haskellPackages.changelog-d: fix (#579188)

Release announcement: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

doc/redirects.json

@@ -1738,6 +1738,24 @@
   "sec-meta-license": [
     "index.html#sec-meta-license"
   ],
+  "sec-meta-license-multiple": [
+    "index.html#sec-meta-license-multiple"
+  ],
+  "lib.licenses.OR": [
+    "index.html#lib.licenses.OR"
+  ],
+  "lib.licenses.AND": [
+    "index.html#lib.licenses.AND"
+  ],
+  "lib.licenses.WITH": [
+    "index.html#lib.licenses.WITH"
+  ],
+  "lib.licenses.PLUS": [
+    "index.html#lib.licenses.PLUS"
+  ],
+  "sec-meta-license-generic": [
+    "index.html#sec-meta-license-generic"
+  ],
   "lib.licenses.free-free": [
     "index.html#lib.licenses.free-free"
   ],

doc/stdenv/meta.chapter.md

@@ -86,6 +86,7 @@ The following are all valid examples:
   - This applies when the package directly incorporates code under another license.
 
 These compound licenses may also be combined within each other: `with lib.licenses; AND [ (OR [ mit asl20 ]) gpl3Plus ]`.
+See [Multiple Licenses](#sec-meta-license-multiple) for the full set of license operators.
 
 The list of valid licenses is defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix).
 See [Licenses](#sec-meta-license) for additional generic values.
@@ -227,23 +228,76 @@ If this list is not empty, the package is marked as "insecure", meaning that it
 
 When available, use a value from `lib.licenses` defined in [`nixpkgs/lib/licenses/licenses.nix`](https://github.com/NixOS/nixpkgs/blob/master/lib/licenses/licenses.nix).
 Otherwise, a custom license can be defined using `lib.licenses.mkLicense`.
-These generic options are also available:
 
-### `lib.licenses.free`, `"free"` {#lib.licenses.free-free}
+### Multiple Licenses {#sec-meta-license-multiple}
+
+If the package is covered under multiple licenses, use license operators to produce compound licenses.
+These operators model the structure of SPDX license expressions, and their semantics are defined in the [SPDX specification][spdx-spec].
+
+#### `lib.licenses.OR [ ... ]` {#lib.licenses.OR}
+
+If the user is able to choose between two or more licenses, use `OR`.
+
+```nix
+# Apache-2.0 OR MIT
+lib.licenses.OR [
+  lib.licenses.asl20
+  lib.licenses.mit
+]
+```
+
+#### `lib.licenses.AND [ ... ]` {#lib.licenses.AND}
+
+If the user must simultaneously abide by the rules of two or more licenses, use `AND`.
+
+```nix
+# GPL-2.0-only AND CC-BY-3.0
+lib.licenses.AND [
+  lib.licenses.gpl2Only
+  lib.licenses.cc-by-30
+]
+```
+
+#### `lib.licenses.WITH license exception` {#lib.licenses.WITH}
+
+If the license text is modified from the original, use `WITH`.
+Common license exceptions are included in `lib.licenses`.
+
+```nix
+# Apache-2.0 WITH LLVM-exception
+lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception
+```
+
+#### `lib.licenses.PLUS license` {#lib.licenses.PLUS}
+
+If the content is licensed under the current version of the license or any later version, use `PLUS`.
+For GPL licenses, do not use the PLUS operator.
+Instead use the "-or-later" license (ex. `GPL-3.0-or-later`, `lib.licenses.gpl3Plus`).
+
+```nix
+# CDDL-1.0+
+lib.licenses.PLUS lib.licenses.cddl
+```
+
+### Generic Licenses {#sec-meta-license-generic}
+
+Although it’s typically better to indicate the specific license, the following generic options are also available.
+
+#### `lib.licenses.free`, `"free"` {#lib.licenses.free-free}
 
 Catch-all for free software licenses not listed above.
 
-### `lib.licenses.unfreeRedistributable`, `"unfree-redistributable"` {#lib.licenses.unfreeredistributable-unfree-redistributable}
+#### `lib.licenses.unfreeRedistributable`, `"unfree-redistributable"` {#lib.licenses.unfreeredistributable-unfree-redistributable}
 
 Unfree package that can be redistributed in binary form. That is, it’s legal to redistribute the *output* of the derivation. This means that the package can be included in the Nixpkgs channel.
 
 Sometimes proprietary software can only be redistributed unmodified. Make sure the builder doesn’t actually modify the original binaries; otherwise we’re breaking the license. For instance, the NVIDIA X11 drivers can be redistributed unmodified, but our builder applies `patchelf` to make them work. Thus, its license is `"unfree"` and it cannot be included in the Nixpkgs channel.
 
-### `lib.licenses.unfree`, `"unfree"` {#lib.licenses.unfree-unfree}
+#### `lib.licenses.unfree`, `"unfree"` {#lib.licenses.unfree-unfree}
 
 Unfree package that cannot be redistributed. You can build it yourself, but you cannot redistribute the output of the derivation. Thus it cannot be included in the Nixpkgs channel.
 
-### `lib.licenses.unfreeRedistributableFirmware`, `"unfree-redistributable-firmware"` {#lib.licenses.unfreeredistributablefirmware-unfree-redistributable-firmware}
+#### `lib.licenses.unfreeRedistributableFirmware`, `"unfree-redistributable-firmware"` {#lib.licenses.unfreeredistributablefirmware-unfree-redistributable-firmware}
 
 This package supplies unfree, redistributable firmware. This is a separate value from `unfree-redistributable` because not everybody cares whether firmware is free.
 
@@ -378,3 +432,5 @@ It provides an interface for additional identifiers of `mkDerivation.src` or for
 
 Additional identifiers are generally not recommended, as they might cause maintenance overhead or diverge.
 For example, a source distribution `pkg:github` may be hard to keep correctly aligned with the corresponding binary distribution `pkg:pypi`.
+
+[spdx-spec]: https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/

lib/licenses/operators.nix

@@ -30,8 +30,8 @@
   };
 
   /**
-     Create a compound licenses where the user needs to follow both licenses,
-     eqivialent of spdx `and` modifier.
+     Create a compound license where the user needs to follow both licenses,
+     equivalent to the SPDX `AND` modifier.
 
     # Inputs
 
@@ -60,8 +60,8 @@
   };
 
   /**
-     Create a licenses exception where a license has a license exception,
-     eqivialent of spdx `with` modifier.
+     Create a license in which an exception has been applied,
+     equivalent to the SPDX `WITH` modifier.
 
