Merge 9eb2e11b4d into haskell-updates

.github/ISSUE_TEMPLATE/bug_report.md

@@ -11,7 +11,7 @@ assignees: ''
 
 <!-- A clear and concise description of what the bug is. -->
 
-## Steps To Reproduce
+## Steps to reproduce
 
 Steps to reproduce the behavior:
 

.github/ISSUE_TEMPLATE/build_failure.md

@@ -7,7 +7,7 @@ assignees: ''
 
 ---
 
-## Steps To Reproduce
+## Steps to reproduce
 
 Steps to reproduce the behavior:
 

.github/ISSUE_TEMPLATE/out_of_date_package_report.md

@@ -7,7 +7,7 @@ assignees: ''
 
 ---
 
-## Package Information
+## Package information
 
 <!-- Search for the package here: https://search.nixos.org/packages?channel=unstable -->
 

.github/ISSUE_TEMPLATE/unreproducible_package.md

@@ -31,7 +31,7 @@ Fixing bit-by-bit reproducibility also has additional advantages, such as
 avoiding hard-to-reproduce bugs, making content-addressed storage more effective
 and reducing rebuilds in such systems.
 
-## Steps To Reproduce
+## Steps to reproduce
 
 In the following steps, replace `<package>` with the canonical name of the
 package.

.github/workflows/README.md

@@ -0,0 +1,20 @@
+# GitHub Actions Workflows
+
+Some architectural notes about key decisions and concepts in our workflows:
+
+- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.
+
+- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
+
+- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
+
+- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
+
+- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
+
+## Terminology
+
+- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.
+- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.
+- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
+- **target commit**: The base branch's parent of the "test merge commit" to compare against.

.github/workflows/backport.yml

@@ -1,13 +1,14 @@
-name: Backport
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
 # WARNING:
 # When extending this action, be aware that $GITHUB_TOKEN allows write access to
 # the GitHub repository. This means that it should not evaluate user input in a
 # way that allows code injection.
 
+name: Backport
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
 permissions: {}
 
 jobs:
@@ -23,10 +24,12 @@ jobs:
         with:
           app-id: ${{ vars.BACKPORT_APP_ID }}
           private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
+
       - name: Create backport PRs
         uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0
         with:

.github/workflows/basic-eval.yml

@@ -1,31 +0,0 @@
-name: Basic evaluation checks
-
-on:
-  workflow_dispatch
-  # pull_request:
-  #   branches:
-  #    - master
-  #    - release-**
-  # push:
-  #   branches:
-  #    - master
-  #    - release-**
-permissions:
-  contents: read
-
-jobs:
-  tests:
-    name: basic-eval-checks
-    runs-on: ubuntu-24.04
-    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
-      with:
-        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-        name: nixpkgs-ci
-        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
-    - run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build
-    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
-    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

.github/workflows/check-cherry-picks.yml

@@ -1,10 +1,11 @@
 name: "Check cherry-picks"
+
 on:
   pull_request_target:
     branches:
-     - 'release-**'
-     - 'staging-**'
-     - '!staging-next'
+      - 'release-**'
+      - 'staging-**'
+      - '!staging-next'
 
 permissions: {}
 
@@ -14,13 +15,14 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        fetch-depth: 0
-        filter: blob:none
-    - name: Check cherry-picks
-      env:
-        BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-      run: |
-        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          filter: blob:none
+
+      - name: Check cherry-picks
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

.github/workflows/check-maintainers-sorted.yml

@@ -4,26 +4,25 @@ on:
   pull_request_target:
     paths:
       - 'maintainers/maintainer-list.nix'
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   nixos:
     name: maintainer-list-check
     runs-on: ubuntu-24.04
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           # Only these directories to perform the check
           sparse-checkout: |
             lib
             maintainers
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - name: Check that maintainer-list.nix is sorted
         run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

.github/workflows/check-nix-format.yml

@@ -3,14 +3,14 @@
 # https://github.com/NixOS/rfcs/pull/166.
 # Because of this, this action is not yet enabled for all files -- only for
 # those who have opted in.
+
 name: Check that Nix files are formatted
 
 on:
   pull_request_target:
-    # See the comment at the same location in ./nixpkgs-vet.yml
     types: [opened, synchronize, reopened, edited]
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   get-merge-commit:
@@ -24,17 +24,18 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
-      - name: Checking out base branch
+
+      - name: Checking out target branch
         run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
+          target=$(mktemp -d)
+          targetRev=$(git rev-parse HEAD^1)
+          git worktree add "$target" "$targetRev"
+          echo "targetRev=$targetRev" >> "$GITHUB_ENV"
+          echo "target=$target" >> "$GITHUB_ENV"
+
       - name: Get Nixpkgs revision for nixfmt
         run: |
           # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
@@ -42,13 +43,15 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
+
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
+
       - name: Check that Nix files are formatted according to the RFC style
         run: |
           unformattedFiles=()
@@ -78,12 +81,12 @@ jobs:
             esac
 
             # Ignore files that weren't already formatted
-            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then
-              echo "Ignoring file $file because it's not formatted in the base commit"
+            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.target }}/"$source" 2>/dev/null; then
+              echo "Ignoring file $file because it's not formatted in the target commit"
             elif ! nixfmt --check "$dest"; then
               unformattedFiles+=("$dest")
             fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
+          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')
 
           if (( "${#unformattedFiles[@]}" > 0 )); then
             echo "Some new/changed Nix files are not properly formatted"

.github/workflows/check-nixf-tidy.yml

@@ -3,8 +3,8 @@ name: Check changed Nix files with nixf-tidy (experimental)
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   nixos:
@@ -14,17 +14,18 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           # Fetches the merge commit and its parents
           fetch-depth: 2
-      - name: Checking out base branch
+
+      - name: Checking out target branch
         run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
+          target=$(mktemp -d)
+          targetRev=$(git rev-parse HEAD^1)
+          git worktree add "$target" "$targetRev"
+          echo "targetRev=$targetRev" >> "$GITHUB_ENV"
+          echo "target=$target" >> "$GITHUB_ENV"
+
       - name: Get Nixpkgs revision for nixf
         run: |
           # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
@@ -32,14 +33,16 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
+
       - name: Install nixf and jq
         # provided jq is incompatible with our expression
         run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
+
       - name: Check that Nix files pass nixf-tidy
         run: |
           # Filtering error messages we don't like
@@ -85,8 +88,8 @@ jobs:
                 continue
             esac
 
-            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then
-              echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"
+            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.target }}/"$source")" != '[]' ]] 2>/dev/null; then
+              echo "Ignoring file $file because it doesn't pass nixf-tidy in the target commit"
               echo # insert blank line
             else
               nixf_report="$(nixf_wrapper "$dest")"
@@ -113,7 +116,7 @@ jobs:
                 failedFiles+=("$dest")
               fi
             fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
+          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')
 
           if [[ -n "$DONT_REPORT_ERROR" ]]; then
             echo "Edited the PR but didn't change the base branch, only the description/title."

.github/workflows/check-shell.yml

@@ -9,26 +9,25 @@ on:
 permissions: {}
 
 jobs:
-  x86_64-linux:
-    name: shell-check-x86_64-linux
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-      - name: Build shell
-        run: nix-build shell.nix
+  shell-check:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            system: x86_64-linux
+          - runner: macos-14
+            system: aarch64-darwin
+
+    name: shell-check-${{ matrix.system }}
+    runs-on: ${{ matrix.runner }}
 
-  aarch64-darwin:
-    name: shell-check-aarch64-darwin
-    runs-on: macos-14
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
       - name: Build shell
         run: nix-build shell.nix

.github/workflows/codeowners-v2.yml

@@ -1,5 +1,3 @@
-name: Codeowners v2
-
 # This workflow depends on two GitHub Apps with the following permissions:
 # - For checking code owners:
 #   - Permissions:
@@ -22,11 +20,12 @@ name: Codeowners v2
 #
 # Note that the latter is also used for ./eval.yml requesting reviewers.
 
+name: Codeowners v2
+
 on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
-# We don't need any default GitHub token
 permissions: {}
 
 env:
@@ -45,67 +44,67 @@ jobs:
     needs: get-merge-commit
     if: needs.get-merge-commit.outputs.mergedSha
     steps:
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
-      if: github.repository_owner == 'NixOS'
-      with:
-        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-        name: nixpkgs-ci
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        if: github.repository_owner == 'NixOS'
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
-    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
-    # We later build and run code from the base branch with access to secrets,
-    # so it's important this is not the PRs code.
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        path: base
+      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
+      # We later build and run code from the base branch with access to secrets,
+      # so it's important this is not the PRs code.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: base
 
-    - name: Build codeowners validator
-      run: nix-build base/ci -A codeownersValidator
+      - name: Build codeowners validator
+        run: nix-build base/ci -A codeownersValidator
 
-    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
-      id: app-token
-      with:
-        app-id: ${{ vars.OWNER_RO_APP_ID }}
-        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_RO_APP_ID }}
+          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
 
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-        path: pr
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          path: pr
 
-    - name: Validate codeowners
-      run: result/bin/codeowners-validator
-      env:
-        OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
-        GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-        REPOSITORY_PATH: pr
-        OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
-        # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
-        EXPERIMENTAL_CHECKS: "avoid-shadowing"
+      - name: Validate codeowners
+        run: result/bin/codeowners-validator
+        env:
+          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
+          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY_PATH: pr
+          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
+          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
+          EXPERIMENTAL_CHECKS: "avoid-shadowing"
 
   # Request reviews from code owners
   request:
     name: Request
     runs-on: ubuntu-24.04
     steps:
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
-    # This is intentional, because we need to request the review of owners as declared in the base branch.
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
+      # This is intentional, because we need to request the review of owners as declared in the base branch.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
-      id: app-token
-      with:
-        app-id: ${{ vars.OWNER_APP_ID }}
-        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_APP_ID }}
+          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
 
-    - name: Build review request package
-      run: nix-build ci -A requestReviews
+      - name: Build review request package
+        run: nix-build ci -A requestReviews
 
-    - name: Request reviews
-      run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
-      env:
-        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      - name: Request reviews
+        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/editorconfig-v2.yml

@@ -1,14 +1,9 @@
 name: "Checking EditorConfig v2"
 
-permissions:
-  pull-requests: read
-  contents: read
-
 on:
-  # avoids approving first time contributors
   pull_request_target:
-    branches-ignore:
-      - 'release-**'
+
+permissions: {}
 
 jobs:
   get-merge-commit:
@@ -18,31 +13,35 @@ jobs:
     name: editorconfig-check
     runs-on: ubuntu-24.04
     needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - name: Get list of changed files from PR
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api \
-          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
-          | jq '.[] | select(.status != "removed") | .filename' \
-          > "$HOME/changed_files"
-    - name: print list of changed files
-      run: |
-        cat "$HOME/changed_files"
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        # pull_request_target checks out the base branch by default
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-      with:
-        # nixpkgs commit is pinned so that it doesn't break
-        # editorconfig-checker 2.4.0
-        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
-    - name: Checking EditorConfig
-      run: |
-        < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
-    - if: ${{ failure() }}
-      run: |
-        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
+      - name: Get list of changed files from PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            repos/${{ github.repository }}/pulls/${{ github.event.number }}/files --paginate \
+            | jq '.[] | select(.status != "removed") | .filename' \
+            > "$HOME/changed_files"
+
+      - name: print list of changed files
+        run: |
+          cat "$HOME/changed_files"
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          # nixpkgs commit is pinned so that it doesn't break
+          # editorconfig-checker 2.4.0
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
+
+      - name: Checking EditorConfig
+        run: |
+          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
+
+      - if: ${{ failure() }}
+        run: |
+          echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

.github/workflows/eval-lib-tests.yml

@@ -1,12 +1,12 @@
 name: "Building Nixpkgs lib-tests"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     paths:
       - 'lib/**'
+
+permissions: {}
+
 jobs:
   get-merge-commit:
     uses: ./.github/workflows/get-merge-commit.yml
@@ -19,12 +19,12 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - name: Building Nixpkgs lib-tests
         run: |
           nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

.github/workflows/eval.yml

@@ -12,8 +12,7 @@ on:
       - haskell-updates
       - python-updates
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   get-merge-commit:
@@ -23,10 +22,9 @@ jobs:
     name: Attributes
     runs-on: ubuntu-24.04
     needs: get-merge-commit
-    # Skip this and dependent steps if the PR can't be merged
     if: needs.get-merge-commit.outputs.mergedSha
     outputs:
-      baseSha: ${{ steps.baseSha.outputs.baseSha }}
+      targetSha: ${{ steps.targetSha.outputs.targetSha }}
       systems: ${{ steps.systems.outputs.systems }}
     steps:
       - name: Check out the PR at the test merge commit
@@ -36,15 +34,17 @@ jobs:
           fetch-depth: 2
           path: nixpkgs
 
-      - name: Determine base commit
+      - name: Determine target commit
         if: github.event_name == 'pull_request_target'
-        id: baseSha
+        id: targetSha
         run: |
-          baseSha=$(git -C nixpkgs rev-parse HEAD^1)
-          echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"
+          targetSha=$(git -C nixpkgs rev-parse HEAD^1)
+          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
 
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          extra_nix_config: sandbox = true
 
       - name: Evaluate the list of all attributes and get the systems matrix
         id: systems
@@ -61,7 +61,7 @@ jobs:
   eval-aliases:
     name: Eval nixpkgs with aliases enabled
     runs-on: ubuntu-24.04
-    needs: [ attrs, get-merge-commit ]
+    needs: [ get-merge-commit ]
     steps:
       - name: Check out the PR at the test merge commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -71,6 +71,8 @@ jobs:
 
