_port(27017)
-    '';
-
-  in
-  {
-    name = "mongodb";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        bluescreen303
-        offline
-        phile314
-      ];
-    };
-
-    nodes = {
-      node =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            # remember to update mongodb.passthru.tests if you change this
-            mongodb-7_0
-          ];
-        };
-    };
-
-    testScript =
-      ''
-        node.start()
-      ''
-      + runMongoDBTest pkgs.mongodb-7_0
-      + ''
-        node.shutdown()
-      '';
-  }
-)
+    with subtest("insert and find a document"):
+        result = mongodb.succeed("${mongoshExe} ${testQuery}")
+        print("Test output:", result)
+        assert result.strip() == "hello"
+  '';
+}

nixos/tests/public-inbox.nix

@@ -10,11 +10,9 @@ import ./make-test-python.nix (
       install -D -t $out key.pem cert.pem
     '';
 
-    # Git repositories paths in Gitolite.
-    # Here only their baseNameOf is used for configuring public-inbox inboxes.
     gitRepositories = [
-      "user/repo1"
-      "user/repo2"
+      "repo1"
+      "repo2"
     ];
   in
   {
@@ -81,7 +79,7 @@ import ./make-test-python.nix (
           };
           inboxes =
             lib.recursiveUpdate
-              (lib.genAttrs (map baseNameOf gitRepositories) (repo: {
+              (lib.genAttrs gitRepositories (repo: {
                 address = [
                   # Routed to the "public-inbox:" transport in services.postfix.transport
                   "${repo}@${domain}"
@@ -106,7 +104,7 @@ import ./make-test-python.nix (
           settings.coderepo = lib.listToAttrs (
             map (
               repositoryName:
-              lib.nameValuePair (baseNameOf repositoryName) {
+              lib.nameValuePair repositoryName {
                 dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
                 cgitUrl = "https://git.${domain}/${repositoryName}.git";
               }
@@ -183,6 +181,12 @@ import ./make-test-python.nix (
     testScript = ''
       start_all()
 
+      # The threshold and/or hardening may have to be changed with new features/checks
+      with subtest("systemd hardening thresholds"):
+        print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager"))
+
       machine.wait_for_unit("multi-user.target")
       machine.wait_for_unit("public-inbox-init.service")
 

nixos/tests/stash.nix

@@ -0,0 +1,80 @@
+import ./make-test-python.nix (
+  let
+    host = "127.0.0.1";
+    port = 1234;
+    dataDir = "/stash";
+  in
+  { pkgs, ... }:
+  {
+    name = "stash";
+    meta.maintainers = pkgs.stash.meta.maintainers;
+
+    nodes.machine = {
+      services.stash = {
+        inherit dataDir;
+        enable = true;
+
+        username = "test";
+        passwordFile = pkgs.writeText "stash-password" "MyPassword";
+
+        jwtSecretKeyFile = pkgs.writeText "jwt_secret_key" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        sessionStoreKeyFile = pkgs.writeText "session_store_key" "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+        plugins =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScripts";
+              rev = "9b6fac4934c2fac2ef0859ea68ebee5111fc5be5";
+              hash = "sha256-PO3J15vaA7SD4r/LyHlXjnpaeYAN9Q++O94bIWdz7OA=";
+            };
+          in
+          [
+            (pkgs.runCommand "stashNotes" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/plugins/stashNotes $out/plugins/stashNotes
+            '')
+            (pkgs.runCommand "Theme-Plex" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/themes/Theme-Plex $out/plugins/Theme-Plex
+            '')
+          ];
+
+        mutableScrapers = true;
+        scrapers =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScrapers";
+              rev = "2ece82d17ddb0952c16842b0775274bcda598d81";
+              hash = "sha256-AEmnvM8Nikhue9LNF9dkbleYgabCvjKHtzFpMse4otM=";
+            };
+          in
+          [
+            (pkgs.runCommand "FTV" { inherit src; } ''
+              mkdir -p $out/scrapers/FTV
+              cp -r $src/scrapers/FTV.yml $out/scrapers/FTV
+            '')
+          ];
+
+        settings = {
+          inherit host port;
+
+          stash = [ { path = "/srv"; } ];
+        };
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("stash.service")
+      machine.wait_for_open_port(${toString port}, "${host}")
+      machine.succeed("curl --fail http://${host}:${toString port}/")
+
+      with subtest("Test plugins/scrapers"):
+        with subtest("mutable plugins directory should not exist"):
+          machine.fail("test -d ${dataDir}/plugins")
+        with subtest("mutable scrapers directory should exist and scraper FTV should be linked"):
+          machine.succeed("test -L ${dataDir}/scrapers/FTV")
+    '';
+  }
+)

nixos/tests/swayfx.nix

@@ -12,80 +12,78 @@ import ./make-test-python.nix (
     # Found 1 error in 1 file (checked 1 source file)
     skipTypeCheck = true;
 
-    nodes.machine =
-      { config, ... }:
-      {
-        # Automatically login on tty1 as a normal user:
-        imports = [ ./common/user-account.nix ];
-        services.getty.autologinUser = "alice";
+    nodes.machine = {
+      # Automatically login on tty1 as a normal user:
+      imports = [ ./common/user-account.nix ];
+      services.getty.autologinUser = "alice";
 
-        environment = {
-          # For glinfo and wayland-info:
-          systemPackages = with pkgs; [
-            mesa-demos
-            wayland-utils
-            alacritty
-          ];
-          # Use a fixed SWAYSOCK path (for swaymsg):
-          variables = {
-            "SWAYSOCK" = "/tmp/sway-ipc.sock";
-            # TODO: Investigate if we can get hardware acceleration to work (via
-            # virtio-gpu and Virgil). We currently have to use the Pixman software
-            # renderer since the GLES2 renderer doesn't work inside the VM (even
-            # with WLR_RENDERER_ALLOW_SOFTWARE):
-            # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
-            "WLR_RENDERER" = "pixman";
-          };
-          # For convenience:
-          shellAliases = {
-            test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-            test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-          };
-
-          # To help with OCR:
-          etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
-            main = {
-              font = "inconsolata:size=14";
-            };
-            colors = rec {
-              foreground = "000000";
-              background = "ffffff";
-              regular2 = foreground;
-            };
-          };
-
-          etc."gpg-agent.conf".text = ''
-            pinentry-timeout 86400
-          '';
+      environment = {
+        # For glinfo and wayland-info:
+        systemPackages = with pkgs; [
+          mesa-demos
+          wayland-utils
+          alacritty
+        ];
+        # Use a fixed SWAYSOCK path (for swaymsg):
+        variables = {
+          "SWAYSOCK" = "/tmp/sway-ipc.sock";
+          # TODO: Investigate if we can get hardware acceleration to work (via
+          # virtio-gpu and Virgil). We currently have to use the Pixman software
+          # renderer since the GLES2 renderer doesn't work inside the VM (even
+          # with WLR_RENDERER_ALLOW_SOFTWARE):
+          # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
+          "WLR_RENDERER" = "pixman";
+        };
+        # For convenience:
+        shellAliases = {
+          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
         };
 
-        fonts.packages = [ pkgs.inconsolata ];
+        # To help with OCR:
+        etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
+          main = {
+            font = "inconsolata:size=14";
+          };
+          colors = rec {
+            foreground = "000000";
+            background = "ffffff";
+            regular2 = foreground;
+          };
+        };
 
-        # Automatically configure and start Sway when logging in on tty1:
-        programs.bash.loginShellInit = ''
-          if [ "$(tty)" = "/dev/tty1" ]; then
-            set -e
-
-            mkdir -p ~/.config/sway
-            sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
-
-            sway --validate
-            sway && touch /tmp/sway-exit-ok
-          fi
+        etc."gpg-agent.conf".text = ''
+          pinentry-timeout 86400
         '';
-
-        programs.sway = {
-          enable = true;
-          package = pkgs.swayfx.override { isNixOS = true; };
-        };
-
-        # To test pinentry via gpg-agent:
-        programs.gnupg.agent.enable = true;
-
-        # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
-        virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
       };
 
+      fonts.packages = [ pkgs.inconsolata ];
+
+      # Automatically configure and start Sway when logging in on tty1:
+      programs.bash.loginShellInit = ''
+        if [ "$(tty)" = "/dev/tty1" ]; then
+          set -e
+
+          mkdir -p ~/.config/sway
+          sed s/Mod4/Mod1/ /etc/sway/config > ~/.config/sway/config
+
+          sway --validate
+          sway && touch /tmp/sway-exit-ok
+        fi
+      '';
+
+      programs.sway = {
+        enable = true;
+        package = pkgs.swayfx.override { isNixOS = true; };
+      };
+
+      # To test pinentry via gpg-agent:
+      programs.gnupg.agent.enable = true;
+
+      # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
+      virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
+    };
+
     testScript =
       { nodes, ... }:
       ''
@@ -194,7 +192,7 @@ import ./make-test-python.nix (
         swaymsg("exec swaylock")
         machine.wait_until_succeeds("pgrep -x swaylock")
         machine.sleep(3)
-        machine.send_chars("${nodes.machine.config.users.users.alice.password}")
+        machine.send_chars("${nodes.machine.users.users.alice.password}")
         machine.send_key("ret")
         machine.wait_until_fails("pgrep -x swaylock")
 

pkgs/applications/audio/airwave/default.nix

@@ -12,6 +12,7 @@
   file,
   libX11,
   qt5,
+  vst2-sdk,
 }:
 
 let
@@ -24,18 +25,6 @@ let
     sha256 = "1ban59skw422mak3cp57lj27hgq5d3a4f6y79ysjnamf8rpz9x4s";
   };
 
-  vst-sdk = stdenv.mkDerivation rec {
-    name = "vstsdk369_01_03_2018_build_132";
-    src = requireFile {
-      name = "${name}.zip";
-      url = "http://www.steinberg.net/en/company/developers.html";
-      sha256 = "0r29fv6yhm2m5yznn8m4my7fq01w1lpphax4sshagy6b1dgjlv3w";
-    };
-    nativeBuildInputs = [ unzip ];
-    installPhase = "cp -r . $out";
-    meta.license = lib.licenses.unfree;
-  };
-
   wine-wow64 = wine.override {
     wineRelease = "stable";
     wineBuild = "wineWow";
@@ -84,7 +73,7 @@ multiStdenv.mkDerivation {
   # Cf. https://github.com/phantom-code/airwave/issues/57
   hardeningDisable = [ "format" ];
 
