Merge 873183508c into haskell-updates

doc/README.md

@@ -34,7 +34,27 @@ $ nix-build doc
 
 If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.html`.
 
-### devmode
+### Development environment
+
+In order to reduce repetition, consider using tools from the provided development environment:
+
+Load it from the Nixpkgs documentation directory with
+
+```ShellSession
+$ cd /path/to/nixpkgs/doc
+$ nix-shell
+```
+
+To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
+
+Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
+
+```
+/**/.envrc
+/**/.direnv
+```
+
+#### `devmode`
 
 The shell in the manual source directory makes available a command, `devmode`.
 It is a daemon, that:

doc/doc-support/package.nix

@@ -14,8 +14,8 @@
   nixpkgs ? { },
   markdown-code-runner,
   roboto,
+  treefmt,
 }:
-
 stdenvNoCC.mkDerivation (
   finalAttrs:
   let
@@ -47,6 +47,8 @@ stdenvNoCC.mkDerivation (
 
     postPatch = ''
       ln -s ${optionsJSON}/share/doc/nixos/options.json ./config-options.json
+      ln -s ${treefmt.functionsDoc.markdown} ./packages/treefmt-functions.section.md
+      ln -s ${treefmt.optionsDoc.optionsJSON}/share/doc/nixos/options.json ./treefmt-options.json
     '';
 
     buildPhase = ''
@@ -97,14 +99,14 @@ stdenvNoCC.mkDerivation (
       dest="$out/share/doc/nixpkgs"
       mkdir -p "$(dirname "$dest")"
       mv out "$dest"
-      mv "$dest/index.html" "$dest/manual.html"
+      cp "$dest/index.html" "$dest/manual.html"
 
       cp ${roboto.src}/web/Roboto\[ital\,wdth\,wght\].ttf "$dest/Roboto.ttf"
 
       cp ${epub} "$dest/nixpkgs-manual.epub"
 
       mkdir -p $out/nix-support/
-      echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
+      echo "doc manual $dest index.html" >> $out/nix-support/hydra-build-products
       echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
 
       runHook postInstall
@@ -123,7 +125,7 @@ stdenvNoCC.mkDerivation (
         let
           devmode' = devmode.override {
             buildArgs = toString ../.;
-            open = "/share/doc/nixpkgs/manual.html";
+            open = "/share/doc/nixpkgs/index.html";
           };
           nixos-render-docs-redirects' = writeShellScriptBin "redirects" "${lib.getExe nixos-render-docs-redirects} --file ${toString ../redirects.json} $@";
         in

doc/packages/index.md

@@ -25,6 +25,7 @@ nginx.section.md
 opengl.section.md
 shell-helpers.section.md
 python-tree-sitter.section.md
+treefmt.section.md
 steam.section.md
 cataclysm-dda.section.md
 urxvt.section.md

doc/packages/treefmt.section.md

@@ -0,0 +1,23 @@
+# treefmt {#treefmt}
+
+[treefmt](https://github.com/numtide/treefmt) streamlines the process of applying formatters to your project, making it a breeze with just one command line.
+
+The [`treefmt` package](https://search.nixos.org/packages?channel=unstable&show=treefmt)
+provides functions for configuring treefmt using the module system, which are [documented below](#sec-functions-library-treefmt), along with [their options](#sec-treefmt-options-reference).
+
+Alternatively, treefmt can be configured using [treefmt-nix](https://github.com/numtide/treefmt-nix).
+
+```{=include=} sections auto-id-prefix=auto-generated-treefmt-functions
+treefmt-functions.section.md
+```
+
+## Options Reference {#sec-treefmt-options-reference}
+
+The following attributes can be passed to [`withConfig`](#pkgs.treefmt.withConfig) or [`evalConfig`](#pkgs.treefmt.evalConfig):
+
+```{=include=} options
+id-prefix: opt-treefmt-
+list-id: configuration-variable-list
+source: ../treefmt-options.json
+```
+

doc/redirects.json

@@ -72,6 +72,15 @@
   "part-toolchains": [
     "index.html#part-toolchains"
   ],
+  "pkgs.treefmt.buildConfig": [
+    "index.html#pkgs.treefmt.buildConfig"
+  ],
+  "pkgs.treefmt.evalConfig": [
+    "index.html#pkgs.treefmt.evalConfig"
+  ],
+  "pkgs.treefmt.withConfig": [
+    "index.html#pkgs.treefmt.withConfig"
+  ],
   "preface": [
     "index.html#preface"
   ],
@@ -111,6 +120,9 @@
   "sec-building-packages-with-llvm-using-clang-stdenv": [
     "index.html#sec-building-packages-with-llvm-using-clang-stdenv"
   ],
+  "sec-functions-library-treefmt": [
+    "index.html#sec-functions-library-treefmt"
+  ],
   "sec-inkscape": [
     "index.html#sec-inkscape"
   ],
@@ -408,6 +420,9 @@
   "sec-tools-of-stdenv": [
     "index.html#sec-tools-of-stdenv"
   ],
+  "sec-treefmt-options-reference": [
+    "index.html#sec-treefmt-options-reference"
+  ],
   "ssec-cosmic-common-issues": [
     "index.html#ssec-cosmic-common-issues"
   ],
@@ -483,6 +498,9 @@
   "tester-testEqualArrayOrMap-return": [
     "index.html#tester-testEqualArrayOrMap-return"
   ],
+  "treefmt": [
+    "index.html#treefmt"
+  ],
   "typst": [
     "index.html#typst",
     "doc/languages-frameworks/typst.section.md#typst"

doc/release-notes/rl-2505.section.md

@@ -374,6 +374,7 @@
   - `i18n.extraLocales` should now be the preferred way to install additional locales.
   - `i18n.supportedLocales` is now considered an implementation detail and will be hidden from the documentation. But the option will still continue to work.
   - `i18n.supportedLocales` will now trigger a warning when it omits any locale set in `i18n.defaultLocale`, `i18n.extraLocales` or `i18n.extraLocaleSettings`.
+  - The options `i18n.defaultCharset` & `i18n.localeCharsets` were added, and they complement `i18n.defaultLocale` & `i18n.extraLocaleSettings` respectively - allowing to control the character set used per locale setting.
 
 - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs []{#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}.
 

maintainers/maintainer-list.nix

@@ -13973,6 +13973,12 @@
     github = "LogicalOverflow";
     githubId = 5919957;
   };
+  lheintzmann1 = {
+    email = "lheintzmann1@disroot.org";
+    github = "lheintzmann1";
+    githubId = 141759313;
+    name = "Lucas Heintzmann";
+  };
   lhvwb = {
     email = "nathaniel.baxter@gmail.com";
     github = "nathanielbaxter";
@@ -24620,6 +24626,15 @@
     githubId = 1220572;
     name = "Christian Theune";
   };
+  thevar1able = {
+    email = "var1able+nixpkgs@var1able.network";
+    github = "thevar1able";
+    githubId = 875885;
+    name = "Konstantin Bogdanov";
+    keys = [
+      { fingerprint = "3221 7A73 EB95 0E9E E550  36A3 DB39 9448 D9FE 52F1"; }
+    ];
+  };
   theverygaming = {
     name = "theverygaming";
     github = "theverygaming";

nixos/doc/manual/contributing-to-this-manual.chapter.md

@@ -17,6 +17,28 @@ There's also [a convenient development daemon](https://nixos.org/manual/nixpkgs/
 
 The above instructions don't deal with the appendix of available `configuration.nix` options, and the manual pages related to NixOS. These are built, and written in a different location and in a different format, as explained in the next sections.
 