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          extra_nix_config: sandbox = true
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
@@ -106,6 +108,8 @@ jobs:
 
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          extra_nix_config: sandbox = true
 
       - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
         env:
@@ -128,7 +132,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs: [ outpaths, attrs, get-merge-commit ]
     outputs:
-      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}
+      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
     steps:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -145,6 +149,8 @@ jobs:
 
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          extra_nix_config: sandbox = true
 
       - name: Combine all output paths and eval stats
         run: |
@@ -158,11 +164,11 @@ jobs:
           name: result
           path: prResult/*
 
-      - name: Get base run id
-        if: needs.attrs.outputs.baseSha
-        id: baseRunId
+      - name: Get target run id
+        if: needs.attrs.outputs.targetSha
+        id: targetRunId
         run: |
-          # Get the latest eval.yml workflow run for the PR's base commit
+          # Get the latest eval.yml workflow run for the PR's target commit
           if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
             -f head_sha="$BASE_SHA" -f event=push \
             --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
@@ -185,30 +191,30 @@ jobs:
             exit 0
           fi
 
-          echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"
+          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
         env:
           REPOSITORY: ${{ github.repository }}
-          BASE_SHA: ${{ needs.attrs.outputs.baseSha }}
+          BASE_SHA: ${{ needs.attrs.outputs.targetSha }}
           GH_TOKEN: ${{ github.token }}
 
       - uses: actions/download-artifact@v4
-        if: steps.baseRunId.outputs.baseRunId
+        if: steps.targetRunId.outputs.targetRunId
         with:
           name: result
-          path: baseResult
+          path: targetResult
           github-token: ${{ github.token }}
-          run-id: ${{ steps.baseRunId.outputs.baseRunId }}
+          run-id: ${{ steps.targetRunId.outputs.targetRunId }}
 
-      - name: Compare against the base branch
-        if: steps.baseRunId.outputs.baseRunId
+      - name: Compare against the target branch
+        if: steps.targetRunId.outputs.targetRunId
         run: |
-          git -C nixpkgs worktree add ../base ${{ needs.attrs.outputs.baseSha }}
-          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.baseSha }} ${{ needs.attrs.outputs.mergedSha }} \
+          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}
+          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
 
-          # Use the base branch to get accurate maintainer info
-          nix-build base/ci -A eval.compare \
-            --arg beforeResultDir ./baseResult \
+          # Use the target branch to get accurate maintainer info
+          nix-build target/ci -A eval.compare \
+            --arg beforeResultDir ./targetResult \
             --arg afterResultDir ./prResult \
             --arg touchedFilesJson ./touched-files.json \
             -o comparison
@@ -216,7 +222,7 @@ jobs:
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload the combined results
-        if: steps.baseRunId.outputs.baseRunId
+        if: steps.targetRunId.outputs.targetRunId
         uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: comparison
@@ -227,7 +233,7 @@ jobs:
     name: Tag
     runs-on: ubuntu-24.04
     needs: [ attrs, process ]
-    if: needs.process.outputs.baseRunId
+    if: needs.process.outputs.targetRunId
     permissions:
       pull-requests: write
       statuses: write
@@ -254,7 +260,7 @@ jobs:
       - name: Check out Nixpkgs at the base commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ needs.attrs.outputs.baseSha }}
+          ref: ${{ needs.attrs.outputs.targetSha }}
           path: base
           sparse-checkout: ci
 

.github/workflows/get-merge-commit.yml

@@ -7,7 +7,6 @@ on:
         description: "The merge commit SHA"
         value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
 
-# We need a token to query the API, but it doesn't need any special permissions
 permissions: {}
 
 jobs:
@@ -16,28 +15,29 @@ jobs:
     outputs:
       mergedSha: ${{ steps.merged.outputs.mergedSha }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        path: base
-        sparse-checkout: ci
-    - name: Check if the PR can be merged and get the test merge commit
-      id: merged
-      env:
-        GH_TOKEN: ${{ github.token }}
-        GH_EVENT: ${{ github.event_name }}
-      run: |
-        case "$GH_EVENT" in
-          push)
-            echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-            ;;
-          pull_request_target)
-            if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-              echo "Checking the merge commit $mergedSha"
-              echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
-            else
-              # Skipping so that no notifications are sent
-              echo "Skipping the rest..."
-            fi
-            ;;
-        esac
-        rm -rf base
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: base
+          sparse-checkout: ci
+
+      - name: Check if the PR can be merged and get the test merge commit
+        id: merged
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_EVENT: ${{ github.event_name }}
+        run: |
+          case "$GH_EVENT" in
+            push)
+              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+              ;;
+            pull_request_target)
+              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+                echo "Checking the merge commit $mergedSha"
+                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+              else
+                # Skipping so that no notifications are sent
+                echo "Skipping the rest..."
+              fi
+              ;;
+          esac
+          rm -rf base

.github/workflows/labels.yml

@@ -1,14 +1,14 @@
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows some write
+# access to the GitHub API. This means that it should not evaluate user input in
+# a way that allows code injection.
+
 name: "Label PR"
 
 on:
   pull_request_target:
     types: [edited, opened, synchronize, reopened]
 
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows some write
-# access to the GitHub API. This means that it should not evaluate user input in
-# a way that allows code injection.
-
 permissions:
   contents: read
   pull-requests: write
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        sync-labels: true
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: true

.github/workflows/manual-nixos-v2.yml

@@ -1,8 +1,5 @@
 name: "Build NixOS manual v2"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     branches:
@@ -10,24 +7,27 @@ on:
     paths:
       - 'nixos/**'
 
+permissions: {}
+
 jobs:
   nixos:
     name: nixos-manual-build
     runs-on: ubuntu-24.04
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
       - name: Building NixOS manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,8 +1,5 @@
 name: "Build Nixpkgs manual v2"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     branches:
@@ -12,24 +9,27 @@ on:
       - 'lib/**'
       - 'pkgs/tools/nix/nixdoc/**'
 
+permissions: {}
+
 jobs:
   nixpkgs:
     name: nixpkgs-manual-build
     runs-on: ubuntu-24.04
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
-          # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
       - name: Building Nixpkgs manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

.github/workflows/nix-parse-v2.yml

@@ -1,14 +1,9 @@
 name: "Check whether nix files are parseable v2"
 
-permissions:
-  pull-requests: read
-  contents: read
-
 on:
-  # avoids approving first time contributors
   pull_request_target:
-    branches-ignore:
-      - 'release-**'
+
+permissions: {}
 
 jobs:
   get-merge-commit:
@@ -18,32 +13,35 @@ jobs:
     name: nix-files-parseable-check
     runs-on: ubuntu-24.04
     needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - name: Get list of changed files from PR
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api \
-          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
-          | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
-          > "$HOME/changed_files"
-        if [[ -s "$HOME/changed_files" ]]; then
-          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
-        fi
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        # pull_request_target checks out the base branch by default
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-      with:
-        nix_path: nixpkgs=channel:nixpkgs-unstable
-    - name: Parse all changed or added nix files
-      run: |
-        ret=0
-        while IFS= read -r file; do
-          out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
-        done < "$HOME/changed_files"
-        exit "$ret"
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
+      - name: Get list of changed files from PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            repos/${{ github.repository }}/pulls/${{github.event.number}}/files --paginate \
+            | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
+            > "$HOME/changed_files"
+          if [[ -s "$HOME/changed_files" ]]; then
+            echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
+          fi
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
+
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          extra_nix_config: sandbox = true
+          nix_path: nixpkgs=channel:nixpkgs-unstable
+
+      - name: Parse all changed or added nix files
+        run: |
+          ret=0
+          while IFS= read -r file; do
+            out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
+          done < "$HOME/changed_files"
+          exit "$ret"
+        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

.github/workflows/nixpkgs-vet.yml

@@ -2,10 +2,10 @@
 # Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).
 # When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.
 # See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.
+
 name: Vet nixpkgs
 
 on:
-  # Using pull_request_target instead of pull_request avoids having to approve first time contributors.
   pull_request_target:
     # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
     # Instead it causes an `edited` event, so we need to add it explicitly here.
@@ -33,16 +33,18 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # pull_request_target checks out the base branch by default
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
-      - name: Checking out base branch
+
+      - name: Checking out target branch
         run: |
-          base=$(mktemp -d)
-          git worktree add "$base" "$(git rev-parse HEAD^1)"
-          echo "base=$base" >> "$GITHUB_ENV"
+          target=$(mktemp -d)
+          git worktree add "$target" "$(git rev-parse HEAD^1)"
+          echo "target=$target" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
       - name: Fetching the pinned tool
         # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
         run: |
@@ -55,12 +57,13 @@ jobs:
 
           # Adds a result symlink as a GC root.
           nix-store --realise "$toolPath" --add-root result
+
       - name: Running nixpkgs-vet
         env:
           # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
           CLICOLOR_FORCE: 1
         run: |
-          if result/bin/nixpkgs-vet --base "$base" .; then
+          if result/bin/nixpkgs-vet --base "$target" .; then
             exit 0
           else
             exitCode=$?

.github/workflows/no-channel.yml

@@ -15,11 +15,11 @@ jobs:
     name: "This PR is is targeting a channel branch"
     runs-on: ubuntu-24.04
     steps:
-    - run: |
-        cat <<EOF
-        The nixos-* and nixpkgs-* branches are pushed to by the channel
-        release script and should not be merged into directly.
+      - run: |
+          cat <<EOF
+          The nixos-* and nixpkgs-* branches are pushed to by the channel
+          release script and should not be merged into directly.
 
-        Please target the equivalent release-* branch or master instead.
-        EOF
-        exit 1
+          Please target the equivalent release-* branch or master instead.
+          EOF
+          exit 1

.github/workflows/periodic-merge-24h.yml

@@ -7,7 +7,6 @@
 
 name: "Periodic Merges (24h)"
 
-
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -16,15 +15,11 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write  # for devmasx/merge-branch to merge branches
+  pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
 
 jobs:
   periodic-merge:
-    permissions:
-      contents: write  # for devmasx/merge-branch to merge branches
-      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
-    if: github.repository_owner == 'NixOS'
-    runs-on: ubuntu-24.04
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
@@ -37,22 +32,9 @@ jobs:
             into: staging-next-24.11
           - from: staging-next-24.11
             into: staging-24.11
-    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          from_branch: ${{ matrix.pairs.from }}
-          target_branch: ${{ matrix.pairs.into }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-        if: ${{ failure() }}
-        with:
-          issue-number: 105153
-          body: |
-            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+          - from: master staging
+            into: haskell-updates
+    uses: ./.github/workflows/periodic-merge.yml
+    with:
+      from: ${{ matrix.pairs.from }}
+      into: ${{ matrix.pairs.into }}

.github/workflows/periodic-merge-6h.yml

@@ -7,7 +7,6 @@
 
 name: "Periodic Merges (6h)"
 
-
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -16,15 +15,11 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write  # for devmasx/merge-branch to merge branches
+  pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
 
 jobs:
   periodic-merge:
-    permissions:
-      contents: write  # for devmasx/merge-branch to merge branches
-      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
-    if: github.repository_owner == 'NixOS'
-    runs-on: ubuntu-24.04
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
@@ -37,22 +32,7 @@ jobs:
             into: staging-next
           - from: staging-next
             into: staging
-    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          from_branch: ${{ matrix.pairs.from }}
-          target_branch: ${{ matrix.pairs.into }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-        if: ${{ failure() }}
-        with:
-          issue-number: 105153
-          body: |
-            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+    uses: ./.github/workflows/periodic-merge.yml
+    with:
+      from: ${{ matrix.pairs.from }}
+      into: ${{ matrix.pairs.into }}

.github/workflows/periodic-merge-haskell-updates.yml

@@ -1,59 +0,0 @@
-# This action periodically merges a merge base of master and staging into haskell-updates.
-#
-# haskell-updates is based on master (so there are little unrelated failures and the cache
-# is already prepopulated), but needs to target staging due to the high amount of rebuilds
-# it typically causes. To prevent unrelated commits clattering the GitHub UI, we need to
-# take care to only merge the merge-base of master and staging into haskell-updates.
-#
-# See also https://github.com/NixOS/nixpkgs/issues/361143.
-
-name: "Periodic Merges (haskell-updates)"
-
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 24 hours
-    - cron:  '0 0 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  periodic-merge:
-    permissions:
-      contents: write  # for devmasx/merge-branch to merge branches
-      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
-    if: github.repository_owner == 'NixOS'
-    runs-on: ubuntu-24.04
-    name: git merge-base master staging → haskell-updates
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      # Note: If we want to do something similar for more branches, we can move this into a
-      # separate job, so we can use the matrix strategy again.
-      - name: Find merge base of master and staging
-        id: find_merge_base_step
-        run: |
-          merge_base="$(git merge-base refs/remotes/origin/master refs/remotes/origin/staging)"
-          echo "Found merge base: $merge_base" >&2
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-
-      - name: git merge-base master staging → haskell-updates
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          head_to_merge: ${{ steps.find_merge_base_step.outputs.merge_base }}
-          target_branch: haskell-updates
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-        if: ${{ failure() }}
-        with:
-          issue-number: 367709
-          body: |
-            Periodic merge from `${{ steps.find_merge_base_step.outputs.merge_base }}` into `haskell-updates` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