-  cmakeFlags = [ "-DVSTSDK_PATH=${vst-sdk}/VST2_SDK" ];
+  cmakeFlags = [ "-DVSTSDK_PATH=${vst2-sdk}" ];
 
   postInstall = ''
     mv $out/bin $out/libexec
@@ -94,7 +83,7 @@ multiStdenv.mkDerivation {
     wrapProgram $out/libexec/airwave-host-64.exe --set WINELOADER ${wine-xembed}/bin/wine64
   '';
 
-  meta = with lib; {
+  meta = {
     description = "WINE-based VST bridge for Linux VST hosts";
     longDescription = ''
       Airwave is a wine based VST bridge, that allows for the use of
@@ -105,9 +94,9 @@ multiStdenv.mkDerivation {
       window.
     '';
     homepage = "https://github.com/phantom-code/airwave";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ michalrus ];
+    maintainers = with lib.maintainers; [ michalrus ];
     hydraPlatforms = [ ];
   };
 }

pkgs/applications/audio/ardour/default.nix

@@ -160,7 +160,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals videoSupport [ harvid xjadeo ];
 
   wafConfigureFlags = [
-    "--cxx11"
+    "--cxx17"
     "--docs"
     "--freedesktop"
     "--no-phone-home"

pkgs/applications/audio/mopidy/mopidy.nix

@@ -30,7 +30,22 @@ pythonPackages.buildPythonApplication rec {
     gst-plugins-base
     gst-plugins-good
     gst-plugins-ugly
-    gst-plugins-rs
+    # Required patches for the Spotify plugin (https://github.com/mopidy/mopidy-spotify/releases/tag/v5.0.0a3)
+    (gst-plugins-rs.overrideAttrs (
+      newAttrs: oldAttrs: {
+        cargoDeps = oldAttrs.cargoDeps.overrideAttrs (oldAttrs': {
+          vendorStaging = oldAttrs'.vendorStaging.overrideAttrs {
+            inherit (newAttrs) patches;
+            outputHash = "sha256-CegT8h+CJ6axipAD6E9drtrPJ9izRy/UCW14rbva5XA=";
+          };
+        });
+
+        # https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/merge_requests/1801/
+        patches = oldAttrs.patches or [ ] ++ [
+          ./spotify-access-token-auth.patch
+        ];
+      }
+    ))
     pipewire
   ];
 

pkgs/applications/audio/mopidy/spotify.nix

@@ -8,14 +8,14 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-spotify";
-  version = "5.0.0a2";
+  version = "5.0.0a3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QeABG9rQKJ8sIoK38R74N0s5rRG+zws7AZR0xPysdcY=";
+    hash = "sha256-pM+kqeWYiPXv9DZDBTgwiEwC6Sbqv6uz5vJ5odcixOw=";
   };
 
   build-system = [ pythonPackages.setuptools ];

pkgs/applications/audio/reaper/default.nix

@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional pulseaudioSupport libpulseaudio;
 
   dontBuild = true;
+  dontStrip = true;
 
   installPhase =
     if stdenv.hostPlatform.isDarwin then

pkgs/applications/audio/seq66/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "seq66";
-  version = "0.99.16";
+  version = "0.99.17";
 
   src = fetchFromGitHub {
     owner = "ahlstromcj";
     repo = "seq66";
     rev = version;
-    hash = "sha256-HXmpAgztIr6fUdksBPyLli/eMoD3Xlfs+UhHvfrZe0U=";
+    hash = "sha256-xGJL6fAk4wTOPI7k3mA0DbVh51dru4gxaJlad00hBiM=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config qttools which wrapQtAppsHook ];

pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix

@@ -31,13 +31,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2025-01-11";
+  version = "0-unstable-2025-01-22";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "6fd5eb21a174e6a04247a2f370b544dcd6cb2420";
-    hash = "sha256-+E1l0Ea0Db5ksX9tDW+cvNUMjT4be5i9qcI/rIvFKbY=";
+    rev = "c87e6ac6d452b3bd94583a5c5edb16f37edadb94";
+    hash = "sha256-+6qU8KGdti/pji1d+024bnT7+oFP5Ve3jToURautKzE=";
   };
 
   patches = [

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -10,18 +10,18 @@
   vimUtils,
 }:
 let
-  version = "0.0.14";
+  version = "0.0.15";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
     tag = "v${version}";
-    hash = "sha256-0dkPejvupXhVZY/5qT45f4LZ4MIVcz8uZam+9TmB+Yo=";
+    hash = "sha256-REFF+4U0AjNwiK1ecbDPwF7C1jKRzITV29aolx+HI24=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-80++U7CIu6QtH1jQCHCEpv2tnYOuoWSczZIUmKyrqJE=";
+    cargoHash = "sha256-7W7uuyzqTTlvZAkeRYRIfkxYVbOv5h7elH8noZe1VMQ=";
 
     nativeBuildInputs = [
       pkg-config

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

@@ -7,19 +7,19 @@
   vimUtils,
 }:
 let
-  version = "0-unstable-2024-12-17";
+  version = "1.0.0";
   src = fetchFromGitHub {
     owner = "vyfor";
     repo = "cord.nvim";
-    rev = "c82ab475e7bb198d6fac20833a3468de1a1d14d0";
-    hash = "sha256-GVy8q9Fxb3mzx6mUQyIMumjnwZ7W08dPz1O3ckzVvdE=";
+    tag = "v${version}";
+    hash = "sha256-rA3R9SO3QRLGBVHlT5NZLtQw+EmkkmSDO/K6DdNtfBI=";
   };
   extension = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
   cord-nvim-rust = rustPlatform.buildRustPackage {
     pname = "cord.nvim-rust";
     inherit version src;
 
-    cargoHash = "sha256-unE600Uo8fXaFV0UWRhBenhQaXftDH7K+HyQ/9xo7JY=";
+    cargoHash = "sha256-wYXJ4+8b3PtHzL2jdplNHrjIBzbAzA7jdvLZ7Vz+Yz8=";
 
     installPhase =
       let
@@ -56,7 +56,6 @@ vimUtils.buildVimPlugin {
 
   passthru = {
     updateScript = nix-update-script {
-      extraArgs = [ "--version=branch" ];
       attrPath = "vimPlugins.cord-nvim.cord-nvim-rust";
     };
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3907,8 +3907,6 @@ let
         };
       };
 
-      nvarner.typst-lsp = callPackage ./nvarner.typst-lsp { };
-
       ocamllabs.ocaml-platform = buildVscodeMarketplaceExtension {
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ocamllabs.ocaml-platform/changelog";

pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix

@@ -1,39 +0,0 @@
-{
-  jq,
-  lib,
-  moreutils,
-  typst-lsp,
-  vscode-utils,
-}:
-
-vscode-utils.buildVscodeMarketplaceExtension {
-  mktplcRef = {
-    name = "typst-lsp";
-    publisher = "nvarner";
-    # Please update the corresponding binary (typst-lsp) when updating
-    # this extension.
-    version = "0.13.0";
-    hash = "sha256-xiFUJymZOTEqlGvCHvLiI0pVg7NLgIXhZ7x8yx+a5mY=";
-  };
-
-  nativeBuildInputs = [
-    jq
-    moreutils
-  ];
-
-  buildInputs = [ typst-lsp ];
-
-  postInstall = ''
-    cd "$out/$installPrefix"
-    jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
-  '';
-
-  meta = {
-    changelog = "https://marketplace.visualstudio.com/items/nvarner.typst-lsp/changelog";
-    description = "VSCode extension for providing a language server for Typst";
-    downloadPage = "https://marketplace.visualstudio.com/items?itemName=nvarner.typst-lsp";
-    homepage = "https://github.com/nvarner/typst-lsp";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.drupol ];
-  };
-}

pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "shellcheck";
     publisher = "timonwong";
-    version = "0.37.4";
-    sha256 = "sha256-+DFoHjb5sl9s5Vqw7onsv+MKjS4+loGVnZsF9/e+7dQ=";
+    version = "0.37.6";
+    sha256 = "sha256-xfVKI+xxA/8YUcCWpskxZLbBLPsYCF46iKJkrV2zODs=";
   };
   nativeBuildInputs = [
     jq

pkgs/applications/editors/vscode/vscodium.nix

@@ -26,11 +26,11 @@ let
 
   sha256 =
     {
-      x86_64-linux = "04q9jm91idlbqsyfjr194i3xayyind67hyk59x4wrmg25sdqa0km";
-      x86_64-darwin = "0a31fjsdx671crd9hs1c9vpqbnskgh57pq4j810v722rmfawn7g0";
-      aarch64-linux = "0i3kx0xsb920f2xnf1xxhf4415xnyljfmah222ikhf6q1lp8dkqd";
-      aarch64-darwin = "068h94fxdafgm7l0z9dvhlmmixp7w8nmll4rzm06i8s3243fzb84";
-      armv7l-linux = "1bqnrgd1ykn67gvscsbkv82bydpmfjq1pn0951iiv2sy4m1g9flr";
+      x86_64-linux = "1l8w890xb3hszz1xf17xh1h8w0n2vcxc2jg3w1yzlx06rdb8bdy5";
+      x86_64-darwin = "1pb8i73bnpgcxzjdbcnb0cgjzr07a8pkb204m1w0zgl4ffjfhak0";
+      aarch64-linux = "0qkjrnhafbdam068gz8fzwpjb6cc3r70m9n11rkcw50i3m4gljrh";
+      aarch64-darwin = "0y3wwzpqwx6hk3rpnjjj8w3la6hw0g1y1fxw73paj9zcsmmz9l0a";
+      armv7l-linux = "053zkdjdvgmibqdd8jwr7msf9awdblqcxkim0wq1zxjxq5xnzz8j";
     }
     .${system} or throwSystem;
 
