Merge 635f366cf9 into haskell-updates

maintainers/maintainer-list.nix

@@ -3444,12 +3444,6 @@
     githubId = 20448408;
     keys = [ { fingerprint = "D446 E58D 87A0 31C7 EC15  88D7 B461 2924 45C6 E696"; } ];
   };
-  berce = {
-    email = "bert.moens@gmail.com";
-    github = "berce";
-    githubId = 10439709;
-    name = "Bert Moens";
-  };
   bergey = {
     email = "bergey@teallabs.org";
     github = "bergey";
@@ -4445,12 +4439,6 @@
     githubId = 54632731;
     name = "Cameron Dugan";
   };
-  cameronfyfe = {
-    email = "cameron.j.fyfe@gmail.com";
-    github = "cameronfyfe";
-    githubId = 21013281;
-    name = "Cameron Fyfe";
-  };
   cameronnemo = {
     email = "cnemo@tutanota.com";
     github = "CameronNemo";
@@ -18478,13 +18466,6 @@
     github = "mohe2015";
     githubId = 13287984;
   };
-  momeemt = {
-    name = "Mutsuha Asada";
-    email = "me@momee.mt";
-    github = "momeemt";
-    githubId = 43488453;
-    keys = [ { fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6"; } ];
-  };
   monaaraj = {
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
@@ -19376,6 +19357,12 @@
     githubId = 137805;
     name = "Alexander Tsvyashchenko";
   };
+  ndom91 = {
+    email = "nix@ndo.dev";
+    github = "ndom91";
+    githubId = 7415984;
+    name = "Nico Domino";
+  };
   nealfennimore = {
     email = "hi@neal.codes";
     github = "nealfennimore";
@@ -28962,6 +28949,14 @@
     githubId = 110242808;
     name = "Vasilii Pustovoit";
   };
+  vavakado = {
+    email = "xor@vavakado.xyz";
+    github = "vavakado";
+    githubId = 80159210;
+    name = "Vladimir Rubin";
+    matrix = "@vavakado:imagisphe.re";
+    keys = [ { fingerprint = "A054 0374 CD37 2C71 FE6D  E0CF CAB7 4472 7F36 B524"; } ];
+  };
   vbgl = {
     email = "Vincent.Laporte@gmail.com";
     github = "vbgl";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -30,6 +30,8 @@
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.

nixos/modules/config/fonts/fontconfig.nix

@@ -127,6 +127,38 @@ let
       </fontconfig>
     '';
 
+  # user defined font aliases
+  # priority 53
+  aliases =
+    let
+      mkFontBlock =
+        key: fonts:
+        lib.optionalString ((builtins.length fonts) > 0) ''
+          <${key}>
+          ${lib.concatMapStrings (font: "<family>${font}</family>") fonts}
+          </${key}>
+        '';
+
+      mkAliasBlock = family: opts: ''
+        <alias binding="${opts.binding}">
+          <family>${family}</family>
+          ${mkFontBlock "prefer" opts.prefer}
+          ${mkFontBlock "accept" opts.accept}
+          ${mkFontBlock "default" opts.default}
+        </alias>
+      '';
+    in
+    pkgs.writeText "fc-53-user-aliases.conf" ''
+      <?xml version='1.0'?>
+      <!DOCTYPE fontconfig SYSTEM 'urn:fontconfig:fonts.dtd'>
+      <fontconfig>
+
+        <!-- User defined aliases -->
+        ${lib.concatStrings (lib.mapAttrsToList mkAliasBlock cfg.aliases)}
+
+      </fontconfig>
+    '';
+
   # bitmap font options
   # priority 53
   rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
@@ -245,6 +277,9 @@ let
         # 53-no-bitmaps.conf
         ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf
 
+        # 53-user-aliases.conf
+        ln -s ${aliases} $dst/53-user-aliases.conf
+
         ${lib.optionalString (!cfg.allowType1) ''
           # 53-nixos-reject-type1.conf
           ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf
@@ -522,6 +557,69 @@ in
           description = "Use embedded bitmaps in fonts like Calibri.";
         };
 
+        aliases = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.submodule {
+              options = {
+                binding = lib.mkOption {
+                  type = lib.types.enum [
+                    "same"
+                    "weak"
+                    "strong"
+                  ];
+                  default = "same";
+                  description = ''
+                    Binding precedence for this font family. See
+                    fontconfig "Font Matching" section for details.
+                  '';
+                };
+
+                prefer = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts whose glyphs are chosen preferentially prior
+                    to fonts which match the alias family.
+                  '';
+                };
+
+                accept = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Fonts that are chosen if none of the preferred
+                    fonts, nor the alias family could provide the
+                    desired glyph.
+                  '';
+                };
+
+                default = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [ ];
+                  description = ''
+                    Last chance fallback fonts which are chosen by
+                    default if none of the other options could
+                    provide the desired glyph.
+                  '';
+                };
+              };
+            }
+          );
+          default = { };
+          example = lib.literalExpression ''
+            {
+                # use FreeSans for Greek symbols missing in Helvetica
+                "Helvetica" = {
+                    default = [ "FreeSans" ];
+                };
+            };
+          '';
+          description = ''
+            Font aliases that can substitute preferential fonts,
+            or specify custom fallback fonts.
+          '';
+        };
+
       };
 
     };
@@ -557,6 +655,9 @@ in
         # 52-nixos-default-fonts.conf
         r ${defaultFontsConf},
 
+        # 53-user-aliases.conf
+        r ${aliases},
+
         # 53-no-bitmaps.conf
         r ${rejectBitmaps},
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix

@@ -11,6 +11,9 @@ in
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
+  # required for calamares
+  security.polkit.enablePkexecWrapper = true;
+
   # required for kpmcore to work correctly
   programs.partition-manager.enable = true;
 

nixos/modules/installer/cd-dvd/sd-image-aarch64-new-kernel.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-aarch64-new-kernel-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-aarch64-new-kernel.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-aarch64-new-kernel-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-aarch64.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-aarch64-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-aarch64.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-aarch64-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-armv7l-multiplatform-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-armv7l-multiplatform.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-armv7l-multiplatform-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image-raspberrypi.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image-raspberrypi-installer.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image-raspberrypi.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image-raspberrypi-installer.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/cd-dvd/sd-image.nix

@@ -1,14 +0,0 @@
-{ config, ... }:
-{
-  imports = [
-    ../sd-card/sd-image.nix
-  ];
-  config = {
-    warnings = [
-      ''
-        .../cd-dvd/sd-image.nix is deprecated and will eventually be removed.
-        Please switch to .../sd-card/sd-image.nix, instead.
-      ''
-    ];
-  };
-}

nixos/modules/installer/tools/tools.nix

@@ -330,7 +330,7 @@ in
           '';
 
           config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
-            security.polkit.enable = lib.mkDefault true;
+            security.run0.enable = lib.mkDefault true;
             environment.systemPackages = [ pkgs.polkit-stdin-agent ];
           };
         }

nixos/modules/programs/gamemode.nix

@@ -60,7 +60,10 @@ in
     };
 
     security = {
-      polkit.enable = true;
+      polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       wrappers = lib.mkIf cfg.enableRenice {
         gamemoded = {
           owner = "root";

nixos/modules/programs/throne.nix

@@ -64,32 +64,36 @@ in
     # 3. Put ThroneCore into a systemd service, and let polkit check service name.
     #    This is the most secure and convenient way but requires heavy modification
     #    to Throne source code. Would be good to let upstream support that eventually.
-    security.polkit.extraConfig =
-      lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
-        ''
-          polkit.addRule(function(action, subject) {
-            const allowedActionIds = [
-              "org.freedesktop.resolve1.revert",
-              "org.freedesktop.resolve1.set-domains",
-              "org.freedesktop.resolve1.set-default-route",
-              "org.freedesktop.resolve1.set-dns-servers"
-            ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+      extraConfig =
+        lib.mkIf (cfg.tunMode.enable && (!cfg.tunMode.setuid) && config.services.resolved.enable)
+          ''
+            polkit.addRule(function(action, subject) {
+              const allowedActionIds = [
+                "org.freedesktop.resolve1.revert",
+                "org.freedesktop.resolve1.set-domains",
+                "org.freedesktop.resolve1.set-default-route",
+                "org.freedesktop.resolve1.set-dns-servers"
+              ];
 
-            if (allowedActionIds.indexOf(action.id) !== -1) {
-              try {
-                var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
-                var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
-                if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
-                  return polkit.Result.YES;
-                } else {
+              if (allowedActionIds.indexOf(action.id) !== -1) {
+                try {
+                  var parentPid = polkit.spawn(["${lib.getExe' pkgs.procps "ps"}", "-o", "ppid=", subject.pid]).trim();
+                  var parentCap = polkit.spawn(["${lib.getExe' pkgs.libcap "getpcaps"}", parentPid]).trim();
+                  if (parentCap.includes("cap_net_admin") && parentCap.includes("cap_net_raw")) {
+                    return polkit.Result.YES;
+                  } else {
+                    return polkit.Result.NOT_HANDLED;
+                  }
+                } catch (e) {
                   return polkit.Result.NOT_HANDLED;
                 }
-              } catch (e) {
-                return polkit.Result.NOT_HANDLED;
               }
-            }
-          })
-        '';
+            })
+          '';
+    };
   };
 
   meta.maintainers = with lib.maintainers; [ aleksana ];

nixos/modules/security/polkit.nix

@@ -6,27 +6,52 @@
 }:
 let
 
-  cfg = config.security.polkit;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkIf
+    mkPackageOption
+    mkRemovedOptionModule
+    types
+    ;
 
+  cfg = config.security.polkit;
 in
 
 {
+  imports = [
+    (mkRemovedOptionModule [ "security" "polkit" "debug" ] "Use security.polkit.extraArgs instead")
+  ];
 
-  options = {
+  options.security.polkit = {
+    enable = mkEnableOption "polkit";
 
-    security.polkit.enable = lib.mkEnableOption "polkit";
+    enablePkexecWrapper = mkEnableOption "the setuid pkexec wrapper";
 
-    security.polkit.package = lib.mkPackageOption pkgs "polkit" { };
+    package = mkPackageOption pkgs "polkit" { };
 
-    security.polkit.debug = lib.mkEnableOption "debug logs from polkit. This is required in order to see log messages from rule definitions";
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "--no-debug"
+        "--log-level=notice"
+      ];
+      description = ''
+        List of arguments to pass to the polkitd executable.
 