+## Development environment {#sec-contributing-development-env}
+
+In order to reduce repetition, consider using tools from the provided development environment:
+
+Load it from the NixOS documentation directory with
+
+```ShellSession
+$ cd /path/to/nixpkgs/nixos/doc/manual
+$ nix-shell
+```
+
+To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
+
+Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
+
+```
+/**/.envrc
+/**/.direnv
+```
+
+You might want to also use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md#devmode) while editing the manual.
+
 ## Testing redirects {#sec-contributing-redirects}
 
 Once you have a successful build, you can open the relevant HTML (path mentioned above) in a browser along with the anchor, and observe the redirection.

nixos/doc/manual/redirects.json

@@ -71,6 +71,9 @@
   "ch-installation": [
     "index.html#ch-installation"
   ],
+  "sec-contributing-development-env": [
+    "index.html#sec-contributing-development-env"
+  ],
   "sec-mattermost": [
     "index.html#sec-mattermost"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -348,6 +348,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
 
+- `gitlab` has been updated from 17.x to 18.x and requires `postgresql` >= 16, as stated in the [documentation](https://docs.gitlab.com/18.0/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+
 - `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.
 
 - `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -10,7 +10,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
@@ -18,6 +18,8 @@
 
 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
 
+- `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/config/i18n.nix

@@ -5,15 +5,19 @@
   ...
 }:
 let
+  sanitizeUTF8Capitalization =
+    lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
   aggregatedLocales =
-    (builtins.map
-      (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
-      (
-        [ config.i18n.defaultLocale ]
-        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
-        ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
-      )
-    )
+    [
+      "${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
+    ]
+    ++ lib.pipe config.i18n.extraLocaleSettings [
+      (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
+      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
+    ]
+    ++ (builtins.map sanitizeUTF8Capitalization (
+      lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
+    ))
     ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
 in
 {
@@ -48,16 +52,24 @@ in
         default = "en_US.UTF-8";
         example = "nl_NL.UTF-8";
         description = ''
-          The default locale.  It determines the language for program
-          messages, the format for dates and times, sort order, and so on.
-          It also determines the character set, such as UTF-8.
+          The default locale. It determines the language for program messages,
+          the format for dates and times, sort order, and so on. Setting the
+          default character set is done via {option}`i18n.defaultCharset`.
+        '';
+      };
+      defaultCharset = lib.mkOption {
+        type = lib.types.str;
+        default = "UTF-8";
+        example = "ISO-8859-8";
+        description = ''
+          The default locale character set.
         '';
       };
 
       extraLocales = lib.mkOption {
         type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
         default = [ ];
-        example = [ "nl_NL.UTF-8" ];
+        example = [ "nl_NL.UTF-8/UTF-8" ];
         description = ''
           Additional locales that the system should support, besides the ones
           configured with {option}`i18n.defaultLocale` and
@@ -74,9 +86,24 @@ in
           LC_TIME = "de_DE.UTF-8";
         };
         description = ''
-          A set of additional system-wide locale settings other than
-          `LANG` which can be configured with
-          {option}`i18n.defaultLocale`.
+          A set of additional system-wide locale settings other than `LANG`
+          which can be configured with {option}`i18n.defaultLocale`. Note that
+          the `/UTF-8` suffix used in {option}`i18n.extraLocales` indicates a
+          character set, and it must not be added manually here. To use a
+          non-`UTF-8` character set such as ISO-XXXX-8, the
+          {option}`i18n.localeCharsets` can be used.
+        '';
+      };
+      localeCharsets = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          LC_MESSAGES = "ISO-8859-15";
+          LC_TIME = "ISO-8859-1";
+        };
+        description = ''
+          Per each {option}`i18n.extraLocaleSettings`, choose the character set
+          to use for it. Essentially defaults to UTF-8 for all of them.
         '';
       };
 

nixos/modules/module-list.nix

@@ -331,6 +331,7 @@
   ./programs/vivid.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
+  ./programs/wayland/gtklock.nix
   ./programs/wayland/hyprland.nix
   ./programs/wayland/hyprlock.nix
   ./programs/wayland/labwc.nix
@@ -603,7 +604,6 @@
   ./services/games/archisteamfarm.nix
   ./services/games/armagetronad.nix
   ./services/games/crossfire-server.nix
-  ./services/games/deliantra-server.nix
   ./services/games/factorio.nix
   ./services/games/freeciv.nix
   ./services/games/mchprs.nix

nixos/modules/programs/wayland/gtklock.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.gtklock;
+  configFormat = pkgs.formats.ini {
+    listToValue = builtins.concatStringsSep ";";
+  };
+
+  inherit (lib)
+    types
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    ;
+in
+{
+  options.programs.gtklock = {
+    enable = mkEnableOption "gtklock, a GTK-based lockscreen for Wayland";
+
+    package = mkPackageOption pkgs "gtklock" { };
+
+    config = mkOption {
+      type = configFormat.type;
+      example = lib.literalExpression ''
+        {
+          main = {
+            idle-hide = true;
+            idle-timeout = 10;
+          };
+        }'';
+      description = ''
+        Configuration for gtklock.
+        See [`gtklock(1)`](https://github.com/jovanlanik/gtklock/blob/master/man/gtklock.1.scd) man page for details.
+      '';
+    };
+
+    style = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      description = ''
+        CSS Stylesheet for gtklock.
+        See [gtklock's wiki](https://github.com/jovanlanik/gtklock/wiki#Styling) for details.
+      '';
+    };
+
+    modules = mkOption {
+      type = with types; listOf package;
+      default = [ ];
+      example = lib.literalExpression ''
+        with pkgs; [
+          gtklock-playerctl-module
+          gtklock-powerbar-module
+          gtklock-userinfo-module
+        ]'';
+      description = "gtklock modules to load.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.gtklock.config.main = {
+      style = lib.mkIf (cfg.style != null) "${pkgs.writeText "style.css" cfg.style}";
+
+      modules = lib.mkIf (cfg.modules != [ ]) (
+        map (pkg: "${pkg}/lib/gtklock/${lib.removePrefix "gtklock-" pkg.pname}.so") cfg.modules
+      );
+    };
+
+    environment.etc."xdg/gtklock/config.ini".source = configFormat.generate "config.ini" cfg.config;
+
+    environment.systemPackages = [ cfg.package ];
+
+    security.pam.services.gtklock = { };
+  };
+}

nixos/modules/services/accessibility/orca.nix

@@ -20,6 +20,7 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
+    systemd.services.display-manager.path = [ cfg.package ];
     services.speechd.enable = true;
   };
 }

nixos/modules/services/cluster/k3s/default.nix

@@ -46,8 +46,12 @@ let
       )
     );
 
-  # Replace characters that are problematic in file names
+  # Replace prefixes and characters that are problematic in file names
   cleanHelmChartName =
+    name:
+    let
+      woPrefix = lib.removePrefix "https://" (lib.removePrefix "oci://" name);
+    in
     lib.replaceStrings
       [
         "/"
@@ -56,7 +60,8 @@ let
       [
         "-"
         "-"
-      ];
+      ]
+      woPrefix;
 
   # Fetch a Helm chart from a public registry. This only supports a basic Helm pull.
   fetchHelm =
@@ -66,7 +71,12 @@ let
       version,
       hash ? lib.fakeHash,
     }:
-    pkgs.runCommand (cleanHelmChartName "${lib.removePrefix "https://" repo}-${name}-${version}.tgz")
+    let
+      isOci = lib.hasPrefix "oci://" repo;
+      pullCmd = if isOci then repo else "--repo ${repo} ${name}";
+      name' = if isOci then "${repo}-${version}" else "${repo}-${name}-${version}";
+    in
+    pkgs.runCommand (cleanHelmChartName "${name'}.tgz")
       {
         inherit (lib.fetchers.normalizeHash { } { inherit hash; }) outputHash outputHashAlgo;
         impureEnvVars = lib.fetchers.proxyImpureEnvVars;
@@ -76,9 +86,7 @@ let
         ];
       }
       ''
-        export HOME="$PWD"
-        helm repo add repository ${repo}
-        helm pull repository/${name} --version ${version}
+        helm pull ${pullCmd} --version ${version}
         mv ./*.tgz $out
       '';
 