@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.96.2.24355";
+  version = "1.96.4.25017";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/emulators/libretro/cores/bsnes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2025-01-10";
+  version = "0-unstable-2025-01-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "1e0054da1c158857dc444b9b52273ddd18858d49";
-    hash = "sha256-zm4X5RTaAm2njtvCBWBT1vhtf/YQvoBaaBSMzz9D2aQ=";
+    rev = "05e820a436d2e2cbbb1b871400f84a96e76e2359";
+    hash = "sha256-jq1W1OrltfTc4WEnEDZSNQUPSWfnUtzrOtiA4fzlIpk=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/gambatte.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-01-10";
+  version = "0-unstable-2025-01-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "36a0da43fe6a82aba6acc5336574dbd749b18fa8";
-    hash = "sha256-3PM7PK1ouMObNZEIIIBG8gxIydYFKP9RRGlWBr5PIGU=";
+    rev = "cd1e180b1edf6e6853cf4d501adac0538076de34";
+    hash = "sha256-NwxditChigU8dUhmv6pnoreG1kp7cZlLBTAexNqbiAo=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-01-10";
+  version = "0-unstable-2025-01-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "bf492bf3532b9d30e7a023e4329e202b15169e1c";
-    hash = "sha256-QxplBzath9xN0AaFOT8K0dVEnMnTaZpLfdsX81fmP9g=";
+    rev = "8ea39eefc76bd97331c0da9efbac6ff343704a95";
+    hash = "sha256-BZHZ5aixtivkxI+1Fpo/ziykIQFM27UtF4hLGOrQ4cQ=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/gpsp.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2024-12-26";
+  version = "0-unstable-2025-01-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "66ced08c693094f2eaefed5e11bd596c41028959";
-    hash = "sha256-gXk9T62wns7QixY98RSjfM/OW6SfH8N3NcjZ328WSAM=";
+    rev = "b0d5d27ae51c23f514974ddffa5760f1e1d05d9b";
+    hash = "sha256-e2U1xEshoPJlaVUEbqNZIayNaSdDC65hE1VrvxvQSx0=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-01-13";
+  version = "0-unstable-2025-01-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "0fcccae96eb722d58be329977eb49173c5c97981";
-    hash = "sha256-Dt9MVWSe9ykNUasEgANsKYuXdqD3cGuM5jQCyD1iSY0=";
+    rev = "cea00d3aa54e61c929e8e205454793f45472c46d";
+    hash = "sha256-v/L9qEhsymWfpep3YKwLiS2OBC3OBCIVpXOZatLGpN4=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/nestopia.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2025-01-05";
+  version = "0-unstable-2025-01-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "9762adc00668f3a2e1016f3ad07ff9cbf9d67459";
-    hash = "sha256-CLEwhQ91dxoTLyhlQwssoCL/dEqY6SetwWLogfJi8RU=";
+    rev = "5b56b6b98ed5f0d7871be4c957fc9d39a608a7c0";
+    hash = "sha256-SBVvfrIaXFx984PG4pG1CE0xsTVypOfn/kCvWSgtZSA=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/puae.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "puae";
-  version = "0-unstable-2025-01-11";
+  version = "0-unstable-2025-01-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-uae";
-    rev = "67785f95db6e96dc081a2207751ab98b06b422ab";
-    hash = "sha256-jJ1yki9uPutIdAI6TBKPWjiZc7W5K9n7P/oYA/UWJf4=";
+    rev = "9b05ecda81e14c0c5b2c5f6af8a65d034afd54a1";
+    hash = "sha256-jBY+Xn9aR/lTyxFZlydWJA5+bpkaCcyCAiYG3fcmGmc=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/swanstation.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "swanstation";
-  version = "0-unstable-2024-07-24";
+  version = "0-unstable-2025-01-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "swanstation";
-    rev = "37cd87e14ca09ac1b558e5b2c7db4ad256865bbb";
-    hash = "sha256-dNIxlTPoY4S6VMtTN22ti3DE4aU/8XN/XhAo3DMNR/E=";
+    rev = "10af0c78ba0e3516e70f4ed7c6020827bdb2647e";
+    hash = "sha256-xxyWvsDF3FXTaP7GOGr9Zym0DgNZKJ4x9BDUgDzcHYA=";
   };
 
   extraNativeBuildInputs = [ cmake ];

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.34.14";
+  version = "3.34.15";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-4nptnzAvLOC8R1sqfdHJ4YYtotwcOARbu9fe4YKwIVM=";
+    hash = "sha256-TFnlQIizI+8CZgNpwkuipSCNT3OYIaOeoz6kIGcSYL4=";
   };
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -80,14 +80,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.40.2";
+  version = "3.40.3";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-8bcCpNgw4FV++qye8G3QXA3k0QCgqByODzPUTw0VX/E=";
+    hash = "sha256-AUDohf71NIuEjFrzRQ8QsdvmEjYsZK9aI4j0msVJgcQ=";
   };
 
   passthru = {

pkgs/applications/graphics/f3d/default.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "f3d";
-  version = "2.5.1";
+  version = "3.0.0";
 
   outputs = [ "out" ] ++ lib.optionals withManual [ "man" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "f3d-app";
     repo = "f3d";
     tag = "v${version}";
-    hash = "sha256-S3eigdW6rkDRSm4uCCTFHx5fhJGNVWpAAAKboougr08=";
+    hash = "sha256-mnDmo5qzdnElhvZwBmHL3xC2o8iLuvYyfZXHoaAUG08=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/krita/generic.nix

@@ -30,7 +30,7 @@
   libkdcraw,
   lcms2,
   gsl,
-  openexr,
+  openexr_3,
   giflib,
   libjxl,
   mlt,
@@ -105,7 +105,7 @@ mkDerivation rec {
     fribidi
     lcms2
     gsl
-    openexr
+    openexr_3
     lager
     libaom
     libheif
@@ -132,9 +132,7 @@ mkDerivation rec {
     python3Packages.pyqt5
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    [ "-I${ilmbase.dev}/include/OpenEXR" ] ++ lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy"
-  );
+  env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy");
 
   # Krita runs custom python scripts in CMake with custom PYTHONPATH which krita determined in their CMake script.
   # Patch the PYTHONPATH so python scripts can import sip successfully.

pkgs/applications/graphics/paraview/default.nix

@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "5.13.0";
+  version = "5.13.2";
 
   docFiles = [
     (fetchurl {
       url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewTutorial-${version}.pdf";
       name = "Tutorial.pdf";
-      hash = "sha256-hoCa/aTy2mmsPHP3Zm0hLZlZKbtUMpjUlc2rFKKChco=";
+      hash = "sha256-jJ6YUT2rgVExfKv900LbSO+MDQ4u73K7cBScHxWoP+g=";
     })
     (fetchurl {
       url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewGettingStarted-${version}.pdf";
@@ -42,7 +42,7 @@ let
     (fetchurl {
       url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewCatalystGuide-${version}.pdf";
       name = "CatalystGuide.pdf";
-      hash = "sha256-t1lJ1Wiswhdxovt2O4sXTXfFxshDiZZVdnkXt/+BQn8=";
+      hash = "sha256-Pl7X5cBj3OralkOw5A29CtXnA+agYr6kWHf/+KZNHow=";
     })
   ];
 
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
     owner = "paraview";
     repo = "paraview";
     rev = "v${version}";
-    hash = "sha256-JRSuvBON2n0UnbrFia4Qmf6eYb1Mc+Z7dIcXSeUhpIc=";
+    hash = "sha256-29PLXVpvj8RLkSDWQgj5QjBZ6l1/0NoVx/qcJXOSssU=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/pineapple-pictures/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pineapple-pictures";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = finalAttrs.version;
-    hash = "sha256-NXg+lCkm4i4ONkIp3F7Z1yHHO9daXucC+X1SuNxPJgQ=";
+    hash = "sha256-FgOmdqhsHyIQvwoNhD3pCoWYr4tW+vni0/rlICGu6rc=";
   };
 
   nativeBuildInputs = [

pkgs/applications/kde/angelfish.nix

@@ -24,9 +24,6 @@
   rustPlatform,
   rustc,
   srcs,
-
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoSha256 ? "sha256-PSrTo7nGgH0KxA82RlBEwtOu80WMCBeaCxHj3n7SgEE=",
 }:
 
 mkDerivation rec {
@@ -40,11 +37,11 @@ mkDerivation rec {
     })
   ];
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     # include version in the name so we invalidate the FOD
     name = "${pname}-${srcs.angelfish.version}";
     inherit (srcs.angelfish) src;
-    sha256 = cargoSha256;
+    hash = "sha256-M3CtP7eWqOxMvnak6K3QvB/diu4jAfMmlsa6ySFIHCU=";
   };
 
   nativeBuildInputs = [

pkgs/applications/kde/kio-extras.nix

@@ -24,9 +24,8 @@
   syntax-highlighting,
   libmtp,
   libssh,
-  openexr,
+  openexr_3,
   libtirpc,
-  ilmbase,
   phonon,
   qtsvg,
   samba,
@@ -72,7 +71,7 @@ mkDerivation {
     syntax-highlighting
     libmtp
     libssh
-    openexr
+    openexr_3
     libtirpc
     phonon
     qtsvg
@@ -90,5 +89,4 @@ mkDerivation {
       --replace Exec=$out Exec=${kio}
   '';
 
-  CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];
 }

pkgs/applications/misc/googleearth-pro/default.nix

@@ -9,6 +9,8 @@
   libGLU,
   libSM,
 
+  libXcomposite,
+  libXi,
   libXrender,
   libX11,
 
@@ -38,11 +40,11 @@ let
 in
 mkDerivation rec {
   pname = "googleearth-pro";
-  version = "7.3.6.9796";
+  version = "7.3.6.10201";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
-    sha256 = "sha256-Wv2jPGN7LC5T32WdX3W1BfGYrcXTNWTI1Wv+PmD0gNM=";
+    sha256 = "sha256-LqkXOSfE52+7x+Y0DBjYzvVKO0meytLNHuS/ia88FbI=";
   };
 
   nativeBuildInputs = [
@@ -63,6 +65,8 @@ mkDerivation rec {
     libGLU
     libSM
     libX11
+    libXcomposite
+    libXi
     libXrender
     libproxy
     libxcb

pkgs/applications/misc/klayout/default.nix

@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.29.10";
+  version = "0.29.11";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    hash = "sha256-3YRWGIfBGgN3vlBlFoVbMWgkhoxs7OQli1qtKUXf0KA=";
+    hash = "sha256-MIXuqDnK8kXjQOSTALVPQHIE1eMk1Dl1M+/GMbw92bg=";
   };
 
   postPatch = ''