-    security.polkit.extraConfig = lib.mkOption {
-      type = lib.types.lines;
+        ::: {.note}
+        To see debug logs you need to negate the default `--no-debug` setting.
+        :::
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
       default = "";
       example = ''
         /* Log authorization checks. */
         polkit.addRule(function(action, subject) {
-          // Make sure to set { security.polkit.debug = true; } in configuration.nix
+          // Make sure to negate --no-debug in services.polkit.extraArgs: { security.polkit.extraArgs = [ "--log-level=notice" ]; }
           polkit.log("user " +  subject.user + " is attempting action " + action.id + " from PID " + subject.pid);
         });
 
@@ -41,8 +66,8 @@ in
       '';
     };
 
-    security.polkit.adminIdentities = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
+    adminIdentities = mkOption {
+      type = with types; listOf str;
       default = [ "unix-group:wheel" ];
       example = [
         "unix-user:alice"
@@ -58,25 +83,34 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
 
     environment.systemPackages = [
       cfg.package.bin
       cfg.package.out
     ];
 
+    services.dbus.packages = [ cfg.package.out ];
+
     systemd.packages = [ cfg.package.out ];
 
-    systemd.services.polkit.serviceConfig.ExecStart = [
-      ""
-      "${cfg.package.out}/lib/polkit-1/polkitd ${lib.optionalString (!cfg.debug) "--no-debug"}"
-    ];
-
-    systemd.services.polkit.restartTriggers = [ config.system.path ];
-    systemd.services.polkit.reloadTriggers = [
-      config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
-    ];
-    systemd.services.polkit.stopIfChanged = false;
+    systemd.services.polkit = {
+      restartTriggers = [ config.system.path ];
+      reloadTriggers = [
+        config.environment.etc."polkit-1/rules.d/10-nixos.rules".source
+      ];
+      serviceConfig.ExecStart = [
+        # nuke default ExecStart
+        ""
+        # provide our own instead
+        (toString (
+          [
+            "${lib.getLib cfg.package}/lib/polkit-1/polkitd"
+          ]
+          ++ cfg.extraArgs
+        ))
+      ];
+    };
 
     systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
 
@@ -89,7 +123,7 @@ in
       # The upstream unit uses PrivateDevices=yes and ProtectHome=yes,
       # which prevents PAM modules from accessing hardware (e.g. FIDO
       # tokens via /dev/hidraw*) or reading key files from home directories.
-      (lib.mkIf config.security.pam.u2f.enable {
+      (mkIf config.security.pam.u2f.enable {
         # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
         PrivateDevices = false;
         DeviceAllow = [
@@ -100,7 +134,7 @@ in
         # ~/.config/Yubico/u2f_keys (the default key file location)
         ProtectHome = "read-only";
       })
-      (lib.mkIf config.security.pam.zfs.enable {
+      (mkIf config.security.pam.zfs.enable {
         PrivateDevices = false;
         DeviceAllow = [
           "/dev/zfs rw"
@@ -120,23 +154,16 @@ in
       ${cfg.extraConfig}
     ''; # TODO: validation on compilation (at least against typos)
 
-    services.dbus.packages = [ cfg.package.out ];
-
     security.pam.services.polkit-1 = { };
 
     security.wrappers.pkexec = {
+      enable = cfg.enablePkexecWrapper;
       setuid = true;
       owner = "root";
       group = "root";
-      source = "${cfg.package.bin}/bin/pkexec";
+      source = lib.getExe' cfg.package "pkexec";
     };
 
-    systemd.tmpfiles.rules = [
-      # Probably no more needed, clean up
-      "R /var/lib/polkit-1"
-      "R /var/lib/PolicyKit"
-    ];
-
     users.users.polkituser = {
       description = "PolKit daemon";
       uid = config.ids.uids.polkituser;

nixos/modules/security/run0.nix

@@ -6,6 +6,13 @@
 }:
 
 let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    ;
+
   cfg = config.security.run0;
 
   sudoAlias = pkgs.writeShellScriptBin "sudo" ''
@@ -18,7 +25,9 @@ let
 in
 {
   options.security.run0 = {
-    wheelNeedsPassword = lib.mkOption {
+    enable = mkEnableOption "support for run0";
+
+    wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
       description = ''
@@ -27,26 +36,45 @@ in
       '';
     };
 
-    enableSudoAlias = lib.mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+    enableSudoAlias = mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
   };
 
-  config = {
-    assertions = [
-      {
-        assertion =
-          cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
-        message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
-      }
-    ];
-
-    security.polkit.extraConfig = lib.mkIf (!cfg.wheelNeedsPassword) ''
-      polkit.addRule(function(action, subject) {
-        if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-          return polkit.Result.YES;
+  config = mkMerge [
+    {
+      # Late introduction of the enable toggle, this should help during migration.
+      # TODO: Remove after 26.11 release
+      assertions = [
+        {
+          assertion = !cfg.wheelNeedsPassword -> cfg.enable;
+          message = "`security.run0.enable` is currently disabled, but is required for the `security.run0.wheelNeedsPassword` option to take effect";
         }
-      });
-    '';
+        {
+          assertion = cfg.enableSudoAlias -> cfg.enable;
+          message = "`security.run0.enableSudoAlias` depends on `security.run0.enable`, which is disabled.";
+        }
+      ];
+    }
+    (mkIf cfg.enable {
+      assertions = [
+        {
+          assertion =
+            cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
+          message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
+        }
+      ];
 
-    environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
-  };
+      security.polkit = {
+        enable = true;
+        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
+          polkit.addRule(function(action, subject) {
+            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+              return polkit.Result.YES;
+            }
+          });
+        '';
+      };
+
+      environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
+    })
+  ];
 }

nixos/modules/services/audio/music-assistant.nix

@@ -83,7 +83,18 @@ in
         lib.optional cfg.enable 8097 # Music Assistant stream port
         ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
         ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927
-        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780;
+        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780
+        ++ lib.optionals (lib.elem "squeezelite" cfg.providers) [
+          # https://lyrion.org/reference/slimproto-protocol/
+          3483 # Slimproto control
+          # https://lyrion.org/reference/cli/using-the-cli/
+          9000 # Slimproto JSON-RPC
+          9090 # Slimproto CLI
+        ];
+      allowedUDPPorts = lib.optionals (lib.elem "squeezelite" cfg.providers) [
+        # https://lyrion.org/reference/slimproto-protocol/
+        3483 # Slimproto discovery
+      ];
       # The information published by Apple 1 seem to not apply to libraop.
       # The closest we could find that represents the port range being used as observed by tcpdump is the ephemeral port range.
       # 1: https://support.apple.com/en-us/103229#:~:text=49152%E2%80%93-,65535,-TCP%2C%20UDP

nixos/modules/services/desktop-managers/budgie.nix

@@ -243,6 +243,8 @@ in
 
     # Required by Budgie's Polkit Dialog.
     security.polkit.enable = mkDefault true;
+    # Required by Budige's Control Center and Desktop
+    security.polkit.enablePkexecWrapper = mkDefault true;
 
     # Required by Budgie Panel plugins and/or Budgie Control Center panels.
     networking.networkmanager.enable = mkDefault true; # for BCC's Network panel.

nixos/modules/services/desktop-managers/cosmic.nix

@@ -146,7 +146,10 @@ in
     environment.sessionVariables.X11_EXTRA_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.extras.xml";
     programs.dconf.enable = true;
     programs.dconf.packages = [ pkgs.cosmic-session ];
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     security.rtkit.enable = true;
     services.accounts-daemon.enable = true;
     services.displayManager.sessionPackages = [ pkgs.cosmic-session ];

nixos/modules/services/desktop-managers/gnome.nix

@@ -325,7 +325,11 @@ in
       i18n.inputMethod.enable = mkDefault true;
       i18n.inputMethod.type = mkDefault "ibus";
       programs.dconf.enable = true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        # Required by gnome-initial-setup, gnome-system-monitor, gvfs for admin://
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       security.rtkit.enable = mkDefault true;
       services.accounts-daemon.enable = true;
       services.dleyna.enable = mkDefault true;

nixos/modules/services/desktops/gnome/gnome-remote-desktop.nix

@@ -22,6 +22,10 @@
   config = lib.mkIf config.services.gnome.gnome-remote-desktop.enable {
     services.pipewire.enable = true;
     services.dbus.packages = [ pkgs.gnome-remote-desktop ];
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     environment.systemPackages = [ pkgs.gnome-remote-desktop ];
 

nixos/modules/services/hardware/tuned.nix

@@ -246,7 +246,10 @@ in
       systemPackages = [ cfg.package ];
     };
 
-    security.polkit.enable = lib.mkDefault true;
+    security.polkit = {
+      enable = lib.mkDefault true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
 
     services = {
       dbus.packages = [ cfg.package ];

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -114,7 +114,6 @@ let
         "restic"
         "rtl_433"
         "sabnzbd"
-        "scaphandre"
         "script"
         "shelly"
         "smartctl"
@@ -521,26 +520,6 @@ in
                 'services.prometheus.exporters.sql.configFile'
             '';
           }
-          {
-            assertion = cfg.scaphandre.enable -> (pkgs.stdenv.targetPlatform.isx86_64 == true);
-            message = ''
-              Scaphandre only support x86_64 architectures.
-            '';
-          }
-          {
-            assertion =
-              cfg.scaphandre.enable
-              -> ((lib.kernel.whenHelpers pkgs.linux.version).whenOlder "5.11" true).condition == false;
-            message = ''
-              Scaphandre requires a kernel version newer than '5.11', '${pkgs.linux.version}' given.
-            '';
-          }
-          {
-            assertion = cfg.scaphandre.enable -> (builtins.elem "intel_rapl_common" config.boot.kernelModules);
-            message = ''
-              Scaphandre needs 'intel_rapl_common' kernel module to be enabled. Please add it in 'boot.kernelModules'.
-            '';
-          }
           {
             assertion =
               cfg.idrac.enable -> ((cfg.idrac.configurationPath == null) != (cfg.idrac.configuration == null));

nixos/modules/services/monitoring/prometheus/exporters/scaphandre.nix

@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  options,
-  ...
-}:
-
-let
-  logPrefix = "services.prometheus.exporter.scaphandre";
-  cfg = config.services.prometheus.exporters.scaphandre;
-in
-{
-  port = 8080;
-  extraOpts = {
-    telemetryPath = lib.mkOption {
-      type = lib.types.str;
-      default = "/metrics";
-      description = ''
-        Path under which to expose metrics.
-      '';
-    };
-  };
-
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.scaphandre}/bin/scaphandre prometheus \
-          --address ${cfg.listenAddress} \
-          --port ${toString cfg.port} \
-          --suffix ${cfg.telemetryPath} \
-          ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}

nixos/modules/services/networking/xrdp.nix

@@ -19,7 +19,7 @@ let
     cat > $out/startwm.sh <<EOF
     #!/bin/sh
     . /etc/profile
-    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init"}
+    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init"}
     ${cfg.defaultWindowManager}
     EOF
     chmod +x $out/startwm.sh

nixos/modules/services/scheduling/scx-loader.nix

@@ -75,7 +75,11 @@ in
       }
     ];
 