.github/workflows/periodic-merge.yml

@@ -0,0 +1,50 @@
+name: "Merge"
+
+on:
+  workflow_call:
+    inputs:
+      from:
+        description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
+        required: true
+        type: string
+      into:
+        description: Target branch to merge into.
+        required: true
+        type: string
+
+jobs:
+  merge:
+    if: github.repository_owner == 'NixOS'
+    runs-on: ubuntu-24.04
+    name: ${{ inputs.from }} → ${{ inputs.into }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Find merge base between two branches
+        if: contains(inputs.from, ' ')
+        id: merge_base
+        env:
+          branches: ${{ inputs.from }}
+        run: |
+          # turn into bash array, split on space
+          read -ra branches <<< "$branches"
+          git fetch --shallow-since="1 month ago" origin "${branches[@]}"
+          merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
+          echo "Found merge base: $merge_base" >&2
+          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
+
+      - name: ${{ inputs.from }} → ${{ inputs.into }}
+        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        with:
+          type: now
+          from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
+          target_branch: ${{ inputs.into }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

maintainers/maintainer-list.nix

@@ -7024,6 +7024,13 @@
     githubId = 2544204;
     name = "Erik Skytthe";
   };
+  esrh = {
+    name = "Eshan Ramesh";
+    email = "esrh@esrh.me";
+    github = "eshrh";
+    githubId = 16175276;
+    keys = [ { fingerprint = "E4CE B0F0 B2EC 09A3 9678  F294 CC7A 7E3C 6CF3 1343"; } ];
+  };
   ethancedwards8 = {
     email = "ethan@ethancedwards.com";
     github = "ethancedwards8";
@@ -7926,6 +7933,12 @@
     githubId = 248148;
     name = "Sigrid Solveig Haflínudóttir";
   };
+  ftsimas = {
+    name = "Filippos Tsimas";
+    email = "filippos.tsimas@outlook.com";
+    github = "ftsimas";
+    githubId = 47324723;
+  };
   fuerbringer = {
     email = "severin@fuerbringer.info";
     github = "fuerbringer";
@@ -11758,6 +11771,12 @@
     githubId = 1730718;
     name = "Hideaki Kawai";
   };
+  kaylorben = {
+    email = "blkaylor22@gmail.com";
+    github = "kaylorben";
+    githubId = 41012641;
+    name = "Benjamin Kaylor";
+  };
   kazcw = {
     email = "kaz@lambdaverse.org";
     github = "kazcw";
@@ -21054,6 +21073,12 @@
     githubId = 174749595;
     keys = [ { fingerprint = "E3CD E225 47C6 2DB6 6CCD  BC06 CC3A E2EA 0000 0000"; } ];
   };
+  sigmike = {
+    email = "mike+nixpkgs@lepton.fr";
+    github = "sigmike";
+    githubId = 28259;
+    name = "Michael Witrant";
+  };
   sikmir = {
     email = "sikmir@disroot.org";
     matrix = "@sikmir:matrix.org";

nixos/modules/programs/wayland/sway.nix

@@ -117,10 +117,7 @@ in
           lib.mkIf
             (
               (lib.elem "nvidia" config.services.xserver.videoDrivers)
-              && !config.hardware.nvidia.open
-              && (lib.versionOlder "551" (
-                lib.versions.major (lib.getVersion config.hardware.nvidia.package)
-              ))
+              && (lib.versionOlder (lib.versions.major (lib.getVersion config.hardware.nvidia.package)) "551")
             )
             [
               "Using Sway with Nvidia driver version <= 550 may result in a broken system. Configure hardware.nvidia.package to use a newer version."

nixos/modules/services/backup/borgmatic.nix

@@ -8,6 +8,50 @@ let
   cfg = config.services.borgmatic;
   settingsFormat = pkgs.formats.yaml { };
 
+  postgresql = config.services.postgresql.package;
+  mysql = config.services.mysql.package;
+  requireSudo =
+    s:
+    s ? postgresql_databases
+    && lib.any (d: d ? username && !(d ? password) && !(d ? pg_dump_command)) s.postgresql_databases;
+  addRequiredBinaries =
+    s:
+    s
+    // {
+      postgresql_databases = map (
+        d:
+        let
+          as_user = if d ? username && !(d ? password) then "${pkgs.sudo}/bin/sudo -u ${d.username} " else "";
+        in
+        {
+          pg_dump_command =
+            if d.name == "all" then
+              "${as_user}${postgresql}/bin/pg_dumpall"
+            else
+              "${as_user}${postgresql}/bin/pg_dump";
+          pg_restore_command = "${as_user}${postgresql}/bin/pg_restore";
+          psql_command = "${as_user}${postgresql}/bin/psql";
+        }
+        // d
+      ) (s.postgresql_databases or [ ]);
+      mariadb_databases = map (
+        d:
+        {
+          mariadb_dump_command = "${mysql}/bin/mariadb-dump";
+          mariadb_command = "${mysql}/bin/mariadb";
+        }
+        // d
+      ) (s.mariadb_databases or [ ]);
+      mysql_databases = map (
+        d:
+        {
+          mysql_dump_command = "${mysql}/bin/mysqldump";
+          mysql_command = "${mysql}/bin/mysql";
+        }
+        // d
+      ) (s.mysql_databases or [ ]);
+    };
+
   repository =
     with lib.types;
     submodule {
@@ -72,7 +116,10 @@ let
       };
     };
 
-  cfgfile = settingsFormat.generate "config.yaml" cfg.settings;
+  cfgfile = settingsFormat.generate "config.yaml" (addRequiredBinaries cfg.settings);
+
+  anycfgRequiresSudo =
+    requireSudo cfg.settings || lib.any requireSudo (lib.attrValues cfg.configurations);
 in
 {
   options.services.borgmatic = {
@@ -106,7 +153,7 @@ in
         // lib.mapAttrs' (
           name: value:
           lib.nameValuePair "borgmatic.d/${name}.yaml" {
-            source = settingsFormat.generate "${name}.yaml" value;
+            source = settingsFormat.generate "${name}.yaml" (addRequiredBinaries value);
           }
         ) cfg.configurations;
       borgmaticCheck =
@@ -132,6 +179,11 @@ in
       environment.etc = configFiles;
 
       systemd.packages = [ pkgs.borgmatic ];
+      systemd.services.borgmatic.path = [ pkgs.coreutils ];
+      systemd.services.borgmatic.serviceConfig = lib.optionalAttrs anycfgRequiresSudo {
+        NoNewPrivileges = false;
+        CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_RAW CAP_SETUID CAP_SETGID";
+      };
 
       # Workaround: https://github.com/NixOS/nixpkgs/issues/81138
       systemd.timers.borgmatic.wantedBy = [ "timers.target" ];

nixos/modules/services/hardware/upower.nix

@@ -179,13 +179,31 @@ in
         '';
       };
 
+      allowRiskyCriticalPowerAction = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Enable the risky critical power actions "Suspend" and "Ignore".
+        '';
+      };
+
       criticalPowerAction = lib.mkOption {
-        type = lib.types.enum [ "PowerOff" "Hibernate" "HybridSleep" ];
+        type = lib.types.enum [
+          "PowerOff"
+          "Hibernate"
+          "HybridSleep"
+          "Suspend"
+          "Ignore"
+        ];
         default = "HybridSleep";
         description = ''
           The action to take when `timeAction` or
           `percentageAction` has been reached for the batteries
-          (UPS or laptop batteries) supplying the computer
+          (UPS or laptop batteries) supplying the computer.
+
+          When set to `Suspend` or `Ignore`,
+          {option}`services.upower.allowRiskyCriticalPowerAction` must be set
+          to `true`.
         '';
       };
 
@@ -193,10 +211,28 @@ in
 
   };
 
-
   ###### implementation
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          let
+            inherit (builtins) elem;
+            riskyActions = [
+              "Suspend"
+              "Ignore"
+            ];
+            riskyActionEnabled = elem cfg.criticalPowerAction riskyActions;
+          in
+          riskyActionEnabled -> cfg.allowRiskyCriticalPowerAction;
+        message = ''
+          services.upower.allowRiskyCriticalPowerAction must be true if
+          services.upower.criticalPowerAction is set to
+          '${cfg.criticalPowerAction}'.
+        '';
+      }
+    ];
 
     environment.systemPackages = [ cfg.package ];
 
@@ -218,6 +254,7 @@ in
         TimeLow = cfg.timeLow;
         TimeCritical = cfg.timeCritical;
         TimeAction = cfg.timeAction;
+        AllowRiskyCriticalPowerAction = cfg.allowRiskyCriticalPowerAction;
         CriticalPowerAction = cfg.criticalPowerAction;
       };
     };

nixos/tests/all-tests.nix

@@ -360,11 +360,7 @@ in {
   freenet = handleTest ./freenet.nix {};
   freeswitch = handleTest ./freeswitch.nix {};
   freetube = discoverTests (import ./freetube.nix);
-  freshrss-extensions = handleTest ./freshrss-extensions.nix {};
-  freshrss-sqlite = handleTest ./freshrss-sqlite.nix {};
-  freshrss-pgsql = handleTest ./freshrss-pgsql.nix {};
-  freshrss-http-auth = handleTest ./freshrss-http-auth.nix {};
-  freshrss-none-auth = handleTest ./freshrss-none-auth.nix {};
+  freshrss = handleTest ./freshrss {};
   frigate = handleTest ./frigate.nix {};
   frp = handleTest ./frp.nix {};
   frr = handleTest ./frr.nix {};

nixos/tests/freshrss/default.nix

@@ -0,0 +1,9 @@
+{ system, pkgs, ... }:
+
+{
+  extensions = import ./extensions.nix { inherit system pkgs; };
+  http-auth = import ./http-auth.nix { inherit system pkgs; };
+  none-auth = import ./none-auth.nix { inherit system pkgs; };
+  pgsql = import ./pgsql.nix { inherit system pkgs; };
+  sqlite = import ./sqlite.nix { inherit system pkgs; };
+}

nixos/tests/freshrss/extensions.nix

@@ -1,7 +1,7 @@
-import ./make-test-python.nix (
+import ../make-test-python.nix (
   { lib, pkgs, ... }:
   {
-    name = "freshrss";
+    name = "freshrss-extensions";
 
     nodes.machine =
       { pkgs, ... }:

nixos/tests/freshrss/http-auth.nix

@@ -1,7 +1,7 @@
-import ./make-test-python.nix (
+import ../make-test-python.nix (
   { lib, pkgs, ... }:
   {
-    name = "freshrss";
+    name = "freshrss-http-auth";
     meta.maintainers = with lib.maintainers; [ mattchrist ];
 
     nodes.machine =

nixos/tests/freshrss/none-auth.nix

@@ -1,7 +1,7 @@
-import ./make-test-python.nix (
+import ../make-test-python.nix (
   { lib, pkgs, ... }:
   {
-    name = "freshrss";
+    name = "freshrss-none-auth";
     meta.maintainers = with lib.maintainers; [ mattchrist ];
 
     nodes.machine =

nixos/tests/freshrss/pgsql.nix

@@ -1,7 +1,7 @@
-import ./make-test-python.nix (
+import ../make-test-python.nix (
   { lib, pkgs, ... }:
   {
-    name = "freshrss";
+    name = "freshrss-pgsql";
     meta.maintainers = with lib.maintainers; [
       etu
       stunkymonkey

nixos/tests/freshrss/sqlite.nix

@@ -1,7 +1,7 @@
-import ./make-test-python.nix (
+import ../make-test-python.nix (
   { lib, pkgs, ... }:
   {
-    name = "freshrss";
+    name = "freshrss-sqlite";
     meta.maintainers = with lib.maintainers; [
       etu
       stunkymonkey

pkgs/applications/audio/reaper/default.nix

@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.29";
+  version = "7.30";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-b1Gb5guaFyWrt9KEwptuXGvfrJAvgnFEl8QuwSufktE="
+        "sha256-nPt2dWbbctRrC3+UufMMLiAikOaMB33tDfFCscJx5cA="
       else
         {
-          x86_64-linux = "sha256-uFK8Y36pYTDK3foCKH9kiq3u1MTir2nNM5KrDwIHEm0=";
-          aarch64-linux = "sha256-KZTUeEtyAVwIFTmclYv4GcGJ2WXukEF0/mfYmmBPfz0=";
+          x86_64-linux = "sha256-rN4SMGkoO03JCmPOKabOdOlk2nfmGDYk1tSfniPyRnQ=";
+          aarch64-linux = "sha256-kASD5099XAoy6w3K5z0y8xrSNpomTWAFOWjtHgULwAA=";
         }
         .${stdenv.hostPlatform.system};
   };

pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix

@@ -31,13 +31,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-01-11";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "402e65f372bb4268c0cd0514a12f0b0e9649c4af";
-    hash = "sha256-iUOjc/iEJMsR87Kk96729luQx34b924zlZejA2oPNZ0=";
+    rev = "6fd5eb21a174e6a04247a2f370b544dcd6cb2420";
+    hash = "sha256-+E1l0Ea0Db5ksX9tDW+cvNUMjT4be5i9qcI/rIvFKbY=";
   };
 
   patches = [

pkgs/applications/editors/vim/plugins/deprecated.json

@@ -39,6 +39,10 @@
         "date": "2023-08-08",
         "new": "lspsaga-nvim"
     },
+    "lua-async-await": {
+        "date": "2025-01-09",
+        "new": "lua-async"
+    },
     "lua-dev-nvim": {
         "date": "2022-10-14",
         "new": "neodev-nvim"