@@ -724,7 +732,11 @@ in
               };
             };
           };
-
+          nginx = {
+            repo = "oci://registry-1.docker.io/bitnamicharts/nginx";
+            version = "20.0.0";
+            hash = "sha256-sy+tzB+i9jIl/tqOMzzuhVhTU4EZVsoSBtPznxF/36c=";
+          };
           custom-chart = {
             package = ../charts/my-chart.tgz;
             values = ../values/my-values.yaml;

nixos/modules/services/games/deliantra-server.nix

@@ -1,182 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.deliantra-server;
-  serverPort = 13327;
-in
-{
-  options.services.deliantra-server = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        If enabled, the Deliantra game server will be started at boot.
-      '';
-    };
-
-    package = lib.mkPackageOption pkgs "deliantra-server" {
-      extraDescription = ''
-        ::: {.note}
-        This will also be used for map/arch data, if you don't change {option}`dataDir`
-        :::
-      '';
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "${pkgs.deliantra-data}";
-      defaultText = lib.literalExpression ''"''${pkgs.deliantra-data}"'';
-      description = ''
-        Where to store readonly data (maps, archetypes, sprites, etc).
-        Note that if you plan to use the live map editor (rather than editing
-        the maps offline and then nixos-rebuilding), THIS MUST BE WRITEABLE --
-        copy the deliantra-data someplace writeable (say,
-        /var/lib/deliantra/data) and update this option accordingly.
-      '';
-    };
-
-    stateDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/deliantra";
-      description = ''
-        Where to store runtime data (save files, persistent items, etc).
-
-        If left at the default, this will be automatically created on server
-        startup if it does not already exist. If changed, it is the admin's
-        responsibility to make sure that the directory exists and is writeable
-        by the `crossfire` user.
-      '';
-    };
-
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Whether to open ports in the firewall for the server.
-      '';
-    };
-
-    configFiles = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      description = ''
-        Contents of the server configuration files. These will be appended to
-        the example configurations the server comes with and overwrite any
-        default settings defined therein.
-
-        The example here is not comprehensive. See the files in
-        /etc/deliantra-server after enabling this module for full documentation.
-      '';
-      example = lib.literalExpression ''
-        {
-          dm_file = '''
-            admin:secret_password:localhost
-            alice:xyzzy:*
-          ''';
-          motd = "Welcome to Deliantra!";
-          settings = '''
-            # Settings for game mechanics.
-            stat_loss_on_death true
-            armor_max_enchant 7
-          ''';
-          config = '''
-            # Settings for the server daemon.
-            hiscore_url https://deliantra.example.net/scores/
-            max_map_reset 86400
-          ''';
-        }
-      '';
-      default = {
-        motd = "";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.users.deliantra = {
-      description = "Deliantra server daemon user";
-      home = cfg.stateDir;
-      createHome = false;
-      isSystemUser = true;
-      group = "deliantra";
-    };
-    users.groups.deliantra = { };
-
-    # Merge the cfg.configFiles setting with the default files shipped with
-    # Deliantra.
-    # For most files this consists of reading
-    # ${deliantra}/etc/deliantra-server/${name} and appending the user setting
-    # to it.
-    environment.etc =
-      lib.attrsets.mapAttrs'
-        (
-          name: value:
-          lib.attrsets.nameValuePair "deliantra-server/${name}" {
-            mode = "0644";
-            text =
-              # Deliantra doesn't come with a motd file, but respects it if present
-              # in /etc.
-              (lib.optionalString (name != "motd") (
-                lib.fileContents "${cfg.package}/etc/deliantra-server/${name}"
-              ))
-              + "\n${value}";
-          }
-        )
-        (
-          {
-            motd = "";
-            settings = "";
-            config = "";
-            dm_file = "";
-          }
-          // cfg.configFiles
-        );
-
-    systemd.services.deliantra-server = {
-      description = "Deliantra Server Daemon";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      environment = {
-        DELIANTRA_DATADIR = "${cfg.dataDir}";
-        DELIANTRA_LOCALDIR = "${cfg.stateDir}";
-        DELIANTRA_CONFDIR = "/etc/deliantra-server";
-      };
-
-      serviceConfig = lib.mkMerge [
-        {
-          ExecStart = "${cfg.package}/bin/deliantra-server";
-          Restart = "always";
-          User = "deliantra";
-          Group = "deliantra";
-          WorkingDirectory = cfg.stateDir;
-        }
-        (lib.mkIf (cfg.stateDir == "/var/lib/deliantra") {
-          StateDirectory = "deliantra";
-        })
-      ];
-
-      # The deliantra server needs access to a bunch of files at runtime that
-      # are not created automatically at server startup; they're meant to be
-      # installed in $PREFIX/var/deliantra-server by `make install`. And those
-      # files need to be writeable, so we can't just point at the ones in the
-      # nix store. Instead we take the approach of copying them out of the store
-      # on first run. If `bookarch` already exists, we assume the rest of the
-      # files do as well, and copy nothing -- otherwise we risk ovewriting
-      # server state information every time the server is upgraded.
-      preStart = ''
-        if [ ! -e "${cfg.stateDir}"/bookarch ]; then
-          ${pkgs.rsync}/bin/rsync -a --chmod=u=rwX,go=rX \
-            "${cfg.package}/var/deliantra-server/" "${cfg.stateDir}/"
-        fi
-      '';
-    };
-
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ serverPort ];
-    };
-  };
-}

nixos/modules/services/misc/gitlab.nix

@@ -1237,8 +1237,8 @@ in
         message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
       }
       {
-        assertion = versionAtLeast postgresqlPackage.version "14.9";
-        message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        assertion = versionAtLeast postgresqlPackage.version "16";
+        message = "PostgreSQL >= 16 is required to run GitLab 18. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
       }
     ];
 

nixos/modules/services/misc/servarr/prowlarr.nix

@@ -13,6 +13,12 @@ in
     services.prowlarr = {
       enable = lib.mkEnableOption "Prowlarr, an indexer manager/proxy for Torrent trackers and Usenet indexers";
 
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/prowlarr";
+        description = "The directory where Prowlarr stores its data files.";
+      };
+
       package = lib.mkPackageOption pkgs "prowlarr" { };
 
       openFirewall = lib.mkOption {
@@ -24,30 +30,63 @@ in
       settings = servarr.mkServarrSettingsOptions "prowlarr" 9696;
 
       environmentFiles = servarr.mkServarrEnvironmentFiles "prowlarr";
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "prowlarr";
+        description = ''
+          User account under which Prowlarr runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "prowlarr";
+        description = ''
+          Group under which Prowlarr runs.
+        '';
+      };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    systemd.services.prowlarr = {
-      description = "Prowlarr";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings // {
-        HOME = "/var/empty";
+    systemd = {
+      services.prowlarr = {
+        description = "Prowlarr";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings;
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          EnvironmentFile = cfg.environmentFiles;
+          ExecStart = "${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'";
+          Restart = "on-failure";
+        };
       };
 