-    environment.systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+    environment = {
+      systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+      etc."scx_loader.toml".source = configFile;
+    };
+
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
 
@@ -84,10 +88,6 @@ in
     systemd.services.scx_loader = {
       path = cfg.schedsPackages;
       wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        TemporaryFileSystem = [ "/etc" ];
-        BindReadOnlyPaths = [ "${configFile.outPath}:/etc/scx_loader.toml" ];
-      };
     };
   };
 

nixos/modules/services/web-apps/plausible.nix

@@ -330,9 +330,6 @@ in
     ];
   };
 
-  meta.maintainers = with lib.maintainers; [
-    e1mo
-    xanderio
-  ];
+  meta.maintainers = [ ];
   meta.doc = ./plausible.md;
 }

nixos/modules/services/web-apps/pretalx.nix

@@ -27,6 +27,28 @@ let
         cfg.settings.database.backend == "postgresql"
       ) finalPackage.optional-dependencies.postgres;
   };
+
+  pretalxManageWrapper = pkgs.writeShellApplication {
+    name = "pretalx-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.filesystem.data}
+      set -a
+      ${lib.concatMapStringsSep "\n" (file: ''
+        . ${lib.escapeShellArg file}
+      '') cfg.environmentFiles}
+      set +a
+      export PRETALX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          preserve-environment = true;
+        }
+      } -- ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+    '';
+  };
 in
 
 {
@@ -325,18 +347,7 @@ in
     # https://docs.pretalx.org/administrator/installation/
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretalx-manage" ''
-        cd ${cfg.settings.filesystem.data}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
-        fi
-        set -a
-        ${lib.concatMapStringsSep "\n" (file: ". ${lib.escapeShellArg file}") cfg.environmentFiles}
-        set +a
-        export PRETALX_CONFIG_FILE=${configFile}
-        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
-      '')
+      pretalxManageWrapper
     ];
 
     services.logrotate.settings.pretalx = {

nixos/modules/services/web-apps/pretix.nix

@@ -24,7 +24,6 @@ let
     mkOption
     mkPackageOption
     optionals
-    optionalString
     recursiveUpdate
     types
     ;
@@ -60,6 +59,24 @@ let
   };
 
   withRedis = cfg.settings.redis.location != null;
+
+  pretixManageWrapper = pkgs.writeShellApplication {
+    name = "pretix-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.pretix.datadir}
+      export PRETIX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          supp-group = if withRedis then config.services.redis.servers.pretix.group else null;
+          whitelist-environment = "PRETIX_CONFIG_FILE";
+        }
+      } -- ${getExe' pythonEnv "pretix-manage"} "$@"
+    '';
+  };
 in
 {
   meta = {
@@ -396,15 +413,7 @@ in
     # https://docs.pretix.eu/en/latest/admin/installation/index.html
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretix-manage" ''
-        cd ${cfg.settings.pretix.datadir}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} ${optionalString withRedis "-g redis-pretix"} --preserve-env=PRETIX_CONFIG_FILE'
-        fi
-        export PRETIX_CONFIG_FILE=${configFile}
-        $sudo ${getExe' pythonEnv "pretix-manage"} "$@"
-      '')
+      pretixManageWrapper
     ];
 
     services.logrotate.settings.pretix = {

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -111,7 +111,10 @@ in
       services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       services.hardware.bolt.enable = mkDefault (notExcluded pkgs.bolt);
       hardware.bluetooth.enable = mkDefault true;
-      security.polkit.enable = true;
+      security.polkit = {
+        enable = true;
+        enablePkexecWrapper = lib.mkDefault true;
+      };
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
       services.dbus.packages = with pkgs; [

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -220,7 +220,10 @@ in
 
     # Enable helpful DBus services.
     services.udisks2.enable = true;
-    security.polkit.enable = true;
+    security.polkit = {
+      enable = true;
+      enablePkexecWrapper = lib.mkDefault true;
+    };
     services.accounts-daemon.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.gnome.glib-networking.enable = true;

nixos/tests/all-tests.nix

@@ -1491,7 +1491,6 @@ in
   sanoid = runTest ./sanoid.nix;
   saunafs = runTest ./saunafs.nix;
   scanservjs = runTest ./scanservjs.nix;
-  scaphandre = runTest ./scaphandre.nix;
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
@@ -1701,6 +1700,7 @@ in
   tiddlywiki = runTest ./tiddlywiki.nix;
   tigervnc = handleTest ./tigervnc.nix { };
   tika = runTest ./tika.nix;
+  timekpr = runTest ./timekpr.nix;
   timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };

nixos/tests/kea.nix

@@ -6,7 +6,6 @@
 # address.
 
 {
-  pkgs,
   lib,
   ...
 }:
@@ -15,7 +14,7 @@
 
   name = "kea";
 
-  nodes = {
+  containers = {
     router =
       { config, pkgs, ... }:
       {
@@ -26,6 +25,7 @@
           firewall.allowedUDPPorts = [ 67 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -141,6 +141,7 @@
           firewall.allowedUDPPorts = [ 53 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -153,8 +154,6 @@
           };
         };
 
-        services.resolved.enable = false;
-
         # Set up an authoritative nameserver, serving the `lan.nixos.test`
         # zone and configure an ACL that allows dynamic updates from
         # the router's ip address.
@@ -213,6 +212,7 @@
       {
         virtualisation.vlans = [ 1 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;
@@ -222,16 +222,23 @@
       };
   };
   testScript =
-    { ... }:
+    # python
     ''
       start_all()
+
       router.wait_for_unit("kea-dhcp4-server.service")
-      client.systemctl("start systemd-networkd-wait-online.service")
-      client.wait_for_unit("systemd-networkd-wait-online.service")
-      client.wait_until_succeeds("ping -c 5 10.0.0.1")
-      router.wait_until_succeeds("ping -c 5 10.0.0.3")
-      nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
-      router.log(router.execute("curl 127.0.0.1:9547")[1])
-      router.succeed("curl --no-buffer 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
+
+      with subtest("DHCPv4"):
+          client.systemctl("start systemd-networkd-wait-online.service")
+          client.wait_for_unit("systemd-networkd-wait-online.service")
+          client.wait_until_succeeds("ping -c 5 10.0.0.1")
+          router.wait_until_succeeds("ping -c 5 10.0.0.3")
+
+      with subtest("DDNS"):
+          nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
+
+      with subtest("Prometheus Exporter"):
+          router.log(router.execute("curl 127.0.0.1:9547")[1])
+          router.succeed("curl --silent 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
     '';
 }

nixos/tests/lomiri.nix

@@ -669,7 +669,7 @@ in
 
               # Doing this here, since we need an in-session shell & separately starting a terminal again wastes time
               with subtest("polkit agent works"):
-                  machine.send_chars("pkexec touch /tmp/polkit-test\n")
+                  machine.send_chars("run0 touch /tmp/polkit-test\n")
                   # There's an authentication notification here that gains focus, but we struggle with OCRing it
                   # Just hope that it's up after a short wait
                   machine.sleep(10)

nixos/tests/plausible.nix

@@ -2,10 +2,7 @@
 {
   name = "plausible";
   meta = {
-    maintainers = with lib.maintainers; [
-      e1mo
-      xanderio
-    ];
+    maintainers = [ ];
   };
 
   nodes.machine =

nixos/tests/prometheus-exporters.nix

@@ -21,6 +21,9 @@ let
     *  `nodeName` (optional)
     *    override an incompatible testnode name
     *
+    *  `testBackend` (optional)
+    *    whether to run in `containers` (default) or `nodes` scope
+    *
     *  Example:
     *    exporterTests.<exporterName> = {
     *      exporterConfig = {
@@ -168,6 +171,7 @@ let
     blackbox =
       { pkgs, ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           configFile = pkgs.writeText "config.yml" (
@@ -373,16 +377,23 @@ let
       };
 
     dovecot =
-      { ... }:
+      { pkgs, ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           scopes = [ "global" ];
-          socketPath = "/var/run/dovecot2/old-stats";
+          socketPath = "/var/run/dovecot2/stats-reader";
           user = "root"; # <- don't use user root in production
         };
         metricProvider = {
-          services.dovecot2.enable = true;
+          services.dovecot2 = {
+            enable = true;
+            settings = {
+              dovecot_config_version = pkgs.dovecot.version;
+              dovecot_storage_version = pkgs.dovecot.version;
+            };
+          };
         };
         exporterTest = ''
           wait_for_unit("prometheus-dovecot-exporter.service")
@@ -423,6 +434,7 @@ let
     ebpf =
       { ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           names = [ "timers" ];
@@ -447,7 +459,6 @@ let
           # `services.elasticsearch` is unmaintained; OpenSearch is the same
           # engine class and is explicitly supported by the exporter.
           services.opensearch.enable = true;
-          virtualisation.memorySize = 2048;
         };
         exporterTest = ''
           wait_for_unit("opensearch.service")
@@ -463,6 +474,7 @@ let
     fail2ban =
       { ... }:
       {
+        testBackend = "nodes"; # setfacl
         exporterConfig = {
           enable = true;
           exitOnError = true;
@@ -964,6 +976,7 @@ let
     modemmanager =
       { ... }:
       {
+        testBackend = "nodes";
         exporterConfig = {
           enable = true;
           refreshRate = "10s";
@@ -1099,7 +1112,7 @@ let
           wait_for_unit("nginx.service")
           wait_for_unit("prometheus-nextcloud-exporter.service")
           wait_for_open_port(9205)
-          succeed("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
+          wait_until_succeeds("curl -sSf http://localhost:9205/metrics | grep 'nextcloud_up 1'")
         '';
       };
 
@@ -1658,24 +1671,6 @@ let
         '';
       };
 