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -193,23 +193,23 @@
   };
   c = buildGrammar {
     language = "c";
-    version = "0.0.0+rev=3efee11";
+    version = "0.0.0+rev=3aa2995";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c";
-      rev = "3efee11f784605d44623d7dadd6cd12a0f73ea92";
-      hash = "sha256-nb+CoRbX7RFAGus7USWA1NhAnnkkJ89vIdSN36QmSCE=";
+      rev = "3aa2995549d5d8b26928e8d3fa2770fd4327414e";
+      hash = "sha256-iT0sjwtrDtCduxCU3wVB1AP6gzxW3DpmqNQaP3LUBiA=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=4bf615f";
+    version = "0.0.0+rev=acff8cb";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "4bf615f8d688f50d69fc5677187dc35f22e03ad6";
-      hash = "sha256-jcZcmqQEOPzkiT1jJ4wuE9Ryg10XXpwBoyANNAhCbZg=";
+      rev = "acff8cbb53a1d7b9cd07b209c9933a0e2da9ef35";
+      hash = "sha256-Mdcr4UuoKiNodrNV7/NRfQkmgynPa798Rv9f6Qm3cFw=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -458,12 +458,12 @@
   };
   diff = buildGrammar {
     language = "diff";
-    version = "0.0.0+rev=63439b5";
+    version = "0.0.0+rev=e42b8de";
     src = fetchFromGitHub {
       owner = "the-mikedavis";
       repo = "tree-sitter-diff";
-      rev = "63439b5e6e35750aff1e53d9eecc663d369c54bc";
-      hash = "sha256-dMEeSOb4DlSPs5eq6tmFhrvkp9Imy3xS85hGoPFeH24=";
+      rev = "e42b8def4f75633568f1aecfe01817bf15164928";
+      hash = "sha256-1ibGin1e6+geAQNoV/KLCBOoXYcZo7S5+Q2XgsZPIfU=";
     };
     meta.homepage = "https://github.com/the-mikedavis/tree-sitter-diff";
   };
@@ -559,12 +559,12 @@
   };
   editorconfig = buildGrammar {
     language = "editorconfig";
-    version = "0.0.0+rev=efcd7c2";
+    version = "0.0.0+rev=ad9d7b8";
     src = fetchFromGitHub {
       owner = "ValdezFOmar";
       repo = "tree-sitter-editorconfig";
-      rev = "efcd7c2852c69822d625786324538b7457fafddb";
-      hash = "sha256-/JJKr4wZc9aGs8VFH479hazUDGD7kt3rw8LpH4w2GX8=";
+      rev = "ad9d7b84453426c40717c2b2c6b13d0a955d0662";
+      hash = "sha256-N717l1J0MCaWbjpmZ5hQI5bUy9kp9FSn2Coeqjn6CGE=";
     };
     meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-editorconfig";
   };
@@ -768,12 +768,12 @@
   };
   fsharp = buildGrammar {
     language = "fsharp";
-    version = "0.0.0+rev=971da5f";
+    version = "0.0.0+rev=207f1c9";
     src = fetchFromGitHub {
       owner = "ionide";
       repo = "tree-sitter-fsharp";
-      rev = "971da5ff0266bfe4a6ecfb94616548032d6d1ba0";
-      hash = "sha256-0jrbznAXcjXrbJ5jnxWMzPKxRopxKCtoQXGl80R1M0M=";
+      rev = "207f1c988f4649e12fe207e4a7e4f83b9da037d1";
+      hash = "sha256-NKK83ZwhpFY3TtSxLlAbaY8bBaQ7TXcVT4wMMm4Zm0A=";
     };
     location = "fsharp";
     meta.homepage = "https://github.com/ionide/tree-sitter-fsharp";
@@ -824,12 +824,12 @@
   };
   gdscript = buildGrammar {
     language = "gdscript";
-    version = "0.0.0+rev=bf39f1b";
+    version = "0.0.0+rev=48b4933";
     src = fetchFromGitHub {
       owner = "PrestonKnopp";
       repo = "tree-sitter-gdscript";
-      rev = "bf39f1b38a234d79940fd8866abb0b132ab51b1e";
-      hash = "sha256-z3/uxEgP1MomeGsAQimeUFBNhBLiUsYzvz0XlxwxoBU=";
+      rev = "48b49330888a4669b48619b211cc8da573827725";
+      hash = "sha256-mGmrCK3nGSzi/66mOxvpRyTA9b74aTMSoIISqzj+l90=";
     };
     meta.homepage = "https://github.com/PrestonKnopp/tree-sitter-gdscript";
   };
@@ -1000,12 +1000,12 @@
   };
   godot_resource = buildGrammar {
     language = "godot_resource";
-    version = "0.0.0+rev=74105cc";
+    version = "0.0.0+rev=941955d";
     src = fetchFromGitHub {
       owner = "PrestonKnopp";
       repo = "tree-sitter-godot-resource";
-      rev = "74105cc46a09850ebe626b894ecc6c61a12fb999";
-      hash = "sha256-aVIxIz92uVtbIZvT6x/eDNGJxiUhYasTWMq+W4/bySo=";
+      rev = "941955d027f1d8530501e77ce5e1d6035f5f99c1";
+      hash = "sha256-qecg47cYY3TXDz6aQLAyuJtxhvunIRB3bcNCftZAmqk=";
     };
     meta.homepage = "https://github.com/PrestonKnopp/tree-sitter-godot-resource";
   };
@@ -1088,12 +1088,12 @@
   };
   groovy = buildGrammar {
     language = "groovy";
-    version = "0.0.0+rev=b53a8cc";
+    version = "0.0.0+rev=1f30c33";
     src = fetchFromGitHub {
       owner = "murtaza64";
       repo = "tree-sitter-groovy";
-      rev = "b53a8cc1075e056b8223b86f3bb392e0d57ae101";
-      hash = "sha256-yLl3/4qla45tsjCd2EFutcNqVrDjyMUjnSpUUHwaIyE=";
+      rev = "1f30c3398495dfeba24c7aa3b12a2bc68c0bd419";
+      hash = "sha256-oq3IzUuY4eF/8/7UhOAoR4ZWAz5onUgiB+f4TmHf7Vc=";
     };
     meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
   };
@@ -1329,6 +1329,17 @@
     };
     meta.homepage = "https://github.com/inko-lang/tree-sitter-inko";
   };
+  ipkg = buildGrammar {
+    language = "ipkg";
+    version = "0.0.0+rev=8d3e978";
+    src = fetchFromGitHub {
+      owner = "srghma";
+      repo = "tree-sitter-ipkg";
+      rev = "8d3e9782f2d091d0cd39c13bfb3068db0c675960";
+      hash = "sha256-DyxD+Ehoqh0ywgU+J6EgnOQTcwOUJEuuXSOVjZ8M89c=";
+    };
+    meta.homepage = "https://github.com/srghma/tree-sitter-ipkg";
+  };
   ispc = buildGrammar {
     language = "ispc";
     version = "0.0.0+rev=9b2f9ae";
@@ -1441,23 +1452,23 @@
   };
   julia = buildGrammar {
     language = "julia";
-    version = "0.0.0+rev=e01c928";
+    version = "0.0.0+rev=ffdd9fe";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-julia";
-      rev = "e01c928d11375513138a175a68485c4d53e55ea9";
-      hash = "sha256-QOJfpPVW4G1Fmbggv4DloJA7sLzq0QYaHLsdgr07r24=";
+      rev = "ffdd9fe4dccdc26d62ce1654fceac52c394f0cf3";
+      hash = "sha256-AMKnttpHAThjas1gj/8YhB9y0TwNxqaIXAgPtiqGDZk=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-julia";
   };
   just = buildGrammar {
     language = "just";
-    version = "0.0.0+rev=4f4e566";
+    version = "0.0.0+rev=bb0c898";
     src = fetchFromGitHub {
       owner = "IndianBoy42";
       repo = "tree-sitter-just";
-      rev = "4f4e566fe47c30b14cfe388a28f70b79009609e5";
-      hash = "sha256-WBUNS+XFXi/h5AUM7Q8j8zAE2oqZeBHdpC5Au2QwqP8=";
+      rev = "bb0c898a80644de438e6efe5d88d30bf092935cd";
+      hash = "sha256-FwEuH/2R745jsuFaVGNeUTv65xW+MPjbcakRNcAWfZU=";
     };
     meta.homepage = "https://github.com/IndianBoy42/tree-sitter-just";
   };
@@ -1496,12 +1507,12 @@
   };
   koto = buildGrammar {
     language = "koto";
-    version = "0.0.0+rev=b420f79";
+    version = "0.0.0+rev=7258681";
     src = fetchFromGitHub {
       owner = "koto-lang";
       repo = "tree-sitter-koto";
-      rev = "b420f7922d0d74905fd0d771e5b83be9ee8a8a9a";
-      hash = "sha256-X1YnhmOpVJ+ENHXSK7jZxl1SXxa0UM07nkXdejlQDOA=";
+      rev = "7258681498ac92f24b2d7ebb844b5e79dc3cf9ac";
+      hash = "sha256-dBx0iyG1p+Lij/yKKhBZLZcnoB70P6A4Xd9UYzq2iVU=";
     };
     meta.homepage = "https://github.com/koto-lang/tree-sitter-koto";
   };
@@ -1552,12 +1563,12 @@
   };
   leo = buildGrammar {
     language = "leo";
-    version = "0.0.0+rev=6ca11a9";
+    version = "0.0.0+rev=44a061b";
     src = fetchFromGitHub {
       owner = "r001";
       repo = "tree-sitter-leo";
-      rev = "6ca11a96fc2cab51217e0cf4a2f9ed3ea63e28fb";
-      hash = "sha256-ye2zzLNZC2ZJqnXtBl7fdSC78kph3rs7j4whIdfDYAE=";
+      rev = "44a061bac4d9443d75f2700c62a71cd4dcf16f05";
+      hash = "sha256-BcQpqCrzn5qNsOlFL1wHvj48vsP1ZrMCYB+HMlIQ0cw=";
     };
     meta.homepage = "https://github.com/r001/tree-sitter-leo";
   };
@@ -1741,12 +1752,12 @@
   };
   mlir = buildGrammar {
     language = "mlir";
-    version = "0.0.0+rev=72929ac";
+    version = "0.0.0+rev=01065de";
     src = fetchFromGitHub {
       owner = "artagnon";
       repo = "tree-sitter-mlir";
-      rev = "72929ac13d7e1c46010114202262b7102a821293";
-      hash = "sha256-lJzZAWYjqX7HG/fbYCIoYWBjpndhlUV5c7ukFvXvRLQ=";
+      rev = "01065decfd6877fe3c4bae05782b8892544cb73e";
+      hash = "sha256-XygafBpyD5WQ9JBZstWjbjKYuDbPWzPbvO/6VLMuQt4=";
     };
     generate = true;
     meta.homepage = "https://github.com/artagnon/tree-sitter-mlir";
@@ -1786,12 +1797,12 @@
   };
   nickel = buildGrammar {
     language = "nickel";
-    version = "0.0.0+rev=ddaa2bc";
+    version = "0.0.0+rev=25464b3";
     src = fetchFromGitHub {
       owner = "nickel-lang";
       repo = "tree-sitter-nickel";
-      rev = "ddaa2bc22355effd97c0d6b09ff5962705c6368d";
-      hash = "sha256-jL054OJj+1eXksNYOTTTFzZjwPqTFp06syC3TInN8rc=";
+      rev = "25464b33522c3f609fa512aa9651707c0b66d48b";
+      hash = "sha256-dQeUoHQHkPYywYIm3TMnTWPXUlh2xh8M5CVUiXASBu8=";
     };
     meta.homepage = "https://github.com/nickel-lang/tree-sitter-nickel";
   };
@@ -1863,12 +1874,12 @@
   };
   nu = buildGrammar {
     language = "nu";
-    version = "0.0.0+rev=755efd5";
+    version = "0.0.0+rev=9822fc6";
     src = fetchFromGitHub {
       owner = "nushell";
       repo = "tree-sitter-nu";
-      rev = "755efd545d39e23418ce6f96f2a8600ff1a7e74d";
-      hash = "sha256-7lfSO/2GyWYicgmLRvwCfM4pqvFeUSD5urA4XE1uKew=";
+      rev = "9822fc63a62ff87939c88ead9f381f951f092dee";
+      hash = "sha256-fcwWrM1KpK1V+TeGqe/iMICOIv7/lA1WZW/8jJXL7WA=";
     };
     meta.homepage = "https://github.com/nushell/tree-sitter-nu";
   };
@@ -1896,24 +1907,24 @@
   };
   ocaml = buildGrammar {
     language = "ocaml";
-    version = "0.0.0+rev=98c2130";
+    version = "0.0.0+rev=57644ed";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-ocaml";
-      rev = "98c2130c59ca7553b47086f91c5d22180151ad55";
-      hash = "sha256-afzEd9+hm/J5T4GPWV6jvL4SGqUPvHCP6HnQixi/O+w=";
+      rev = "57644edfbba0edb38ac17dba2add4c243fa3539b";
+      hash = "sha256-eRCO7hNbNXd6k6I+cSLHMX8Ry68fKXTjJXLFmBvnQro=";
     };
     location = "grammars/ocaml";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
   };
   ocaml_interface = buildGrammar {
     language = "ocaml_interface";
-    version = "0.0.0+rev=98c2130";
+    version = "0.0.0+rev=57644ed";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-ocaml";
-      rev = "98c2130c59ca7553b47086f91c5d22180151ad55";
-      hash = "sha256-afzEd9+hm/J5T4GPWV6jvL4SGqUPvHCP6HnQixi/O+w=";
+      rev = "57644edfbba0edb38ac17dba2add4c243fa3539b";
+      hash = "sha256-eRCO7hNbNXd6k6I+cSLHMX8Ry68fKXTjJXLFmBvnQro=";
     };
     location = "grammars/interface";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-ocaml";
@@ -2156,12 +2167,12 @@
   };
   properties = buildGrammar {
     language = "properties";
-    version = "0.0.0+rev=f93f673";
+    version = "0.0.0+rev=579b62f";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-properties";
-      rev = "f93f673990deffbfa548826eebade93af81887b4";
-      hash = "sha256-XATT9i8lYcdTDtNHChtbUux9E6pg7jFPKnWR6tMEBew=";
+      rev = "579b62f5ad8d96c2bb331f07d1408c92767531d9";
+      hash = "sha256-4WgGbU6fthFH1DcvlQiqNGXucCfxA+hANZ7Y+r8eXHg=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-properties";
   };
@@ -2245,12 +2256,12 @@
   };
   python = buildGrammar {
     language = "python";
-    version = "0.0.0+rev=bffb65a";
+    version = "0.0.0+rev=409b5d6";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-python";
-      rev = "bffb65a8cfe4e46290331dfef0dbf0ef3679de11";
-      hash = "sha256-71Od4sUsxGEvTwmXX8hBvzqD55hnXkVJublrhp1GICg=";
+      rev = "409b5d671eb0ea4972eeacaaca24bbec1acf79b1";
+      hash = "sha256-IIAL2qteFPBCPmDK1N2EdDgpI4CwfMuuVL8t5tYueLU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
   };
@@ -2278,12 +2289,12 @@
   };
   qmljs = buildGrammar {
     language = "qmljs";
-    version = "0.0.0+rev=6d4db24";
+    version = "0.0.0+rev=8fef30e";
     src = fetchFromGitHub {
       owner = "yuja";
       repo = "tree-sitter-qmljs";
-      rev = "6d4db242185721e1f5ef21fde613ca90c743ec47";
-      hash = "sha256-S6rBQRecJvPgyWq1iydFZgDyXbm9CZBw8kxzNI0cqdw=";
+      rev = "8fef30e231d74b65c713bcbac21956156d8963da";
+      hash = "sha256-4OIXOePSu1Pc2BJuXoNNVZnKvjTjOQ6ixqE8NU7tLqg=";
     };
     meta.homepage = "https://github.com/yuja/tree-sitter-qmljs";
   };
@@ -2344,12 +2355,12 @@
   };
   rbs = buildGrammar {
     language = "rbs";
-    version = "0.0.0+rev=8d8e65a";
+    version = "0.0.0+rev=de893b1";
     src = fetchFromGitHub {
       owner = "joker1007";
       repo = "tree-sitter-rbs";
-      rev = "8d8e65ac3f77fbc9e15b1cdb9f980a3e0ac3ab99";
-      hash = "sha256-M72rShapD813gpBbWUIil6UgcnoF1DVTffMSnTpejgg=";
+      rev = "de893b166476205b09e79cd3689f95831269579a";
+      hash = "sha256-87Z8XQfuqrWYj9Mc+whVu9o3ZwfjGYylbvxZNYnA3UM=";
     };
     meta.homepage = "https://github.com/joker1007/tree-sitter-rbs";
   };
@@ -2621,12 +2632,12 @@
   };
   snakemake = buildGrammar {
     language = "snakemake";
-    version = "0.0.0+rev=29a82dd";
+    version = "0.0.0+rev=f36c158";
     src = fetchFromGitHub {
       owner = "osthomas";
       repo = "tree-sitter-snakemake";
-      rev = "29a82ddde86c0d428acf971b04794c13525c4bc5";
-      hash = "sha256-55nfPYR9iuHpV1TXELOAyF+PVqI1LYpCGc9RP2RylVU=";
+      rev = "f36c1587624d6d84376c82a357c20fc319cbf02c";
+      hash = "sha256-yiEfMB67bIaIj+iXQ/ShvVQES6HCWnKI6DzWxsrIrRk=";
     };
     meta.homepage = "https://github.com/osthomas/tree-sitter-snakemake";
   };
@@ -2689,12 +2700,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=f2a6b6f";
+    version = "0.0.0+rev=b9d1095";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "f2a6b6f86cd4322c346faa312ddf2b839bf5e989";
-      hash = "sha256-8rEUNBP8ZChtPcQVTcVm7tg9E4ImogSYkLA6aw0hz+E=";
+      rev = "b9d109588d5b5ed986c857464830c2f0bef53f18";
+      hash = "sha256-uEiwHIlLC6AyqD3/fH9KmXMdgQUb30MwBGrjPoyAPbc=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -2711,12 +2722,12 @@
   };
   ssh_config = buildGrammar {
     language = "ssh_config";
-    version = "0.0.0+rev=dd32616";
+    version = "0.0.0+rev=0dd3c7e";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-ssh-config";
-      rev = "dd32616275c6e9d7800c58f40c16a09ad1c7c238";
-      hash = "sha256-BOvCOnt76f00+hqjEmJ8VLiwqSPd3p/yScTXsuNdexY=";
+      rev = "0dd3c7e9f301758f6c69a6efde43d3048deb4d8a";
+      hash = "sha256-jNB9cHOfHDIRPELm8LedJjNzjx16/ApcPGi8eaaJKZs=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
   };
@@ -2811,12 +2822,12 @@
   };
   swift = buildGrammar {
     language = "swift";
-    version = "0.0.0+rev=7ca0504";
+    version = "0.0.0+rev=f4be807";
     src = fetchFromGitHub {
       owner = "alex-pinkus";
       repo = "tree-sitter-swift";
-      rev = "7ca0504e6d1a3e1e2f5fa725dafecf5e5bd2b202";
-      hash = "sha256-k+8dgX0VYVu9B1UwFdLcxjnfOGQiqQr0LCXbr+T4N8o=";
+      rev = "f4be8072f18fb9704fd35d4b8154ae2b19e314c0";
+      hash = "sha256-B/LtB+HyZKXra/Fs2ZyhVSjUXUJKQDgG8xuv/LpL6YA=";
     };
     generate = true;
     meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -2901,12 +2912,12 @@
   };
   templ = buildGrammar {
     language = "templ";
-    version = "0.0.0+rev=9269b5a";
+    version = "0.0.0+rev=60310af";
     src = fetchFromGitHub {
       owner = "vrischmann";
       repo = "tree-sitter-templ";
-      rev = "9269b5a65e79be8fb6b6669935823263343b7ba0";
-      hash = "sha256-GnL5J5JBx+DW2UbKRGVg3eSDHryvJMs7irOqnWZXpL0=";
+      rev = "60310af0d788a0160d719d4aff8f146b6e6c55bd";
+      hash = "sha256-M0+Yw2Ld9qT9Ag9OaMpmls8LO4+IK0xtAZ8X5oZ2c78=";
     };
     meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
   };
@@ -3148,12 +3159,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=b9644a2";
+    version = "0.0.0+rev=5351039";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "v-analyzer";
-      rev = "b9644a24bf0be5bf41de61bda681b28492dd3112";
-      hash = "sha256-XURrUjpp7tytq5eO4BY0fmaMssE4B46P3gybbcfVzr4=";
+      rev = "535103910159887a41d019635c1cdbec910d1a31";
+      hash = "sha256-4VxvK9KzJlN0AsXz0XL5FIs3H65vPgyj/YqTc138zC4=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/v-analyzer";
@@ -3171,12 +3182,12 @@
   };
   vento = buildGrammar {
     language = "vento";
-    version = "0.0.0+rev=3321077";
+    version = "0.0.0+rev=3b32474";
     src = fetchFromGitHub {
       owner = "ventojs";
       repo = "tree-sitter-vento";
-      rev = "3321077d7446c1b3b017c294fd56ce028ed817fe";
-      hash = "sha256-/U8hZiYC9/pWscAYDIFgttLDMTq6RLNuHKNTZ/Q4bAc=";
+      rev = "3b32474bc29584ea214e4e84b47102408263fe0e";
+      hash = "sha256-h8yC+MJIAH7DM69UQ8moJBmcmrSZkxvWrMb+NqtYB2Y=";
     };
     meta.homepage = "https://github.com/ventojs/tree-sitter-vento";
   };
@@ -3193,12 +3204,12 @@
   };
   vhdl = buildGrammar {
     language = "vhdl";
-    version = "0.0.0+rev=eb15328";
+    version = "0.0.0+rev=63d0360";
     src = fetchFromGitHub {
       owner = "jpt13653903";
       repo = "tree-sitter-vhdl";
-      rev = "eb1532861767a46fc336102bd4ebc938da8773f5";
-      hash = "sha256-IEE3uSS+XD8xXrbAzebfiDKGZpoYVOEazAX1tC7L2p8=";
+      rev = "63d0360d42c43b4902b8470c7ddcf323432e2dde";
+      hash = "sha256-D85VFM82lU4GDpIWZmY+j6134DHp0pGbqg8Haj2mgiw=";
     };
     meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
   };
@@ -3326,12 +3337,12 @@
   };
   xresources = buildGrammar {
     language = "xresources";
-    version = "0.0.0+rev=5fd347f";
+    version = "0.0.0+rev=8117b0a";
     src = fetchFromGitHub {
       owner = "ValdezFOmar";
       repo = "tree-sitter-xresources";
-      rev = "5fd347f0b950b2d2563d41176373c610a0a5468c";
-      hash = "sha256-M0oDcCiAlybi0kXXor1g1Kxj3ulZEJkBiMNA0OcxNao=";
+      rev = "8117b0ab58df8afb902c0862b7f6eb3bbb06c7ab";
+      hash = "sha256-3umsmD5avsKW4BmBvwXI14Ex82E8hXq8xk4EFabDjO0=";
     };
     meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-xresources";
   };

