Merge release-26.05 into staging-next-26.05

nixos/modules/module-list.nix

@@ -827,6 +827,7 @@
   ./services/misc/anki-sync-server.nix
   ./services/misc/apache-kafka.nix
   ./services/misc/atuin.nix
+  ./services/misc/aurral.nix
   ./services/misc/autobrr.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix

nixos/modules/services/misc/aurral.nix

@@ -0,0 +1,185 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.aurral;
+in
+{
+  options = {
+    services.aurral = {
+      enable = lib.mkEnableOption "Aurral is the Lidarr companion for self-hosted music discovery";
+
+      package = lib.mkPackageOption pkgs "aurral" { };
+
+      directories = lib.mkOption {
+        type = lib.types.listOf lib.types.externalPath;
+        default = [ ];
+        description = ''
+          Directories that Aurral needs access to. Other directories won't be visible by the app.
+          Environment variable `DOWNLOAD_FOLDER` is added automatically.
+          See BindPaths in {manpage}`systemd.exec(5)`.
+        '';
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.externalPath;
+        default = "/var/lib/aurral";
+        description = ''
+          The directory where Aurral stores its stateful data.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 3001;
+        description = "Port number";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for Aurral.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          User account under which Aurral runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          Group under which Aurral runs.
+        '';
+      };
+
+      environment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          DOWNLOAD_FOLDER = "/media/downloads";
+          TRUST_PROXY = "true";
+        };
+        description = ''
+          Environment variables passed to the service.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
+        '';
+      };
+
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.aurral = {
+      description = "Aurral";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment // {
+        AURRAL_DATA_DIR = cfg.dataDir;
+        PORT = toString cfg.port;
+      };
+
+      path = [ cfg.package ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/aurral") "aurral";
+        WorkingDirectory = cfg.dataDir;
+        ReadWritePaths = "";
+        ProtectSystem = "strict";
+        BindPaths = [
+          cfg.dataDir
+        ]
+        ++ (lib.map (x: "-" + x) cfg.directories)
+        ++ lib.optional (cfg.environment ? DOWNLOAD_FOLDER) cfg.environment.DOWNLOAD_FOLDER;
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
+          "-/etc/resolv.conf"
+        ]
+        ++ lib.optionals config.services.resolved.enable [
+          "/run/systemd/resolve/stub-resolv.conf"
+          "/run/systemd/resolve/resolv.conf"
+        ];
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        SocketBindDeny = "any";
+        SocketBindAllow = toString cfg.port;
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0007";
+        SystemCallArchitectures = "native";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        DevicePolicy = "closed";
+        PrivateIPC = true;
+        PrivatePIDs = true;
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectHostname = true;
+        RemoveIPC = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = false;
+      };
+
+      confinement.enable = true;
+    };
+
+    systemd.tmpfiles.settings."10-aurral" = lib.mkIf (cfg.environment ? DOWNLOAD_FOLDER) {
+      ${cfg.environment.DOWNLOAD_FOLDER}.d = {
+        inherit (cfg) user group;
+        mode = "0770";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "aurral") {
+      aurral = {
+        isSystemUser = true;
+        home = cfg.dataDir;
+        group = cfg.group;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "aurral") {
+      aurral = { };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}

nixos/modules/services/networking/syncthing.nix

@@ -1044,7 +1044,7 @@ in
       };
       syncthing-init = mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
-        requisite = [ "syncthing.service" ];
+        requires = [ "syncthing.service" ];
         after = [ "syncthing.service" ];
         wantedBy = [ "multi-user.target" ];
 