-    scaphandre =
-      { ... }:
-      {
-        exporterConfig = {
-          enable = true;
-        };
-        metricProvider = {
-          boot.kernelModules = [ "intel_rapl_common" ];
-        };
-        exporterTest = ''
-          wait_for_unit("prometheus-scaphandre-exporter.service")
-          wait_for_open_port(8080)
-          wait_until_succeeds(
-              "curl -sSf 'localhost:8080/metrics'"
-          )
-        '';
-      };
-
     shelly =
       { pkgs, ... }:
       {
@@ -2143,6 +2138,7 @@ let
     zfs =
       { ... }:
       {
+        testBackend = "nodes"; # zfs kmod
         exporterConfig = {
           enable = true;
         };
@@ -2165,13 +2161,14 @@ lib.mapAttrs (
     { pkgs, lib, ... }:
     let
       testConfig = testConfigFun { inherit pkgs lib; };
-      nodeName = testConfig.nodeName or exporter;
+      testBackend = testConfig.testBackend or "containers";
+      nodeName = "machine";
     in
     {
       name = "prometheus-${exporter}-exporter";
       node.pkgsReadOnly = testConfig.pkgsReadOnly or true;
 
-      nodes.${nodeName} = lib.mkMerge [
+      ${testBackend}.${nodeName} = lib.mkMerge [
         {
           services.prometheus.exporters.${exporter} = testConfig.exporterConfig;
         }
@@ -2196,7 +2193,6 @@ lib.mapAttrs (
               "${nodeName}.${line}"
           ) (lib.splitString "\n" (lib.removeSuffix "\n" testConfig.exporterTest))
         )}
-        ${nodeName}.shutdown()
       '';
 
       meta.maintainers = [ ];

nixos/tests/rtkit.nix

@@ -55,7 +55,7 @@
 
       # Provide a little logging of polkit checks - otherwise it's
       # impossible to know what's going on.
-      security.polkit.debug = true;
+      security.polkit.extraArgs = [ "--log-level=notice" ];
       security.polkit.extraConfig = ''
         polkit.addRule(function(action, subject) {
           const ns = "org.freedesktop.RealtimeKit1.";

nixos/tests/scaphandre.nix

@@ -1,18 +0,0 @@
-{
-  name = "scaphandre";
-
-  nodes.scaphandre =
-    { pkgs, ... }:
-    {
-      boot.kernelModules = [ "intel_rapl_common" ];
-
-      environment.systemPackages = [ pkgs.scaphandre ];
-    };
-
-  testScript = ''
-    scaphandre.start()
-    scaphandre.wait_until_succeeds(
-        "scaphandre stdout -t 4",
-    )
-  '';
-}

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

@@ -17,7 +17,7 @@ import ./make-test-python.nix (
         hexa
       ];
     };
-    nodes = {
+    containers = {
 
       # The ISP's routers job is to delegate IPv6 prefixes via DHCPv6. Like with
       # regular IPv6 auto-configuration it will also emit IPv6 router
@@ -38,6 +38,7 @@ import ./make-test-python.nix (
             interfaces.eth1 = lib.mkForce { }; # Don't use scripted networking
           };
 
+          services.resolved.enable = false;
           systemd.network = {
             enable = true;
 
@@ -204,6 +205,7 @@ import ./make-test-python.nix (
           interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           networks = {
             # systemd-networkd will load the first network unit file
@@ -300,6 +302,7 @@ import ./make-test-python.nix (
       client = {
         virtualisation.vlans = [ 2 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;

nixos/tests/timekpr.nix

@@ -1,13 +1,15 @@
-{ pkgs, lib, ... }:
+{
+  lib,
+  ...
+}:
+
 {
   name = "timekpr";
   meta.maintainers = [ lib.maintainers.atry ];
 
-  nodes.machine =
-    { pkgs, lib, ... }:
-    {
-      services.timekpr.enable = true;
-    };
+  containers.machine = {
+    services.timekpr.enable = true;
+  };
 
   testScript = ''
     start_all()

nixos/tests/web-apps/pretalx.nix

@@ -4,37 +4,38 @@
   name = "pretalx";
   meta.maintainers = pkgs.pretalx.meta.maintainers;
 
-  nodes = {
-    pretalx =
-      { config, ... }:
-      {
-        networking.extraHosts = ''
-          127.0.0.1 talks.local
-        '';
+  containers.pretalx =
+    { config, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
 
-        services.pretalx = {
-          enable = true;
-          plugins = with config.services.pretalx.package.plugins; [
-            pages
-          ];
-          nginx.domain = "talks.local";
-          settings = {
-            site.url = "http://talks.local";
-          };
+      services.pretalx = {
+        enable = true;
+        plugins = with config.services.pretalx.package.plugins; [
+          pages
+        ];
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
         };
       };
-  };
+    };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretalx.wait_for_unit("pretalx-web.service")
-    pretalx.wait_for_unit("pretalx-worker.service")
+      pretalx.wait_for_unit("pretalx-web.service")
+      pretalx.wait_for_unit("pretalx-worker.service")
 
-    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+      pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
 
-    pretalx.succeed("pretalx-manage --help")
+      pretalx.log(pretalx.succeed("id"))
+      pretalx.succeed("pretalx-manage --help | grep -q 'createsuperuser'")
 
-    pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
-  '';
+      pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
+    '';
 }

nixos/tests/web-apps/pretix.nix

@@ -1,50 +1,47 @@
 {
-  lib,
   pkgs,
   ...
 }:
 
 {
   name = "pretix";
-  meta.maintainers = with lib.maintainers; [ hexa ];
+  meta.maintainers = pkgs.pretix.meta.maintainers;
 
-  nodes = {
-    pretix = {
-      virtualisation.memorySize = 2048;
+  containers.pretix = {
+    networking.extraHosts = ''
+      127.0.0.1 tickets.local
+    '';
 
-      networking.extraHosts = ''
-        127.0.0.1 tickets.local
-      '';
-
-      services.pretix = {
-        enable = true;
-        nginx.domain = "tickets.local";
-        plugins = with pkgs.pretix.plugins; [
-          passbook
-          pages
-          zugferd
-        ];
-        settings = {
-          pretix = {
-            instance_name = "NixOS Test";
-            url = "http://tickets.local";
-          };
-          mail.from = "hello@tickets.local";
+    services.pretix = {
+      enable = true;
+      nginx.domain = "tickets.local";
+      plugins = with pkgs.pretix.plugins; [
+        passbook
+        pages
+        zugferd
+      ];
+      settings = {
+        pretix = {
+          instance_name = "NixOS Test";
+          url = "http://tickets.local";
         };
+        mail.from = "hello@tickets.local";
       };
     };
   };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretix.wait_for_unit("pretix-web.service")
-    pretix.wait_for_unit("pretix-worker.service")
+      pretix.wait_for_unit("pretix-web.service")
+      pretix.wait_for_unit("pretix-worker.service")
 
-    pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
+      pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
 
-    pretix.succeed("pretix-manage --help")
+      pretix.succeed("pretix-manage --help | grep -q 'createsuperuser'")
 
-    pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
-  '';
+      pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
+    '';
 }

pkgs/applications/audio/deadbeef/plugins/statusnotifier.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deadbeef-statusnotifier-plugin";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "vovochka404";
     repo = "deadbeef-statusnotifier-plugin";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6WEbY59vPNrL3W5GUwFQJimmSS+td8Ob+G46fPAxfV4=";
+    sha256 = "sha256-pDiQn+iHSTNWTO01j/fbEq3P374TMmnUiC5/Jn2hwBI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix

@@ -5097,6 +5097,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1.0.20260530.4";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/devel/keymap-popup-0.3.1.0.20260530.4.tar";
+        sha256 = "1k6aqp65x3azbipj2pwdg15pip045cawx4im04s84kbk91fx0fxs";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/devel/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -5015,6 +5015,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/keymap-popup-0.3.1.tar";
+        sha256 = "0m44s8618n7g5pajxiv4k1dfx6l58gr01a3ga26fxc51j1d05q8b";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/nongnu-common-overrides.nix

@@ -20,5 +20,22 @@ in
       yasnippet
     ]
   );
+
+  # requires optional dependency for OMEMO support.
+  jabber = super.jabber.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ pkgs.mbedtls ];
+    nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ];
+
+    # We need to run this in postInstall for package directory to become available
+    postInstall =
+      (old.postInstall or "")
+      + "\n"
+      + ''
+        pushd $out/share/emacs/site-lisp/elpa/jabber-*/src
+        make CC=$CC
+        rm -r $out/share/emacs/site-lisp/elpa/jabber-*/src
+        popd
+      '';
+  });
   # keep-sorted end
 }

pkgs/applications/editors/emacs/elisp-packages/nongnu-devel-generated.nix

@@ -3225,17 +3225,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5.0.20260423.192938";
+      version = "0.11.0.0.20260614.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.10.5.0.20260423.192938.tar";
-        sha256 = "1q79iv4znishj6rdz1m76r0c8h72i2g47xfh6xfw2gqxbkkyilv3";
+        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.11.0.0.20260614.0.tar";
+        sha256 = "19h0w85m6vzwwpsgg6ifcyx2j082cgj6dpd7s5yd7pr438jazkn3";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu-devel/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -3240,17 +3240,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5";
+      version = "0.11.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/jabber-0.10.5.tar";
-        sha256 = "1vjmajcls0l6mwccqdp7gr4g4r1z6f2qaf2palnimjb7w3gzh4mk";
+        url = "https://elpa.nongnu.org/nongnu/jabber-0.11.0.tar";
+        sha256 = "1wikfd8iqj9r1qrh6cd593vgbkjndfpm9f12ilsdwxwh0nx3cpd7";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -67,10 +67,10 @@ vimUtils.buildVimPlugin {
     in
     ''
       mkdir -p $out/build
-      ln -s ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
+      cp ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
+      cp ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
+      cp ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
+      cp ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
 
       # Fixes PKCE auth flows not finding libcrypto
       substituteInPlace "$out/lua/avante/auth/pkce.lua" \

pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix

@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.45.1";
+  version = "2.49.2";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-1F6z/rhZxiuI6W1ReyHP6EQFxys4qm3fbINxoy1hQZA=";
+    hash = "sha256-kT5plTJP4VfN6mFkq6voDTmr9LaZ37W80UU3QUGlKkY=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];

pkgs/applications/editors/vscode/generic.nix

@@ -376,7 +376,7 @@ stdenv.mkDerivation (
           )
         }
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
-        --add-flags ${lib.escapeShellArg commandLineArgs}
+        --append-flags ${lib.escapeShellArg commandLineArgs}
       )
     '';
 