pkgs/applications/editors/vim/plugins/patches/aider-nvim/bin.patch

@@ -0,0 +1,15 @@
+diff --git a/lua/aider.lua b/lua/aider.lua
+index 98b5071..589b06d 100644
+--- a/lua/aider.lua
++++ b/lua/aider.lua
+@@ -61,9 +61,9 @@ function M.AiderOpen(args, window_type)
+     log("Existing aider buffer found, opening in new window")
+     helpers.open_buffer_in_new_window(window_type, M.aider_buf)
+   else
+     log("No existing aider buffer, creating new one")
+-    local command = "aider " .. (args or "")
++    local command = "@aider@ " .. (args or "")
+     log("Opening window with type: " .. window_type)
+     helpers.open_window(window_type)
+     log("Adding buffers to command")
+     command = helpers.add_buffers_to_command(command, is_valid_buffer)

pkgs/applications/editors/vim/plugins/patches/aider.nvim/fix-paths.patch

@@ -1,26 +0,0 @@
-diff --git a/lua/aider.lua b/lua/aider.lua
-index 38db0d1..d1ad6d5 100644
---- a/lua/aider.lua
-+++ b/lua/aider.lua
-@@ -26,7 +26,7 @@ function M.AiderOpen(args, window_type)
-   if M.aider_buf and vim.api.nvim_buf_is_valid(M.aider_buf) then
-     helpers.open_buffer_in_new_window(window_type, M.aider_buf)
-   else
--    command = 'aider ' .. (args or '')
-+    command = '@aider@ ' .. (args or '')
-     helpers.open_window(window_type)
-     command = helpers.add_buffers_to_command(command)
-     M.aider_job_id = vim.fn.termopen(command, {on_exit = OnExit})
-diff --git a/lua/helpers.lua b/lua/helpers.lua
-index 152182b..aa21584 100644
---- a/lua/helpers.lua
-+++ b/lua/helpers.lua
-@@ -63,7 +63,7 @@ end
- 
- local function build_background_command(args, prompt)
-   prompt = prompt or "Complete as many todo items as you can and remove the comment for any item you complete."
--  local command = 'aider --msg "' .. prompt .. '" ' .. (args or '')
-+  local command = '@aider@ --msg "' .. prompt .. '" ' .. (args or '')
-   command = add_buffers_to_command(command)
-   return command
- end

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -257,6 +257,9 @@ https://github.com/rizzatti/dash.vim/,HEAD,
 https://github.com/nvimdev/dashboard-nvim/,,
 https://github.com/Shougo/ddc-filter-matcher_head/,HEAD,
 https://github.com/Shougo/ddc-filter-sorter_rank/,HEAD,
+https://github.com/tani/ddc-fuzzy/,HEAD,
+https://github.com/Shougo/ddc-source-around/,HEAD,
+https://github.com/LumaKernel/ddc-source-file/,HEAD,
 https://github.com/Shougo/ddc-source-lsp/,HEAD,
 https://github.com/Shougo/ddc-ui-native/,HEAD,
 https://github.com/Shougo/ddc-ui-pum/,HEAD,
@@ -531,7 +534,7 @@ https://github.com/deathbeam/lspecho.nvim/,HEAD,
 https://github.com/onsails/lspkind.nvim/,,
 https://github.com/nvimdev/lspsaga.nvim/,,
 https://github.com/barreiroleo/ltex_extra.nvim/,HEAD,
-https://github.com/nvim-java/lua-async-await/,HEAD,
+https://github.com/nvim-java/lua-async/,HEAD,
 https://github.com/arkav/lualine-lsp-progress/,,
 https://github.com/nvim-lualine/lualine.nvim/,,
 https://github.com/l3mon4d3/luasnip/,,
@@ -597,6 +600,7 @@ https://github.com/echasnovski/mini.operators/,HEAD,
 https://github.com/echasnovski/mini.pairs/,HEAD,
 https://github.com/echasnovski/mini.pick/,HEAD,
 https://github.com/echasnovski/mini.sessions/,HEAD,
+https://github.com/echasnovski/mini.snippets/,HEAD,
 https://github.com/echasnovski/mini.splitjoin/,HEAD,
 https://github.com/echasnovski/mini.starter/,HEAD,
 https://github.com/echasnovski/mini.statusline/,HEAD,

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2024-11-15";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "1068cb8dbd6f312664ecf5901625cab4a6533204";
-    hash = "sha256-ioAnpz6OkHWPaYE0uTEvnHV+vGzq02bQ4oUP8jW6/YA=";
+    rev = "60cf49e94e65d4023d93718161dc03b9e24da47a";
+    hash = "sha256-EFiLF/5zcoPFnzozEqkXWOEjx3KCgRoixYXqN9ai7qc=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/beetle-supafaust.nix