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox-beta";
-  version = "135.0b3";
+  version = "135.0b9";
   applicationName = "Mozilla Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "2d6f04b929257532ac3883f6c16f063718c66acaf0c131d1f449f4a0de947d061ca772a3388f02b9122649ba27474500db287a9b4b7a0cc53a1639805c7f3064";
+    sha512 = "3007c2a8743e4444226e66f0c11f53f01255c09702deda7de83bbe134a19c324b8b49de78d3211b20bb82c7b2040127145d2e39ed8aa81c653ac4397c46476f6";
   };
 
   meta = {

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.0.3495.29";
+  version = "7.1.3570.39";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-GdywFoaxx2VSpOJ0FJIhFcIRDJEhozCWvYvdatmEi5o=";
-      x86_64-linux = "sha256-PNSGx2oCIbB3vaNFS+7coM9Xw+2qDELJBXX8zA1UC3Q=";
+      aarch64-linux = "sha256-rhIz+vX/W39sN/j37nhaq+iEbIc/rfgMprqmX+DM2D8=";
+      x86_64-linux = "sha256-d6NQRueNE9P2/IOLwBIm4evrqO0D+RNKUUC156PEgcc=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -126,11 +126,11 @@
     "vendorHash": "sha256-P7ykNhpFoPTINX3eo61/x/9Ts2Z9dscY/P5fQNRsmVo="
   },
   "azuread": {
-    "hash": "sha256-m4ZzZFlcMBAfGN7tHjeYACMwxaG6rpUO4MPVMqjD7Hk=",
+    "hash": "sha256-UV6jgVS8tzWiEBC/C/U7/2bGZ1sqk2MnS8xNRBuL+C8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v3.0.2",
+    "rev": "v3.1.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -180,13 +180,13 @@
     "vendorHash": "sha256-iNY6Jz/SKOLynx33smDFbg371Wa31CouNtrOuV7lkcw="
   },
   "bitwarden": {
-    "hash": "sha256-zvl9B1RhViJ83/7i9ab1KvQc9Yfpzq3c1JIz+bzwVmM=",
+    "hash": "sha256-A8x17x4BrtLXvJa/px/ktuhCyXxMZHhyCARxGiDMGTw=",
     "homepage": "https://registry.terraform.io/providers/maxlaverse/bitwarden",
     "owner": "maxlaverse",
     "repo": "terraform-provider-bitwarden",
-    "rev": "v0.12.1",
+    "rev": "v0.13.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9k3+Qyural6S9xbqZ/NHXPFoo9cgLklIScTEBLuB0kA="
+    "vendorHash": "sha256-whXQejYaYH4bMpIKVphfdfcB/V9ZW+O7CHjcGCnWFco="
   },
   "brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -354,11 +354,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-mPNc65zah7HO3Knd44qxbwGgPp4LyxG76abBOV/1D3I=",
+    "hash": "sha256-JRBur7pH1niPZLN+5do6GiuoiSP18QsDZqWjlc9riek=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.46.1",
+    "rev": "v2.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -480,20 +480,20 @@
     "vendorHash": "sha256-EiTWJ4bw8IwsRTD9Lt28Up2DXH0oVneO2IaO8VqWtkw="
   },
   "gitea": {
-    "hash": "sha256-cIbDYFc6q6GMoQH9bqEA/LqC3MczAM7mewhYRRYQcy0=",
+    "hash": "sha256-pbh3ADR77iVwHQ3e7krSUU+rNfhdA8zYnxLbTdnRfaU=",
     "homepage": "https://registry.terraform.io/providers/go-gitea/gitea",
     "owner": "go-gitea",
     "repo": "terraform-provider-gitea",
-    "rev": "v0.5.1",
+    "rev": "v0.6.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-7gA6KoP7NwjwItigBUeCg9AYQ/MggkOHOe/bH7Tf/xA="
+    "vendorHash": "sha256-d8XoZzo2XS/wAPvdODAfK31qT1c+EoTbWlzzgYPiwq4="
   },
   "github": {
-    "hash": "sha256-curdrL2vQ0bnD3ci3ZH1GYNz9JO8ycKaZstK+v//b28=",
+    "hash": "sha256-RD2yGXClIYBa+Gs0IunPXKm0f0d1iFCVZSKUzXhlJyc=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.4.0",
+    "rev": "v6.5.0",
     "spdx": "MIT",
     "vendorHash": null
   },
@@ -750,20 +750,20 @@
     "vendorHash": "sha256-Q9LdhokZol1jhSfQVIRvPe1XrE8nVvc22aWHt7wkcHY="
   },
   "linode": {
-    "hash": "sha256-lM0haU3tLbKaW+EJNMZp9ms/nTH3xEdhBAiIjFSUZ7s=",
+    "hash": "sha256-qyHRGkhwq9YS/mYLFMXEkEdNtH3yfCrXIP4q/QdOzcY=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v2.31.1",
+    "rev": "v2.32.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WCD51W44xN+Qgojbcjrj3f9bUsVLN4itsY7ZBEen0YQ="
+    "vendorHash": "sha256-1wwePyqy6ZLc3ZN0M2zZ6sxhVGZl7gWATv1xvcHBqB4="
   },
   "linuxbox": {
-    "hash": "sha256-+8Wyrb/AjzpfhDK42ze0HBIAdGvtJUFEIpYZs7uOym4=",
+    "hash": "sha256-svQRz1/PdVLpHoxOam1sfRTwHqgqs4ohJQs3IPMMAM4=",
     "homepage": "https://registry.terraform.io/providers/numtide/linuxbox",
     "owner": "numtide",
     "repo": "terraform-provider-linuxbox",
-    "rev": "v0.5.6",
+    "rev": "v0.5.8",
     "spdx": "BSD-3-Clause",
     "vendorHash": "sha256-GxMCY/udIy3c7zLeNeghXtfCUw4+Ll83L/40N4/yVh8="
   },
@@ -985,11 +985,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-C0Ded8XrPh+yeN+0SvrOPaKONTWvvj4J15xsaXgsri4=",
+    "hash": "sha256-r0F+WSEY7j2AesQ0sDixOe9uKD0hOIdSzDYEhC8yEDA=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.18.3",
+    "rev": "v3.19.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1111,13 +1111,13 @@
     "vendorHash": null
   },
   "selectel": {
-    "hash": "sha256-Wd9HX3Tvoi84t3NulTQlOWWvbsMPNC0mn1yEDmlmnb8=",
+    "hash": "sha256-bXPH/1fEuGehOOSTXsR/yi0BiR8zneIc2KUqOEoG5Qw=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v6.0.1",
+    "rev": "v6.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JytWDb7d2RW/fp5rptAzmfTTuytZ+lp6cB05ol9mhhM="
+    "vendorHash": "sha256-LRs2zI5L5qdWiM8VexQPkP8SjrO/sVEj/MOX+n4NKSc="
   },
   "sentry": {
     "hash": "sha256-2JfzteVripOz96bAtQXC32wi8dWUQw8bry0HllNRQRA=",
@@ -1138,13 +1138,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-qZHbeQDbyahUuYLhWFqBogG+w2pI1XAUdPvcNTngQUw=",
+    "hash": "sha256-C8LyILuqT15NqqzBrj09N+Nx9KMhE/oBPfXtc8gPfns=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.5.0",
+    "rev": "v9.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EnEfch59DIBzK8fmhZ1mvTSxPSjtxMTAOUMeocHgA8I="
+    "vendorHash": "sha256-ijq03YXHiSKOgjG9gbyNHPUsYlYHi9nY4pmhMxM5CrI="
   },
   "skytap": {
     "hash": "sha256-JII4czazo6Di2sad1uFHMKDO2gWgZlQE8l/+IRYHQHU=",
@@ -1183,11 +1183,11 @@
     "vendorHash": "sha256-YFV+qXD78eajSeagJPgPu+qIktx1Vh/ZT0fUPOBuZyo="
   },
   "spacelift": {
-    "hash": "sha256-RWrhVeXPEgFYFGh34vFargTrZH+3CxY36+i0lmFSjXg=",
+    "hash": "sha256-qa+mBk57B2lauJI8k6t4BLksyKVM9tXKQOzo0ky/gAQ=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.19.0",
+    "rev": "v1.19.1",
     "spdx": "MIT",
     "vendorHash": "sha256-c3R/7k7y7XS2Qli00nSj7gh/3Mj88PY4WybBTq/+pPs="
   },
@@ -1355,13 +1355,13 @@
     "vendorHash": "sha256-Dxd/2TjxPoa+JcHlmmcoPx2wegZJzhbI1abNmF4wDik="
   },
   "vault": {
-    "hash": "sha256-vMt7FyNY+Tv7C+YT4h6BOn4EDU5ypOHQvtW0VtQiifg=",
+    "hash": "sha256-6xS+d1oDaRz6UVyK9Z3h4LPo2jZ0iVwzfVw1e6PHnDc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v4.5.0",
+    "rev": "v4.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tg1LBq8K8loMkPUXPMEi9Y4Epg0ZfpaYADfWLaZ2k3U="
+    "vendorHash": "sha256-H53MSJVW5hmG16VmTrHsSnphsgp8DG9B/Ur3SGDhSxE="
   },
   "vcd": {
     "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",
@@ -1373,13 +1373,13 @@
     "vendorHash": "sha256-eCIJ2w8DjmUCGp0VbliLaQ6C29mJhl6Spya06Xyiqd4="
   },
   "venafi": {
-    "hash": "sha256-9Nn2dFF9W8STQoRXFNiXYCrHEWiirNvOAAS1f1brutw=",
+    "hash": "sha256-/fRqTu/M3OHR5v7pWAE04ijq70F7MxRILP1Ab2hw7gs=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.21.1",
+    "rev": "v0.21.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-xZTd/L5ZRTRuDsdyNZEZPmlOu9nUIAE5W1UG94aOS/o="
+    "vendorHash": "sha256-kZ0JLjAYu3b01zHfp+VWTZ8sUCivfaS1Ld2/SDMOrks="
   },
   "vinyldns": {
     "hash": "sha256-ow+o9fRw/t2i4N65zuVFbfPb68ZUcJfNB5ARYqRTsIs=",
@@ -1418,13 +1418,13 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-7tLqWVJL5G+OMtGVNkpfJZ6xfZ8hJy6gsitUVd0NHGc=",
+    "hash": "sha256-8xJOuafposGNtFw6ZMfrmoGOp67rubOdrLDR9DFRxdg=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.10.0",
+    "rev": "v2.11.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kjS1YYMoE5IBeKWXnxzO3nFp6NpBEwUCaTzO0VSBDLA="
+    "vendorHash": "sha256-nQM1RcdgndUwHJWAspu/INFSXBoXJgAFBZR1x2txCkE="
   },
   "vultr": {
     "hash": "sha256-vgeTK5fGHYzHCBdxq1JN9agK6+jYGkCkFnAWrkIz/gM=",