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-06-02";
+  version = "0-unstable-2026-06-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ee042b73f8fe2aa9c8c73408b5bf200a3ce1a67b";
-    hash = "sha256-k1DvQHGQH/d6W7jTIAW9jIk0qVHUji3PeYAa8MuUP9w=";
+    rev = "d460f8342060526678e7fd8222048324c2a80d86";
+    hash = "sha256-QzlVlXfJmSwd+gp+fROMKrTj8AxCisYJN5WTff6eHLA=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2026-06-04";
+  version = "0-unstable-2026-06-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "298f913aeb781908c7f6a568a2ede3940a98738d";
-    hash = "sha256-UP0jNsqXMzrO+EQY8Gbkl2lIizfsAKoKiGaXGp7Nok8=";
+    rev = "9723c47c2d782ccb8cf48f96568a89a44631e6ba";
+    hash = "sha256-zYIC0up0tkvq0TLjSiypxwSTYAF1XnmHXsUTKsUQejA=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/hatari.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "hatari";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-06-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "hatari";
-    rev = "6aa7c7079b3186025ebc6bad4b4251aa359a3947";
-    hash = "sha256-17L2EpLGwkWA/9XTgtIq+PNABGvgdBQDsAfAZFRKLOE=";
+    rev = "c605d3aa342f2ad8f915f94bf03bae018e1be7b7";
+    hash = "sha256-UJyfIt5+anXaqqMmL9JNTBvXu5bmyMYloYc8fWxx2m0=";
   };
 
   extraNativeBuildInputs = [ which ];

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2026-05-31";
+  version = "0-unstable-2026-06-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "2ffec28bcf65eceb395722c9d721e7d4523fbb56";
-    hash = "sha256-37SD78rFYgIoI7FDsgHhupYse8QbzwVRrJCXSVjpLCc=";
+    rev = "e126237dcf44622deaf18e7668f07ba96c363673";
+    hash = "sha256-6M4revCs32ffmUjhl10nL/MsVl8QRn6JQmC7NzDW1Mo=";
     fetchSubmodules = true;
   };
 

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -85,7 +85,7 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.10";
+  version = "3.44.11";
   pname = "qgis-ltr-unwrapped";
   outputs = [ "out" ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) "man";
 
@@ -93,7 +93,7 @@ mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-wWLbnZpLIchm0NXuU7jEXCBctrI6G1z8iqf9R2YhS8Y=";
+    hash = "sha256-gWSl9OrRSxreQdKxKKDCOUWBE5uE2w3/ebW266LCWLI=";
   };
 
   passthru = {

pkgs/applications/graphics/gimp/default.nix

@@ -338,8 +338,6 @@ stdenv.mkDerivation (finalAttrs: {
     gtk = gtk3;
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "GNU Image Manipulation Program";
     homepage = "https://www.gimp.org/";

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cni-plugins";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    hash = "sha256-0ZonR8pV20bBbC2AkNCJhoseDVxNwwMa7coD/ON6clA=";
+    hash = "sha256-3OhUvIJPU5Ayc4/po9Rj4Tfa5536aN8bj+51M6Xg5os=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-uIggPhDgTMQei6LpXPzAbfbsoNjVN35P60QcqqHyCIA=",
+    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.17.0",
+    "rev": "v8.18.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
-    "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",
+    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.23.1",
+    "rev": "v0.23.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-chDZVBd7tb1VsfTXcWz7j29LzHpUnJpXKRFAyqxnR8s="
+    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
   },
   "vinyldns_vinyldns": {
     "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",

pkgs/applications/networking/p2p/deluge/default.nix

@@ -5,6 +5,7 @@
   libtorrent-rasterbar,
   python3Packages,
   gtk3,
+  libappindicator-gtk3,
   glib,
   gobject-introspection,
   librsvg,
@@ -54,6 +55,7 @@ let
           gtk3
           gobject-introspection
           pygobject3
+          libappindicator-gtk3
         ];
 
       nativeBuildInputs = [

pkgs/applications/video/kodi/addons/jellycon/default.nix

@@ -17,13 +17,13 @@ in
 buildKodiAddon rec {
   pname = "jellycon";
   namespace = "plugin.video.jellycon";
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellycon";
     rev = "v${version}";
-    sha256 = "sha256-bSAzd0nKD0S3hNEM0azmCNPw9wHQK5XH6lbfcz3sW9o=";
+    sha256 = "sha256-1o9mkMjlLDIcokpTqDKmFlCOF1XjrVOxlFfy0bpZolc=";
   };
 
   nativeBuildInputs = [

pkgs/build-support/fetchcodeberg/default.nix

@@ -1,2 +1,11 @@
 { lib, fetchFromGitea }:
-lib.makeOverridable (args: fetchFromGitea ({ domain = "codeberg.org"; } // args))
+lib.makeOverridable (
+  args:
+  fetchFromGitea (
+    {
+      domain = "codeberg.org";
+      functionName = "fetchFromCodeberg";
+    }
+    // args
+  )
+)

pkgs/build-support/fetchgitea/default.nix

@@ -3,7 +3,20 @@
 { lib, fetchFromGitHub }:
 
 lib.makeOverridable (
-  { domain, ... }@args:
+  {
+    domain,
+    functionName ? "fetchFromGitea",
+    ...
+  }@args:
 
-  fetchFromGitHub ((removeAttrs args [ "domain" ]) // { githubBase = domain; })
+  fetchFromGitHub (
+    (removeAttrs args [
+      "domain"
+      "functionName"
+    ])
+    // {
+      inherit functionName;
+      githubBase = domain;
+    }
+  )
 )

pkgs/build-support/fetchgithub/default.nix

@@ -48,6 +48,7 @@ decorate (
     repo,
     tag ? null,
     rev ? null,
+    functionName ? "fetchFromGitHub",
     # TODO(@ShamrockLee): Add back after reconstruction with lib.extendMkDerivation
     # name ? repoRevToNameMaybe finalAttrs.repo (lib.revOrTag finalAttrs.revCustom finalAttrs.tag) "github",
     private ? false,
@@ -60,7 +61,7 @@ decorate (
 
   assert (
     lib.xor (tag == null) (rev == null)
-    || throw "fetchFromGitHub requires one of either `rev` or `tag` to be provided (not both)."
+    || throw "${functionName} requires one of either `rev` or `tag` to be provided (not both)."
   );
 
   let
@@ -115,6 +116,7 @@ decorate (
         "repo"
         "tag"
         "rev"
+        "functionName"
         "private"
         "githubBase"
         "varPrefix"
@@ -135,7 +137,7 @@ decorate (
         in
         ''
           if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
-            echo "Error: Private fetchFromGitHub requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+            echo "Error: Private ${functionName} requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
             exit 1
           fi
           cat > netrc <<EOF

pkgs/by-name/ac/actionlint/package.nix

@@ -53,7 +53,7 @@ buildGoModule (finalAttrs: {
     description = "Static checker for GitHub Actions workflow files";
     changelog = "https://github.com/rhysd/actionlint/raw/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "actionlint";
   };
 })

pkgs/by-name/al/albyhub/bark-ffi-go/default.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  protobuf,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bark-ffi-go";
+  version = "0.2.3";
+
+  src = fetchFromGitLab {
+    owner = "ark-bitcoin";
+    repo = "bark-ffi-bindings";
+    rev = "3c626a43d7523c4d19e867bd453ec80c541780c7";
+    hash = "sha256-PbGTbVMO2L+gQpZQewkR0uo6fxqrVUjT/eAsnz2o/u4=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/golang/rust";
+
+  cargoHash = "sha256-OED+NqNt71771UDZ1M8Ks/Yfx8YNjfL246FKMeLFfLg=";
+
+  cargoBuildFlags = [ "--lib" ];
+
+  doCheck = false;
+
+  nativeBuildInputs = [
+    protobuf
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 target/*/release/libbark_ffi_go.a \
+      $out/lib/libbark_ffi_go.a
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Go bindings static library for Bark";
+    homepage = "https://gitlab.com/ark-bitcoin/bark-ffi-bindings";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ bleetube ];
+  };
+})

pkgs/by-name/al/albyhub/ldk-node-go/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "ldk-node-go";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node-go";
-    rev = "3690cdb3031c75f0ee0a67222c2db3c69fea8f2c";
-    hash = "sha256-OlJGHhal5fkR0r0FtsVbG1aILZSTLsSRcqrZ84pIRLU=";
+    rev = "5ba22268f000c78baa5cf57329eb0b1c07bd91d7";
+    hash = "sha256-+fuCvc2SuxBLXiacfc+0oNzAsBgFjUJgZ0+5B4Sy4vs=";
   };
 
   vendorHash = null;

pkgs/by-name/al/albyhub/ldk-node/default.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ldk-node";
-  version = "0-unstable-2026-04-24";
+  version = "0-unstable-2026-06-08";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node";
-    rev = "6d5546ec5fff10d4e560188cfcff6f294944c16e";
-    hash = "sha256-k3AZ1k/hV4Bh+RfOqmpo22wRQ5sdDaFR4bcnw58iwNI=";
+    rev = "549107b4d731bc9af06b81fbcd65463e3055df16";
+    hash = "sha256-7S/+po+a6DkUCnfCrwBMfMnsHzbLcvSiPxEmQc2Hzr0=";
   };
 
   buildFeatures = [ "uniffi" ];

pkgs/by-name/al/albyhub/package.nix

@@ -8,10 +8,12 @@
   yarn,
   stdenv,
   makeWrapper,
+  runCommand,
   callPackage,
 }:
 
 let
+  barkFfiGo = callPackage ./bark-ffi-go { };
   ldkNode = callPackage ./ldk-node { };
   ldkNodeGo = callPackage ./ldk-node-go {
     inherit ldkNode;
@@ -21,18 +23,25 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "albyhub";
-  version = "1.22.2";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xP/J9zdh4sZ1x+JUpOf12ft8f2II2Mn1Q7/gnMuFzy8=";
+    hash = "sha256-1mdpsctrQN012+HAWSgorzlN2UBA5D4+sZIIVYCq8k8=";
   };
 
-  vendorHash = "sha256-nzdHXY14o4D8NrcXu2JvDagvIfemfVAaGU3IDifhyW0=";
+  vendorHash = "sha256-xQkQIWBrbrXzU9/5BMD3/+KKR847gh4XQrwj/CDoml0=";
   proxyVendor = true; # needed for secp256k1-zkp CGO bindings
 