     # Inputs
 
@@ -94,7 +94,9 @@
 
   /**
      Create a licenses which can be upgraded to any later version of itself,
-     eqivialent of spdx `+` modifier
+     equivalent to the SPDX `+` modifier.
+     For GPL licenses, do not use the PLUS modifier: use the "-or-later"
+     license (ex. `lib.licenses.gpl3Plus`).
 
     # Inputs
 

maintainers/maintainer-list.nix

@@ -1685,6 +1685,11 @@
     githubId = 26391003;
     name = "Amadej Kastelic";
   };
+  amaidurova = {
+    github = "amaidurova";
+    githubId = 295547583;
+    name = "An Mai";
+  };
   aman9das = {
     email = "amandas62640@gmail.com";
     github = "Aman9das";
@@ -30036,6 +30041,11 @@
     githubId = 1486805;
     name = "Toon Nolten";
   };
+  toothbrush = {
+    github = "toothbrush";
+    githubId = 423357;
+    name = "toothbrush";
+  };
   tophcodes = {
     email = "toki@toph.so";
     github = "tophcodes";
@@ -31039,6 +31049,12 @@
     githubId = 19894025;
     name = "Vinny Meller";
   };
+  vinso = {
+    email = "8vinso8@gmail.com";
+    github = "8Vinso8";
+    githubId = 44764023;
+    name = "Vinso";
+  };
   vinylen = {
     email = "victor@viclab.se";
     github = "vinylen";

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/unbreak.nu

@@ -6,7 +6,7 @@
 
 # Attention: For unknown reasons, the script can't be easily cancelled and needs to be killed manually if it shouldn't run to completion.
 
-use std log
+use std/log
 
 let broken_config = "pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml"
 

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver version, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -213,6 +213,8 @@
 
 - [Vouch Proxy](https://github.com/vouch/vouch-proxy), an SSO and OAuth / OIDC login solution for Nginx using the auth_request module. Available as [services.vouch-proxy](#opt-services.vouch-proxy.enable).
 
+- [Grimmory](https://grimmory.org/), a self-hosted library for your ebooks, comics, and audiobooks. Available as [services.grimmory](#opt-services.grimmory.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -503,6 +505,8 @@
 
 - `services.minio` has been removed because the `minio` package was abandoned upstream and therefore dropped from nixpkgs.
 
+- The `services.scx` module has been removed. Please migrate to [`services.scx-loader`](#opt-services.scx-loader.enable) instead.
+
 - `hydra` has been updated to the Rust queue runner/evaluator:
   - `services.hydra.dbi` was replaced by [services.hydra.dbUrl](#opt-services.hydra.dbUrl), which takes a `postgres://` URL instead of a DBI string.
   - `services.hydra.buildMachinesFiles` was removed. The queue runner no longer connects to build machines over SSH. Instead each build machine (including the Hydra host itself, if it should build) must enable [services.hydra-builder](#opt-services.hydra-builder.enable) and point it at [services.hydra.queueRunner.grpc](#opt-services.hydra.queueRunner.grpc.port).

nixos/modules/module-list.nix

@@ -1553,7 +1553,6 @@
   ./services/scheduling/gocron.nix
   ./services/scheduling/prefect.nix
   ./services/scheduling/scx-loader.nix
-  ./services/scheduling/scx.nix
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
@@ -1749,6 +1748,7 @@
   ./services/web-apps/goupile.nix
   ./services/web-apps/grav.nix
   ./services/web-apps/greenlight.nix
+  ./services/web-apps/grimmory.nix
   ./services/web-apps/grist.nix
   ./services/web-apps/grocy.nix
   ./services/web-apps/guacamole-client.nix

nixos/modules/programs/browserpass.nix

@@ -27,10 +27,6 @@
         # vivaldi
         "opt/vivaldi/native-messaging-hosts/${appId}".source = source "hosts/chromium";
         "opt/vivaldi/policies/managed/${appId}".source = source "policies/chromium";
-
-        # brave
-        "opt/brave/native-messaging-hosts/${appId}".source = source "hosts/chromium";
-        "opt/brave/policies/managed/${appId}".source = source "policies/chromium";
       };
     programs.firefox.nativeMessagingHosts.packages = [ pkgs.browserpass ];
   };

nixos/modules/programs/chromium.nix

@@ -22,7 +22,7 @@ in
 
   options = {
     programs.chromium = {
-      enable = lib.mkEnableOption "policies for chromium based browsers like Chromium, Google Chrome or Brave";
+      enable = lib.mkEnableOption "policies for chromium based browsers like Chromium or Google Chrome";
 
       enablePlasmaBrowserIntegration = lib.mkEnableOption "Native Messaging Host for Plasma Browser Integration";
 
@@ -187,16 +187,6 @@ in
       "opt/chrome/policies/recommended/extra.json" = lib.mkIf (cfg.extraOptsRecommended != { }) {
         text = builtins.toJSON cfg.extraOptsRecommended;
       };
-      # for brave
-      "brave/policies/managed/default.json" = lib.mkIf (defaultProfile != { }) {
-        text = builtins.toJSON defaultProfile;
-      };
-      "brave/policies/managed/extra.json" = lib.mkIf (cfg.extraOpts != { }) {
-        text = builtins.toJSON cfg.extraOpts;
-      };
-      "brave/policies/recommended/extra.json" = lib.mkIf (cfg.extraOptsRecommended != { }) {
-        text = builtins.toJSON cfg.extraOptsRecommended;
-      };
     };
   };
 }

nixos/modules/rename.nix

@@ -604,6 +604,7 @@ in
     (mkRemovedOptionModule [ "services" "castopod" ] ''
       services.castopod has been removed together with pkgs.castopod.
     '')
+    (mkRemovedOptionModule [ "services" "scx" ] "Please migrate to services.scx-loader instead.")
     # Do NOT add any option renames here, see top of the file
   ];
 }

nixos/modules/services/scheduling/scx-loader.nix

@@ -62,10 +62,6 @@ in
         assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
         message = "SCX is only supported on kernel version 6.12 and above.";
       }
-      {
-        assertion = !config.services.scx.enable;
-        message = "services.scx and services.scx_loader cannot be enabled simultaneously. Please enable only one of them.";
-      }
       {
         assertion =
           cfg.config.default_sched == null || lib.elem cfg.config.default_sched ([ "" ] ++ schedulers);