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -9,32 +9,32 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.80";
-        ptb = "0.0.126";
-        canary = "0.0.569";
+        stable = "0.0.81";
+        ptb = "0.0.127";
+        canary = "0.0.574";
         development = "0.0.67";
       }
     else
       {
-        stable = "0.0.332";
-        ptb = "0.0.156";
-        canary = "0.0.681";
-        development = "0.0.76";
+        stable = "0.0.333";
+        ptb = "0.0.157";
+        canary = "0.0.686";
+        development = "0.0.78";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-oamuF2LcdBC2HUzB08lTlxvrXjE6YFBXwLJDrmYKRXM=";
+        hash = "sha256-V3xaBbCZX1TUaXxLbMOhJ8VFKMZBfCR/w5ajrAvu2kQ=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-4OvGEeOP4i4j7WwMjnnSvaNQ2e5RZ0EMF797xoIsWMY=";
+        hash = "sha256-mgR2MDQ3ZtgBltQPOxT6773aNUx5hH2P6LvFJFEuUts=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-akbcAPuxF1pl4u2Cw/I7rlv8WVDsIZDPPpGRUt1qQvA=";
+        hash = "sha256-pZdHl7U3aNmxe6PtaK7JbQ7XdAPtlTAUuGcBRFkQI3s=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -44,19 +44,19 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-ZIAFYbC4rRjb9Lz3E50TfR0Lgdmg0MZllxy+vk36Eg8=";
+        hash = "sha256-ebPbTIiaZ2hMoJdVCax0hT2bLUFLj5fuIf2e74qLHns=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-Uluw2l/yAFzy4uMzp9ugFri8Psl7hy50H7QHag+St10=";
+        hash = "sha256-bZ9LVthjBib/yRfDTIXBNKDulWhW35HOdSDyEyjyLyA=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-OmN8g5Skg/KmdO8sv8iOhbZOFU/XUyUqvSthEam6RNE=";
+        hash = "sha256-F3vLcLjNhYRGnOyuNziwtbBNxiUKgw6wZaa1LbVF5PU=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-GyHOJcxWoKdFJ5/oca5JFwu5OdGGykR4OXGMaa3XfiY=";
+        hash = "sha256-SkPMUbRiY5C4sHHcnpneibG8kazHfJ3ohT1h0jbx4F8=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.10.3";
+  version = "5.10.5";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-AsxCDh/pneRHVuGtlqFYD6c9pezmKo/wrMU4RPtWlXA=";
+    hash = "sha256-0BfKWwb+mnlaMD55KKvEMRIFvqBDQCs272lemvXBnjw=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/applications/networking/protonvpn-cli/default.nix

@@ -6,6 +6,9 @@
   protonvpn-nm-lib,
   pythondialog,
   dialog,
+  wrapGAppsNoGuiHook,
+  gobject-introspection,
+  glib,
 }:
 
 buildPythonApplication rec {
@@ -22,12 +25,27 @@ buildPythonApplication rec {
     sha256 = "sha256-KhfogC23i7THe6YZJ6Sy1+q83vZupHsS69NurHCeo8I=";
   };
 
+  nativeBuildInputs = [
+    wrapGAppsNoGuiHook
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    glib
+  ];
+
   propagatedBuildInputs = [
     protonvpn-nm-lib
     pythondialog
     dialog
   ];
 
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+  ];
+
   # Project has a dummy test
   doCheck = false;
 

pkgs/applications/office/skrooge/default.nix

@@ -31,11 +31,11 @@
 
 mkDerivation rec {
   pname = "skrooge";
-  version = "2.33.0";
+  version = "25.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/skrooge/skrooge-${version}.tar.xz";
-    hash = "sha256-9K4/r3I9VNdUKHi4FCo0SxR+QzewvEKGOQevRM/r9GU=";
+    hash = "sha256-t8A9egotR2XoMBo5uoH2RBPEo3H6nPSJS5Oi4MkSVww=";
   };
 
   nativeBuildInputs = [

pkgs/applications/radio/qlog/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.40.1";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-6mAFOf/5LsmgMBxzkBlN1MOz4NVS9hi9YWOgeJ2tHSs=";
+    hash = "sha256-6+/GtAf/MGPcL6hh7aFeoCPVo6jhX3BQGBTHVHx1jDU=";
     fetchSubmodules = true;
   };
 

pkgs/applications/science/biology/blast/bin.nix

@@ -11,25 +11,29 @@
   glib,
   libxml2,
   coreutils,
+  sqlite,
 }:
 let
   pname = "blast-bin";
-  version = "2.14.1";
+  version = "2.16.0";
 
   srcs = rec {
     x86_64-linux = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-linux.tar.gz";
-      hash = "sha256-OO8MNOk6k0J9FlAGyCOhP+hirEIT6lL+rIInB8dQWEU=";
+      hash = "sha256-sLEwmMkB0jsyStFwDnRxu3QIp/f1F9dNX6rXEb526PQ=";
     };
     aarch64-linux = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-aarch64-linux.tar.gz";
-      hash = "sha256-JlOyoxZQBbvUcHIMv5muTuGQgrh2uom3rzDurhHQ+FM=";
+      hash = "sha256-1EeiMu08R9Glq8qRky4OTT5lQPLJcM7iaqUrmUOS4MI=";
     };
     x86_64-darwin = fetchurl {
       url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-x64-macosx.tar.gz";
-      hash = "sha256-eMfuwMCD6VlDgeshLslDhYBBp0YOpL+6q/zSchR0bAs=";
+      hash = "sha256-fu4edyD12q8G452ckrEl2Qct5+uB9JnABd7bCLkyMkw=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-aarch64-macosx.tar.gz";
+      hash = "sha256-6NpPNLBCHaBRscLZ5fjh5Dv3bjjPk2Gh2+L7xEtiJNs=";
     };
-    aarch64-darwin = x86_64-darwin;
   };
   src = srcs.${stdenv.hostPlatform.system};
 in
@@ -48,6 +52,7 @@ stdenv.mkDerivation {
       bzip2
       glib
       libxml2
+      sqlite
     ];
 
   installPhase = ''

pkgs/applications/science/logic/coq/default.nix

@@ -60,6 +60,7 @@ let
    "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
    "8.20.0".sha256   = "sha256-WFpZlA6CzFVAruPhWcHQI7VOBVhrGLdFzWrHW0DTSl0=";
    "8.20.1".sha256   = "sha256-nRaLODPG4E3gUDzGrCK40vhl4+VhPyd+/fXFK/HC3Ig=";
+   "9.0+rc1".sha256  = "sha256-TLq925HFdizxyHjKRMeHBH9rLRpLNUiVIfA1JSMgYXA=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -1,104 +1,147 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, libunistring
-, harfbuzz, fontconfig, pkg-config, ncurses, imagemagick
-, libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor
-, libxkbcommon, libXi, libXext, wayland-protocols, wayland, xxHash
-, nerd-fonts
-, lcms2
-, librsync
-, openssl
-, installShellFiles
-, dbus
-, sudo
-, Libsystem
-, Cocoa
-, Kernel
-, UniformTypeIdentifiers
-, UserNotifications
-, libcanberra
-, libicns
-, wayland-scanner
-, libpng
-, python3
-, zlib
-, simde
-, bashInteractive
-, zsh
-, fish
-, nixosTests
-, go_1_23
-, buildGo123Module
-, nix-update-script
-, makeBinaryWrapper
-, autoSignDarwinBinariesHook
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+  libunistring,
+  harfbuzz,
+  fontconfig,
+  pkg-config,
+  ncurses,
+  imagemagick,
+  libstartup_notification,
+  libGL,
+  libX11,
+  libXrandr,
+  libXinerama,
+  libXcursor,
+  libxkbcommon,
+  libXi,
+  libXext,
+  wayland-protocols,
+  wayland,
+  xxHash,
+  nerd-fonts,
+  lcms2,
+  librsync,
+  openssl,
+  installShellFiles,
+  dbus,
+  sudo,
+  Libsystem,
+  Cocoa,
+  Kernel,
+  UniformTypeIdentifiers,
+  UserNotifications,
+  libcanberra,
+  libicns,
+  wayland-scanner,
+  libpng,
+  python3,
+  zlib,
+  simde,
+  bashInteractive,
+  zsh,
+  fish,
+  nixosTests,
+  go_1_23,
+  buildGo123Module,
+  nix-update-script,
+  makeBinaryWrapper,
+  autoSignDarwinBinariesHook,
 }:
 
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.38.1";
+  version = "0.39.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-0M4Bvhh3j9vPedE/d+8zaiZdET4mXcrSNUgLllhaPJw=";
+    hash = "sha256-4JlsIwQzCxs1i8Pvsj9KcJZpXbVkSzWtW7klatA0FOM";
   };
 
-  goModules = (buildGo123Module {
-    pname = "kitty-go-modules";
-    inherit src version;
-    vendorHash = "sha256-K12P81jE7oOU7qX2yQ+VtVHX/igKG0nPMSBkZ7wsR0o=";
-  }).goModules;
+  goModules =
+    (buildGo123Module {
+      pname = "kitty-go-modules";
+      inherit src version;
+      vendorHash = "sha256-Yahn+nlarPy4Yf1QmDminnHDqbe0+iJ6IsUKF0tioK4=";
+    }).goModules;
 
-  buildInputs = [
-    harfbuzz
-    ncurses
-    simde
-    lcms2
-    librsync
-    matplotlib
-    openssl.dev
-    xxHash
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    Kernel
-    UniformTypeIdentifiers
-    UserNotifications
-    libpng
-    python3
-    zlib
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    Libsystem
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fontconfig libunistring libcanberra libX11
-    libXrandr libXinerama libXcursor libxkbcommon libXi libXext
-    wayland-protocols wayland dbus libGL
-  ];
+  buildInputs =
+    [
+      harfbuzz
+      ncurses
+      simde
+      lcms2
+      librsync
+      matplotlib
+      openssl.dev
+      xxHash
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Cocoa
+      Kernel
+      UniformTypeIdentifiers
+      UserNotifications
+      libpng
+      python3
+      zlib
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+      Libsystem
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      fontconfig
+      libunistring
+      libcanberra
+      libX11
+      libXrandr
+      libXinerama
+      libXcursor
+      libxkbcommon
+      libXi
+      libXext
+      wayland-protocols
+      wayland
+      dbus
+      libGL
+    ];
 
-  nativeBuildInputs = [
-    installShellFiles
-    ncurses
-    pkg-config
-    sphinx
-    furo
-    sphinx-copybutton
-    sphinxext-opengraph
-    sphinx-inline-tabs
-    go_1_23
-    fontconfig
-    makeBinaryWrapper
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    imagemagick
-    libicns  # For the png2icns tool.
-    autoSignDarwinBinariesHook
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    wayland-scanner
-  ];
+  nativeBuildInputs =
+    [
+      installShellFiles
+      ncurses
+      pkg-config
+      sphinx
+      furo
+      sphinx-copybutton
+      sphinxext-opengraph
+      sphinx-inline-tabs
+      go_1_23
+      fontconfig
+      makeBinaryWrapper
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      imagemagick
+      libicns # For the png2icns tool.
+      autoSignDarwinBinariesHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      wayland-scanner
+    ];
 
   depsBuildBuild = [ pkg-config ];
 