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "prowlarr";
-        EnvironmentFile = cfg.environmentFiles;
-        ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
-        Restart = "on-failure";
+      tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = {
+        inherit (cfg) user group;
+        mode = "0700";
       };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.settings.server.port ];
     };
+
+    users.users = lib.mkIf (cfg.user == "prowlarr") {
+      prowlarr = {
+        isSystemUser = true;
+        group = cfg.group;
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "prowlarr") {
+      prowlarr = { };
+    };
   };
 }

nixos/modules/system/boot/systemd/journald.nix

@@ -116,22 +116,19 @@ in
   };
 
   config = {
-    systemd.additionalUpstreamSystemUnits =
-      [
-        "systemd-journald.socket"
-        "systemd-journald@.socket"
-        "systemd-journald-varlink@.socket"
-        "systemd-journald.service"
-        "systemd-journald@.service"
-        "systemd-journal-flush.service"
-        "systemd-journal-catalog-update.service"
-        "systemd-journald-sync@.service"
-      ]
-      ++ (lib.optional (!config.boot.isContainer) "systemd-journald-audit.socket")
-      ++ [
-        "systemd-journald-dev-log.socket"
-        "syslog.socket"
-      ];
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-journald.socket"
+      "systemd-journald@.socket"
+      "systemd-journald-varlink@.socket"
+      "systemd-journald.service"
+      "systemd-journald@.service"
+      "systemd-journal-flush.service"
+      "systemd-journal-catalog-update.service"
+      "systemd-journald-sync@.service"
+      "systemd-journald-audit.socket"
+      "systemd-journald-dev-log.socket"
+      "syslog.socket"
+    ];
 
     systemd.sockets.systemd-journald-audit.wantedBy = [
       "systemd-journald.service"

nixos/tests/all-tests.nix

@@ -994,6 +994,7 @@ in
   orthanc = runTest ./orthanc.nix;
   owncast = handleTest ./owncast.nix { };
   outline = handleTest ./outline.nix { };
+  i18n = runTest ./i18n.nix;
   image-contents = handleTest ./image-contents.nix { };
   openvscode-server = handleTest ./openvscode-server.nix { };
   open-webui = runTest ./open-webui.nix;

nixos/tests/brscan5.nix

@@ -48,6 +48,10 @@ import ./make-test-python.nix (
       print(scanimage)
       assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
       assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
+
+      # Confirm systemd-udevd no longer logs errors about SYSFS
+      logs = machine.succeed('journalctl --unit systemd-udevd')
+      assert "Invalid key 'SYSFS'" not in logs
     '';
   }
 )

nixos/tests/i18n.nix

@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  name = "glibLocales-custom-builds";
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
+
+  nodes = {
+    nonUTF8Charset = {
+      i18n = {
+        defaultLocale = "en_US";
+        defaultCharset = "ISO-8859-1";
+      };
+    };
+    extraLocales1 = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocales = [
+          "nl_NL.UTF-8/UTF-8"
+        ];
+      };
+    };
+    extraLocaleSettings = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_MESSAGES = "en_US.UTF-8";
+          LC_TIME = "de_DE.UTF-8";
+        };
+      };
+    };
+    localeCharsets = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_TIME = "de_DE";
+        };
+        localeCharsets = {
+          LC_TIME = "ISO-8859-1";
+        };
+      };
+    };
+  };
+  testScript = { nodes, ... }: "";
+}

nixos/tests/k3s/default.nix

@@ -4,9 +4,11 @@
   lib ? pkgs.lib,
 }:
 let
-  allK3s = lib.filterAttrs (n: _: lib.strings.hasPrefix "k3s_" n) pkgs;
+  allK3s = lib.filterAttrs (
+    n: _: lib.strings.hasPrefix "k3s_" n && (builtins.tryEval pkgs.${n}).success
+  ) pkgs;
 in
-{
+lib.recurseIntoAttrs {
   airgap-images = lib.mapAttrs (
     _: k3s: import ./airgap-images.nix { inherit system pkgs k3s; }
   ) allK3s;

nixos/tests/kernel-generic.nix

@@ -42,6 +42,7 @@ let
       linux_6_6_hardened
       linux_6_12_hardened
       linux_6_13_hardened
+      linux_6_14_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15

nixos/tests/systemd-journal.nix

@@ -12,11 +12,23 @@ import ./make-test-python.nix (
     };
     nodes.auditd = {
       security.auditd.enable = true;
+      security.audit.enable = true;
       environment.systemPackages = [ pkgs.audit ];
+      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+      boot.kernelParams = [ "audit_backlog_limit=8192" ];
     };
     nodes.journaldAudit = {
       services.journald.audit = true;
+      security.audit.enable = true;
       environment.systemPackages = [ pkgs.audit ];
+      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+      boot.kernelParams = [ "audit_backlog_limit=8192" ];
+    };
+    nodes.containerCheck = {
+      containers.c1 = {
+        autoStart = true;
+        config = { };
+      };
     };
 
     testScript = ''
@@ -50,6 +62,16 @@ import ./make-test-python.nix (
         # logs ideally should NOT end up in kmesg, but they do due to
         # https://github.com/systemd/systemd/issues/15324
         journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+
+
+      with subtest("container systemd-journald-audit not running"):
+        containerCheck.wait_for_unit("multi-user.target");
+        containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
+
+        # systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
+        (status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
+        containerCheck.log(output)
+        assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
     '';
   }
 )

nixos/tests/tusd/default.nix

@@ -43,6 +43,7 @@ in
     client.succeed("${pkgs.coreutils}/bin/truncate --size=100M file-100M.bin")
 
     # Upload it.
+    client.wait_for_unit("network.target")
     client.succeed("${./tus-curl-upload.sh} file-100M.bin http://server:${toString port}/files/")
 
     print("Upload succeeded")

nixos/tests/vector/dnstap.nix

@@ -114,6 +114,7 @@ import ../make-test-python.nix (
       unbound.wait_for_file("${dnstapSocket}")
       unbound.succeed("test 770 -eq $(stat -c '%a' ${dnstapSocket})")
 
+      dnsclient.systemctl("start network-online.target")
       dnsclient.wait_for_unit("network-online.target")
       dnsclient.succeed(
         "dig @unbound test.local"

pkgs/applications/editors/vim/plugins/non-generated/nvim-spectre/default.nix

@@ -7,12 +7,12 @@
   vimUtils,
 }:
 let
-  version = "0-unstable-2025-04-28";
+  version = "0-unstable-2025-05-13";
   src = fetchFromGitHub {
     owner = "nvim-pack";
     repo = "nvim-spectre";
-    rev = "197150cd3f30eeb1b3fd458339147533d91ac385";
-    hash = "sha256-ATW1QJ2aXHcUtGK6MNLSq4VkML3FLQphVcLqfzoX9PI=";
+    rev = "72f56f7585903cd7bf92c665351aa585e150af0f";
+    hash = "sha256-WPEizIClDmseDEhomCasLx/zfAMT7lq7ZBnfc/a8CuA=";
   };
 
   spectre_oxi = rustPlatform.buildRustPackage {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1587,8 +1587,8 @@ let
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "17.0.3";
-          hash = "sha256-jU1N5tJ4V3jzSNW9oE8AH5PRhTmsiIGnu65+IH5NxO0=";
+          version = "17.1.0";
+          hash = "sha256-WPSMf1yLXSDqImpMTxn1eXcSrimVSVjjaXDzFMQ/l0E=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -1841,8 +1841,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.14";
-          hash = "sha256-iLF2kxhSw39JBIs5K6hVmrEKueS8C22rnKCs+CiphwY=";
+          version = "0.7.15";
+          hash = "sha256-BXilurHO9WATC0PhT/scpZWEiRhJ9cSlq59opEM6wlE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
@@ -2514,8 +2514,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.25.8";
-          hash = "sha256-/pnLLFj6Iwn14GLGbuc2Ex7IbNmXFiH1Btd12cCGGes=";
+          version = "7.25.10";
+          hash = "sha256-2d12itLc9qBZZ7nQNS/80K46dde2RUKpkWgPwFxogIs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -4824,6 +4824,8 @@ let
 
       tekumara.typos-vscode = callPackage ./tekumara.typos-vscode { };
 
+      teros-technology.teroshdl = callPackage ./teros-technology-teroshdl { };
+
       theangryepicbanana.language-pascal = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-pascal";

pkgs/applications/editors/vscode/extensions/teros-technology-teroshdl/default.nix

@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "teroshdl";
+    publisher = "teros-technology";
+    version = "7.0.3";
+    hash = "sha256-Bt31ia0X4sQQfREq8PPVEGt/oGe/Oob0yQbYkwNRSsk=";
+  };
+
+  meta = {
+    changelog = "https://github.com/TerosTechnology/vscode-terosHDL/releases";
+    description = "Visual Studio Code extension for HDL developments (SystemVerilog/Verilog/VHDL)";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=teros-technology.teroshdl";
+    homepage = "https://github.com/TerosTechnology/vscode-terosHDL";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ lheintzmann1 ];
+  };
+}