nixos/modules/services/scheduling/scx.nix

@@ -1,107 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  utils,
-  ...
-}:
-let
-  cfg = config.services.scx;
-in
-{
-  options.services.scx = {
-    enable = lib.mkEnableOption null // {
-      description = ''
-        Whether to enable SCX service, a daemon to run schedulers from userspace.
-
-        ::: {.note}
-        This service requires a kernel with the Sched-ext feature.
-        Generally, kernel version 6.12 and later are supported.
-        :::
-      '';
-    };
-
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.scx.full;
-      defaultText = lib.literalExpression "pkgs.scx.full";
-      example = lib.literalExpression "pkgs.scx.rustscheds";
-      description = ''
-        `scx` package to use. `scx.full`, which includes all schedulers, is the default.
-        You may choose a minimal package, such as `pkgs.scx.rustscheds`.
-
-        ::: {.note}
-        Overriding this does not change the default scheduler; you should set `services.scx.scheduler` for it.
-        :::
-      '';
-    };
-
-    scheduler = lib.mkOption {
-      type = lib.types.enum cfg.package.schedulers;
-      default = "scx_rustland";
-      example = "scx_bpfland";
-      description = ''
-        Which scheduler to use. See [SCX documentation](https://github.com/sched-ext/scx/tree/main/scheds)
-        for details on each scheduler and guidance on selecting the most suitable one.
-      '';
-    };
-
-    extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "--verbose"
-        "--slice-us 5000"
-      ];
-      description = ''
-        Parameters passed to the chosen scheduler at runtime.
-
-        ::: {.note}
-        Run `chosen-scx-scheduler --help` to see the available options. Generally,
-        each scheduler has its own set of options, and they are incompatible with each other.
-        :::
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-
-    systemd.services.scx = {
-      description = "SCX scheduler daemon";
-
-      # SCX service should be started only if the kernel supports sched-ext
-      unitConfig.ConditionPathIsDirectory = "/sys/kernel/sched_ext";
-
-      startLimitIntervalSec = 30;
-      startLimitBurst = 2;
-
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = ''
-          ${pkgs.runtimeShell} -c 'exec ${cfg.package}/bin/''${SCX_SCHEDULER_OVERRIDE:-$SCX_SCHEDULER} ''${SCX_FLAGS_OVERRIDE:-$SCX_FLAGS}'
-        '';
-        Restart = "on-failure";
-      };
-
-      environment = {
-        SCX_SCHEDULER = cfg.scheduler;
-        SCX_FLAGS = lib.concatStringsSep " " cfg.extraArgs;
-      };
-
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    assertions = [
-      {
-        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
-        message = "SCX is only supported on kernel version >= 6.12.";
-      }
-    ];
-  };
-
-  meta = {
-    inherit (pkgs.scx.full.meta) maintainers;
-    buildDocsInSandbox = false;
-  };
-}

nixos/modules/services/security/crowdsec/default.nix

@@ -930,7 +930,7 @@ in
               value."f+" = {
                 user = cfg.user;
                 group = cfg.group;
-                argument = content;
+                argument = lib.replaceStrings [ "%" ] [ "%%" ] content;
               };
             };
 