-  outputs = [ "out" "terminfo" "shell_integration" "kitten" ];
+  outputs = [
+    "out"
+    "terminfo"
+    "shell_integration"
+    "kitten"
+  ];
 
   patches = [
     # Gets `test_ssh_env_vars` to pass when `bzip2` is in the output of `env`.
@@ -130,49 +173,58 @@ buildPythonApplication rec {
     cp -r --reflink=auto $goModules vendor
   '';
 
-  buildPhase = let
-    commonOptions = ''
-      --update-check-interval=0 \
-      --shell-integration=enabled\ no-rc
+  buildPhase =
+    let
+      commonOptions = ''
+        --update-check-interval=0 \
+        --shell-integration=enabled\ no-rc
+      '';
+      darwinOptions = ''
+        --disable-link-time-optimization \
+        ${commonOptions}
+      '';
+    in
+    ''
+      runHook preBuild
+
+      # Add the font by hand because fontconfig does not finds it in darwin
+      mkdir ./fonts/
+      cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+
+      ${
+        if stdenv.hostPlatform.isDarwin then
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
+            make docs
+            ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
+          ''
+        else
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
+            --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
+            --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
+            --canberra-library='${libcanberra}/lib/libcanberra.so' \
+            --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
+            ${commonOptions}
+            ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
+          ''
+      }
+      runHook postBuild
     '';
-    darwinOptions = ''
-      --disable-link-time-optimization \
-      ${commonOptions}
-    '';
-  in ''
-    runHook preBuild
 
-    # Add the font by hand because fontconfig does not finds it in darwin
-    mkdir ./fonts/
-    cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+  nativeCheckInputs =
+    [
+      pillow
 
-    ${if stdenv.hostPlatform.isDarwin then ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
-      make docs
-      ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
-    '' else ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
-      --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
-      --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
-      --canberra-library='${libcanberra}/lib/libcanberra.so' \
-      --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
-      ${commonOptions}
-      ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
-    ''}
-    runHook postBuild
-  '';
-
-  nativeCheckInputs = [
-    pillow
-
-    # Shells needed for shell integration tests
-    bashInteractive
-    zsh
-    fish
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    # integration tests need sudo
-    sudo
-  ];
+      # Shells needed for shell integration tests
+      bashInteractive
+      zsh
+      fish
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      # integration tests need sudo
+      sudo
+    ];
 
   # skip failing tests due to darwin sandbox
   preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -186,49 +238,61 @@ buildPythonApplication rec {
   '';
 
   checkPhase = ''
-      runHook preCheck
+    runHook preCheck
 
-      # Fontconfig error: Cannot load default config file: No such file: (null)
-      export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
+    # Fontconfig error: Cannot load default config file: No such file: (null)
+    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
 
-      # Required for `test_ssh_shell_integration` to pass.
-      export TERM=kitty
+    # Required for `test_ssh_shell_integration` to pass.
+    export TERM=kitty
 
-      make test
-      runHook postCheck
-    '';
+    make test
+    runHook postCheck
+  '';
 
   installPhase = ''
     runHook preInstall
     mkdir -p "$out"
     mkdir -p "$kitten/bin"
-    ${if stdenv.hostPlatform.isDarwin then ''
-    mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
-    cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
-    mkdir "$out/Applications"
-    cp -r kitty.app "$out/Applications/kitty.app"
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir "$out/bin"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
+          cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
+          mkdir "$out/Applications"
+          cp -r kitty.app "$out/Applications/kitty.app"
 
-    installManPage 'docs/_build/man/kitty.1'
-    '' else ''
-    cp -r linux-package/{bin,share,lib} "$out"
-    cp linux-package/bin/kitten "$kitten/bin/kitten"
-    ''}
+          installManPage 'docs/_build/man/kitty.1'
+        ''
+      else
+        ''
+          cp -r linux-package/{bin,share,lib} "$out"
+          cp linux-package/bin/kitten "$kitten/bin/kitten"
+        ''
+    }
 
     # dereference the `kitty` symlink to make sure the actual executable
     # is wrapped on macOS as well (and not just the symlink)
-    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick ncurses.dev ]}"
+    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${
+      lib.makeBinPath [
+        imagemagick
+        ncurses.dev
+      ]
+    }"
 
     installShellCompletion --cmd kitty \
       --bash <("$out/bin/kitty" +complete setup bash) \
       --fish <("$out/bin/kitty" +complete setup fish2) \
       --zsh  <("$out/bin/kitty" +complete setup zsh)
 
-    terminfo_src=${if stdenv.hostPlatform.isDarwin then
-      ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
+    terminfo_src=${
+      if stdenv.hostPlatform.isDarwin then
+        ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
       else
-      "$out/share/terminfo"}
+        "$out/share/terminfo"
+    }
 
     mkdir -p $terminfo/share
     mv "$terminfo_src" $terminfo/share/terminfo
@@ -245,12 +309,12 @@ buildPythonApplication rec {
     tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
       default = nixosTests.terminal-emulators.kitty;
     };
-    updateScript = nix-update-script {};
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
     homepage = "https://github.com/kovidgoyal/kitty";
-    description = "Modern, hackable, featureful, OpenGL based terminal emulator";
+    description = "The fast, feature-rich, GPU based terminal emulator";
     license = licenses.gpl3Only;
     changelog = [
       "https://sw.kovidgoyal.net/kitty/changelog/"
@@ -258,6 +322,11 @@ buildPythonApplication rec {
     ];
     platforms = platforms.darwin ++ platforms.linux;
     mainProgram = "kitty";
-    maintainers = with maintainers; [ tex rvolosatovs Luflosi kashw2 ];
+    maintainers = with maintainers; [
+      tex
+      rvolosatovs
+      Luflosi
+      kashw2
+    ];
   };
 }

pkgs/applications/version-management/git-stack/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-stack";
-  version = "0.10.17";
+  version = "0.10.18";
 
   src = fetchFromGitHub {
     owner = "gitext-rs";
     repo = "git-stack";
     rev = "v${version}";
-    hash = "sha256-foItJSZ6jsLuWkO/c1Ejb45dSdzZ/ripieyVIYsEyy0=";
+    hash = "sha256-iFoxYq4NHC/K0ruPDXHfayZDglebBJE00V57HUH9Y84=";
   };
 
-  cargoHash = "sha256-MEhUmy4ijR/zHm/qMt4PqNGYnCfIgjNaL9SlMmXCMmc=";
+  cargoHash = "sha256-kX0eOqp3emGEYZPIzkP62WpfH8mTxMi7zB+nwtpSFuk=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     Security

pkgs/applications/version-management/pass-git-helper/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonApplication rec {
   pname = "pass-git-helper";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "languitar";
     repo = "pass-git-helper";
     tag = "v${version}";
-    sha256 = "sha256-DLH3l4wYfBlrc49swLgyHeZXebJ5JSzU7cHjD7Hmw0g=";
+    sha256 = "sha256-HcafOaunDsyUm5KPcDNo/hENFMZseWSD8GYilKYOPco=";
   };
 
   build-system = [ setuptools ];

pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix

@@ -16,20 +16,20 @@ let
   bento4 = fetchFromGitHub {
     owner = "xbmc";
     repo = "Bento4";
-    rev = "1.6.0-641-${rel}";
-    sha256 = "sha256-vsFMDzH8JJecYw0qWKGCxnd/m5wn62mCKE2g2HwQhwI=";
+    tag = "1.6.0-641-3-${rel}";
+    hash = "sha256-ycWQvXgr1DQ3Wng73S8i6y6XmcUD/iN8OKfO1czgsnY=";
   };
 in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "21.4.6";
+  version = "21.5.9";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
-    rev = "${version}-${rel}";
-    sha256 = "sha256-ub4ep89datfr8aZLZAfoz7zhOizGFpzgp2PVON6Ptj8=";
+    tag = "${version}-${rel}";
+    hash = "sha256-OArvp/MgJGsRs3Z59JfgOkfwyhQ3ArC1yf37z7Y7khg=";
   };
 
   extraCMakeFlags = [

pkgs/applications/video/mpv/scripts/twitch-chat.nix

@@ -0,0 +1,42 @@
+{
+  buildLua,
+  curl,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+}:
+buildLua (finalAttrs: {
+  pname = "twitch-chat";
+  version = "0-unstable-2024-06-23";
+
+  src = fetchFromGitHub {
+    owner = "CrendKing";
+    repo = "mpv-twitch-chat";
+    rev = "bb0c2e84675f4f1e0c221c8e1d3516b60242b985";
+    hash = "sha256-WyNPUiAs5U/vrjNbAgyqkfoxh9rabLmuZ1zG5uZYxaw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D main.lua $out/share/mpv/scripts/twitch-chat.lua
+    runHook postInstall
+  '';
+
+  passthru.extraWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ curl ])
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Show Twitch chat messages as subtitles when watching Twitch VOD with mpv.";
+    homepage = "https://github.com/CrendKing/mpv-twitch-chat";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.naho ];
+  };
+})

pkgs/applications/video/obs-studio/plugins/obs-freeze-filter.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-freeze-filter";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-freeze-filter";
     rev = finalAttrs.version;
-    hash = "sha256-CaHBTfdk8VFjmiclG61elj35glQafgz5B4ENo+7J35o=";
+    hash = "sha256-fVrfGqwce4oFYdWGElXMsXHO1AzQ/mhfBmZL1mPdT3I=";
     fetchSubmodules = true;
   };
 

pkgs/applications/window-managers/phosh/default.nix

@@ -42,12 +42,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phosh";
-  version = "0.44.0";
+  version = "0.44.1";
 
   src = fetchurl {
     # Release tarball which includes subprojects gvc and libcall-ui
     url = with finalAttrs; "https://sources.phosh.mobi/releases/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-b4yrSC0TzTuh5kl93DeJNh06ZKjvNhTSjhDzmsEuK2g=";
+    hash = "sha256-rczGr7YSmVFu13oa3iSTmSQ4jsjl7lv38zQtD7WmDis=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ab/abi-dumper/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abi-dumper";
-  version = "1.2";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "lvc";
     repo = "abi-dumper";
     rev = version;
-    sha256 = "1i00rfnddrrb9lb1l6ib19g3a76pyasl9lb7rqz2p998gav1gjp2";
+    sha256 = "sha256-BefDMeKHx4MNU6SyX5UpQnwdI+zqap7zunsgdWG/2xc=";
   };
 
   patchPhase = ''