@@ -5,7 +5,7 @@
 }:
 mkLibretroCore {
   core = "mednafen-supafaust";
-  version = "0-unstable-2024-10-01";
+  version = "0-unstable-2024-09-30";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/bsnes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2024-12-13";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "a0bb11bbb1fc5d6b478baca53c3efe526c43986c";
-    hash = "sha256-unOJ2hdCA5LxNUcJe7fJCAetLpqrQzujxFDOsxLzXow=";
+    rev = "1e0054da1c158857dc444b9b52273ddd18858d49";
+    hash = "sha256-zm4X5RTaAm2njtvCBWBT1vhtf/YQvoBaaBSMzz9D2aQ=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/desmume2015.nix

@@ -10,7 +10,7 @@
 }:
 mkLibretroCore {
   core = "desmume2015";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2022-04-05";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2024-09-28";
+  version = "0-unstable-2024-12-31";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "9b4147fd14332a7354c9b76fa72653bda2d919e9";
-    hash = "sha256-lzRBzBMIQ3X+VAHK8pl/HYELecTkdFlWJI7C1csmZ7I=";
+    rev = "9e468f0087454c6c1b68975ead933977d5cf33b2";
+    hash = "sha256-tiyDXxwZapu+Ol1icOeemVQ5oAjMMx2/M4nA0CiRkMY=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/easyrpg.nix

@@ -67,6 +67,9 @@ mkLibretroCore {
   ];
   makefile = "Makefile";
 
+  # Do not update automatically since we want to pin a specific version
+  passthru.updateScript = null;
+
   meta = {
     description = "EasyRPG Player libretro port";
     homepage = "https://github.com/EasyRPG/Player";

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2024-10-03";
+  version = "0-unstable-2025-01-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "d72f49f4a45dbfc5a855956d1a75ce2d0601c1c5";
-    hash = "sha256-+T+HQo6IfY8+oE/mOg54Vn9NhasGYNCLXksFdSDT/xE=";
+    rev = "b8780c057029db8768c9a057b0bc28f9a12609d8";
+    hash = "sha256-cK3ILA0Ape6rHf5dPbXOMmQ69ZPZ/qrxeKYA1LniBEk=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2024-10-05";
+  version = "0-unstable-2025-01-09";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "d689c50e21bf956913ac607933cd4082eaedc06b";
-    hash = "sha256-XIe1JrKVY4ba5WnKrVofWNpJU5pcwUyDd14ZzaGcf+k=";
+    rev = "3114344414dbd8fb08efe1d6a25dbae457a2ec44";
+    hash = "sha256-UgH8L02WkAPaMMUnes6GYLjRbkuY8+9b6LCGaaQWhjQ=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/fuse.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fuse";
-  version = "0-unstable-2024-09-20";
+  version = "0-unstable-2024-11-24";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fuse-libretro";
-    rev = "6fd07d90acc38a1b8835bf16539b833f21aaa38f";
-    hash = "sha256-q5vcFNr1RBeTaw1R2LDY9xLU1oGeWtPemTdliWR+39s=";
+    rev = "cad85b7b1b864c65734f71aa4a510b6f6536881c";
+    hash = "sha256-SdwdcR9szJJoUxQ4y8rh40Bdnn5ZI2qV4OcS39BFViQ=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/gambatte.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2024-12-20";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "a870b6dcde66fba00cd7aab5ae4bb699e458a91b";
-    hash = "sha256-yarpWSRmfqufj3sXwO1SHZ7VnPSITK/WG8u6mHil/OE=";
+    rev = "36a0da43fe6a82aba6acc5336574dbd749b18fa8";
+    hash = "sha256-3PM7PK1ouMObNZEIIIBG8gxIydYFKP9RRGlWBr5PIGU=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2024-12-13";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "3c1698778080541927f3d7011a00d2c9efe545af";
-    hash = "sha256-H310/VeGDVNz3bYEb7qIcstFc2ae0F+5+0LVVSHLeqI=";
+    rev = "bf492bf3532b9d30e7a023e4329e202b15169e1c";
+    hash = "sha256-QxplBzath9xN0AaFOT8K0dVEnMnTaZpLfdsX81fmP9g=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/mame.nix

@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2024-11-01";
+  version = "0-unstable-2025-01-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "a67797ad2f7516906ed7acef87569c6f35ca8739";
-    hash = "sha256-MF6MWQftHBYL1Uv3ZYKFqCH24nd1+M73rhUzkdftMzk=";
+    rev = "20db0f242e4e11a476b548dd57d2ef9cc3e84f03";
+    hash = "sha256-+xShU96m+KCHrFleEy55fBD5vCM+hsYMqIvRZQtzsr8=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/mame2000.nix

@@ -6,7 +6,7 @@
 }:
 mkLibretroCore {
   core = "mame2000";
-  version = "0-unstable-2024-11-01";
+  version = "0-unstable-2024-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2024-12-29";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "aaf1a95728d9ca6d4cf6633b6a839f8daa27db81";
-    hash = "sha256-AjeXfISAcH6RiHU5gJutZUdpg2p+ASVKsI1+Nl76xSY=";
+    rev = "61305d60329d6a9abf7ddad1c3657b3253c5e64d";
+    hash = "sha256-fLThBOHkX0dV0zjDuJIh1ILpWi2FNV9oOXRH4ApcGbs=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2015.nix

@@ -7,7 +7,7 @@
 }:
 mkLibretroCore {
   core = "mame2015";
-  version = "0-unstable-2023-11-01";
+  version = "0-unstable-2023-10-31";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/mame2016.nix

@@ -8,7 +8,7 @@
 }:
 mkLibretroCore {
   core = "mame2016";
-  version = "0-unstable-2024-04-06";
+  version = "0-unstable-2022-04-06";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/mesen.nix

@@ -5,7 +5,7 @@
 }:
 mkLibretroCore {
   core = "mesen";
-  version = "0.9.9-unstable-2024-10-21";
+  version = "0-unstable-2024-10-21";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/mrboom.nix

@@ -5,7 +5,7 @@
 }:
 mkLibretroCore rec {
   core = "mrboom";
-  version = "5.5-unstable-2024-10-21";
+  version = "0-unstable-2024-10-21";
 
   src = fetchFromGitHub {
     owner = "Javanaise";

pkgs/applications/emulators/libretro/cores/nestopia.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nestopia";
-  version = "0-unstable-2024-12-22";
+  version = "0-unstable-2025-01-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nestopia";
-    rev = "6bbfff9a56ead67f0da696ab2c3aea3c11896964";
-    hash = "sha256-D2FtfabikcZq0dl+ot/NJJkOaQXj0Sl5P2ioNrvxgSs=";
+    rev = "9762adc00668f3a2e1016f3ad07ff9cbf9d67459";
+    hash = "sha256-CLEwhQ91dxoTLyhlQwssoCL/dEqY6SetwWLogfJi8RU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/opera.nix

@@ -6,7 +6,7 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2024-10-17";
+  version = "0-unstable-2024-10-16";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2024-11-17";
+  version = "0-unstable-2025-01-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "e3d7ea45c75f2752e351d5c5b54cf7e79e66d26e";
-    hash = "sha256-dJqomyUHYQ+vpyu7/w2S/NidgYbHiGBWjebFQAXjzI0=";
+    rev = "c5d1f1dd5e304dfcba2adf0de8aa9188ca35fad3";
+    hash = "sha256-4stYqeGrKtNtjbhoG8IriV41xq3urH9QMNnqYMQ7CxQ=";
   };
 
   dontConfigure = true;

pkgs/applications/emulators/libretro/cores/pcsx2.nix

@@ -2,62 +2,54 @@
   lib,
   cmake,
   fetchFromGitHub,
-  gcc12Stdenv,
-  gettext,
   libGL,
   libGLU,
-  libaio,
-  libpcap,
-  libpng,
-  libxml2,
   mkLibretroCore,
+  perl,
   pkg-config,
-  xxd,
   xz,
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2023-01-30";
+  version = "0-unstable-2025-01-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
-    repo = "lrps2";
-    rev = "f3c8743d6a42fe429f703b476fecfdb5655a98a9";
-    hash = "sha256-0piCNWX7QbZ58KyTlWp4h1qLxXpi1z6ML8sBHMTvCY4=";
+    repo = "ps2";
+    rev = "397b8f54b92aeffd2dd502c2c9b601305fb1de9d";
+    hash = "sha256-zP4gOxAAWqgmGkilVijY2GF6awD7cbMICfxYSsI1wa0=";
+    fetchSubmodules = true;
   };
 
   extraNativeBuildInputs = [
     cmake
-    gettext
     pkg-config
   ];
+
   extraBuildInputs = [
-    libaio
     libGL
     libGLU
-    libpcap
-    libpng
-    libxml2
+    perl
     xz
-    xxd
   ];
+
+  # libretro/ps2 needs at least those flags to compile, and probably doesn't
+  # work on x86_64-v1
+  # https://github.com/libretro/ps2/blob/397b8f54b92aeffd2dd502c2c9b601305fb1de9d/cmake/BuildParameters.cmake#L101
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-msse"
+    "-msse2"
+    "-msse4.1"
+    "-mfxsr"
+  ];
+
   makefile = "Makefile";
-  cmakeFlags = [ "-DLIBRETRO=ON" ];
-  # remove ccache
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail "ccache" ""
-  '';
-  postBuild = "cd pcsx2";
-  # causes redefinition of _FORTIFY_SOURCE
-  hardeningDisable = [ "fortify3" ];
-  # FIXME: multiple build errors with GCC13.
-  # Unlikely to be fixed until we switch to libretro/pcsx2 that is a more
-  # up-to-date port (but still WIP).
-  stdenv = gcc12Stdenv;
+
+  preInstall = "cd bin";
 
   meta = {
     description = "Port of PCSX2 to libretro";
-    homepage = "https://github.com/libretro/lrps2";
+    homepage = "https://github.com/libretro/ps2";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.x86;
   };

pkgs/applications/emulators/libretro/cores/picodrive.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "picodrive";
-  version = "0-unstable-2024-10-19";
+  version = "0-unstable-2024-12-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "picodrive";
-    rev = "0daf92b57fba1fdbc124651573e88373eef28aa5";
-    hash = "sha256-rvgcGNpHhjHpg5q6qiu08lBn+Zjx87E5/Q98gPoffhE=";
+    rev = "bb4b7bcddb9f2f218e88971cccc66edf6c7669f0";
+    hash = "sha256-KbPsPG4pFZRHQoLuPVvBdXQTa+uXtmvSBKi7ShMyB3A=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2024-10-19";
+  version = "0-unstable-2025-01-09";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "c3cba5418b4e5618befd9c2790498cf3cf88372a";
-    hash = "sha256-xO2Pgl1E0JFEsthTmG+Ka+NqOTWG/JeeAIa6wBWXJyc=";
+    rev = "2958fa6c5ada62a3150513e4d8b6c4343c1cfbb8";
+    hash = "sha256-beo3tOUW62tiZISdAAGdeSVrS8w1l8x+JIi0nDDl5wA=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2024-11-15";
+  version = "0-unstable-2025-01-10";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "2402eea4b16908ad59079bcf3fab06ba63531a3c";
-    hash = "sha256-bpeiZdcXkGWLFZOsxTGuVmo4xAiUb9v5Wf6pWkt5JV0=";
+    rev = "aa752ade6c99ec6db4c7f7cbc6c1133738005c5f";
+    hash = "sha256-zbDXAI3VnpPQbPMAN1ie5nPFCNzBQif1S1nZnar4fvg=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/snes9x.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "1.63-unstable-2024-12-08";
+  version = "0-unstable-2024-12-17";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "9be3ed49a8711b016eb7280b758995bf2cbca4dd";
-    hash = "sha256-3FE90o+OJYiBzaiLEggZZ3jbLCFTRMwI/ayaJ5clm4c=";
+    rev = "48fe9344633001703782244651cdbf754532f9ab";
+    hash = "sha256-rPwav34DQPITmzIYB/iJOVjJQ96YJdJa4y4AbkZJMvg=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/snes9x2010.nix

@@ -5,7 +5,7 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2024-11-18";
+  version = "0-unstable-2024-11-19";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/stella.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "7.0-unstable-2024-12-18";
+  version = "0-unstable-2025-01-02";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "dacf66131c938635a7017de364ba999ebbb35bb7";
-    hash = "sha256-X6haV9SKQn2lnWs5kcNePP9wfz3G3yq/rEIGiPiBTOY=";
+    rev = "66823c533a9b273293a18a342ffaea749218827b";
+    hash = "sha256-EQGpHnIcvgNdp5rwJVxQRdJwRzBTMxZDSF1521ybZqI=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/thepowdertoy.nix

@@ -6,7 +6,7 @@
 }:
 mkLibretroCore {
   core = "thepowdertoy";
-  version = "0-unstable-2024-10-01";
+  version = "0-unstable-2024-09-30";
 
   src = fetchFromGitHub {
     owner = "libretro";

pkgs/applications/emulators/libretro/cores/vecx.nix

@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "vecx";
-  version = "0-unstable-2024-06-28";
+  version = "0-unstable-2024-10-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-vecx";
-    rev = "0e48a8903bd9cc359da3f7db783f83e22722c0cf";
-    hash = "sha256-lB8NSaxDbN2qljhI0M/HFDuN0D/wMhFUQXhfSdGHsHU=";
+    rev = "a103a212ca8644fcb5d76eac7cdec77223c4fb02";
+    hash = "sha256-veCGW5mbR1V7cCzZ4BzDSdPZDycw4WNveie/DDVAzw8=";
   };
 
   extraBuildInputs = [

pkgs/applications/graphics/inkscape/extensions/textext/default.nix

@@ -21,13 +21,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "textext";
-  version = "1.10.2";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "textext";
     repo = "textext";
     tag = version;
-    sha256 = "sha256-JbI/ScCFCvHbK9JZzHuT67uSAL3546et+gtTkwRnCSE=";
+    sha256 = "sha256-u0oNAauCUHNObE5Hp/X9hHcEP2wmLhcxH2aas3Mg5RY=";
   };
 
   patches = [
@@ -59,6 +59,7 @@ python3.pkgs.buildPythonApplication rec {
     python3.pkgs.lxml
     python3.pkgs.cssselect
     python3.pkgs.numpy
+    python3.pkgs.tinycss2
   ];
 