+  postPatch = ''
+    cp -r ${barkFfiGo.src}/golang bark-ffi-bindings-golang
+    chmod -R u+w bark-ffi-bindings-golang
+    rm -r bark-ffi-bindings-golang/lib
+    go mod edit -replace gitlab.com/ark-bitcoin/bark-ffi-bindings/golang=./bark-ffi-bindings-golang
+  '';
+
   nativeBuildInputs = [
     fixup-yarn-lock
     nodejs
@@ -41,16 +50,21 @@ buildGoModule (finalAttrs: {
   ];
 
   buildInputs = [
+    barkFfiGo
     ldkNodeGo
     (lib.getLib stdenv.cc.cc)
   ];
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/frontend/yarn.lock";
-    hash = "sha256-BeuTBLJ/Iakd4jhIkI2+oHc4MFy6DSn8QcygTHEMmQo=";
+    hash = "sha256-VI4FRe1kzVMqqcZ68nZmZqmXW7FOQMbJ0z8QqZoLYEA=";
   };
 
   preBuild = ''
+    mkdir -p bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}
+    cp ${barkFfiGo}/lib/libbark_ffi_go.a \
+      bark-ffi-bindings-golang/lib/linux_${stdenv.hostPlatform.go.GOARCH}/libbark_ffi_go.a
+
     export HOME=$TMPDIR
     pushd frontend
       fixup-yarn-lock yarn.lock
@@ -85,6 +99,41 @@ buildGoModule (finalAttrs: {
     } $out/bin/albyhub
   '';
 
+  passthru.tests.startup = runCommand "${finalAttrs.pname}-startup-test" { } ''
+    export HOME="$TMPDIR"
+    export AUTO_LINK_ALBY_ACCOUNT=false
+    export WORK_DIR="$TMPDIR/albyhub"
+    export DATABASE_URI="$WORK_DIR/nwc.db"
+    export PORT=8099
+    export LDK_LOG_LEVEL=2
+    export LOG_LEVEL=5
+
+    mkdir -p "$WORK_DIR"
+
+    ${lib.getExe finalAttrs.finalPackage} > "$TMPDIR/albyhub.log" 2>&1 &
+    pid=$!
+    trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+    for _ in $(seq 1 30); do
+      if grep -q "http server started" "$TMPDIR/albyhub.log"; then
+        touch "$out"
+        exit 0
+      fi
+
+      if ! kill -0 "$pid" 2>/dev/null; then
+        echo "albyhub exited before startup" >&2
+        cat "$TMPDIR/albyhub.log" >&2
+        exit 1
+      fi
+
+      sleep 1
+    done
+
+    echo "timed out waiting for albyhub to start" >&2
+    cat "$TMPDIR/albyhub.log" >&2
+    exit 1
+  '';
+
   meta = {
     description = "Control lightning wallets over nostr";
     homepage = "https://github.com/getAlby/hub";

pkgs/by-name/al/algolia-cli/package.nix

@@ -43,6 +43,6 @@ buildGoModule {
     mainProgram = "algolia";
     homepage = "https://algolia.com/doc/tools/cli/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/al/almo/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     homepage = "https://github.com/abap34/almo";
     changelog = "https://github.com/abap34/almo/releases/tag/${finalAttrs.src.tag}";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "almo";
   };
 })

pkgs/by-name/am/amnezia-vpn-bin/package.nix

@@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn-bin";
-  version = "4.8.16.0";
+  version = "4.8.18.0";
 
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/amnezia-vpn/amnezia-client/releases/download/${finalAttrs.version}/AmneziaVPN_${finalAttrs.version}_linux_x64.tar";
-    hash = "sha256-0gffxBD0pNsyTvqAFdYdjI8rzCkyaXHOApSCu4waP7s=";
+    hash = "sha256-Mypzq/Lm+JI0HljRJ6/0ZDFlwOeVbZB+Lmuy33xE06M=";
   };
 
   strictDeps = true;

pkgs/by-name/am/amp-cli/package.nix

@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1780564400-g2007df";
+  version = "0.0.1781370323-g977781";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-7hUa1Qs1pNH2+31rrc9T99eDQ9Vq+CSwxROISyPqogY=";
-            aarch64-linux = "sha256-ThT2J1YBoZM5+YanRbL40GyxYQtK/xyDqac8fv0gfZs=";
-            x86_64-darwin = "sha256-VnuMqXVzqge5jgduxB+woYLVZkFtu92MEsEsrh4tJgE=";
-            aarch64-darwin = "sha256-gYAI+eQitglQTBtuilHkHKd8rsYsJ7s2QKoFQR85l6o=";
+            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
+            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
+            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
+            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
           }
           .${system'};
       }

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -88,355 +88,353 @@
 
   enabledProviders,
 }:
-let
-  version = "3.2.2";
+buildPythonPackage (
+  finalAttrs:
+  let
+    inherit (finalAttrs) src version;
 
-  src = fetchFromGitHub {
-    owner = "apache";
-    repo = "airflow";
-    tag = version;
-    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
-  };
+    airflowUi = stdenv.mkDerivation (uiAttrs: {
+      pname = "airflow-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
 
-  pnpm = pnpm_10;
+      # vite build resolves "localhost" during the build, which the darwin
+      # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
 
-  airflowUi = stdenv.mkDerivation rec {
-    pname = "airflow-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
 
-    # vite build resolves "localhost" during the build, which the darwin
-    # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+      pnpmDeps = fetchPnpmDeps {
+        pname = "airflow-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = uiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
+      };
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/ui
+        cp -r dist $out/share/airflow/ui/
+      '';
+    });
+
+    airflowSimpleAuthUi = stdenv.mkDerivation (simpleUiAttrs: {
+      pname = "airflow-simple-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
+
+      pnpmDeps = fetchPnpmDeps {
+        pname = "simple-auth-manager-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = simpleUiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
+      };
+
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/simple-ui
+        cp -r dist $out/share/airflow/simple-ui/
+      '';
+    });
+
+    requiredProviders = [
+      "common_compat"
+      "common_io"
+      "common_sql"
+      "smtp"
+      "standard"
     ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "airflow-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
-    };
+    providers = import ./providers.nix;
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
+    buildProvider =
+      provider:
+      buildPythonPackage {
+        pname = "apache-airflow-providers-${provider}";
+        version = providers.${provider}.version;
+        pyproject = true;
 
-    installPhase = ''
-      mkdir -p $out/share/airflow/ui
-      cp -r dist $out/share/airflow/ui/
-    '';
-  };
+        inherit src;
+        sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
 
-  airflowSimpleAuthUi = stdenv.mkDerivation rec {
-    pname = "airflow-simple-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+        buildInputs = [ flit-core ];
 
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+        dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
 
-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
-    ];
+        pythonRemoveDeps = [
+          "apache-airflow"
+        ];
 
-    pnpmDeps = fetchPnpmDeps {
-      pname = "simple-auth-manager-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
-    };
+        pythonRelaxDeps = [
+          "flit-core"
+        ];
+      };
 
-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
-
-    installPhase = ''
-      mkdir -p $out/share/airflow/simple-ui
-      cp -r dist $out/share/airflow/simple-ui/
-    '';
-  };
-
-  requiredProviders = [
-    "common_compat"
-    "common_io"
-    "common_sql"
-    "smtp"
-    "standard"
-  ];
-
-  providers = import ./providers.nix;
-
-  buildProvider =
-    provider:
-    buildPythonPackage {
-      pname = "apache-airflow-providers-${provider}";
-      version = providers.${provider}.version;
+    taskSdk = buildPythonPackage {
+      pname = "task-sdk";
+      inherit src version;
       pyproject = true;
 
-      inherit src;
-      sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
+      sourceRoot = "${src.name}/task-sdk";
 
-      buildInputs = [ flit-core ];
+      postPatch = ''
+        # resolve cyclic dependency
+        sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
 
-      dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
-      pythonRemoveDeps = [
-        "apache-airflow"
+        # task-sdk needs config.yml from core subpackage
+        mkdir -p src/airflow/config_templates
+        cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+      '';
+
+      build-system = [
+        hatchling
       ];
 
-      pythonRelaxDeps = [
-        "flit-core"
+      dependencies = [
+        asgiref
+        attrs
+        babel
+        colorlog
+        fsspec
+        greenback
+        httpx
+        jinja2
+        jsonschema
+        methodtools
+        msgspec
+        pendulum
+        psutil
+        pydantic
+        pygtrie
+        python-dateutil
+        requests
+        retryhttp
+        structlog
+        tenacity
+        types-requests
       ];
     };
 
-  airflowCore = buildPythonPackage {
-    pname = "apache-airflow-core";
-    inherit src version;
+    airflowCore = buildPythonPackage {
+      pname = "apache-airflow-core";
+      inherit src version;
+      pyproject = true;
+
+      sourceRoot = "${src.name}/airflow-core";
+
+      postPatch = ''
+        # remove cyclic dependency
+        sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
+
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+
+        # Copy built UI assets
+        cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
+        cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
+      '';
+
+      build-system = [
+        gitdb
+        gitpython
+        hatchling
+        packaging
+        smmap
+        tomli
+        trove-classifiers
+      ];
+
+      dependencies = [
+        a2wsgi
+        aiosqlite
+        alembic
+        argcomplete
+        asgiref
+        attrs
+        cachetools
+        cadwyn
+        colorlog
+        cron-descriptor
+        croniter
+        cryptography
+        deprecated
+        dill
+        fastapi
+        httpx
+        importlib-metadata
+        itsdangerous
+        jinja2
+        jsonschema
+        lazy-object-proxy
+        libcst
+        linkify-it-py
+        lockfile
+        methodtools
+        msgspec
+        natsort
+        opentelemetry-api
+        opentelemetry-exporter-otlp
+        packaging
+        pathspec
+        pendulum
+        pluggy
+        psutil
+        pydantic
+        pygments
+        pygtrie
+        pyjwt
+        python-daemon
+        python-dateutil
+        python-slugify
+        pyyaml
+        requests
+        rich
+        rich-argparse
+        rich-click
+        setproctitle
+        sqlalchemy
+        sqlalchemy-jsonfield
+        sqlalchemy-utils
+        starlette
+        structlog
+        svcs
+        tabulate
+        taskSdk
+        tenacity
+        termcolor
+        typing-extensions
+        universal-pathlib
+        uuid6
+        uvicorn
+      ]
+      ++ (map buildProvider requiredProviders);
+
+      pythonRelaxDeps = [ "starlette" ];
+    };
+  in
+  {
+    pname = "apache-airflow";
+    version = "3.2.2";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "apache";
+      repo = "airflow";
+      tag = finalAttrs.version;
+      hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
+    };
+
     pyproject = true;
 