nixos/modules/services/web-apps/invoiceplane.nix

@@ -332,6 +332,18 @@ in
             assertion = cfg.cron.enable -> cfg.cron.key != null;
             message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
           }
+          {
+            assertion =
+              (lib.versionAtLeast (pkg hostName cfg).version "1.7.2" && cfg.invoiceTemplates != [ ])
+              -> cfg.settings ? CUSTOM_INVOICE_TEMPLATES_PDF;
+            message = ''services.invoiceplane.sites."${hostName}".invoiceTemplates is set but settings.CUSTOM_INVOICE_TEMPLATES_PDF is not. Since InvoicePlane >= 1.7.2 (current: ${cfg.package.version}), the filename of the custom invoice template PHP file must be explicitly whitelisted via settings.CUSTOM_INVOICE_TEMPLATES_PDF, otherwise it will not be picked up.'';
+          }
+          {
+            assertion =
+              (lib.versionAtLeast (pkg hostName cfg).version "1.7.2" && cfg.quoteTemplates != [ ])
+              -> cfg.settings ? CUSTOM_QUOTE_TEMPLATES_PDF;
+            message = ''services.invoiceplane.sites."${hostName}".quoteTemplates is set but settings.CUSTOM_QUOTE_TEMPLATES_PDF is not. Since InvoicePlane >= 1.7.2 (current: ${cfg.package.version}), the filename of the custom quote template PHP file must be explicitly whitelisted via settings.CUSTOM_QUOTE_TEMPLATES_PDF, otherwise it will not be picked up.'';
+          }
         ]) eachSite
       );
 

nixos/tests/all-tests.nix

@@ -245,6 +245,7 @@ in
   audiobookshelf = runTest ./audiobookshelf.nix;
   audit = runTest ./audit.nix;
   audit-testsuite = runTest ./audit-testsuite.nix;
+  aurral = runTest ./aurral.nix;
   auth-mysql = runTest ./auth-mysql.nix;
   authelia = runTest ./authelia.nix;
   auto-cpufreq = runTest ./auto-cpufreq.nix;

nixos/tests/aurral.nix

@@ -0,0 +1,29 @@
+{ lib, ... }:
+{
+  name = "aurral";
+  meta = with lib.maintainers; {
+    maintainers = [ hougo ];
+  };
+
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.aurral = {
+          enable = true;
+          environment = {
+            DOWNLOAD_FOLDER = "/var/lib/aurral-downloads";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("aurral.service")
+    machine.wait_for_open_port(3001)
+
+    machine.succeed('curl --fail http://localhost:3001/api/health')
+  '';
+}

pkgs/by-name/au/aurral/package.json.patch

@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 5e1328e5..0f289597 100644
+--- a/package.json
++++ b/package.json
+@@ -4,9 +4,7 @@
+   "description": "Aurral artist request manager",
+   "private": true,
+   "type": "module",
+-  "engines": {
+-    "node": "22.23.x"
+-  },
++  "files": ["backend/*", "frontend/dist/*", "lib/*"],
+   "workspaces": [
+     "backend",
+     "frontend"