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-05-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "d3e54870080f9389b4b3e6c6f717bfa29a2fd7fe";
-    hash = "sha256-k3YLCP9FNBu5rD+T5bM+hJr1XNbUlXm8a96VRcj7PFw=";
+    rev = "c478eae7484b76aaacc76659dd4d7b8e1163bc87";
+    hash = "sha256-l7GwSj7/A/1ZAAqWz1GtMDCl6F45GJqucDBD89yqcsU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-05-19";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "732d05c2c136856a3f173574233a2431a015a6f5";
-    hash = "sha256-5PVN8qG0ONsro6jH/8rAIma+4DlKAUoS/6aUPqBqbe4=";
+    rev = "48852ed81dbfb4b502a45eb632d4f999a892cc72";
+    hash = "sha256-XgYu36byAxXTDsgq4Iz+VPWQNsPxXQP+hx+/MYZkm6k=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/vice.nix

@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "vice-${type}";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-05-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vice-libretro";
-    rev = "5f094cfb57d1f656027a9d26bda681b6ecc46419";
-    hash = "sha256-XqWAh3e2Q/i7c8nxqDP+sJHGdYWCyqdk2pwJ+JPsdVk=";
+    rev = "86bcfa8c4839236f70e31c656d220c074ff1dfb0";
+    hash = "sha256-Dw+dY1IsR5cIzXa61bWO+2GhrYqgC2ASMjxQe2MVeco=";
   };
 
   makefile = "Makefile";

pkgs/applications/misc/organicmaps/default.nix

@@ -19,6 +19,7 @@
   icu,
   freetype,
   pugixml,
+  xorg,
   nix-update-script,
 }:
 
@@ -32,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.03.02-7";
+  version = "2025.05.20-5";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-5WX+YDgu8Ll5+rZWWxfbNW0pBFz+2XWkw/ahM14Ml08=";
+    hash = "sha256-cqcFI5cXREOeHusPkXsMwdCopzpea50mZQ/+ogLlemk=";
     fetchSubmodules = true;
   };
 
@@ -78,6 +79,9 @@ stdenv.mkDerivation (finalAttrs: {
     icu
     freetype
     pugixml
+    xorg.libXrandr
+    xorg.libXinerama
+    xorg.libXcursor
   ];
 
   # Yes, this is PRE configure. The configure phase uses cmake
@@ -94,14 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  meta = with lib; {
+  meta = {
     # darwin: "invalid application of 'sizeof' to a function type"
     broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://organicmaps.app/";
     description = "Detailed Offline Maps for Travellers, Tourists, Hikers and Cyclists";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
     mainProgram = "OMaps";
   };
 })

pkgs/applications/misc/rofi/default.nix

@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-unwrapped";
-  version = "1.7.8";
+  version = "1.7.9";
 
   src = fetchFromGitHub {
     owner = "davatorium";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-TEn3LoTUc5mxYcVkckIFTfkqQ9cUJxkXyg/5TFv5TZ0=";
+    hash = "sha256-YI6ShRRBJ9ExkzDnI31YjtI1mWRWPzVRYQvpTAtLTeI=";
   };
 
   preConfigure = ''

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -71,7 +71,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.3.3635.11";
+  version = "7.3.3635.12";
 
   suffix =
     {
@@ -84,8 +84,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-w1/wWP3lZUQ5tBvv6XOCkoR1OCoByURBEvaaemsY19U=";
-        x86_64-linux = "sha256-kJNFPXiZekjofGtKFbGc85c8yQymhntkCBuhylwQBpE=";
+        aarch64-linux = "sha256-Gplg0QD7DcibaOv1Q8RUnefACZdNnM8yKYYiP1dpY58=";
+        x86_64-linux = "sha256-qcV4n9/nAbb0Gw8azorDSjpjy4cXe2XlR94WwuwUEyc=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -41,6 +41,7 @@ lib:
   ethtool,
   fetchFromGitHub,
   fetchgit,
+  fetchpatch,
   fetchurl,
   fetchzip,
   findutils,
@@ -69,7 +70,7 @@ lib:
   sqlite,
   stdenv,
   systemd,
-  util-linux,
+  util-linuxMinimal,
   yq-go,
   zstd,
 }:
@@ -331,6 +332,17 @@ let
       ldflags = versionldflags;
     }).overrideAttrs
       overrideContainerdAttrs;
+
+  # TODO (#405952): remove this patch. We had to add it to avoid a mass rebuild
+  # for the 25.05 release. Once the above PR is merged, switch back to plain util-linuxMinimal.
+  k3sUtilLinux = util-linuxMinimal.overrideAttrs (prev: {
+    patches =
+      prev.patches or [ ]
+      ++ lib.singleton (fetchpatch {
+        url = "https://github.com/util-linux/util-linux/commit/7dbfe31a83f45d5aef2b508697e9511c569ffbc8.patch";
+        hash = "sha256-bJqpZiPli5Pm/XpDA445Ab5jesXrlcnaO6e4V0B3rSw=";
+      });
+  });
 in
 buildGoModule rec {
   pname = "k3s";
@@ -377,7 +389,7 @@ buildGoModule rec {
     ipset
     bridge-utils
     ethtool
-    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
+    k3sUtilLinux # kubelet wants 'nsenter' and 'mount' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
     conntrack-tools
     runc
     bash

pkgs/applications/version-management/gitlab/data.json

@@ -1,15 +0,0 @@
-{
-  "version": "17.11.2",
-  "repo_hash": "1jaxqchqag6q0c4vmrpwnmflv72b2xpskba9b0m4y6w6sy7hqx7q",
-  "yarn_hash": "0z06jaxqbg2wnq7yhpkba0cpxp4w4iy2cxla8nhc6kgx49xk179v",
-  "owner": "gitlab-org",
-  "repo": "gitlab",
-  "rev": "v17.11.2-ee",
-  "passthru": {
-    "GITALY_SERVER_VERSION": "17.11.2",
-    "GITLAB_PAGES_VERSION": "17.11.2",
-    "GITLAB_SHELL_VERSION": "14.41.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.0",
-    "GITLAB_WORKHORSE_VERSION": "17.11.2"
-  }
-}

pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-3d-effect";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-3d-effect";
     rev = version;
-    sha256 = "sha256-SgxrBhuO3IaqINwjwdtn31cIcu3hXiPZyVMZJiNsO+s=";
+    sha256 = "sha256-5cPXfEcKIATFQktjIN5lmYjvakYe/k26aHKlJz5FqPE=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-vkcapture";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = "obs-vkcapture";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RIDsT6eL6bUfqPiyPlecnZHu5OorcJb3Xal8pjdOpAA=";
+    hash = "sha256-ghfRST7J3bipQnOZnYMtmDggET+Etq/ngHs+zQ0bm1w=";
   };
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isi686 [

pkgs/applications/virtualization/podman-compose/default.nix

@@ -9,7 +9,7 @@
 }:
 
 buildPythonApplication rec {
-  version = "1.3.0";
+  version = "1.4.0";
   pname = "podman-compose";
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonApplication rec {
     repo = "podman-compose";
     owner = "containers";
     tag = "v${version}";
-    hash = "sha256-0k+vJwWYEXQ6zxkcvjxBv9cq8nIBS15F7ul5VwqYtys=";
+    hash = "sha256-779L8fc5rxnkW5f4i/zgc8K9bEwKNKjw20cNlSwU/aA=";
   };
 
   build-system = [

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix

@@ -14,13 +14,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.49.0";
+            version = "0.49.0-fix";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-GpsLyK/U05q7QnyFIWrnGS2loVyjPZByTtPitwu9UNw=";
+              hash = "sha256-5wjvmFtk85uBJLnrKZbfrgo9OTTQlFP18ZNgfBwFsz0=";
             };
           in
           mkHyprlandPlugin hyprland {

pkgs/build-support/docker/default.nix

@@ -392,6 +392,7 @@ rec {
 
       postMount = ''
         echo "Packing raw image..."
+        mkdir -p $out
         tar -C mnt --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar .
       '';
 

pkgs/build-support/rust/test/import-cargo-lock/basic-dynamic/default.nix

@@ -1,21 +1,12 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "basic-dynamic";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
-  cargoLock.lockFileContents = builtins.readFile ./Cargo.lock;
+  cargoLock.lockFileContents = builtins.readFile ./package/Cargo.lock;
 
   doInstallCheck = true;
 

pkgs/build-support/rust/test/import-cargo-lock/basic-sparse/default.nix

@@ -1,23 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "basic-sparse";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./.cargo/config.toml
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     extraRegistries = {
       "sparse+https://index.crates.io/" = "https://static.crates.io/crates";
     };

pkgs/build-support/rust/test/import-cargo-lock/basic/default.nix

@@ -1,22 +1,13 @@
 { lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
   pname = "basic";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
   };
 
   doInstallCheck = true;