nixos/modules/services/web-apps/grimmory.nix

@@ -0,0 +1,351 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    literalExpression
+    mkIf
+    mkDefault
+    mkOption
+    mkEnableOption
+    mkMerge
+    mkPackageOption
+    optional
+    types
+    ;
+  cfg = config.services.grimmory;
+in
+{
+  options.services.grimmory = {
+    enable = mkEnableOption "Whether to enable Grimmory Server.";
+
+    package = mkPackageOption pkgs "grimmory" { };
+
+    host = mkOption {
+      description = "Listen address which Grimmory should listen on. (`SERVER_ADDRESS`)";
+      default = "localhost";
+      type = types.str;
+    };
+
+    port = mkOption {
+      description = "Port on which Grimmory should listen on. (`BOOKLORE_PORT`)";
+      default = 6060;
+      type = types.port;
+    };
+
+    user = mkOption {
+      description = "User account under which Grimmory runs.";
+      default = "grimmory";
+      type = types.str;
+      example = "media";
+    };
+
+    group = mkOption {
+      description = "Group under which Grimmory runs.";
+      default = "grimmory";
+      type = types.str;
+      example = "media";
+    };
+
+    stateDir = mkOption {
+      description = "State and configuration directory Grimmory will use. (`APP_PATH_CONFIG`)";
+      default = "/var/lib/grimmory";
+      type = types.str;
+      example = "/grimmory";
+    };
+
+    booksDir = mkOption {
+      description = "Path to root directory of book library.";
+      default = "${cfg.stateDir}/books";
+      defaultText = "\${cfg.stateDir}/books";
+      type = types.str;
+      example = "/books";
+    };
+
+    bookdropDir = mkOption {
+      description = "Path to directory where Grimmory watches for books to import. (`APP_BOOKDROP_FOLDER`)";
+      default = "${cfg.stateDir}/bookdrop";
+      defaultText = "\${cfg.stateDir}/bookdrop";
+      type = types.str;
+      example = "/bookdrop";
+    };
+
+    database = {
+      createLocally = mkOption {
+        description = "Create a local MariaDB database and user for Grimmory via `services.mysql`.";
+        default = true;
+        type = types.bool;
+      };
+
+      name = mkOption {
+        description = "MySQL database name that holds Grimmory's data. (`DATABASE_NAME`)";
+        default = "grimmory";
+        type = types.str;
+        example = "booklore";
+      };
+
+      host = mkOption {
+        description = "MySQL Database host (`DATABASE_HOST`)";
+        default = "localhost";
+        type = types.str;
+      };
+
+      port = mkOption {
+        description = "MySQL Database port (`DATABASE_PORT`)";
+        default = 3306;
+        type = types.port;
+      };
+
+      user = mkOption {
+        description = ''
+          Name of the user with all permissions to the Grimmory MySQL database. (`DATABASE_USERNAME`)
+        '';
+        default = "grimmory";
+        type = types.str;
+        example = "booklore";
+      };
+
+      passwordFile = mkOption {
+        description = ''
+          A file containing the password for the database named {option}`database.name`.
+
+          > A password file is currently required, but should be avoidable in a future release
+        '';
+        default = null;
+        type = types.nullOr types.path;
+        example = "/run/keys/grimmory-db-password";
+      };
+    };
+
+    environment = mkOption {
+      description = ''
+        Environment variables passed passed into the backend server.
+
+        Some variables are defined here: <https://grimmory.org/docs/installation>
+      '';
+      default = { };
+      type = types.attrsOf types.str;
+      example = {
+        FORCE_DISABLE_OIDC = "true";
+      };
+    };
+
+    environmentFile = mkOption {
+      description = "Optional path to an `EnvironmentFile` to configure or add secrets to Grimmory service.";
+      default = null;
+      type = types.nullOr types.path;
+    };
+
+    extraArgs = mkOption {
+      description = ''
+        Additional command-line arguments passed verbatim to grimmory after -jar grimmory.jar
+      '';
+      default = [ ];
+      type = types.listOf types.str;
+      example = [ "--debug" ];
+    };
+
+    domain = mkOption {
+      description = "Domain to use for the virtualhost to serve Grimmory at.";
+      type = types.str;
+      example = literalExpression "grimmory.\${config.networking.domain}";
+    };
+
+    caddy = {
+      enable = mkEnableOption "a virtualhost to serve Grimmory through caddy";
+      virtualHost = mkOption {
+        description = "Extra configuration for the caddy virtualhost for Grimmory.";
+        type = types.submodule (
+          import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; }
+        );
+        default = { };
+        example = literalExpression ''
+          {
+            serverAliases = [ "grimmory.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+    nginx = {
+      enable = mkEnableOption "a virtualhost to serve Grimmory through nginx";
+      virtualHost = mkOption {
+        description = "Extra configuration for the nginx virtualhost for Grimmory.";
+        type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+        default = { };
+        example = literalExpression ''
+          {
+            serverAliases = [ "grimmory.''${config.networking.domain}" ];
+          }
+        '';
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    services.grimmory.environment = {
+      SERVER_ADDRESS = mkDefault cfg.host;
+      BOOKLORE_PORT = mkDefault (toString cfg.port);
+      APP_PATH_CONFIG = mkDefault cfg.stateDir;
+      APP_BOOKDROP_FOLDER = mkDefault cfg.bookdropDir;
+      DATABASE_HOST = mkDefault cfg.database.host;
+      DATABASE_PORT = mkDefault (toString cfg.database.port);
+      DATABASE_NAME = mkDefault cfg.database.name;
+      DATABASE_USERNAME = mkDefault cfg.database.user;
+    };
+
+    users.groups = mkIf (cfg.group == "grimmory") { grimmory = { }; };
+
+    users.users = mkIf (cfg.user == "grimmory") {
+      grimmory = {
+        group = cfg.group;
+        home = cfg.stateDir;
+        description = "Grimmory Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.grimmory = {
+      description = "Grimmory is a self-hosted library for your ebooks, comics and audiobooks.";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+        "mysql.service"
+      ];
+      after = [
+        "network-online.target"
+        "mysql.service"
+      ];
+
+      environment = cfg.environment;
+
+      script =
+        if cfg.database.passwordFile != null then
+          ''
+            DATABASE_PASSWORD="$(cat ''${CREDENTIALS_DIRECTORY}/db-password)" ${lib.getExe cfg.package} ${lib.escapeShellArgs cfg.extraArgs}
+          ''
+        else
+          ''
+            ${lib.getExe cfg.package} ${lib.escapeShellArgs cfg.extraArgs}
+          '';
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+
+        Type = "simple";
+        Restart = "on-failure";
+
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+
+        LoadCredential = mkIf (cfg.database.passwordFile != null) [
+          "db-password:${cfg.database.passwordFile}"
+        ];
+
+        ExecStartPre = mkIf cfg.database.createLocally "+${pkgs.writeShellScript "update-grimmory-password" ''
+          ${lib.optionalString (cfg.database.passwordFile != null) ''
+            DATABASE_PASSWORD="$(cat ''${CREDENTIALS_DIRECTORY}/db-password)"
+          ''}
+
+          if [ -z "$DATABASE_PASSWORD" ]; then
+            echo "DATABASE_PASSWORD is empty or unset; add a password file with services.grimmory.database.passwordFile or add DATABASE_PASSWORD to services.grimmory.environmentFile" >&2
+            exit 1
+          fi
+
+          escaped_password="$(printf '%s' "$DATABASE_PASSWORD" | sed "s/'/'''/g")"
+
+          ${lib.getExe' config.services.mysql.package "mysql"} <<EOF
+          SET sql_mode = 'NO_BACKSLASH_ESCAPES';
+          ALTER USER '${cfg.database.user}'@'localhost' IDENTIFIED BY '$escaped_password';
+          FLUSH PRIVILEGES;
+          EOF
+        ''}";
+
+        StateDirectory = mkIf (cfg.stateDir == "/var/lib/grimmory") "grimmory";
+
+        # Make paths writable if not in the state directory
+        ReadWritePaths =
+          [ ]
+          ++ (optional (cfg.stateDir != "/var/lib/grimmory") cfg.stateDir)
+          ++ (optional (!(lib.hasPrefix cfg.stateDir cfg.bookdropDir)) cfg.bookdropDir)
+          ++ (optional (!(lib.hasPrefix cfg.stateDir cfg.booksDir)) cfg.booksDir);
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "all";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.database.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.caddy = mkIf cfg.caddy.enable {
+      enable = lib.mkDefault true;
+      virtualHosts.${cfg.domain} = mkMerge [
+        cfg.caddy.virtualHost
+        {
+          hostName = lib.mkForce cfg.domain;
+          extraConfig = ''
+            reverse_proxy ${cfg.host}:${toString cfg.port}
+          '';
+        }
+      ];
+    };
+
+    services.nginx = mkIf cfg.nginx.enable {
+      enable = lib.mkDefault true;
+      virtualHosts.${cfg.domain} = mkMerge [
+        cfg.nginx.virtualHost
+        {
+          locations."/" = {
+            proxyPass = "http://${cfg.host}:${toString cfg.port}";
+            proxyWebsockets = true;
+            recommendedProxySettings = true;
+          };
+        }
+      ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ kraftnix ];
+}

nixos/modules/services/web-apps/netbox.nix

@@ -744,25 +744,6 @@ in
             };
           };
 