pkgs/by-name/au/aurral/package.nix

@@ -0,0 +1,114 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  nodejs_26,
+  sqlite,
+  ffmpeg,
+  yt-dlp,
+  jemalloc,
+  runtimeShell,
+  makeFontsConf,
+  noto-fonts-color-emoji,
+  dejavu_fonts,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "aurral";
+  version = "2.8.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "lklynet";
+    repo = "aurral";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+  };
+
+  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
+  # Remove engine constraint not matching upstream dockerfile.
+  patches = [
+    ./package.json.patch
+  ];
+
+  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+
+  nodejs = nodejs_26;
+
+  env.VITE_APP_VERSION = finalAttrs.version;
+
+  npmInstallFlags = [
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  npmBuildFlags = [ "--workspace=frontend" ];
+
+  npmPruneFlags = [
+    "--workspace=backend"
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  postInstall = ''
+    mkdir $out/bin
+    cat > $out/bin/aurral <<EOL
+    #!${runtimeShell} -e
+    export LD_PRELOAD=${lib.getLib jemalloc}/lib/libjemalloc.so
+    export LD_LIBRARY_PATH=${
+      lib.makeLibraryPath [
+        sqlite
+      ]
+    }
+    export PATH=${
+      lib.makeBinPath [
+        finalAttrs.nodejs
+        ffmpeg
+        yt-dlp
+      ]
+    }\''${PATH:+:}\$PATH
+    export FONTCONFIG_FILE=${
+      makeFontsConf {
+        fontDirectories = [
+          noto-fonts-color-emoji
+          dejavu_fonts
+        ];
+      }
+    }
+    export APP_VERSION=${finalAttrs.version}
+    export NODE_ENV=production
+    case "\$1" in
+        resetAdminPassword)
+        exec node $out/lib/node_modules/aurral/backend/scripts/resetAdminPassword.js "\$@"
+        ;;
+        server|"")
+        exec node $out/lib/node_modules/aurral/backend/server.js
+        ;;
+        -h|--help|*)
+        echo "Usage: (server|resetAdminPassword)"
+        echo
+        echo "We recommend using it in the service namespace. Example:"
+        echo "sudo nsenter -t \\\$(systemctl show --property MainPID --value aurral.service) -a -e -S follow -G follow aurral resetAdminPassword -g"
+        ;;
+    esac
+    EOL
+    chmod +x $out/bin/aurral
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Aurral is the Lidarr companion for self-hosted music discovery";
+    mainProgram = "aurral";
+    homepage = "https://aurral.org";
+    changelog = "https://github.com/lklynet/aurral/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.aarch64);
+    maintainers = with lib.maintainers; [
+      hougo
+      staticdev
+    ];
+  };
+})

pkgs/by-name/ca/cadabra2/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
 
   cmake,
   pkg-config,
@@ -51,6 +52,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Pbk9SmJ64CZ+yxMj53JpxULBQye2ETDi8xNKw38cC9k=";
   };
 
+  patches = [
+    # Backport a MicroTeX fix for fontconfig >= 2.18.
+    # Remove once cadabra2 updates its MicroTeX submodule to 7944eb4 or later.
+    (fetchpatch2 {
+      name = "microtex-fix-recent-fontconfig-build.patch";
+      url = "https://github.com/kpeeters/MicroTeX/commit/7944eb496dec1b7ff8af4c13e0cfee279eea30b8.patch?full_index=1";
+      extraPrefix = "submodules/microtex/";
+      stripLen = 1;
+      hash = "sha256-mobQF8uZGF1bdddYoyAxrZ4XhbMwUuK8kLwjmVrZZh0=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'MESSAGE(FATAL_ERROR "Building with -DPACKAGING_MODE=ON also requires -DCMAKE_INSTALL_PREFIX=/usr")' ""

pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py

@@ -258,10 +258,7 @@ cfgmisc = """\
     alsa.support32Bit = true;
     pulse.enable = true;
     # If you want to use JACK applications, uncomment this
-    #jack.enable = true;
-
-    # Use the WirePlumber session manager
-    #wireplumber.enable = true;
+    # jack.enable = true;
   };
 
   # Enable touchpad support (enabled default in most desktopManager).

pkgs/by-name/cr/croaring/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croaring";
-  version = "5.1.1";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "RoaringBitmap";
     repo = "CRoaring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I9ioukybY8NXBFmQd9xFyrd9Ye2FuGTewuX1pCQscQM=";
+    hash = "sha256-BDQpqRlle9mjlybOjxctwxkP5rQl2y673EnpthjFbBA=";
   };
 
   # roaring.pc.in cannot handle absolute CMAKE_INSTALL_*DIRs, nor

pkgs/by-name/gv/gvfs/package.nix

@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvfs";
-  version = "1.60.2";
+  version = "1.60.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gvfs/${lib.versions.majorMinor finalAttrs.version}/gvfs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qNd0RhWkiKVZMC/gzI9BjVtEq6PCuiFj5anm9gfBvpo=";
+    hash = "sha256-TLIdURwuKVEamfOhk96qkUqLt9njciKGc8awha/2P0s=";
   };
 