   # strictDeps do not play nicely with introspection setup hooks.

pkgs/applications/graphics/sane/xsane.nix

@@ -27,12 +27,87 @@ stdenv.mkDerivation rec {
     hash = "sha256-oOg94nUsT9LLKnHocY0S5g02Y9a1UazzZAjpEI/s+yM=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/xsane/raw/rawhide/f/xsane-0.998-libpng.patch";
-      hash = "sha256-0z292+Waa2g0PCQpUebdWprl9VDyBOY0XgqMJaIcRb8=";
-    })
-  ];
+  # add all fedora patchs. fix gcc-14 build among other things
+  # https://src.fedoraproject.org/rpms/xsane/tree/main
+  patches =
+    let
+      fetchFedoraPatch =
+        { name, hash }:
+        fetchpatch {
+          inherit name hash;
+          url = "https://src.fedoraproject.org/rpms/xsane/raw/846ace0a29063335c708b01e9696eda062d7459c/f/${name}";
+        };
+    in
+    map fetchFedoraPatch [
+      {
+        name = "0001-Follow-new-convention-for-registering-gimp-plugin.patch";
+        hash = "sha256-yOY7URyc8HEHHynvdcZAV1Pri31N/rJ0ddPavOF5zLw=";
+      }
+      {
+        name = "xsane-0.995-close-fds.patch";
+        hash = "sha256-qE7larHpBEikz6OaOQmmi9jl6iQxy/QM7iDg9QrVV1o=";
+      }
+      {
+        name = "xsane-0.995-xdg-open.patch";
+        hash = "sha256-/kHwwuDC2naGEp4NALfaJ0pJe+9kYhV4TX1eGeARvq8=";
+      }
+      {
+        name = "xsane-0.996-no-eula.patch";
+        hash = "sha256-CYmp1zFg11PUPz9um2W7XF6pzCzafKSEn2nvPiUSxNo=";
+      }
+      {
+        name = "xsane-0.997-ipv6.patch";
+        hash = "sha256-D3xH++DHxyTKMxgatU+PNCVN1u5ajPc3gQxvzhMYIdM=";
+      }
+      {
+        name = "xsane-0.997-off-root-build.patch";
+        hash = "sha256-2LXQfMbvqP+TAhAmxRe6pBqNlSX4tVjhDkBHIfX9HcA=";
+      }
+      {
+        name = "xsane-0.998-desktop-file.patch";
+        hash = "sha256-3xEj6IaOk/FS8pv+/yaNjZpIoB+0Oei0QB9mD4/owkM=";
+      }
+      {
+        name = "xsane-0.998-libpng.patch";
+        hash = "sha256-0z292+Waa2g0PCQpUebdWprl9VDyBOY0XgqMJaIcRb8=";
+      }
+      {
+        name = "xsane-0.998-preview-selection.patch";
+        hash = "sha256-TZ8vRA+0qPY2Rqz0VNHjgkj3YPob/BW+zBoVqxnUhb8=";
+      }
+      {
+        name = "xsane-0.998-wmclass.patch";
+        hash = "sha256-RubFOs+hsZS+GdxF0yvLSy4v+Fi6vb9G6zfwWZcUlkY=";
+      }
+      {
+        name = "xsane-0.999-lcms2.patch";
+        hash = "sha256-eiAxa1lhFrinqBvlIhH+NP7WBKk0Plf2S+OVTcpxXac=";
+      }
+      {
+        name = "xsane-0.999-man-page.patch";
+        hash = "sha256-4g0w4x9boAIOA6s5eTzKMh2mkkRKtF1TZ9KgHNTDaAg=";
+      }
+      {
+        name = "xsane-0.999-no-file-selected.patch";
+        hash = "sha256-e/QKtvsIwU5yy0SJKAEAmhmCoxWqV6FHmAW41SbW/eI=";
+      }
+      {
+        name = "xsane-0.999-pdf-no-high-bpp.patch";
+        hash = "sha256-o3LmOvgERuB9CQ8RL2Nd40h1ePuuuGMSK1GN68QlJ6s=";
+      }
+      {
+        name = "xsane-0.999-signal-handling.patch";
+        hash = "sha256-JU9BJ6UIDa1FsuPaQKsxcjxvsJkwgmuopIqCVWY3LQ0=";
+      }
+      {
+        name = "xsane-0.999-snprintf-update.patch";
+        hash = "sha256-bSTeoIOLeJ4PEsBHR+ZUQLPmrc0D6aQzyJGlLVhXt8o=";
+      }
+      {
+        name = "xsane-configure-c99.patch";
+        hash = "sha256-ukaNGgzCGiQwbOzSguAqBIKOUzXofSC3lct812U/8gY=";
+      }
+    ];
 
   preConfigure = ''
     sed -e '/SANE_CAP_ALWAYS_SETTABLE/d' -i src/xsane-back-gtk.c

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox-beta";
-  version = "133.0b9";
+  version = "135.0b3";
   applicationName = "Mozilla Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "2c950f04730666387a84b25cfe3afbd93b53988608345a062c8b538619e895c274049fe557a604e86f7ea5744ae2a50dc9c448a20664f0d7308949422a453ae9";
+    sha512 = "2d6f04b929257532ac3883f6c16f063718c66acaf0c131d1f449f4a0de947d061ca772a3388f02b9122649ba27474500db287a9b4b7a0cc53a1639805c7f3064";
   };
 
   meta = {

pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "133.0.3-1",
+  "packageVersion": "134.0-1",
   "source": {
-    "rev": "133.0.3-1",
-    "sha256": "05mlqqcvsa84h3nagm51hwsxkxsbcn2676fj4bih37ddlgkylf3b"
+    "rev": "134.0-1",
+    "sha256": "bu9ec9gK4b1OkC2Z1ycr/lmhrSB5TcIqcHXaZxf0Vmw="
   },
   "firefox": {
-    "version": "133.0.3",
-    "sha512": "ce48beaa5bb1717d9b6dbfff035b1bb5de1456df14b6a91adfaf3ccfb7ac550ab7ee854546231424a920e01d981825253609fce2ec326c4aa1ca316bbbdb31f8"
+    "version": "134.0",
+    "sha512": "EnWmhtwKJ7SN9K4FYWURUS9nbgNHTjCVslIerCWjhdNFqj6HhnFtvoEq9J4H1ysydyR5CJ1kiWjiAEygycNTRA=="
   }
 }

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.10.0";
+  version = "5.10.2";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-gkwu28VWelUhjkvcosBnGuT1J0MLykOufcsn9jl7vqU=";
+    hash = "sha256-uVXBQPUz1eSJkHk5q7MK2JOT4R7sbtJjTxXBt9WsUzI=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -46,11 +46,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.54.2";
+  version = "3.54.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-7eopEv/bZZnA6gKJw6muIBe/43oI14IjWEUhqlaGtXY=";
+    hash = "sha256-dGz4HvXDJa8X9Tsvq0bWcmDzsT2gFNiZTUrZ6Ea4Ves=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -98,8 +98,8 @@ rec {
   thunderbird-esr = thunderbird-128;
 
   thunderbird-128 = common {
-    version = "128.5.2esr";
-    sha512 = "cbfd4b1a7245c2a2f6ef9b2cf69d95a8095eba855755d00fd397351b21ad504733084d6f41801f4114be7015332b8db65e5290bec45f5321efc753412b9acecc";
+    version = "128.6.0esr";
+    sha512 = "a561eac0bf0b8c72f3337ccebcde9099c342d1b31ce2b1f31096f1f805a195c49d627cf726cd56d41b21ec292d96fd577e8f226fcb24d8b13e0d773fc334b073";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-128";

pkgs/applications/networking/p2p/mldonkey/default.nix

@@ -1,53 +1,64 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
+  autoreconfHook,
+  autoconf-archive,
   ocamlPackages,
+  pkg-config,
   zlib,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mldonkey";
-  version = "3.1.7-2";
+  version = "3.2.1";
 
-  src = fetchurl {
-    url = "https://ygrek.org/p/release/mldonkey/mldonkey-${version}.tar.bz2";
-    sha256 = "b926e7aa3de4b4525af73c88f1724d576b4add56ef070f025941dd51cb24a794";
+  src = fetchFromGitHub {
+    owner = "ygrek";
+    repo = "mldonkey";
+    tag = "release-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    hash = "sha256-Dbb7163CdqHY7/FJY2yWBFRudT+hTFT6fO4sFgt6C/A=";
   };
 
-  patches = [
-    # Fixes C++17 compat
-    (fetchpatch {
-      url = "https://github.com/ygrek/mldonkey/pull/66/commits/20ff84c185396f3d759cf4ef46b9f0bd33a51060.patch";
-      hash = "sha256-MCqx0jVfOaLkZhhv0b1cTdO6BK2/f6TxTWmx+NZjXME=";
-    })
-    # Fixes OCaml 4.12 compat
-    (fetchpatch {
-      url = "https://github.com/ygrek/mldonkey/commit/a153f0f7a4826d86d51d4bacedc0330b70fcbc34.patch";
-      hash = "sha256-/Muk3mPFjQJ48FqaozGa7o8YSPhDLXRz9K1EyfxlzC8=";
-    })
-    # Fixes OCaml 4.14 compat
-    (fetchpatch {
-      url = "https://github.com/FabioLolix/AUR-artifacts/raw/6721c2d4ef0be9a99499ecf2787e378e50b915e9/mldonkey-fix-build.patch";
-      hash = "sha256-HPW/CKfhywy+Km5/64Iok4tO9LJjAk53jVlsYzIRPfs=";
-    })
-  ];
-
-  preConfigure = ''
-    substituteInPlace Makefile --replace '+camlp4' \
-      '${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4'
+  postPatch = ''
+    substituteInPlace config/Makefile.in \
+      --replace-fail '+camlp4' '${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4'
   '';
 
   strictDeps = true;
-  nativeBuildInputs = with ocamlPackages; [
-    ocaml
-    camlp4
+
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    ocamlPackages.camlp4
+    ocamlPackages.findlib
+    ocamlPackages.ocaml
+    pkg-config
   ];
-  buildInputs = (with ocamlPackages; [ num ]) ++ [ zlib ];
+
+  buildInputs = [
+    ocamlPackages.num
+    zlib
+  ];
+
+  preAutoreconf = ''
+    cd config
+  '';
+
+  postAutoreconf = ''
+    cd ..
+  '';
+
+  env =
+    {
+      NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+    }
+    # https://github.com/ygrek/mldonkey/issues/117
+    // lib.optionalAttrs stdenv.cc.isClang {
+      CXXFLAGS = "-std=c++98";
+    };
 
   meta = {
-    broken = stdenv.hostPlatform.isDarwin;
     description = "Client for many p2p networks, with multiple frontends";
     homepage = "https://github.com/ygrek/mldonkey";
     license = lib.licenses.gpl2Only;

pkgs/applications/networking/protonvpn-gui/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.8.1";
+  version = "4.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     tag = "v${version}";
-    hash = "sha256-+UnMsjIJ0M1YiF+BcY7RObUoCeDZGtE0ul6KBaODzeY=";
+    hash = "sha256-kNWwrNpXCkAPvXXqv8HwOx0msYEVsO0JgrtG3wUVmQ4=";
   };
 
   nativeBuildInputs = [
@@ -80,6 +80,9 @@ buildPythonApplication rec {
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
     mainProgram = "protonvpn-app";
-    maintainers = with lib.maintainers; [ sebtm ];
+    maintainers = with lib.maintainers; [
+      sebtm
+      rapiteanu
+    ];
   };
 }

pkgs/applications/science/misc/graphia/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "graphia";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchFromGitHub {
     owner = "graphia-app";
     repo = "graphia";
     rev = version;
-    sha256 = "sha256-gAJwAz3iKa4auRtsrPS9dz3ieiB09FeL6VN5Psq1i8Y=";
+    sha256 = "sha256-tS5oqpwpqvWGu67s8OuA4uQR3Zb5VzHTY/GnfVQki6k=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/anilibria-winmaclinux/default.nix

@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.23";
+  version = "2.2.24";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-RF0pe2G4K0uiqlOiAVESOi6bgwO0gJOh1VFkF7V3Wnc=";
+    hash = "sha256-FAnVgrH6ZXfIp8FaacSpcHIwF6DCFt4K5e+UMAUb6qI=";
   };
 
   sourceRoot = "${src.name}/src";

pkgs/applications/virtualization/podman-compose/default.nix

@@ -9,15 +9,15 @@
 }:
 
 buildPythonApplication rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "podman-compose";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "podman-compose";
     owner = "containers";
-    rev = "v${version}";
-    hash = "sha256-40RatexY/6eRfCodaiBeJpyt1sDUj2STSPL0gBECdRs=";
+    tag = "v${version}";
+    hash = "sha256-0k+vJwWYEXQ6zxkcvjxBv9cq8nIBS15F7ul5VwqYtys=";
   };
 
   build-system = [

pkgs/build-support/make-darwin-bundle/default.nix

@@ -1,7 +1,7 @@
 # given a package with an executable and an icon, make a darwin bundle for
 # it. This package should be used when generating launchers for native Darwin
 # applications. If the package conatins a .desktop file use
-# `desktopToDarwinLauncher` instead.
+# `desktopToDarwinBundle` instead.
 