-        systemd.timers.netbox-housekeeping = {
-          description = "Run NetBox housekeeping job";
-          documentation = [ "https://netboxlabs.com/docs/netbox/" ];
-
-          wantedBy = [ "multi-user.target" ];
-
-          after = [
-            "network-online.target"
-            "netbox.service"
-          ];
-          wants = [ "network-online.target" ];
-
-          timerConfig = {
-            OnCalendar = "daily";
-            AccuracySec = "1h";
-            Persistent = true;
-          };
-        };
-
         users.users.netbox = {
           home = "${cfg.dataDir}";
           isSystemUser = true;

nixos/tests/all-tests.nix

@@ -419,7 +419,10 @@ in
   chhoto-url = runTest ./chhoto-url.nix;
   chipass = runTest ./chipass.nix;
   chromadb = runTest ./chromadb.nix;
-  chromium = (handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./chromium.nix { }).stable or { };
+  chromium = runTestOn [ "aarch64-linux" "x86_64-linux" ] {
+    imports = [ ./chromium.nix ];
+    _module.args.chromiumPackage = pkgs.chromium;
+  };
   chrony = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony.nix;
   chrony-ptp = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./chrony-ptp.nix;
   cinnamon = runTest ./cinnamon.nix;
@@ -796,6 +799,7 @@ in
   graylog = runTest ./graylog.nix;
   greenlight = runTest ./greenlight.nix;
   greetd-no-shadow = runTest ./greetd-no-shadow.nix;
+  grimmory = runTest ./grimmory.nix;
   grist = runTest ./grist.nix;
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
@@ -1658,8 +1662,7 @@ in
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
-  scx = runTest ./scx/default.nix;
-  scx-loader = runTest ./scx/loader.nix;
+  scx-loader = runTest ./scx-loader.nix;
   sddm = import ./sddm.nix { inherit runTest; };
   sdl3 = runTest ./sdl3.nix;
   searx = runTest ./searx.nix;
@@ -1938,6 +1941,10 @@ in
   umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;
   unbound = runTest ./unbound.nix;
+  ungoogled-chromium = runTestOn [ "aarch64-linux" "x86_64-linux" ] {
+    imports = [ ./chromium.nix ];
+    _module.args.chromiumPackage = pkgs.ungoogled-chromium;
+  };
   unifi = runTest ./unifi.nix;
   unit-perl = runTest ./web-servers/unit-perl.nix;
   unpackerr = runTest ./unpackerr.nix;

nixos/tests/chromium.nix

@@ -1,289 +1,82 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  channelMap ? {
-    # Maps "channels" to packages
-    stable = pkgs.chromium;
-    beta = pkgs.chromiumBeta;
-    dev = pkgs.chromiumDev;
-    ungoogled = pkgs.ungoogled-chromium;
-    chrome-stable = pkgs.google-chrome;
-    chrome-beta = pkgs.google-chrome-beta;
-    chrome-dev = pkgs.google-chrome-dev;
-  },
+  lib,
+  pkgs,
+  chromiumPackage,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+{
+  inherit (chromiumPackage) name;
 
-let
-  user = "alice";
+  meta = {
+    inherit (chromiumPackage.meta) maintainers;
+  }
+  // lib.optionalAttrs (chromiumPackage.meta ? timeout) {
+    # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
+    inherit (chromiumPackage.meta) timeout;
+  };
 
-  startupHTML = pkgs.writeText "chromium-startup.html" ''
-    <!DOCTYPE html>
-    <html>
-    <head>
-    <meta charset="UTF-8">
-    <title>Chromium startup notifier</title>
-    </head>
-    <body onload="javascript:document.title='startup done'">
-      <img src="file://${
-        pkgs.fetchurl {
-          url = "https://nixos.org/logo/nixos-hex.svg";
-          sha256 = "07ymq6nw8kc22m7kzxjxldhiq8gzmc7f45kq2bvhbdm0w5s112s4";
-        }
-      }" />
-    </body>
-    </html>
-  '';
-in
+  containers.machine =
+    { config, ... }:
 
-mapAttrs (
-  channel: chromiumPkg:
-  makeTest {
-    name = "chromium-${channel}";
-    meta = {
-      maintainers = with maintainers; [
-        aszlig
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/x11.nix
       ];
-    }
-    // optionalAttrs (chromiumPkg.meta ? timeout) {
-      # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
-      # Note: optionalAttrs is used since meta.timeout is not set for Google Chrome
-      inherit (chromiumPkg.meta) timeout;
-    };
 
-    enableOCR = true;
-
-    nodes.machine =
-      { ... }:
-      {
-        imports = [
-          ./common/user-account.nix
-          ./common/x11.nix
-        ];
-        virtualisation.memorySize = 2047;
-        test-support.displayManager.auto.user = user;
-        environment = {
-          systemPackages = [ chromiumPkg ];
-          variables."XAUTHORITY" = "/home/alice/.Xauthority";
+      programs.chromium = {
+        enable = true;
+        extraOptsRecommended = {
+          # Set policy for Memory Saver, so we don't race against a
+          # "Make Chromium faster" in-product help promo (pop-up):
+          HighEfficiencyModeEnabled = false;
         };
       };
 
-    testScript =
-      let
-        xdo =
-          name: text:
-          let
-            xdoScript = pkgs.writeText "${name}.xdo" text;
-          in
-          "${pkgs.xdotool}/bin/xdotool ${xdoScript}";
-      in
-      ''
-        import shlex
-        import re
-        from contextlib import contextmanager
+      # chromium refuses to run as root user
+      test-support.displayManager.auto.user = "alice";
+      environment.variables."XAUTHORITY" = "${config.users.users.alice.home}/.Xauthority";
 
+      environment.systemPackages = [
+        chromiumPackage
+        pkgs.xclip
+      ];
+    };
 
-        major_version = "${versions.major (getVersion chromiumPkg.name)}"
+  testScript = ''
+    machine.wait_for_x()
 
+    with subtest("file:///"):
+        machine.execute("runuser alice chromium file:/// >&2 &")
+        machine.wait_for_window("Index of /")
+        machine.screenshot("file")
 
-        # Run as user alice
-        def ru(cmd):
-            return "su - ${user} -c " + shlex.quote(cmd)
+    with subtest("chrome://newtab"):
+        machine.send_key("ctrl-t")
+        machine.wait_for_window("New Tab")
+        machine.screenshot("newtab")
 
+    with subtest("chrome://version"):
+        machine.send_key("ctrl-l")
+        machine.send_chars("chrome://version\n")
+        machine.wait_for_window("About Version")
+        machine.screenshot("version")
 