-    sourceRoot = "${src.name}/airflow-core";
-
     postPatch = ''
-      # remove cyclic dependency
-      sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
-
       # relax dependencies
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
       sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # Copy built UI assets
-      cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
-      cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
     '';
 
+    nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
     build-system = [
       gitdb
       gitpython
       hatchling
       packaging
+      pathspec
+      pluggy
       smmap
       tomli
       trove-classifiers
     ];
 
     dependencies = [
-      a2wsgi
-      aiosqlite
-      alembic
-      argcomplete
-      asgiref
-      attrs
-      cachetools
-      cadwyn
-      colorlog
-      cron-descriptor
-      croniter
-      cryptography
-      deprecated
-      dill
-      fastapi
-      httpx
-      importlib-metadata
-      itsdangerous
-      jinja2
-      jsonschema
-      lazy-object-proxy
-      libcst
-      linkify-it-py
-      lockfile
-      methodtools
-      msgspec
-      natsort
-      opentelemetry-api
-      opentelemetry-exporter-otlp
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      psutil
-      pydantic
-      pygments
-      pygtrie
-      pyjwt
-      python-daemon
-      python-dateutil
-      python-slugify
-      pyyaml
-      requests
-      rich
-      rich-argparse
-      rich-click
-      setproctitle
-      sqlalchemy
-      sqlalchemy-jsonfield
-      sqlalchemy-utils
-      starlette
-      structlog
-      svcs
-      tabulate
-      taskSdk
-      tenacity
-      termcolor
-      typing-extensions
-      universal-pathlib
-      uuid6
-      uvicorn
+      airflowCore # subpackage from airflow src
+      taskSdk # subpackage from airflow src
     ]
-    ++ (map buildProvider requiredProviders);
+    ++ (map buildProvider enabledProviders);
 
-    pythonRelaxDeps = [ "starlette" ];
-  };
-
-  taskSdk = buildPythonPackage {
-    pname = "task-sdk";
-    inherit src version;
-    pyproject = true;
-
-    sourceRoot = "${src.name}/task-sdk";
-
-    postPatch = ''
-      # resolve cyclic dependency
-      sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
-
-      # relax dependencies
-      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # task-sdk needs config.yml from core subpackage
-      mkdir -p src/airflow/config_templates
-      cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+    postInstall = ''
+      # Create a symlink to the airflow-core package
+      mkdir -p $out/bin
+      ln -s ${airflowCore}/bin/airflow $out/bin/airflow
     '';
 
-    build-system = [
-      hatchling
-    ];
+    installCheckPhase = ''
+      runHook preInstallCheck
 
-    dependencies = [
-      asgiref
-      attrs
-      babel
-      colorlog
-      fsspec
-      greenback
-      httpx
-      jinja2
-      jsonschema
-      methodtools
-      msgspec
-      pendulum
-      psutil
-      pydantic
-      pygtrie
-      python-dateutil
-      requests
-      retryhttp
-      structlog
-      tenacity
-      types-requests
-    ];
-  };
+      $out/bin/airflow version
+      $out/bin/airflow db reset -y
 
-in
-buildPythonPackage rec {
-  pname = "apache-airflow";
-  inherit src version;
-  pyproject = true;
+      runHook postInstallCheck
+    '';
 
-  postPatch = ''
-    # relax dependencies
-    sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-    sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-    sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-  '';
+    pythonImportsCheck = [
+      "airflow"
+    ]
+    ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
 
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+    passthru.updateScript = ./update.sh;
+    passthru.airflowUi = airflowUi;
+    passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
 
-  build-system = [
-    gitdb
-    gitpython
-    hatchling
-    packaging
-    pathspec
-    pluggy
-    smmap
-    tomli
-    trove-classifiers
-  ];
+    # Note on testing the web UI:
+    # You can (manually) test the web UI as follows:
+    #
+    #   nix shell .#apache-airflow
+    #   airflow version
+    #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
+    #   airflow standalone
+    #
+    # Then navigate to the localhost URL using the credentials printed, try
+    # triggering the 'example_bash_operator' DAG and see if it reports success.
 
-  dependencies = [
-    airflowCore # subpackage from airflow src
-    taskSdk # subpackage from airflow src
-  ]
-  ++ (map buildProvider enabledProviders);
-
-  postInstall = ''
-    # Create a symlink to the airflow-core package
-    mkdir -p $out/bin
-    ln -s ${airflowCore}/bin/airflow $out/bin/airflow
-  '';
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/airflow version
-    $out/bin/airflow db reset -y
-
-    runHook postInstallCheck
-  '';
-
-  pythonImportsCheck = [
-    "airflow"
-  ]
-  ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
-
-  passthru.updateScript = ./update.sh;
-  passthru.airflowUi = airflowUi;
-  passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
-
-  # Note on testing the web UI:
-  # You can (manually) test the web UI as follows:
-  #
-  #   nix shell .#apache-airflow
-  #   airflow version
-  #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
-  #   airflow standalone
-  #
-  # Then navigate to the localhost URL using the credentials printed, try
-  # triggering the 'example_bash_operator' DAG and see if it reports success.
-
-  meta = {
-    description = "Platform to programmatically author, schedule and monitor workflows";
-    homepage = "https://airflow.apache.org/";
-    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      taranarmo
-    ];
-    mainProgram = "airflow";
-  };
-}
+    meta = {
+      description = "Platform to programmatically author, schedule and monitor workflows";
+      homepage = "https://airflow.apache.org/";
+      changelog = "https://airflow.apache.org/docs/apache-airflow/${finalAttrs.version}/release_notes.html";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        taranarmo
+      ];
+      mainProgram = "airflow";
+    };
+  }
+)

pkgs/by-name/as/astroterm/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astroterm";
-  version = "1.0.10";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "da-luce";
     repo = "astroterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z9KblIAoXk///NnRFHCSAFNDuNiPxDuuiliajcsyJM0=";
+    hash = "sha256-u0UKYoZCDClRmG12czmm0rmOcy3nruarSyjdh8Lu2dw=";
   };
 
   bsc5File = fetchurl {

pkgs/by-name/au/autologin/package.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Run a command inside of a new PAM user session";
-    homepage = "https://sr.ht/~kennylevinsen/autologin";
+    homepage = "https://git.sr.ht/~kennylevinsen/autologin";
     changelog = "https://git.sr.ht/~kennylevinsen/autologin/refs/${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;

pkgs/by-name/av/avell-unofficial-control-center/package.nix

@@ -7,7 +7,7 @@
 python3Packages.buildPythonApplication {
   pname = "avell-unofficial-control-center";
   version = "1.0.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rodgomesc";
@@ -17,14 +17,16 @@ python3Packages.buildPythonApplication {
     sha256 = "1qz1kv7p09nxffndzz9jlkzpfx26ppz66f8603zyamjq9dqdmdin";
   };
 
-  # No tests included
-  doCheck = false;
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     pyusb
     elevate
   ];
 
+  # No tests included
+  doCheck = false;
+
   meta = {
     homepage = "https://github.com/rodgomesc/avell-unofficial-control-center";
     description = "Software for controlling RGB keyboard lights on some gaming laptops that use ITE Device(8291) Rev 0.03";

pkgs/by-name/av/avro-tools/package.nix

@@ -36,6 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "avro-tools";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/aw/aws-lc/package.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.69.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ykpPbMONAJK6rEANOn0O7JfIkXPSoPXs1Zr4Bv+eXqQ=";
+    hash = "sha256-Dvy6mzEfKgimxCGp7q2fPk9urBMJMU6gZmaZXwdZfWw=";
   };
 
   outputs = [
@@ -47,6 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
+  postInstall = ''
+    moveToOutput lib/crypto/cmake "$dev"
+    moveToOutput lib/ssl/cmake "$dev"
+  '';
+
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isGNU [
       # Needed with GCC 12 but breaks on darwin (with clang)

pkgs/by-name/ba/backintime-common/package.nix

@@ -9,6 +9,7 @@
   cron,
   openssh,
   sshfs-fuse,
+  fuse3,
   gocryptfs,
   which,
   ps,
@@ -73,11 +74,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "share" "${python'.sitePackages}"
 
     substituteInPlace "schedule.py" \
-      --replace-fail "'crontab'" "'${cron}/bin/crontab'" \
+      --replace-fail "'crontab'" "'${lib.getExe' cron "crontab"}'" \
       --replace-fail "'which'" "'${lib.getExe which}'" \
       --replace-fail "'ps'" "'${lib.getExe ps}'" \
       --replace-fail "'grep'" "'${lib.getExe gnugrep}'" \
 
+    substituteInPlace mount.py \
+      --replace-fail "'fusermount'" "'${lib.getExe' fuse3 "fusermount3"}'"
+
     substituteInPlace "bitlicense.py" \
       --replace-fail "/usr/share/doc" "$out/share/doc" \
   '';

pkgs/by-name/ba/bazel-gazelle/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-gazelle";
-  version = "0.47.0";
+  version = "0.51.3";
 
   src = fetchFromGitHub {
-    owner = "bazelbuild";
+    owner = "bazel-contrib";
     repo = "bazel-gazelle";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-rnJ8rht7ccAI8ceOv3B0mlcY0fQg9Nfy+hu+/pmQQqE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ooqk4xutkjXoy9Irikos/53+6Mhdh3+WmJF7vo3JVFw=";
   };
 
   vendorHash = null;
@@ -22,14 +22,18 @@ buildGoModule (finalAttrs: {
   subPackages = [ "cmd/gazelle" ];
 
   meta = {
-    homepage = "https://github.com/bazelbuild/bazel-gazelle";
+    changelog = "https://github.com/bazel-contrib/bazel-gazelle/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/bazel-contrib/bazel-gazelle";
     description = ''
       Gazelle is a Bazel build file generator for Bazel projects. It natively
       supports Go and protobuf, and it may be extended to support new languages
       and custom rule sets.
     '';
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [
+      kalbasit
+      hythera
+    ];
     mainProgram = "gazelle";
   };
 })

pkgs/by-name/ba/bazel_8/examples.nix

@@ -108,10 +108,10 @@ in
     bazelVendorDepsFOD = {
       outputHash =
         {
-          aarch64-darwin = "sha256-wjVwHQEtIoApY01s9AEVExmRhy+LLQv0/B2vAxmXz+o=";
-          aarch64-linux = "sha256-Z7Y8bBEaPgp9y6RZoC5Ewqvzi//vnamkpeHXGpoBFAQ=";
-          x86_64-darwin = "sha256-aUTfOrsa59zUE0Wb+u5TORQR0nAGQ/7MWSRHc2hcXoo=";
-          x86_64-linux = "sha256-yrXIJocCGq4NYW0jg5s2cMDEvknrtjtBQo6cZFbz8CE=";
+          aarch64-darwin = "sha256-50cAS1okGT1Mq3+TNLk2dk6OdBOAF2LdcskcYuVNOSY=";
+          aarch64-linux = "sha256-2Oia7+2nzLrWeo/bK/5L7du5Y30DY+S0jit6e1ixJXw=";
+          x86_64-darwin = "sha256-+vgvj3ABm+vvXT7U7JxjuzIMwVAiUh1gcWZnFNzcmY0=";
+          x86_64-linux = "sha256-kBnSlFRfYsotZTRMrTNhk8/106+BLzwuU6MIRXlD1jE=";
         }
         .${stdenv.hostPlatform.system};
       outputHashAlgo = "sha256";

pkgs/by-name/ba/bazel_8/package.nix

@@ -31,7 +31,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "8.6.0",
+  version ? "8.7.0",
 }:
 
 let
@@ -45,7 +45,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-W22eB0IzHNZe3xaF8AZOkUTDCic3NXkypdqSDY61Su0=";
+    hash = "sha256-bm+gkkrAVepJWZddDEV1+jX4jRdD+tZ1TH2YG9adIyk=";
     stripRoot = false;
   };
 