pkgs/by-name/ab/abracadabra/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abracadabra";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     rev = "v${version}";
-    hash = "sha256-T2l5wjE62xBb55IzKzInf/K4VPOuZ68vp5VxS0vIn+I=";
+    hash = "sha256-3sjN62SWl5Xpb2cP108IFqCuJAo8JLOCLxJENCrq8wI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ac/activemq/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "6.1.4";
+  version = "6.1.5";
 in
 stdenvNoCC.mkDerivation {
   pname = "activemq";
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchurl {
     url = "https://archive.apache.org/dist/activemq/${version}/apache-activemq-${version}-bin.tar.gz";
-    hash = "sha256-8b0no0XUNOw3U2ULWtNW9R7DAWXtAajvh0nGuTkVNfM=";
+    hash = "sha256-JrLLSm6+Be1vSBTTryRcZfbiGK0PrmJ/pM2uYnGuN9E=";
   };
 
   installPhase = ''

pkgs/by-name/ad/adr-tools/package.nix

@@ -0,0 +1,118 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  installShellFiles,
+  makeWrapper,
+  nix-update-script,
+
+  bash,
+  bashInteractive,
+  coreutils,
+  findutils,
+  gawk,
+  getopt,
+  gnugrep,
+  gnused,
+
+  # tests
+  adr-tools,
+  runCommand,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "adr-tools";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "npryce";
+    repo = "adr-tools";
+    tag = version;
+    hash = "sha256-JEwLn+SY6XcaQ9VhN8ARQaZc1zolgAJKfIqPggzV+sU=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+
+  buildInputs = [
+    # need an interactive interpreter for compgen
+    bashInteractive
+  ];
+
+  checkInputs = [ getopt ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  doCheck = true;
+
+  # patch makefile and shebangs so checks can run
+  patchPhase = ''
+    substituteInPlace Makefile --replace-fail '/bin:/usr/bin' '$${HOST_PATH}'
+    patchShebangs src/
+    patchShebangs approve
+  '';
+
+  checkPhase = ''
+    make check
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin/ $out/libexec
+    cp src/* $out/libexec
+
+    makeWrapper $out/libexec/adr $out/bin/adr --prefix PATH : ${
+      lib.makeBinPath [
+        coreutils
+        findutils
+        gawk
+        getopt
+        gnugrep
+        gnused
+      ]
+    }
+    # avoid having two bash dependencies in output
+    substituteInPlace $out/bin/adr --replace-fail "${lib.getExe bash}" "${lib.getExe bashInteractive}"
+
+    installShellCompletion --bash autocomplete/adr
+  '';
+
+  passthru = {
+    tests.default = runCommand "adr-tools-test" { } ''
+      set -euo pipefail
+      export PATH=$PATH:${
+        lib.makeBinPath [
+          adr-tools
+          gnugrep
+        ]
+      }
+
+      mkdir $out
+      cd $out
+
+      adr init
+      test -e doc/adr/0001-record-architecture-decisions.md
+
+      EDITOR= adr new blah
+      test -e doc/adr/0002-blah.md
+
+      adr generate toc | grep 0002-blah.md
+      adr list | grep 0002-blah.md
+
+      adr link 2 Amends 1 "TESTED AMEND"
+      grep 'TESTED AMEND' doc/adr/0001-record-architecture-decisions.md | grep 0002-blah.md
+    '';
+
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Command-line tools for working with Architecture Decision Records";
+    homepage = "https://github.com/npryce/adr-tools";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ adamcstephens ];
+    mainProgram = "adr";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/ae/aerc/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";
     rev = version;
-    hash = "sha256-YlpR85jB6Il3UW4MTaf8pkilRVjkO0q/D/Yu+OiBX6Y=";
+    hash = "sha256-0ZSmmmj5PpSORL0s0SSNoZGzct9Ps8j0ILAUCpJOOBw=";
   };
 
   proxyVendor = true;

pkgs/by-name/ai/airwin2rack/juce-clap-juce-extensions-src-juce-cmakelists.patch

@@ -0,0 +1,36 @@
+diff --git a/src-juce/CMakeLists.txt b/src-juce/CMakeLists.txt
+index 1f41088..10bdbb4 100644
+--- a/src-juce/CMakeLists.txt
++++ b/src-juce/CMakeLists.txt
+@@ -1,28 +1,8 @@
+ # vi:set sw=2 et:
+ project(airwin-consolidated VERSION ${CMAKE_PROJECT_VERSION})
+ 
+-include ("../cmake/CPM.cmake")
+-
+-
+-if (DEFINED AWCO_ONJUCE7)
+-  set(AWCO_JUCETAG 7.0.12)
+-else()
+-  set(AWCO_JUCETAG 8.0.4)
+-endif()
+-
+-message(STATUS "Getting JUCE TAG ${AWCO_JUCETAG}")
+-CPMAddPackage(
+-        NAME JUCE
+-        GITHUB_REPOSITORY juce-framework/JUCE
+-        GIT_TAG ${AWCO_JUCETAG} # specify the tag to a version of your choice
+-)
+-
+-CPMAddPackage(
+-        NAME clap-juce-extensions
+-        GITHUB_REPOSITORY free-audio/clap-juce-extensions
+-        GIT_TAG main
+-        SUBMODULE_RECURSIVE ON
+-)
++add_subdirectory(juce)
++add_subdirectory(clap-juce-extensions)
+ 
+ if (NOT DEFINED AWCO_ARM64EC)
+   list(APPEND AWCO_FORMATS VST3)
+

pkgs/by-name/ai/airwin2rack/package.nix

@@ -0,0 +1,228 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  makeDesktopItem,
+  copyDesktopItems,
+  srcOnly,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  xorg,
+  freetype,
+  libGLU,
+  libjack2,
+  juce,
+  webkitgtk_4_0,
+  libsysprof-capture,
+  pcre2,
+  util-linux,
+  libselinux,
+  libsepol,
+  libthai,
+  libxkbcommon,
+  libdatrie,
+  libepoxy,
+  libsoup_2_4,
+  lerc,
+  sqlite,
+  glib,
+  gtk3-x11,
+  curl,
+  vcv-rack,
+  jansson,
+  glew,
+  glfw,
+  libarchive,
+  speexdsp,
+  libpulseaudio,
+  libsamplerate,
+  rtmidi,
+  zstd,
+  jq,
+  enableVCVRack ? false,
+}:
+let
+  clapJuceExtensions = fetchFromGitHub {
+    owner = "free-audio";
+    repo = "clap-juce-extensions";
+    rev = "4f33b4930b6af806018c009f0f24b3a50808af99";
+    hash = "sha256-M+T7ll3Ap6VIP5ub+kfEKwT2RW2IxxY4wUPRQKFIotk=";
+    fetchSubmodules = true;
+  };
+
+  vcvRackSdk = srcOnly vcv-rack;
+  pname = "airwin2rack";
+  version = "2.13.0";
+in
+stdenv.mkDerivation {
+  inherit pname;
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "baconpaul";
+    repo = "airwin2rack";
+    tag = "DAWPlugin";
+    hash = "sha256-xjE9M5fMeOOYncq7xe+v++XvfUL6QZc2tF0jnYWSwKQ=";
+    fetchSubmodules = true;
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      type = "Application";
+      name = "Airwin2rack";
+      desktopName = "Airwindows Consolidated";
+      comment = "Various Airwindows Plugins Consolidated (Standalone)";
+      exec = "Airwindows Consolidated";
+      categories = [
+        "Audio"
+        "AudioVideo"
+      ];
+    })
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+      copyDesktopItems
+    ]
+    ++ lib.optionals enableVCVRack [
+      jq
+      zstd
+    ];
+
+  buildInputs =
+    [
+      alsa-lib
+      xorg.libX11
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXext
+      xorg.libXinerama
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      xorg.libXdmcp
+      libGLU
+      libjack2
+      freetype
+      webkitgtk_4_0
+      glib
+      gtk3-x11
+      curl
+      libsysprof-capture
+      pcre2
+      util-linux
+      libselinux
+      libsepol
+      libthai
+      libxkbcommon
+      libdatrie
+      libepoxy
+      libsoup_2_4
+      lerc
+      sqlite
+    ]
+    ++ lib.optionals enableVCVRack [
+      vcv-rack
+      jansson
+      glew
+      glfw
+      libarchive
+      speexdsp
+      libpulseaudio
+      libsamplerate
+      rtmidi
+      zstd
+    ];
+
+  cmakeFlags =
+    [
+      (lib.cmakeBool "BUILD_JUCE_PLUGIN" true)
+      (lib.cmakeBool "USE_JUCE_PROGRAMS" true)
+    ]
+    ++ lib.optionals enableVCVRack [
+      (lib.cmakeBool "BUILD_RACK_PLUGIN" true)
+      (lib.cmakeFeature "RACK_SDK_DIR" "${vcvRackSdk}")
+    ];
+
+  cmakeBuildType = "Release";
+
+  patches = [
+    ./juce-clap-juce-extensions-src-juce-cmakelists.patch
+  ];
+
+  prePatch = ''
+    ln -s ${juce.src} src-juce/juce
+    ln -s ${clapJuceExtensions} src-juce/clap-juce-extensions
+  '';
+
+  preConfigure = lib.optionalString enableVCVRack ''export RACK_DIR=${vcvRackSdk}'';
+
+  buildPhase = ''
+    runHook preBuild
+    cmake --build . --target awcons-products ${lib.optionalString enableVCVRack "build_plugin"} --parallel $NIX_BUILD_CORES
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst3 $out/lib/lv2 $out/lib/clap $out/bin
+
+    cp -r "awcons-products/Airwindows Consolidated.vst3" $out/lib/vst3
+    cp -r "awcons-products/Airwindows Consolidated.lv2" $out/lib/lv2
+    install -Dm644 "awcons-products/Airwindows Consolidated.clap" -t $out/lib/clap
+
+    install -Dm755 "awcons-products/Airwindows Consolidated" $out/bin/Airwindows\ Consolidated
+
+    ${lib.optionalString enableVCVRack ''
+      mkdir ../${pname}
+      strip -s plugin.so
+      mv plugin.so ../${pname}
+      cd ..
+      mv LICENSE.md ${pname}
+      mv README.md ${pname}
+      mv plugin.json ${pname}
+      mv res ${pname}
+      tar -c ${pname} | zstd -19 -o "${pname}-${version}-lin-x64.vcvplugin"
+      # got the directory from arch wiki
+      install -Dm755 "${pname}-${version}-lin-x64.vcvplugin" $out/usr/lib/vcvrack/plugins
+    ''}
+
+    runHook postInstall
+  '';
+
+  NIX_LDFLAGS = (
+    toString [
+      "-lX11"
+      "-lXext"
+      "-lXcomposite"
+      "-lXcursor"
+      "-lXinerama"
+      "-lXrandr"
+      "-lXrender"
+      "-lXtst"
+      "-lXdmcp"
+    ]
+  );
+
+  meta = {
+    description = "JUCE Plugin Version of Airwindows Consolidated";
+    homepage = "https://airwindows.com/";
+    platforms = [ "x86_64-linux" ];
+    license =
+      with lib.licenses;
+      [ mit ]
+      ++ lib.optional enableVCVRack [
+        gpl3Plus
+        cc-by-nc-40
+        unfreeRedistributable
+      ];
+    mainProgram = "Airwindows Consolidated";
+    maintainers = [ lib.maintainers.l1npengtul ];
+  };
+}