   patches = [

pkgs/by-name/in/invoiceplane/package.nix

@@ -11,7 +11,7 @@
   fetchzip,
 }:
 let
-  version = "1.7.1";
+  version = "1.7.2";
   # Fetch release tarball which contains language files
   # https://github.com/InvoicePlane/InvoicePlane/issues/1170
   languages = fetchzip {
@@ -27,13 +27,13 @@ php.buildComposerProject2 (finalAttrs: {
     owner = "InvoicePlane";
     repo = "InvoicePlane";
     tag = "v${version}";
-    hash = "sha256-Nci5GaCMYIjewq0W5emE6TDgc6JPz4bVVF3okNtHUag=";
+    hash = "sha256-LC/c1wdVNguv8BrrY7ysVwomgG8uTPoY1Fw8/EPFk2I=";
   };
 
   # Composer.lock validation currently fails for unknown reason
   composerStrictValidation = true;
 
-  vendorHash = "sha256-adKvKWo55SSbEKpgMJzR9vJQA8DnNXOTfSzp7t8s2Nk=";
+  vendorHash = "sha256-BRNglvJMREFD9iHPqXycw1WYlxuV9fL8/Zoba2Z3p8w=";
 
   nativeBuildInputs = [
     yarnConfigHook
@@ -45,7 +45,7 @@ php.buildComposerProject2 (finalAttrs: {
 
   offlineCache = fetchYarnDeps {
     inherit (finalAttrs) src patches;
-    hash = "sha256-rJlOYMnzFKui+caIFD4d82Q/RcDYnadeJ1G56fcNNQY=";
+    hash = "sha256-faEq9sVsE5xcqL07IIEmXcavcWPZicb7asmuhuBI+h4=";
   };
 
   postBuild = ''
@@ -57,7 +57,7 @@ php.buildComposerProject2 (finalAttrs: {
     chmod -R u+w $out/share
     mv $out/share/php/invoiceplane/* $out/
     cp -r ${languages}/application/language $out/application/
-    rm -r $out/{composer.json,composer.lock,CONTRIBUTING.md,docker-compose.yml,Gruntfile.js,package.json,node_modules,yarn.lock,share}
+    rm -r $out/{composer.json,composer.lock,docker-compose.yml,Gruntfile.js,package.json,node_modules,yarn.lock,share}
   '';
 
   passthru.tests = {

pkgs/by-name/ki/kimai/package.nix

@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.65.0";
+  version = "2.66.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-lqKHXf5pksyZpKEf3ZIey2ub/3Q9b/Gik7NH+B2ZgAE=";
+    hash = "sha256-cL7XhcNkuXsDV9rbjXTt9N+3pN9lPqUEiuVZ9ZrHx4w=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-0nOmdnpGzUszBiAYH0sdkT4UCJc8Sd8eihBQE5Vo4Lo=";
+  vendorHash = "sha256-TpQV62iRp9zEZsxbqg1EUt/dvU7NzS+K0J4gwcoBiPI=";
 
   composerNoPlugins = false;
   postInstall = ''

pkgs/by-name/li/libmtp/package.nix

@@ -3,7 +3,6 @@
   autoconf,
   automake,
   fetchFromGitHub,
-  fetchpatch,
   gettext,
   lib,
   libiconv,
@@ -15,29 +14,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmtp";
-  version = "1.1.22";
+  version = "1.1.23";
 
   src = fetchFromGitHub {
     owner = "libmtp";
     repo = "libmtp";
     rev = "libmtp-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    sha256 = "sha256-hIH6W8qQ6DB4ST7SlFz6CCnLsEGOWgmUb9HoHMNA3wY=";
+    sha256 = "sha256-FlPj9PEeOAWabU11dFTzDgY9TBbgmJclbeL0iULYw6A=";
   };
 