 {
   lib,

pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh

@@ -21,38 +21,17 @@ composerInstallConfigureHook() {
         exit 1
     fi
 
-    install -Dm644 ${composerVendor}/composer.{json,lock} .
+    install -Dm644 ${composerVendor}/composer.json .
 
-    if [[ ! -f "composer.lock" ]]; then
-        composer \
-            --no-install \
-            --no-interaction \
-            --no-progress \
-            --optimize-autoloader \
-            ${composerNoDev:+--no-dev} \
-            ${composerNoPlugins:+--no-plugins} \
-            ${composerNoScripts:+--no-scripts} \
-            update
-
-        install -Dm644 composer.lock -t $out/
-
-        echo
-        echo -e "\e[31mERROR: No composer.lock found\e[0m"
-        echo
-        echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
-        echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
-        echo
-        echo -e '\e[31mTo fix the issue:\e[0m'
-        echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
-        echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
-        echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
-        echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
-        echo
-
-        exit 1
+    if [[ -f "${composerVendor}/composer.lock" ]]; then
+        install -Dm644 ${composerVendor}/composer.lock .
     fi
 
-    chmod +w composer.{json,lock}
+    if [[ -f "composer.lock" ]]; then
+        chmod +w composer.lock
+    fi
+
+    chmod +w composer.json
 
     echo "Finished composerInstallConfigureHook"
 }

pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh

@@ -22,8 +22,10 @@ composerVendorConfigureHook() {
         install -Dm644 $composerLock ./composer.lock
     fi
 
+
     if [[ ! -f "composer.lock" ]]; then
         composer \
+            --no-cache \
             --no-install \
             --no-interaction \
             --no-progress \
@@ -33,25 +35,31 @@ composerVendorConfigureHook() {
             ${composerNoScripts:+--no-scripts} \
             update
 
-        install -Dm644 composer.lock -t $out/
+        if [[ -f "composer.lock" ]]; then
+            install -Dm644 composer.lock -t $out/
 
-        echo
-        echo -e "\e[31mERROR: No composer.lock found\e[0m"
-        echo
-        echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
-        echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
-        echo
-        echo -e '\e[31mTo fix the issue:\e[0m'
-        echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
-        echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
-        echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
-        echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
-        echo
+            echo
+            echo -e "\e[31mERROR: No composer.lock found\e[0m"
+            echo
+            echo -e '\e[31mNo composer.lock file found, consider adding one to your repository to ensure reproducible builds.\e[0m'
+            echo -e "\e[31mIn the meantime, a composer.lock file has been generated for you in $out/composer.lock\e[0m"
+            echo
+            echo -e '\e[31mTo fix the issue:\e[0m'
+            echo -e "\e[31m1. Copy the composer.lock file from $out/composer.lock to the project's source:\e[0m"
+            echo -e "\e[31m  cp $out/composer.lock <path>\e[0m"
+            echo -e '\e[31m2. Add the composerLock attribute, pointing to the copied composer.lock file:\e[0m'
+            echo -e '\e[31m  composerLock = ./composer.lock;\e[0m'
+            echo
 
-        exit 1
+            exit 1
+        fi
     fi
 
-    chmod +w composer.{json,lock}
+    if [[ -f "composer.lock" ]]; then
+        chmod +w composer.lock
+    fi
+
+    chmod +w composer.json
 
     echo "Finished composerVendorConfigureHook"
 }
@@ -62,10 +70,7 @@ composerVendorBuildHook() {
     setComposerEnvVariables
 
     composer \
-        `# The acpu-autoloader is not reproducible and has to be disabled.` \
-        `# Upstream PR: https://github.com/composer/composer/pull/12090` \
-        `# --apcu-autoloader` \
-        `# --apcu-autoloader-prefix="$(jq -r -c 'try ."content-hash"' < composer.lock)"` \
+        --no-cache \
         --no-interaction \
         --no-progress \
         --optimize-autoloader \
@@ -89,7 +94,12 @@ composerVendorInstallHook() {
     echo "Executing composerVendorInstallHook"
 
     mkdir -p $out
-    cp -ar composer.{json,lock} $(composer config vendor-dir) $out/
+
+    cp -ar composer.json $(composer config vendor-dir) $out/
+
+    if [[ -f "composer.lock" ]]; then
+        cp -ar composer.lock $(composer config vendor-dir) $out/
+    fi
 
     echo "Finished composerVendorInstallHook"
 }

pkgs/by-name/_9/_9base/package.nix

@@ -40,21 +40,17 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
   strictDeps = true;
   nativeBuildInputs = [ pkg-config ];
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      # workaround build failure on -fno-common toolchains like upstream
-      # gcc-10. Otherwise build fails as:
-      #   ld: diffio.o:(.bss+0x16): multiple definition of `bflag'; diffdir.o:(.bss+0x6): first defined here
-      "-fcommon"
-      # hide really common warning that floods the logs:
-      #   warning: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
-      "-D_DEFAULT_SOURCE"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      # error: call to undeclared function 'p9mbtowc'; ISO C99 and later do not support implicit function declarations
-      "-Wno-error=implicit-function-declaration"
-    ]
-  );
+  env.NIX_CFLAGS_COMPILE = toString ([
+    # workaround build failure on -fno-common toolchains like upstream
+    # gcc-10. Otherwise build fails as:
+    #   ld: diffio.o:(.bss+0x16): multiple definition of `bflag'; diffdir.o:(.bss+0x6): first defined here
+    "-fcommon"
+    # hide really common warning that floods the logs:
+    #   warning: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
+    "-D_DEFAULT_SOURCE"
+    # error: call to undeclared function 'p9mbtowc'; ISO C99 and later do not support implicit function declarations
+    "-Wno-error=implicit-function-declaration"
+  ]);
   env.LDFLAGS = lib.optionalString enableStatic "-static";
   makeFlags = [
     "PREFIX=${placeholder "out"}"

pkgs/by-name/al/alacritty-theme/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   pname = "alacritty-theme";
-  version = "0-unstable-2024-12-02";
+  version = "0-unstable-2025-01-03";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "95a7d695605863ede5b7430eb80d9e80f5f504bc";
-    hash = "sha256-IsUIfoacXJYilTPQBKXnDEuyQCt9ofBMJ8UZ1McFwXM=";
+    rev = "aff9d111d43e1ad5c22d4e27fc1c98176e849fb9";
+    hash = "sha256-GxCdyBihypHKkPlCVGiTAD4dP3ggkSyQSNS5AKUhSVo=";
     sparseCheckout = [ "themes" ];
   };
 

pkgs/by-name/al/alpine/package.nix

@@ -43,6 +43,10 @@ stdenv.mkDerivation rec {
     "--with-c-client-target=slx"
   ];
 
+  # Fixes https://github.com/NixOS/nixpkgs/issues/372699
+  # See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074804
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-incompatible-pointer-types" ];
+
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = with lib; {

pkgs/by-name/am/amber-secret/package.nix

@@ -1,9 +1,9 @@
 {
   lib,
   stdenv,
-  rustPlatform,
+  darwin,
   fetchFromGitHub,
-  Security,
+  rustPlatform,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,18 +15,19 @@ rustPlatform.buildRustPackage rec {
     owner = "fpco";
     repo = "amber";
     rev = "v${version}";
-    sha256 = "sha256-nduSnDhLvHpZD7Y1zeZC4nNL7P1qfLWc0yMpsdqrKHM=";
+    hash = "sha256-nduSnDhLvHpZD7Y1zeZC4nNL7P1qfLWc0yMpsdqrKHM=";
   };
 
   cargoHash = "sha256-DxTsbJ51TUMvc/NvsUYhRG9OxxEGrWfEPYCOYaG9PXo=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  meta = with lib; {
+  meta = {
     description = "Manage secret values in-repo via public key cryptography";
     homepage = "https://github.com/fpco/amber";
-    license = licenses.mit;
-    maintainers = with maintainers; [ psibi ];
+    changelog = "https://github.com/fpco/amber/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ psibi ];
     mainProgram = "amber";
   };
 }

pkgs/by-name/ar/arti/package.nix

@@ -6,7 +6,8 @@
   pkg-config,
   sqlite,
   openssl,
-  darwin,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     group = "tpo";
     owner = "core";
     repo = "arti";
-    rev = "arti-v${version}";
+    tag = "arti-v${version}";
     hash = "sha256-vypPQjTr3FsAz1AyS1J67MF35+HzMLNu5B9wkkEI30A=";
   };
 
@@ -26,15 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs =
-    [ sqlite ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-      ]
-    );
+  buildInputs = [ sqlite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   cargoBuildFlags = [
     "--package"
@@ -51,11 +44,21 @@ rustPlatform.buildRustPackage rec {
     "--skip=reload_cfg::test::watch_multiple"
   ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Implementation of Tor in Rust";
     mainProgram = "arti";
     homepage = "https://arti.torproject.org/";
-    changelog = "https://gitlab.torproject.org/tpo/core/arti/-/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://gitlab.torproject.org/tpo/core/arti/-/blob/arti-v${version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit

pkgs/by-name/ay/ayugram-desktop/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  telegram-desktop,
+  withWebkit ? true,
+}:
+
+telegram-desktop.override {
+  pname = "ayugram-desktop";
+  inherit withWebkit;
+  unwrapped = telegram-desktop.unwrapped.overrideAttrs (
+    finalAttrs: previousAttrs: {
+      pname = "ayugram-desktop-unwrapped";
+      version = "5.8.3";
+
+      src = fetchFromGitHub {
+        owner = "AyuGram";
+        repo = "AyuGramDesktop";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-bgfqYI77kxHmFZB6LCdLzeIFv6bfsXXJrrkbz5MD6Q0=";
+        fetchSubmodules = true;
+      };
+
+      # Since the original .desktop file is for Flatpak, we need to fix it
+      postPatch =
+        (previousAttrs.postPatch or "")
+        +
+          lib.optionalString stdenv.hostPlatform.isLinux
+            # Rudiment: related functionality is disabled by disabling the auto-updater
+            # and it breaks the .desktop file in Aylur's Gtk Shell
+            # (with it, it causes the application to not be seen by the app launcher)
+            # https://github.com/AyuGram/AyuGramDesktop/blob/5566a8ca0abe448a7f1865222b64b68ed735ee07/Telegram/SourceFiles/platform/linux/specific_linux.cpp#L455
+            ''
+              substituteInPlace lib/xdg/com.ayugram.desktop.desktop \
+                --replace-fail "DESKTOPINTEGRATION=1 " ""
+            ''
+        +
+          # Since we aren't in Flatpak, "DBusActivatable" has no unit to
+          # activate and it causes the .desktop file to show the error "Could not activate remote peer
+          # 'com.ayugram.desktop': unit failed" (at least on KDE6)
+          ''
+            substituteInPlace lib/xdg/com.ayugram.desktop.desktop \
+              --replace-fail "DBusActivatable=true" ""
+          '';
+
+      meta = previousAttrs.meta // {
+        mainProgram = if stdenv.hostPlatform.isLinux then "ayugram-desktop" else "AyuGram";
+        description = "Desktop Telegram client with good customization and Ghost mode";
+        longDescription = ''
+          The best that could be in the world of Telegram clients.
+          AyuGram is a Telegram client with a very pleasant features.
+        '';
+        homepage = "https://github.com/AyuGram/AyuGramDesktop";
+        changelog = "https://github.com/AyuGram/AyuGramDesktop/releases/tag/v${finalAttrs.version}";
+        maintainers = with lib.maintainers; [ aucub ];
+      };
+    }
+  );
+}

pkgs/by-name/ba/badchars/package.nix

@@ -1,33 +1,30 @@
 {
   lib,
-  buildPythonApplication,
-  fetchPypi,
+  fetchFromGitHub,
+  gitUpdater,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "badchars";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-4neV1S5gwQ03kEXEyZezNSj+PVXJyA5MO4lyZzGKE/c=";
+  src = fetchFromGitHub {
+    owner = "cytopia";
+    repo = "badchars";
+    tag = version;
+    hash = "sha256-VWe3k34snEviBK7VBCDTWAu3YjZfh1gXHXjlnFlefJw=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "argparse" ""
-  '';
-
-  build-system = with python3.pkgs; [
-    setuptools
-  ];
+  build-system = with python3.pkgs; [ setuptools ];
 
   # no tests are available and it can't be imported (it's only a script, not a module)
   doCheck = false;
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
     description = "HEX badchar generator for different programming languages";
     longDescription = ''
       A HEX bad char generator to instruct encoders such as shikata-ga-nai to
@@ -35,8 +32,8 @@ python3.pkgs.buildPythonApplication rec {
     '';
     homepage = "https://github.com/cytopia/badchars";
     changelog = "https://github.com/cytopia/badchars/releases/tag/${version}";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "badchars";
   };
 }

pkgs/by-name/bu/bup/package.nix

@@ -15,7 +15,7 @@
 assert par2Support -> par2cmdline != null;
 
 let
-  version = "0.33.6";
+  version = "0.33.7";
 
   pythonDeps =
     with python3.pkgs;
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     repo = "bup";
     owner = "bup";
     rev = version;
-    hash = "sha256-78lKB4iKlcHKR+suHDKJlDpZ2Gj8mfXmGK8tK/gFYMw=";
+    hash = "sha256-tuOUml4gF4i7bE2xtjJJol1gRAfYv73RghUYwIDsGyM=";
   };
 
   buildInputs = [