-        def launch_browser():
-            """Launches the web browser with the correct options."""
-            # Determine the name of the binary:
-            pname = "${getName chromiumPkg.name}"
-            if pname.find("chromium") != -1:
-                binary = "chromium"  # Same name for all channels and ungoogled-chromium
-            elif pname == "google-chrome":
-                binary = "google-chrome-stable"
-            elif pname == "google-chrome-dev":
-                binary = "google-chrome-unstable"
-            else:  # For google-chrome-beta and as fallback:
-                binary = pname
-            # Add optional CLI options:
-            options = []
-            if major_version > "95" and not pname.startswith("google-chrome"):
-                # Workaround to avoid a GPU crash:
-                options.append("--use-gl=swiftshader")
-            # Launch the process:
-            options.append("file://${startupHTML}")
-            machine.succeed(ru(f'ulimit -c unlimited; {binary} {shlex.join(options)} >&2 & disown'))
-            if binary.startswith("google-chrome"):
-                # Need to click away the first window:
-                machine.wait_for_text("Make Google Chrome the default browser")
-                machine.screenshot("google_chrome_default_browser_prompt")
-                machine.send_key("ret")
+        machine.send_key("tab")
+        machine.send_key("spc")
+        clipboard = machine.succeed("xclip -out")
+        t.assertIn("${chromiumPackage.version}", clipboard)
 
+    with subtest("chrome://sandbox"):
+        machine.send_key("ctrl-t")
+        machine.send_chars("chrome://sandbox\n")
+        machine.wait_for_window("Sandbox Status")
+        machine.screenshot("sandbox")
 
-        def create_new_win():
-            """Creates a new Chromium window."""
-            with machine.nested("Creating a new Chromium window"):
-                machine.wait_until_succeeds(
-                    ru(
-                        "${xdo "create_new_win-select_main_window" ''
-                          search --onlyvisible --name "startup done"
-                          windowfocus --sync
-                          windowactivate --sync
-                        ''}"
-                    )
-                )
-                machine.send_key("ctrl-n")
-                # Wait until the new window appears:
-                machine.wait_until_succeeds(
-                    ru(
-                        "${xdo "create_new_win-wait_for_window" ''
-                          search --onlyvisible --name "New Tab"
-                          windowfocus --sync
-                          windowactivate --sync
-                        ''}"
-                    )
-                )
-
-
-        def close_new_tab_win():
-            """Closes the Chromium window with the title "New Tab"."""
-            machine.wait_until_succeeds(
-                ru(
-                    "${xdo "close_new_tab_win-select_main_window" ''
-                      search --onlyvisible --name "New Tab"
-                      windowfocus --sync
-                      windowactivate --sync
-                    ''}"
-                )
-            )
-            machine.send_key("ctrl-w")
-            # Wait until the closed window disappears:
-            machine.wait_until_fails(
-                ru(
-                    "${xdo "close_new_tab_win-wait_for_close" ''
-                      search --onlyvisible --name "New Tab"
-                    ''}"
-                )
-            )
-
-
-        @contextmanager
-        def test_new_win(description, url, window_name):
-            create_new_win()
-            machine.wait_for_window("New Tab")
-            machine.send_chars(f"{url}\n")
-            machine.wait_for_window(window_name)
-            machine.screenshot(description)
-            machine.succeed(
-                ru(
-                    "${xdo "copy-all" ''
-                      key --delay 1000 Ctrl+a Ctrl+c
-                    ''}"
-                )
-            )
-            clipboard = machine.succeed(
-                ru("${pkgs.xclip}/bin/xclip -o")
-            )
-            if url == "chrome://gpu":
-                clipboard = ""  # TODO: We cannot copy the text via Ctrl+a
-            print(f"{description} window content:\n{clipboard}")
-            with machine.nested(description):
-                yield clipboard
-            # Close the newly created window:
-            machine.send_key("ctrl-w")
-
-
-        machine.wait_for_x()
-
-        launch_browser()
-
-        machine.wait_for_text("startup done")
-        machine.wait_until_succeeds(
-            ru(
-                "${xdo "check-startup" ''
-                  search --sync --onlyvisible --name "startup done"
-                  # close first start help popup
-                  key -delay 1000 Escape
-                  windowfocus --sync
-                  windowactivate --sync
-                ''}"
-            )
-        )
-
-        create_new_win()
-        # Optional: Wait for the new tab page to fully load before taking the screenshot:
-        machine.wait_for_text("Web Store")
-        machine.screenshot("empty_windows")
-        close_new_tab_win()
-
-        machine.screenshot("startup_done")
-
-        with test_new_win("sandbox_info", "chrome://sandbox", "Sandbox Status") as clipboard:
-            filters = [
-                "layer 1 sandbox.*namespace",
-                "pid namespaces.*yes",
-                "network namespaces.*yes",
-                "seccomp.*sandbox.*yes",
-                "you are adequately sandboxed",
-            ]
-            if not all(
-                re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
-                for filter in filters
-            ):
-                assert False, f"sandbox not working properly: {clipboard}"
-
-            machine.sleep(1)
-            machine.succeed(
-                ru(
-                    "${xdo "find-window-after-copy" ''
-                      search --onlyvisible --name "Sandbox Status"
-                    ''}"
-                )
-            )
-
-            clipboard = machine.succeed(
-                ru(
-                    "echo void | ${pkgs.xclip}/bin/xclip -i >&2"
-                )
-            )
-            machine.succeed(
-                ru(
-                    "${xdo "copy-sandbox-info" ''
-                      key --delay 1000 Ctrl+a Ctrl+c
-                    ''}"
-                )
-            )
-
-            clipboard = machine.succeed(
-                ru("${pkgs.xclip}/bin/xclip -o")
-            )
-            if not all(
-                re.search(filter, clipboard, flags=re.DOTALL | re.IGNORECASE)
-                for filter in filters
-            ):
-                assert False, f"copying twice in a row does not work properly: {clipboard}"
-
-            machine.screenshot("after_copy_from_chromium")
-
-
-        with test_new_win("gpu_info", "chrome://gpu", "GPU Internals"):
-            # To check the text rendering (catches regressions like #131074):
-            machine.wait_for_text("Graphics Feature Status")
-            # TODO: Fix copying all of the text to the clipboard
-
-
-        with test_new_win("version_info", "chrome://version", "About Version") as clipboard:
-            filters = [
-                r"${chromiumPkg.version} \(Official Build",
-            ]
-            if not all(
-                re.search(filter, clipboard) for filter in filters
-            ):
-                assert False, "Version info not correct."
-
-
-        machine.shutdown()
-      '';
-  }
-) channelMap
+        machine.send_key("ctrl-a")
+        machine.send_key("ctrl-c")
+        clipboard = machine.succeed("xclip -out")
+        t.assertIn("You are adequately sandboxed.", clipboard)
+  '';
+}