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-branch/default.nix

@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-branch";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.4" = "1ilk9wvfw3mdm57g199ys8f5nrgdrh0n3a4c8b7nz6lgnqvfrv6z";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix

@@ -3,23 +3,13 @@
   pkg-config,
   openssl,
   zlib,
-  lib,
 }:
-let
-  fs = lib.fileset;
-in
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-rev-non-workspace-nested-crate";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   nativeBuildInputs = [
     pkg-config
@@ -31,7 +21,7 @@ rustPlatform.buildRustPackage {
   ];
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "cargo-test-macro-0.1.0" = "1yy1y1d523xdzwg1gc77pigbcwsbawmy4b7vw8v21m7q957sk0c4";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev/default.nix

@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-rev";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-tag/default.nix

@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency-tag";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0l3p174bpwia61vcvxz5mw65a13ri3wy94z04xrnyy5lzciykz4f";
     };

pkgs/build-support/rust/test/import-cargo-lock/git-dependency/default.nix

@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "git-dependency";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
     outputHashes = {
       "rand-0.8.3" = "0ya2hia3cn31qa8894s3av2s8j5bjwb6yq92k0jsnlx7jid0jwqa";
     };

pkgs/build-support/rust/test/import-cargo-lock/v1/default.nix

@@ -1,22 +1,13 @@
-{ lib, rustPlatform }:
-let
-  fs = lib.fileset;
-in
+{ rustPlatform }:
+
 rustPlatform.buildRustPackage {
   pname = "v1";
   version = "0.1.0";
 
-  src = fs.toSource {
-    root = ./.;
-    fileset = fs.unions [
-      ./Cargo.toml
-      ./Cargo.lock
-      ./src
-    ];
-  };
+  src = ./package;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ./package/Cargo.lock;
   };
 
   doInstallCheck = true;

pkgs/build-support/vm/default.nix

@@ -984,277 +984,11 @@ rec {
 
   # The set of supported RPM-based distributions.
 
-  rpmDistros = {
-
-    # Note: no i386 release for Fedora >= 26
-    fedora26x86_64 =
-      let
-        version = "26";
-      in
-      {
-        name = "fedora-${version}-x86_64";
-        fullName = "Fedora ${version} (x86_64)";
-        packagesList = fetchurl rec {
-          url = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os/repodata/${sha256}-primary.xml.gz";
-          sha256 = "880055a50c05b20641530d09b23f64501a000b2f92fe252417c530178730a95e";
-        };
-        urlPrefix = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os";
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonFedoraPackages ++ [
-          "cronie"
-          "util-linux"
-        ];
-        unifiedSystemDir = true;
-      };
-
-    fedora27x86_64 =
-      let
-        version = "27";
-      in
-      {
-        name = "fedora-${version}-x86_64";
-        fullName = "Fedora ${version} (x86_64)";
-        packagesList = fetchurl rec {
-          url = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os/repodata/${sha256}-primary.xml.gz";
-          sha256 = "48986ce4583cd09825c6d437150314446f0f49fa1a1bd62dcfa1085295030fe9";
-        };
-        urlPrefix = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os";
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonFedoraPackages ++ [
-          "cronie"
-          "util-linux"
-        ];
-        unifiedSystemDir = true;
-      };
-
-    centos6i386 =
-      let
-        version = "6.9";
-      in
-      rec {
-        name = "centos-${version}-i386";
-        fullName = "CentOS ${version} (i386)";
-        urlPrefix = "mirror://centos/${version}/os/i386";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "b826a45082ef68340325c0855f3d2e5d5a4d0f77d28ba3b871791d6f14a97aeb";
-        };
-        archs = [
-          "noarch"
-          "i386"
-        ];
-        packages = commonCentOSPackages ++ [ "procps" ];
-      };
-
-    centos6x86_64 =
-      let
-        version = "6.9";
-      in
-      rec {
-        name = "centos-${version}-x86_64";
-        fullName = "CentOS ${version} (x86_64)";
-        urlPrefix = "mirror://centos/${version}/os/x86_64";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "ed2b2d4ac98d774d4cd3e91467e1532f7e8b0275cfc91a0d214b532dcaf1e979";
-        };
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonCentOSPackages ++ [ "procps" ];
-      };
-
-    # Note: no i386 release for 7.x
-    centos7x86_64 =
-      let
-        version = "7.4.1708";
-      in
-      rec {
-        name = "centos-${version}-x86_64";
-        fullName = "CentOS ${version} (x86_64)";
-        urlPrefix = "mirror://centos/${version}/os/x86_64";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "b686d3a0f337323e656d9387b9a76ce6808b26255fc3a138b1a87d3b1cb95ed5";
-        };
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonCentOSPackages ++ [ "procps-ng" ];
-      };
-  };
+  rpmDistros = { };
 
   # The set of supported Dpkg-based distributions.
 
   debDistros = {
-    ubuntu1404i386 = {
-      name = "ubuntu-14.04-trusty-i386";
-      fullName = "Ubuntu 14.04 Trusty (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/main/binary-i386/Packages.bz2";
-          sha256 = "1d5y3v3v079gdq45hc07ja0bjlmzqfwdwwlq0brwxi8m75k3iz7x";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/universe/binary-i386/Packages.bz2";
-          sha256 = "03x9w92by320rfklrqhcl3qpwmnxds9c8ijl5zhcb21d6dcz5z1a";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1404x86_64 = {
-      name = "ubuntu-14.04-trusty-amd64";
-      fullName = "Ubuntu 14.04 Trusty (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/main/binary-amd64/Packages.bz2";
-          sha256 = "1hhzbyqfr5i0swahwnl5gfp5l9p9hspywb1vpihr3b74p1z935bh";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/universe/binary-amd64/Packages.bz2";
-          sha256 = "04560ba8s4z4v5iawknagrkn9q1nzvpn081ycmqvhh73p3p3g1jm";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1604i386 = {
-      name = "ubuntu-16.04-xenial-i386";
-      fullName = "Ubuntu 16.04 Xenial (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/main/binary-i386/Packages.xz";
-          sha256 = "13r75sp4slqy8w32y5dnr7pp7p3cfvavyr1g7gwnlkyrq4zx4ahy";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/universe/binary-i386/Packages.xz";
-          sha256 = "14fid1rqm3sc0wlygcvn0yx5aljf51c2jpd4x0zxij4019316hsh";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1604x86_64 = {
-      name = "ubuntu-16.04-xenial-amd64";
-      fullName = "Ubuntu 16.04 Xenial (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/main/binary-amd64/Packages.xz";
-          sha256 = "110qnkhjkkwm316fbig3aivm2595ydz6zskc4ld5cr8ngcrqm1bn";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/universe/binary-amd64/Packages.xz";
-          sha256 = "0mm7gj491yi6q4v0n4qkbsm94s59bvqir6fk60j73w7y4la8rg68";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1804i386 = {
-      name = "ubuntu-18.04-bionic-i386";
-      fullName = "Ubuntu 18.04 Bionic (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/main/binary-i386/Packages.xz";
-          sha256 = "0f0v4131kwf7m7f8j3288rlqdxk1k3vqy74b7fcfd6jz9j8d840i";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/universe/binary-i386/Packages.xz";
-          sha256 = "1v75c0dqr0wp0dqd4hnci92qqs4hll8frqdbpswadgxm5chn91bw";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1804x86_64 = {
-      name = "ubuntu-18.04-bionic-amd64";
-      fullName = "Ubuntu 18.04 Bionic (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/main/binary-amd64/Packages.xz";
-          sha256 = "1ls81bjyvmfz6i919kszl7xks1ibrh1xqhsk6698ackndkm0wp39";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/universe/binary-amd64/Packages.xz";
-          sha256 = "1832nqpn4ap95b3sj870xqayrza9in4kih9jkmjax27pq6x15v1r";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu2004i386 = {
-      name = "ubuntu-20.04-focal-i386";
-      fullName = "Ubuntu 20.04 Focal (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/main/binary-i386/Packages.xz";
-          sha256 = "sha256-7RAYURoN3RKYQAHpwBS9TIV6vCmpURpphyMJQmV4wLc=";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/universe/binary-i386/Packages.xz";
-          sha256 = "sha256-oA551xVE80volUPgkMyvzpQ1d+GhuZd4DAe7dXZnULM=";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu2004x86_64 = {
-      name = "ubuntu-20.04-focal-amd64";
-      fullName = "Ubuntu 20.04 Focal (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-d1eSH/j+7Zw5NKDJk21EG6SiOL7j6myMHfXLzUP8mGE=";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-RqdG2seJvZU3rKVNsWgLnf9RwkgVMRE1A4IZnX2WudE=";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
     ubuntu2204i386 = {
       name = "ubuntu-22.04-jammy-i386";
       fullName = "Ubuntu 22.04 Jammy (i386)";
@@ -1315,28 +1049,6 @@ rec {
       ];
     };
 