-  patches = [
-    # gettext-0.25 support
-    (fetchpatch {
-      name = "gettext-0.25.patch";
-      url = "https://github.com/libmtp/libmtp/commit/5e53ee68e61cc6547476b942b6aa9776da5d4eda.patch";
-      hash = "sha256-eXDNDHg8K+ZiO9n4RqQPJrh4V9GNiK/ZxZOA/oIX83M=";
-    })
-    (fetchpatch {
-      name = "gettext-0.25-p2.patch";
-      url = "https://github.com/libmtp/libmtp/commit/122eb9d78b370955b9c4d7618b12a2429f01b81a.patch";
-      hash = "sha256-Skqr6REBl/Egf9tS5q8k5qmEhFY+rG2fymbiu9e4Mho=";
-    })
-  ];
-
   outputs = [
     "bin"
     "dev"

pkgs/by-name/ma/mago/package.nix

@@ -11,17 +11,17 @@
 
 rustPackages_1_97.rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mago";
-  version = "1.47.5";
+  version = "1.47.6";
 
   src = fetchFromGitHub {
     owner = "carthage-software";
     repo = "mago";
     tag = finalAttrs.version;
-    hash = "sha256-IUz1BrwJnx+VXq89YbuN6kR7CzCZzkTOG1pQQ9+NpA4=";
+    hash = "sha256-stb+grYjtflzM90qCK8S/uIQVnOuenhIsQlN+zBhm0g=";
     forceFetchGit = true; # Does not download all files otherwise
   };
 
-  cargoHash = "sha256-r9YgTFIBa3HoKEpDH3SLqmXLLd5HNPCznf/mo1si2rw=";
+  cargoHash = "sha256-f+EjMcImL5hwN06/hUn0Y3jlk1vxcxqqNwyrpGxL3T8=";
 
   env = {
     # Get openssl-sys to use pkg-config

pkgs/by-name/mo/modrinth-app-unwrapped/package.nix

@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.19.1";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-71Irrg5rAAil82z3ezPOI/SpqbdrPpWNZTk4zn9FNU0=";
+    hash = "sha256-PAoRh9McFvX3+F3KdwXoDbgTsrQEnhGIvA0XWCAKn2A=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-7Kl3sQe+A/68yjzX5F9o60x2JehETn7blMScKIr/f9U=";
+  cargoHash = "sha256-HQYHggmfKlzhgKoP/lnC8wlcUc5BQ8sAjgaKuTUZZus=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-I1tFnuMlKn+67drRN1ZajA6j5b21yn+mAxWguWB885Q=";
+    hash = "sha256-A8mxLcpBX82iZkC66XhdziOvzLxEALEdFw3MBoLLNoo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/n8/n8n/package.nix

@@ -4,7 +4,7 @@
   nixosTests,
   fetchFromGitHub,
   nodejs,
-  pnpm_10,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   python3,
@@ -27,25 +27,25 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.36.7";
+  version = "2.37.10";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-g0cIcvs3HMypQ0Y52R27GUGH03r6U4p0htLHUh5CIOA=";
+    hash = "sha256-cEWwXiyBLiZ8MgH5OKe0+hgd9ooYZTDQIuS4Dq0nKos=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-bzYKeZ5ruIef62FnCG0mtnT9ssn/EETmUqGCA8GhkxQ=";
+    hash = "sha256-T1axKjZT1I8NjXFV8hAKSYa+zCl/Fpyzz2DGM+cmkLQ=";
   };
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_10
+    pnpm_11
     python3 # required to build sqlite3 bindings
     node-gyp # required to build sqlite3 bindings
     makeWrapper
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     rm node_modules/.modules.yaml
     rm packages/nodes-base/dist/types/nodes.json
 