nixos/tests/grimmory.nix

@@ -0,0 +1,92 @@
+{ pkgs, ... }:
+{
+  name = "grimmory";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ kraftnix ];
+  };
+
+  nodes = {
+    grimmory =
+      { config, pkgs, ... }:
+      {
+        services.grimmory = {
+          enable = true;
+          database.passwordFile = builtins.toFile "snakeoil-mysql-password" "deadbeef";
+        };
+        specialisation.caddy = {
+          inheritParentConfig = true;
+          configuration = {
+            systemd.tmpfiles.rules = [
+              "d /bookdrop 0740 grimmory grimmory -"
+              "d /books 0740 grimmory grimmory -"
+            ];
+            services.grimmory = {
+              domain = "localhost";
+              caddy.enable = true;
+              caddy.virtualHost.extraConfig = "tls internal";
+              bookdropDir = "/bookdrop";
+              booksDir = "/books";
+              database.passwordFile = pkgs.lib.mkForce null;
+              environment.DATABASE_PASSWORD = "deadbeef1";
+            };
+          };
+        };
+        specialisation.nginx = {
+          inheritParentConfig = true;
+          configuration = {
+            services.grimmory = {
+              domain = "localhost";
+              port = 8888;
+              nginx.enable = true;
+              database.passwordFile = pkgs.lib.mkForce null;
+              environmentFile = builtins.toFile "snakeoil-mysql-password" "DATABASE_PASSWORD=deadbeef2";
+            };
+          };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      with subtest("Testing basic Grimmory config"):
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(6060)
+
+        with subtest("Check Frontend accessible"):
+          grimmory.succeed("curl --fail http://localhost:6060/login")
+
+        with subtest("Check API accessible"):
+          grimmory.succeed("curl --fail http://localhost:6060/api/v1/healthcheck")
+
+        with subtest("Create an admin user"):
+          grimmory.succeed('curl --fail -X POST -H "Content-Type: application/json" --data \'{"username":"admin","password":"snakeoil-password","name":"Admin","email":"admin@localhost"}\' http://localhost:6060/api/v1/setup')
+
+      with subtest("Testing nginx Grimmory config"):
+        grimmory.succeed("${nodes.grimmory.system.build.toplevel}/specialisation/nginx/bin/switch-to-configuration test")
+        grimmory.wait_for_unit("nginx.service")
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(8888)
+
+        with subtest("Check Frontend accessible via nginx"):
+          grimmory.succeed("curl --fail http://localhost/login")
+
+        with subtest("Check API accessible via nginx"):
+          grimmory.succeed("curl --fail http://localhost/api/v1/healthcheck")
+
+      with subtest("Testing caddy Grimmory config"):
+        grimmory.succeed("${nodes.grimmory.system.build.toplevel}/specialisation/caddy/bin/switch-to-configuration test")
+        grimmory.wait_for_unit("caddy.service")
+        grimmory.wait_for_unit("mysql.service")
+        grimmory.wait_for_unit("grimmory.service")
+        grimmory.wait_for_open_port(6060)
+
+        with subtest("Check Frontend accessible via caddy"):
+          grimmory.succeed("curl --fail -k https://localhost/login")
+
+        with subtest("Check API accessible via caddy"):
+          grimmory.succeed("curl --fail -k https://localhost/api/v1/healthcheck")
+    '';
+}

nixos/tests/scx-loader.nix

@@ -0,0 +1,63 @@
+{ pkgs, lib, ... }:
+
+{
+  name = "scx-loader";
+  meta.maintainers = with lib.maintainers; [ ccicnce113424 ] ++ pkgs.scx.full.meta.maintainers;
+
+  nodes.machine = {
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+    services.scx-loader = {
+      enable = true;
+      config.default_sched = lib.mkDefault "scx_bpfland";
+    };
+
+    specialisation = {
+      beerland.configuration.services.scx-loader.config.default_sched = "scx_beerland";
+      bpfland.configuration.services.scx-loader.config.default_sched = "scx_bpfland";
+      cake.configuration.services.scx-loader.config.default_sched = "scx_cake";
+      cosmos.configuration.services.scx-loader.config.default_sched = "scx_cosmos";
+      flash.configuration.services.scx-loader.config.default_sched = "scx_flash";
+      flow.configuration.services.scx-loader.config.default_sched = "scx_flow";
+      forge.configuration.services.scx-loader.config.default_sched = "scx_forge";
+      lavd.configuration.services.scx-loader.config.default_sched = "scx_lavd";
+      mlfq.configuration.services.scx-loader.config.default_sched = "scx_mlfq";
+      p2dq.configuration.services.scx-loader.config.default_sched = "scx_p2dq";
+      pandemonium.configuration.services.scx-loader.config.default_sched = "scx_pandemonium";
+      rustland.configuration.services.scx-loader.config.default_sched = "scx_rustland";
+      rusty.configuration.services.scx-loader.config.default_sched = "scx_rusty";
+      tickless.configuration.services.scx-loader.config.default_sched = "scx_tickless";
+    };
+  };
+
+  testScript = ''
+    specialisation = [
+        "beerland",
+        "bpfland",
+        "cake",
+        "cosmos",
+        "flash",
+        "flow",
+        "forge",
+        "lavd",
+        "mlfq",
+        "p2dq",
+        "pandemonium",
+        "rustland",
+        "rusty",
+        "tickless",
+    ]
+
+    def activate_specialisation(name: str):
+        machine.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
+
+    machine.wait_for_unit("multi-user.target")
+    output = machine.succeed("scxctl get").strip()
+    assert output == "running Bpfland in Auto mode", f"Unexpected scxctl output: {output!r}"
+
+    for sched in specialisation:
+        with subtest(f"{sched}"):
+            activate_specialisation(sched)
+            machine.succeed("systemctl restart scx_loader.service")
+            machine.succeed(f"ps -U root -u root u | grep scx_{sched}")
+  '';
+}