-    debian10i386 = {
-      name = "debian-10.13-buster-i386";
-      fullName = "Debian 10.13 Buster (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/buster/main/binary-i386/Packages.xz";
-        hash = "sha256-n9JquhtZgxw3qr9BX0MQoY3ZTIHN0dit+iru3DC31UY=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20221126T084953Z";
-      packages = commonDebianPackages;
-    };
-
-    debian10x86_64 = {
-      name = "debian-10.13-buster-amd64";
-      fullName = "Debian 10.13 Buster (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/buster/main/binary-amd64/Packages.xz";
-        hash = "sha256-YukIIB3u87jgp9oudwklsxyKVKjSL618wFgDSXiFmjU=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20221126T084953Z";
-      packages = commonDebianPackages;
-    };
-
     debian11i386 = {
       name = "debian-11.8-bullseye-i386";
       fullName = "Debian 11.8 Bullseye (i386)";

pkgs/build-support/writers/test.nix

@@ -456,7 +456,7 @@ recurseIntoAttrs {
     );
   };
 
-  data = {
+  data = recurseIntoAttrs {
     json = expectDataEqual {
       file = writeJSON "data.json" { hello = "world"; };
       expected = ''

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.273";
+  version = "3.0.277";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-Zmi+izG8gHZrtSaLR9sE9F0W55+PEj25lBKueIwY8iY=";
+    hash = "sha256-4HWSebmMys3yzj2H3JC7hAayl9xQeVBQWCEGlZSudUc=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-K6et/P1GKoZeEsfB5LMBqfBx+YoVMMC87YLNKOkL30g=";
+  vendorHash = "sha256-cyE7yuwYUR/vv1w/b7QaiSoyX2XiUy5vNdodu+9PIl8=";
 
   subPackages = [ "main" ];
 

pkgs/by-name/am/amd-libflame/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amd-libflame";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchFromGitHub {
     owner = "amd";
     repo = "libflame";
     rev = version;
-    hash = "sha256-Shsv5Zd59FN5tq1LY7QqPRtAHEysHIVbPeKIIZ/2eMw=";
+    hash = "sha256-9Z0e6RCJfqQlq3oT4fBu8rwPH1OWEKQ52rVDa0Y0rJU=";
   };
 
   postPatch = ''

pkgs/by-name/ar/ares-rs/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -36,5 +37,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     mainProgram = "ares";
+    broken = stdenv.isDarwin;
   };
 }

pkgs/by-name/ar/ares/darwin-build-fixes.patch

@@ -1,18 +1,18 @@
 diff --git a/cmake/macos/compilerconfig.cmake b/cmake/macos/compilerconfig.cmake
-index 99272c662..50f94db37 100644
+index f0c900f28..4da64f0b3 100644
 --- a/cmake/macos/compilerconfig.cmake
 +++ b/cmake/macos/compilerconfig.cmake
-@@ -27,7 +27,7 @@ message(DEBUG "macOS SDK Path: ${CMAKE_OSX_SYSROOT}")
- string(REGEX MATCH ".+/SDKs/MacOSX([0-9]+\\.[0-9])+\\.sdk$" _ ${CMAKE_OSX_SYSROOT})
- set(_ares_macos_current_sdk ${CMAKE_MATCH_1})
- message(DEBUG "macOS SDK version: ${_ares_macos_current_sdk}")
--if(_ares_macos_current_sdk VERSION_LESS _ares_macos_minimum_sdk)
-+if(FALSE)
-   message(
-     FATAL_ERROR
-     "Your macOS SDK version (${_ares_macos_current_sdk}) is too low. "
+@@ -25,7 +25,7 @@ function(check_sdk_requirements)
+   set(ares_macos_minimum_sdk 11.1) # Minimum tested SDK
+   set(ares_macos_minimum_xcode 12.4) # Sync with SDK
+   execute_process(
+-    COMMAND xcrun --sdk macosx --show-sdk-platform-version
++    COMMAND echo @sdkVersion@
+     OUTPUT_VARIABLE ares_macos_current_sdk
+     RESULT_VARIABLE result
+     OUTPUT_STRIP_TRAILING_WHITESPACE
 diff --git a/cmake/macos/helpers.cmake b/cmake/macos/helpers.cmake
-index 864a629f0..f455345bf 100644
+index 3777ac98a..07ff17009 100644
 --- a/cmake/macos/helpers.cmake
 +++ b/cmake/macos/helpers.cmake
 @@ -35,7 +35,6 @@ function(ares_configure_executable target)
@@ -23,3 +23,16 @@ index 864a629f0..f455345bf 100644
  
      install(TARGETS ${target} BUNDLE DESTINATION "." COMPONENT Application)
    endif()
+diff --git a/ruby/cmake/os-macos.cmake b/ruby/cmake/os-macos.cmake
+index 39c339428..dafb58c66 100644
+--- a/ruby/cmake/os-macos.cmake
++++ b/ruby/cmake/os-macos.cmake
+@@ -43,7 +43,7 @@ target_link_libraries(
+ if(SDL_FOUND)
+   target_link_libraries(
+     ruby
+-    PRIVATE "$<LINK_LIBRARY:WEAK_FRAMEWORK,SDL::SDL>"
++    PRIVATE "$<LINK_LIBRARY:WEAK_LIBRARY,SDL::SDL>"
+   )
+ endif()
+ 

pkgs/by-name/ar/ares/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  SDL2,
   alsa-lib,
   apple-sdk_14,
   cmake,
@@ -19,6 +18,8 @@
   moltenvk,
   openal,
   pkg-config,
+  replaceVars,
+  sdl3,
   stdenv,
   udev,
   vulkan-loader,
@@ -28,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ares";
-  version = "143";
+  version = "144";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uuFKbS7WvxkTyyQfuQ6iKPvRt+54zUPdjUlQ/ohBAr8=";
+    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
   };
 
   nativeBuildInputs =
@@ -49,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [
-      SDL2
+      sdl3
       libao
       librashader
       vulkan-loader
@@ -73,7 +74,9 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
   patches = [
-    ./darwin-build-fixes.patch
+    (replaceVars ./darwin-build-fixes.patch {
+      sdkVersion = apple-sdk_14.version;
+    })
   ];
 