-    CI=true pnpm --ignore-scripts prune --prod
+    CI=true pnpm --ignore-scripts prune --prod -w
     find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
     rm -rf node_modules/.pnpm/{typescript*,prettier*}
     shopt -s globstar

pkgs/by-name/pr/prismlauncher-unwrapped/package.nix

@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prismlauncher-unwrapped";
-  version = "11.0.3";
+  version = "11.1.0";
 
   src = fetchFromGitHub {
     owner = "PrismLauncher";
     repo = "PrismLauncher";
     tag = finalAttrs.version;
-    hash = "sha256-0o31pLKnYY0mulLrZKzZtaTPzCviGsgCnEcBt0Y/aG4=";
+    hash = "sha256-bt2ofUj4PXWKNmdACMpXtbVWdNz1aBOUTrPnOsM7NCA=";
   };
 
   postUnpack = ''

pkgs/by-name/sh/sharedown/package.nix

@@ -15,11 +15,11 @@
   libsecret,
   ffmpeg,
   yt-dlp,
-  electron_41,
+  electron_43,
   chromium,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 buildNpmPackage (finalAttrs: {
   pname = "Sharedown";

pkgs/by-name/si/simplex-chat-desktop/package.nix

@@ -7,16 +7,16 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "7.0.1";
+  version = "7.0.2";
 
   sources = {
     "aarch64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-aarch64.AppImage";
-      hash = "sha256-p8vpMdqRgxGANaDs8G1brNRYCEvdghHLJFNfGfuK9rs=";
+      hash = "sha256-VNQaDtd32pFIkSILxuUKFjsfns5SLOqpY0W4bWK7iKs=";
     };
     "x86_64-linux" = fetchurl {
       url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-      hash = "sha256-7GJLmnr8R3x6H4Rf2aiyJic0mn5g03srw42B/Iz43Cc=";
+      hash = "sha256-hYf5f1F4u4fvxWsmHAHJhSh5QdTNzfdADptotlsXEcE=";
     };
   };
 

pkgs/by-name/sm/sm64coopdx/package.nix

@@ -40,13 +40,13 @@ in
 # note: there is a generic builder in pkgs/games/sm64ex/generic.nix that is meant to help build sm64ex and its forks; however sm64coopdx has departed significantly enough in its build that it doesn't make sense to use that other than the baseRom derivation
 stdenv.mkDerivation (finalAttrs: {
   pname = "sm64coopdx";
-  version = "1.4.1";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "coop-deluxe";
     repo = "sm64coopdx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BIdKKIp6q9Vp2DByXzT9CJzOszFhjriiWBEqFwUT28M=";
+    hash = "sha256-AadjXTjUBnSbHP8tRHKvWotW58s5tMUJGtxbdPxYg6E=";
   };
 
   patches = [ ./no-update-check.patch ];

pkgs/by-name/yt/ytdownloader/config-dir.patch

@@ -1,10 +1,9 @@
 --- a/main.js
 +++ b/main.js
-@@ -13,6 +13,15 @@
- const fs = require("fs");
- const path = require("path");
+@@ -19,6 +19,14 @@ const { platform } = require("os");
+ process.env.ELECTRON_DISABLE_SECURITY_WARNINGS = "true";
  autoUpdater.autoDownload = false;
-+
+ 
 +// Set the config directory to XDG_CONFIG_HOME/ytdownloader
 +const xdgConfigHome = process.env.XDG_CONFIG_HOME;
 +let configDir = app.getPath('home') + "/.config/ytdownloader";
@@ -13,6 +12,5 @@
 +}
 +app.setPath ('userData', configDir);
 +
- /**@type {BrowserWindow} */
- let win = null;
- let secondaryWindow = null;
+ const USER_DATA_PATH = app.getPath("userData");
+ const CONFIG_FILE_PATH = path.join(USER_DATA_PATH, "ytdownloader.json");

pkgs/by-name/yt/ytdownloader/package.nix

@@ -7,23 +7,23 @@
   ffmpeg-headless,
   yt-dlp,
   makeDesktopItem,
-  electron_41,
+  electron_43,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.19.3";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     tag = "v${version}";
-    hash = "sha256-6HYVNtjGOQICiby4je3iYG9mPGMEXWTY+87HuUMaA2A=";
+    hash = "sha256-chTaQ0nHTtdIhMo4GBSoQ6YbqDy8HNj190JNUt5nDiE=";
   };
 