pkgs/by-name/ai/airwindows/cmakelists-and-helper.patch

@@ -0,0 +1,31 @@
+diff --git a/plugins/LinuxVST/CMakeLists.txt b/plugins/LinuxVST/CMakeLists.txt
+index f43ea128..b87a5c03 100755
+--- a/plugins/LinuxVST/CMakeLists.txt
++++ b/plugins/LinuxVST/CMakeLists.txt
+@@ -2,11 +2,24 @@ cmake_minimum_required(VERSION 3.9)
+ project(airwindows_ports)
+ 
+ set(CMAKE_CXX_STANDARD 14)
+-add_compile_options(-O2 -D__cdecl=)
++add_compile_options(-D__cdecl=)
++
++set(VST2_SDK_PATH "${PROJECT_SOURCE_DIR}/include/vstsdk" CACHE STRING "VST2 SDK Path")
++
++set(VSTSDK_ROOT
++    "${VST2_SDK_PATH}"
++    "${VST2_SDK_PATH}/pluginterfaces/vst2.x/"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/"
++)
++
++set(VSTSDK_SOURCES
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/audioeffectx.cpp"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/audioeffect.cpp"
++    "${VST2_SDK_PATH}/public.sdk/source/vst2.x/vstplugmain.cpp"
++)
+ 
+ include(Helpers.cmake)
+ 
+-add_subdirectory(include/vstsdk)
+ add_airwindows_plugin(Acceleration)
+ add_airwindows_plugin(Acceleration2)
+ add_airwindows_plugin(ADClip7)

pkgs/by-name/ai/airwindows/package.nix

@@ -0,0 +1,69 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  fetchzip,
+  lib,
+  cmake,
+  nix-update-script,
+  vst2-sdk,
+}:
+stdenv.mkDerivation {
+  pname = "airwindows";
+  version = "0-unstable-2025-01-06";
+
+  src = fetchFromGitHub {
+    owner = "airwindows";
+    repo = "airwindows";
+    rev = "0ca33035253b9fc0c6c876592d9e5ff3a654cd10";
+    hash = "sha256-+AyB6y179BRWTvflA9Ld5utpF2scSJDszkGa8BCvPdM=";
+  };
+
+  # we patch helpers because honestly im spooked out by where those variables
+  # came from.
+  prePatch = ''
+    mkdir -p plugins/LinuxVST/include
+    ln -s ${vst2-sdk} plugins/LinuxVST/include/vstsdk
+  '';
+
+  patches = [
+    ./cmakelists-and-helper.patch
+  ];
+
+  # we are building for linux, so we go to linux
+  preConfigure = ''
+    cd plugins/LinuxVST
+  '';
+
+  cmakeBuildType = "Release";
+
+  cmakeFlags = [ ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    vst2-sdk
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/vst/airwindows
+    find "$PWD" -type f -name "*.so" -exec install -Dm755 {} $out/lib/vst/airwindows \;
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "All Airwindows VST Plugins";
+    homepage = "https://airwindows.com/";
+    platforms = lib.platforms.linux;
+    license = [
+      lib.licenses.mit
+    ];
+    maintainers = [ lib.maintainers.l1npengtul ];
+  };
+}

pkgs/by-name/al/alacritty-theme/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   pname = "alacritty-theme";
-  version = "0-unstable-2025-01-03";
+  version = "0-unstable-2025-01-21";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "aff9d111d43e1ad5c22d4e27fc1c98176e849fb9";
-    hash = "sha256-GxCdyBihypHKkPlCVGiTAD4dP3ggkSyQSNS5AKUhSVo=";
+    rev = "69d07c3bc280add63906a1cebf6be326687bc9eb";
+    hash = "sha256-G8sUu8GD44uqUyQ7sZrgrGxC4IOfhSn++WIc+U67zL0=";
     sparseCheckout = [ "themes" ];
   };
 

pkgs/by-name/al/alpaca-proxy/package.nix

@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "alpaca-proxy";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchFromGitHub {
     owner = "samuong";
     repo = "alpaca";
     rev = "v${version}";
-    hash = "sha256-Rf8//4FeruVZZ//uba80z20XGUxycwF91Aa09fosRXI=";
+    hash = "sha256-1CMuZl1bVlofogPwA2wRuQPlXNE2EM1B8rDDDaJGq64=";
   };
 
-  vendorHash = "sha256-JEiHgyPJvWmtPf8R4aX/qlevfZRdKajre324UsgRm5Y=";
+  vendorHash = "sha256-N9qpyCQg6H1v/JGJ2wCxDX+ZTM9x6/BM6wQ26xC+dlE=";
 
   ldflags = [
     "-s"

pkgs/by-name/ar/armadillo/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "14.2.1";
+  version = "14.2.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-JJWBXPnRMPcP/7ahJzPQ3K+Gy6rFHotLgq0lGD7aHdU=";
+    hash = "sha256-MFTI5j2zq98aXI+f235rStgz+bz7WDJMD/ht4HhMcOA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/au/audiobookshelf/source.json

@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "de8b0abc3af740148bddde462fe809f03159d678",
-  "hash": "sha256-lLCG6xw1qWbIOxHbD8ONH7iYzayJ8OhMy+WgaXExcFQ=",
-  "version": "2.17.7",
-  "depsHash": "sha256-1uDCbgZNmx8e+LrsOHTfM29SZhS1TLDHmTg48XMbwkg=",
-  "clientDepsHash": "sha256-cDT45OtLbFDF0TXO4zVVj9+UOJhkb9TjCajtSWq4H8U="
+  "rev": "66b90e0841f2b08a4a401fad202605c8fbaf3c48",
+  "hash": "sha256-SAce3URkZxPa5URyaO7G9xty4JCG0/tJym5fXLnwv74=",
+  "version": "2.18.1",
+  "depsHash": "sha256-1d3V8MzIaJdYpY5BdoAX96HTGfjBBNz/JLkG7jl0TRY=",
+  "clientDepsHash": "sha256-hClfu993JpHWOqPMgmKdMIneAFDYAi6pCPlf8GmXzow="
 }

pkgs/by-name/aw/awscli2/package.nix

@@ -62,14 +62,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.23.2"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.23.5"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-1cMZJFhty0YF27EndWc/yVLK1RVA8oI+tkyjePJ0wKI=";
+    hash = "sha256-uDKiTw1UCcbfitoJzSPzVT1qM4Gm4bQaryRz7VTeEzg=";
   };
 
   postPatch = ''

pkgs/by-name/ay/ayugram-desktop/package.nix

@@ -53,7 +53,7 @@ telegram-desktop.override {
         '';
         homepage = "https://github.com/AyuGram/AyuGramDesktop";
         changelog = "https://github.com/AyuGram/AyuGramDesktop/releases/tag/v${finalAttrs.version}";
-        maintainers = with lib.maintainers; [ aucub ];
+        maintainers = with lib.maintainers; [ ];
       };
     }
   );

pkgs/by-name/ba/bazecor/package.nix

@@ -6,12 +6,12 @@
 }:
 let
   pname = "bazecor";
-  version = "1.6.1";
+  version = "1.6.2";
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-Qf9FqHgTSCD2rYp8PC/gYHyiYcfFTJJmG4oRK/bch8Y=";
+      hash = "sha256-FfowCbnhGI0sglFvxf7ActUJC9Lsj97Ui08nObBnjoE=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370

pkgs/by-name/be/bespokesynth/package.nix

@@ -23,6 +23,7 @@
   libXScrnSaver,
   libGL,
   libxcb,
+  vst2-sdk,
   xcbutil,
   libxkbcommon,
   xcbutilkeysyms,
@@ -40,20 +41,6 @@
   enableVST2 ? false,
 }:
 
-let
-  # equal to vst-sdk in ../oxefmsynth/default.nix
-  vst-sdk = stdenv.mkDerivation rec {
-    name = "vstsdk3610_11_06_2018_build_37";
-    src = fetchzip {
-      url = "https://web.archive.org/web/20181016150224if_/https://download.steinberg.net/sdk_downloads/${name}.zip";
-      sha256 = "0da16iwac590wphz2sm5afrfj42jrsnkr1bxcy93lj7a369ildkj";
-    };
-    installPhase = ''
-      cp -r . $out
-    '';
-  };
-
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bespokesynth";
   version = "1.3.0";
@@ -88,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "BESPOKE_SYSTEM_JSONCPP" true)
     ]
     ++ lib.optionals enableVST2 [
-      (lib.cmakeFeature "BESPOKE_VST2_SDK_LOCATION" "${vst-sdk}/VST2_SDK")
+      (lib.cmakeFeature "BESPOKE_VST2_SDK_LOCATION" "${vst2-sdk}")
     ];
 
   strictDeps = true;
@@ -185,12 +172,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Software modular synth with controllers support, scripting and VST";
     homepage = "https://www.bespokesynth.com/";
-    license =
-      with lib.licenses;
-      [
-        gpl3Plus
-      ]
-      ++ lib.optional enableVST2 unfree;
+    license = [ lib.licenses.gpl3Plus ];
     maintainers = with lib.maintainers; [
       astro
       tobiasBora

pkgs/by-name/be/betterdisplay/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "betterdisplay";
-  version = "3.3.0";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "https://github.com/waydabber/BetterDisplay/releases/download/v${finalAttrs.version}/BetterDisplay-v${finalAttrs.version}.dmg";
-    hash = "sha256-A0kh3XNdl5kJ32Kxwb0PAgxfGJR+EZEoaP+gspRJEcU=";
+    hash = "sha256-4hS+F9cPgQ6HEzX7RkikANyJqc2bMAhKCYlL1lmka54=";
   };
 
   dontPatch = true;

pkgs/by-name/bi/bitcomet/package.nix

@@ -38,6 +38,6 @@ appimageTools.wrapType2 {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [ aucub ];
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.25.0";
+  version = "2.26.1";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = version;
-    hash = "sha256-ejAwUHBx+HwYEQxT+lrXxoiD6hkIIRhBPTPBlqugOrM=";
+    hash = "sha256-gL9YvddHIU+ZHC5/4NH7xsBLM+p9f5Uc6JzxUAIAVSo=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access