   cmakeFlags = [

pkgs/by-name/ar/armadillo/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "14.4.1";
+  version = "14.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    hash = "sha256-Js4nK/3IJGwnjm+M+lN3eh77FO8ZbogIL+4F2hpGNJE=";
+    hash = "sha256-bf3c+9kecGedfBHpSlljp+/aAC/sNR5vSHWsjiRcURc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ar/arp-scan-rs/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   gitUpdater,
   rustPlatform,
@@ -18,6 +19,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
+
   cargoHash = "sha256-lPE/mx4LzSOG1YjGol1f77oox4voZzp9RqrKYZAMoX0=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -43,5 +45,6 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "arp-scan";
+    broken = stdenv.isDarwin;
   };
 }

pkgs/by-name/as/ast-grep/package.nix

@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.37.0";
+  version = "0.38.2";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-X2FTIyvpz4nEBc7zrPNAq/yTdOlVupwSoDQzvZGDjo8=";
+    hash = "sha256-mUqjD/otB891kJ8aIF3NP9ewo7yAuGE3yPK+gIIrm2w=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-0PUXj9LSFFC10H3LHVuiOHCREwFz8AkgkzJDUAGI+V0=";
+  cargoHash = "sha256-s2h2Zt0cRW6V0VAKNuTL8WkHdfkLvuZA/bnSkQKcr9w=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/au/auth0-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-T3AJYDPdVkFYsvZUIdqndaxsJmsoJeeyr0316rafg7Q=";
+    hash = "sha256-RcRJBW8FgCi9Lxz/KARql7ArozqYgttpQ9IXIKzvo6s=";
   };
 
-  vendorHash = "sha256-/F3GNGCfsa9LM1F+eYJ+okqqjIuKfxHDT90ZS9gsJzs=";
+  vendorHash = "sha256-6y2iGxaromnMYIU2rnvwmQwn8f1PdihB4DH9r5sRT68=";
 
   ldflags = [
     "-s"

pkgs/by-name/az/azurehound/package.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
@@ -37,5 +38,6 @@ buildGoModule rec {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "azurehound";
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ba/bamtools/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bamtools";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "pezmaster31";
     repo = "bamtools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l2DmA4P1kPneTCL9YVACE6LcQHT0F+mufPyM69VkksE=";
+    hash = "sha256-3kIa407YgBpulh2koQQFK/RLmGEZvEvTnZyWKm+pngg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/be/beekeeper-studio/package.nix

@@ -26,13 +26,12 @@
   vulkan-loader,
   systemd,
   libGL,
-  writeShellScript,
-  nix-update,
+  krb5,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "beekeeper-studio";
-  version = "5.1.5";
+  version = "5.2.9";
 
   src =
     let
@@ -45,8 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/beekeeper-studio_${finalAttrs.version}_${arch}.deb";
       hash = selectSystem {
-        x86_64-linux = "sha256-ClKD5OnNhEBo1O3E3rXOGu9X8vVGZAOrfXQFppuEnbU=";
-        aarch64-linux = "sha256-64ID+psuwfiVTfBayILeotJ3en21Hsv8FMQj+IQjjyE=";
+        x86_64-linux = "sha256-iooZSiIkHfd3jSk+Pk0E7s/g51UzbyqyP8qnfes3mts=";
+        aarch64-linux = "sha256-zLkEMOJhckIM0qPCKBNUgFwYiF1YjJU4wKmiLJ1pzNg=";
       };
     };
 
@@ -84,11 +83,10 @@ stdenv.mkDerivation (finalAttrs: {
     expat
     libgbm
     vulkan-loader
+    krb5
   ];
 
-  runtimeDependencies = map lib.getLib [
-    systemd
-  ];
+  runtimeDependencies = map lib.getLib [ systemd ];
 
   installPhase = ''
     runHook preInstall
@@ -106,6 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preFixup = ''
     patchelf --add-needed libGL.so.1 \
+      --add-needed libEGL.so.1 \
       --add-rpath ${
         lib.makeLibraryPath [
           libGL
@@ -113,10 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
       } $out/opt/beekeeper-studio/beekeeper-studio-bin
   '';
 
-  passthru.updateScript = writeShellScript "beekeeper-studio-update-script" ''
-    ${lib.getExe nix-update} beekeeper-studio --system x86_64-linux
-    ${lib.getExe nix-update} beekeeper-studio --system aarch64-linux --version "skip"
-  '';
+  passthru.updateScript = ./update.sh;
 
   meta = {
     description = "Modern and easy to use SQL client for MySQL, Postgres, SQLite, SQL Server, and more";

pkgs/by-name/be/beekeeper-studio/update.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused jq nix bash coreutils nix-update common-updater-scripts
+
+set -eou pipefail
+
+PACKAGE_DIR=$(realpath $(dirname $0))
+
+latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/beekeeper-studio/beekeeper-studio/releases/latest | jq --raw-output .tag_name | sed 's/^v//')
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; beekeeper-studio.version or (lib.getVersion beekeeper-studio)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+nix-update beekeeper-studio --version "$latestVersion" || true
+
+hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "$(nix eval -f . --raw beekeeper-studio.src.url --system aarch64-linux)"))
+update-source-version beekeeper-studio $latestVersion $hash --system=aarch64-linux --ignore-same-version

pkgs/by-name/be/bento/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "bento";
-  version = "1.6.1";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${version}";
-    hash = "sha256-T13r41ygQNmEBCwTKyCocQbGcyJSQ8lvmRllbxU512Y=";
+    hash = "sha256-pV7Fd+Ir+ZqteM0In/NiZrAyvPFS+oOnONhGVeBzA2g=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-/DXdPL98Y4peF3USV9/J4sT/TUTRp3Cds500kxb18QA=";
+  vendorHash = "sha256-ow/XOO8Xc72v6Ue9VHjnPuq+HlqE4YZHw+gJB4x7sKk=";
 
   subPackages = [
     "cmd/bento"

pkgs/by-name/bo/boxflat/package.nix

@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.30.0";
+  version = "1.30.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-6fzz3pq9fHoeGMT1Vz5Y8pKLdrprQEV5kLiZt7uJ1KI=";
+    hash = "sha256-5P6To0VRnvdu316bPIL7gDRuZLRjXLFbOpB9wZKs/t8=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/br/brscan5/package.nix

@@ -79,6 +79,9 @@ stdenv.mkDerivation rec {
       # driver is hardcoded to look in /opt/brother/scanner/brscan5/models for model metadata.
       # patch it to look in /etc/opt/brother/scanner/models instead, so nixos environment.etc can make it available
       printf '/etc/opt/brother/scanner/models\x00' | dd of=opt/brother/scanner/brscan5/libsane-brother5.so.1.0.7 bs=1 seek=${toString patchOffsetBytes} conv=notrunc
+
+      # remove deprecated SYSFS udev rule
+      sed -i -e '/^SYSFS/d' opt/brother/scanner/brscan5/udev-rules/*.rules
     '';
 
   installPhase = ''

pkgs/by-name/ca/catppuccin/package.nix

@@ -92,8 +92,8 @@ let
       name = "element";
       owner = "catppuccin";
       repo = "element";
-      rev = "ddced941a2014107918484263b63e030889777fe";
-      hash = "sha256-8EP/IQW3rdtomHBfnQNIjGbiD6OapPzXPFLjziNDcmc=";
+      rev = "70b7ee121dcef28c6c8191d60df2f88b23c89084";
+      hash = "sha256-iUSPlmEvwL9akbPobkbDWPr6TTHA/LdCK2Nty7Zslls=";
     };
 
     grub = fetchFromGitHub {
@@ -254,7 +254,7 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
       ''
       + lib.optionalString (lib.elem "element" themeList) ''
         mkdir -p "$out/element"
-        cp -r "${sources.element}/themes/Catppuccin-${variant}.json" "$out/element/"
+        cp -r "${sources.element}/themes/${variant}/${accent}.json" "$out/element/"
 
       ''
       + lib.optionalString (lib.elem "grub" themeList) ''