-  npmDepsHash = "sha256-FiWtZBixg7iz/9YgqnhIIG6MYNql7ITOUXH7aBBv7Co=";
+  npmDepsHash = "sha256-Czs09QnQ7lnNjgysvSb7TFKz6t8ChvoT+1KzHFJ87SA=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [
@@ -55,22 +55,24 @@ buildNpmPackage rec {
   # Otherwise it stores config in ~/.config/Electron
   patches = [ ./config-dir.patch ];
 
-  # Replace hardcoded ffmpeg and ytdlp paths
-  # Also stop it from downloading ytdlp
   postPatch = ''
-    substituteInPlace src/renderer.js \
-      --replace-fail $\{__dirname}/../ffmpeg '${lib.getExe ffmpeg-headless}' \
-      --replace-fail 'path.join(os.homedir(), ".ytDownloader", "ytdlp")' '`${lib.getExe yt-dlp}`' \
-      --replace-fail 'let ytDlpIsPresent = false;' 'let ytDlpIsPresent = true;'
     # Disable auto-updates
     substituteInPlace src/preferences.js \
       --replace-warn 'const autoUpdateDisabled = getId("autoUpdateDisabled");' 'const autoUpdateDisabled = "true";'
   '';
 
   postInstall = ''
+    # Set paths to use system ffmpeg and yt-dlp to prevent downloading
     makeWrapper ${electron}/bin/electron $out/bin/ytdownloader \
         --add-flags $out/lib/node_modules/ytdownloader/main.js \
-        --prefix PATH : ${lib.makeBinPath [ ffmpeg-headless ]}
+        --set YTDOWNLOADER_FFMPEG_PATH "${lib.getExe ffmpeg-headless}" \
+        --set YTDOWNLOADER_YTDLP_PATH "${lib.getExe yt-dlp}" \
+        --prefix PATH : ${
+          lib.makeBinPath [
+            ffmpeg-headless
+            yt-dlp
+          ]
+        }
 
     install -Dm444 assets/images/icon.png $out/share/icons/hicolor/512x512/apps/ytdownloader.png
   '';

pkgs/development/tools/pnpm/generic.nix

@@ -65,6 +65,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       cp -R . $out/libexec/pnpm
       ln -s $out/libexec/pnpm/bin/pnpm.${ext} $out/bin/pnpm
       ln -s $out/libexec/pnpm/bin/pnpx.${ext} $out/bin/pnpx
+      ln -s pnpm $out/bin/pn
+      ln -s pnpx $out/bin/pnx
 
       runHook postInstall
     '';

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.50";
-      hash = "sha256-ZTzKkPGkkzfIgeQc6DOKSW4cCObamH117OjgNVm9cDU=";
+      version = "6.18.51";
+      hash = "sha256-9iUOgXffGPXMgtxP2Dh0iWDwqi/iFc21CZsle3B7SSw=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.2.4";
-      hash = "sha256-Qih/0v0WE5XJueOn93JhG0WhEaI1bfFi0wua4yP9zSo=";
+      version = "7.2.5";
+      hash = "sha256-PQDZPcIc+F7dAkb0/3S0Ft7b2JYvQ9BldSyCifEIcpM=";
     };
   };
 

pkgs/os-specific/linux/nftables/python.nix

@@ -4,13 +4,16 @@
   nftables,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "nftables";
   inherit (nftables) version src;
   pyproject = true;
 
+  __structuredAttrs = true;
+
   postPatch = ''
     substituteInPlace "src/nftables.py" \
+      --replace-fail 'NFTABLES_VERSION = "0.1"' 'NFTABLES_VERSION = "${finalAttrs.version}"' \
       --replace-fail "libnftables.so.1" "${nftables}/lib/libnftables.so.1"
   '';
 
@@ -29,4 +32,4 @@ buildPythonPackage {
       maintainers
       ;
   };
-}
+})