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -95,9 +95,6 @@ buildNpmPackage rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # make electron-builder not attempt to codesign the app on darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   nativeBuildInputs = [
     cargo
     dart-sass

pkgs/by-name/bl/blackfire/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2.29.7";
+  version = "2026.6.0";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -60,23 +60,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-JPhh7LNiLZXLN5iycNobZ/uJQjOhKqqYSw9P78+/BKk=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-uoqUDJ/bexqaRlf5Y692OGm91W1ErlS8Q8/l9MlsHwU=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+        hash = "sha256-kL9s17Bnt8UYj3IiX2b7e3OWSsRLq5TSzdK6OdByD40=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "TvxIm4plE7nnTIkJNfCzxzr2r0B2Aqlxdveb1M+sqL4=";
+        hash = "sha256-p9D87uaDVu25SG4cclmzaq9oKaFDlIy8/XLx3rHuIQ4=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "oNDNIPBqvaARz9W967bxuvo2bpPORiHci3sryGqznsU=";
+        hash = "sha256-ppCSvk259NNlujl9olyRlmwRdNbLu/uRs+gq71S79B8=";
       };
     };
 

pkgs/by-name/bl/bloaty/package.nix

@@ -86,6 +86,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/google/bloaty";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/bl/blocky/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SZpAPX+MIQA0HRUUmjXi7g+DEJ+jyub4rlyc0RLclew=";
+    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-DahHFf0w0ksQniuVByX45/fLcqpAga23qMjAGnZTjjY=";
+  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
 
   ldflags = [
     "-s"

pkgs/by-name/bs/bsky-cli/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bsky-cli";
-  version = "0.0.79";
+  version = "0.0.81";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "bsky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-id7+g9NMCSicPbDoDSqnc7OwEMIVXbXw3O8TkeQjfmg=";
+    hash = "sha256-Su2AhHaIozuqTzK1vyAjZR/a01j0dnlayV14Q7hTcCU=";
   };
 
-  vendorHash = "sha256-m4kth6r13++53fbceWjKYu4D297meAwnkaSsCiu5zS8=";
+  vendorHash = "sha256-jGeKaAR0rAqrhoUx/FqdDwdOxA/WioppFjGyi/PsIQs=";
 
   buildInputs = [
     libpcap

pkgs/by-name/bu/buildpack/package.nix

@@ -42,6 +42,6 @@ buildGoModule (finalAttrs: {
     description = "CLI for building apps using Cloud Native Buildpacks";
     mainProgram = "pack";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/bu/bundletool/package.nix

@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://developer.android.com/studio/command-line/bundletool";
     changelog = "https://github.com/google/bundletool/releases/tag/${finalAttrs.version}";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     platforms = jre_headless.meta.platforms;
     license = lib.licenses.asl20;
   };

pkgs/by-name/by/byobu/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "byobu";
-  version = "6.13";
+  version = "6.15";
 
   src = fetchFromGitHub {
     owner = "dustinkirkland";
     repo = "byobu";
-    rev = finalAttrs.version;
-    hash = "sha256-h+3BEMfBRozmpqFNRyfKzjKgevaYm8v7DsJMwkhiCQ4=";
+    tag = finalAttrs.version;
+    hash = "sha256-QovoXH8cm8CZMSYGjI7FgynHtJjahpe9R2s62F7aZvo=";
   };
 
   nativeBuildInputs = [
@@ -103,9 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
       Tmux terminal multiplexer, and works on most Linux, BSD, and Mac
       distributions.
     '';
-    license = with lib.licenses; [ gpl3Plus ];
+    license = lib.licenses.gpl3Plus;
     mainProgram = "byobu";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ cbrxyz ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ca/caffeine-ng/fix-build.patch

@@ -13,12 +13,3 @@ index 3e4f9ea..5b82861 100644
  )
  
  dependency('pygobject-3.0')
-@@ -82,7 +78,7 @@ configure_file(
- 
- install_data(
-   'share/applications/caffeine.desktop',
--  install_dir: '/etc/xdg/autostart',
-+  install_dir: join_paths(get_option('sysconfdir'), 'xdg/autostart'),
- )
- 
- install_data(

pkgs/by-name/ca/caffeine-ng/package.nix

@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "caffeine-ng";
-  version = "4.2.0";
+  version = "4.3.2";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "WhyNotHugo";
     repo = "caffeine-ng";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uYzLRZ+6ZgIwhSuJWRBpLYHgonX7sFXgUZid0V26V0Q=";
+    hash = "sha256-eJ/0lzE5X1WFhgTAgI/SOmtxPbK7ppTk90RWobPZk2o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/cargo-risczero/package.nix

@@ -49,6 +49,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "cargo-risczero";
     homepage = "https://risczero.com";
     license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/cd/cdncheck/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.2.39";
+  version = "1.2.40";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zBxNONUM5/7i7qmLzCl/xWadbP9FO9xWD/j96ncyIBo=";
+    hash = "sha256-awlLfO9YvsRwLRguCB+qDBYuqRkQb2Z+8gdTvzwDQYs=";
   };
 
   vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";

pkgs/by-name/cf/cfn-nag/package.nix

@@ -19,7 +19,6 @@ bundlerEnv {
     mainProgram = "cfn_nag";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
-      momeemt
       mathstlouis
     ];
     platforms = lib.platforms.unix;

pkgs/by-name/cl/clean-css-cli/package.nix

@@ -26,6 +26,6 @@ buildNpmPackage (finalAttrs: {
     changelog = "https://github.com/clean-css/clean-css-cli/blob/v${finalAttrs.version}/History.md";
     license = lib.licenses.mit;
     mainProgram = "cleancss";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/cl/clojure/package.nix

@@ -10,7 +10,9 @@
   rlwrap,
   makeWrapper,
   writeScript,
+  versionCheckHook,
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
   version = "1.12.5.1654";
@@ -31,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   # See https://github.com/clojure/brew-install/blob/1.10.3/src/main/resources/clojure/install/linux-install.sh
   installPhase =
@@ -69,11 +72,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   installCheckPhase = ''
+    runHook preInstallCheck
+
     CLJ_CONFIG=$TMPDIR CLJ_CACHE=$TMPDIR/.clj_cache $out/bin/clojure \
       -Spath \
       -Sverbose \
       -Scp $out/libexec/clojure-tools-${finalAttrs.version}.jar
+
+    runHook postInstallCheck
   '';
 
   passthru.updateScript = writeScript "update-clojure" ''
@@ -99,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://clojure.org/";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.epl10;
+    mainProgram = "clojure";
     longDescription = ''
       Clojure is a dynamic programming language that targets the Java
       Virtual Machine. It is designed to be a general-purpose language,

pkgs/by-name/co/corefonts/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   cabextract,
+  installFonts,
 }:
 
 let
@@ -76,7 +77,10 @@ stdenv.mkDerivation {
     ) fonts
   );
 
-  nativeBuildInputs = [ cabextract ];
+  nativeBuildInputs = [
+    cabextract
+    installFonts
+  ];
 
   buildCommand = ''
     for i in $exes; do
@@ -124,7 +128,9 @@ stdenv.mkDerivation {
     mv webdings.ttf  Webdings.ttf.tmp
     mv Webdings.ttf.tmp  Webdings.ttf
 
-    install -m444 -Dt $out/share/fonts/truetype *.ttf
+    # using buildCommand means no phases are run
+    # so we run the function ourselves
+    installFonts
 
     # Also put the EULA there to be on the safe side.
     cp ${eula} $out/share/fonts/truetype/eula.html

pkgs/by-name/cp/cpufetch/darwin-x86-sysctl.patch

@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -30,7 +30,7 @@
+ 			HEADERS += $(SRC_DIR)freq/freq.h
+ 			CFLAGS += -pthread
+ 		endif
+-		ifeq ($(os), FreeBSD)
++		ifneq (,$(filter $(os),FreeBSD Darwin))
+ 			SOURCE += $(SRC_COMMON)sysctl.c
+ 			HEADERS += $(SRC_COMMON)sysctl.h
+ 		endif

pkgs/by-name/cp/cpufetch/package.nix

@@ -20,6 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
   ];
 
+  # Upstream Makefile bug: for x86 builds, sysctl.c is only added to
+  # SOURCE on FreeBSD even though cpuid.c calls get_sys_info_by_name
+  # (defined there) on darwin too. Without this the x86_64-darwin
+  # build fails to link with "Undefined symbols: _get_sys_info_by_name".
+  # Widen the conditional to cover Darwin alongside FreeBSD.
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+    ./darwin-x86-sysctl.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/da/dashy-ui/package.nix

@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "4.2.2";
+  version = "4.3.3";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-8oShyf4TfHjPG/yxK1sbZA5gHyqOQYqfoUEDQlaJgU0=";
+    hash = "sha256-3uzitxmaFKWrB8NOEFs2eEOqqYDW9R8pH1VAMEutBKU=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-5a2ypu6A4WOGdcm6HlvuzuCEgq3szd64zqTp/rmnjh4=";
+    hash = "sha256-5yYaOZk/SiR5vvM860JQkH3/TjVOFMnqwRlxxziKMr8=";
   };
 
   passthru = {