nixos/tests/scx/default.nix

@@ -1,60 +0,0 @@
-{ pkgs, ... }:
-
-{
-  name = "scx_full";
-  meta = {
-    inherit (pkgs.scx.full.meta) maintainers;
-  };
-
-  nodes.machine = {
-    boot.kernelPackages = pkgs.linuxPackages_latest;
-    services.scx.enable = true;
-
-    specialisation = {
-      beerland.configuration.services.scx.scheduler = "scx_beerland";
-      bpfland.configuration.services.scx.scheduler = "scx_bpfland";
-      cake.configuration.services.scx.scheduler = "scx_cake";
-      chaos.configuration.services.scx.scheduler = "scx_chaos";
-      cosmos.configuration.services.scx.scheduler = "scx_cosmos";
-      flash.configuration.services.scx.scheduler = "scx_flash";
-      flow.configuration.services.scx.scheduler = "scx_flow";
-      forge.configuration.services.scx.scheduler = "scx_forge";
-      lavd.configuration.services.scx.scheduler = "scx_lavd";
-      p2dq.configuration.services.scx.scheduler = "scx_p2dq";
-      pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
-      rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
-      rustland.configuration.services.scx.scheduler = "scx_rustland";
-      rusty.configuration.services.scx.scheduler = "scx_rusty";
-      tickless.configuration.services.scx.scheduler = "scx_tickless";
-    };
-  };
-
-  testScript = ''
-    specialisation = [
-      "beerland",
-      "bpfland",
-      "cake",
-      "chaos",
-      "cosmos",
-      "flash",
-      "flow",
-      "forge",
-      "lavd",
-      "p2dq",
-      "pandemonium",
-      "rlfifo",
-      "rustland",
-      "rusty",
-      "tickless",
-    ]
-
-    def activate_specialisation(name: str):
-      machine.succeed(f"/run/booted-system/specialisation/{name}/bin/switch-to-configuration test >&2")
-
-    for sched in specialisation:
-      with subtest(f"{sched}"):
-        activate_specialisation(sched)
-        machine.succeed("systemctl restart scx.service")
-        machine.succeed(f"ps -U root -u root u | grep scx_{sched}")
-  '';
-}

nixos/tests/scx/loader.nix

@@ -1,20 +0,0 @@
-{ pkgs, lib, ... }:
-
-{
-  name = "scx-loader";
-  meta.maintainers = with lib.maintainers; [ ccicnce113424 ];
-
-  nodes.machine = {
-    boot.kernelPackages = pkgs.linuxPackages_latest;
-    services.scx-loader = {
-      enable = true;
-      config.default_sched = "scx_bpfland";
-    };
-  };
-
-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
-    output = machine.succeed("scxctl get").strip()
-    assert output == "running Bpfland in Auto mode", f"Unexpected scxctl output: {output!r}"
-  '';
-}

pkgs/applications/editors/vscode/extensions/biomejs.biome/default.nix

@@ -29,11 +29,12 @@ vscode-utils.buildVscodeMarketplaceExtension {
     description = "Biome LSP extension for Visual Studio Code";
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=biomejs.biome";
     homepage = "https://github.com/biomejs/biome-vscode";
-    license = with lib.licenses; [
-      mit
-      # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = [ ];
   };
 }

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2049,8 +2049,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "7.2.5";
-          hash = "sha256-qcA9he4jxa8fTFJtGSvdIdq2j9G9zI0ps4zAwcH1ju0=";
+          version = "7.3.5";
+          hash = "sha256-bNrGfkwbVhZAnxODW/ePnXQXcl2vHiCRAynYP5eyjrE=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";

pkgs/applications/networking/browsers/brave/default.nix

@@ -1,37 +0,0 @@
-{ callPackage }:
-
-let
-  flavorData = {
-    browser = {
-      optStem = "brave";
-      fileStem = "brave-browser";
-      appIdStem = "com.brave.Browser";
-      darwinStem = "Brave Browser";
-      changelogFile = "CHANGELOG_DESKTOP.md";
-      homepage = "https://brave.com/";
-      innerBinary = "brave";
-    };
-    origin = {
-      optStem = "brave-origin";
-      fileStem = "brave-origin";
-      appIdStem = "com.brave.Origin";
-      darwinStem = "Brave Origin";
-      changelogFile = "CHANGELOG_DESKTOP_ORIGIN.md";
-      homepage = "https://brave.com/origin/";
-      innerBinary = "brave";
-    };
-  };
-
-  mkBrave =
-    release:
-    let
-      pkg = import release;
-      fd = flavorData.${pkg.flavor or "browser"};
-    in
-    callPackage ((import ./make-brave.nix) (pkg // fd)) { };
-
-in
-{
-  brave = mkBrave ./packages/brave.nix;
-  brave-origin = mkBrave ./packages/brave-origin.nix;
-}

pkgs/applications/networking/browsers/brave/make-brave.nix

@@ -1,357 +0,0 @@
-{
-  pname,
-  version,
-  # Map from Nix system strings ("x86_64-linux", "aarch64-darwin", ...) to
-  # the corresponding upstream `{ url, sha256 }` record. Encoding the per-system
-  # sources as data rather than positional arguments lets channel-specific
-  # package.nix files drop platforms that upstream hasn't published yet.
-  archives,
-  # Upstream product flavor: "browser" (the regular Brave) or "origin" (the
-  # stripped-down Brave Origin).
-  flavor ? "browser",
-  # Flavor-specific paths supplied by the caller (default.nix).
-  optStem,
-  fileStem,
-  appIdStem,
-  darwinStem,
-  changelogFile,
-  homepage,
-  innerBinary,
-}:
-
-{
-  lib,
-  stdenv,
-  fetchurl,
-  buildPackages,
-  alsa-lib,
-  at-spi2-atk,
-  at-spi2-core,
-  atk,
-  cairo,
-  cups,
-  dbus,
-  dpkg,
-  expat,
-  fontconfig,
-  freetype,
-  gdk-pixbuf,
-  glib,
-  adwaita-icon-theme,
-  gsettings-desktop-schemas,
-  gtk3,
-  gtk4,
-  qt6,
-  libx11,
-  libxscrnsaver,
-  libxcomposite,
-  libxcursor,
-  libxdamage,
-  libxext,
-  libxfixes,
-  libxi,
-  libxrandr,
-  libxrender,
-  libxtst,
-  libdrm,
-  libkrb5,
-  libuuid,
-  libxkbcommon,
-  libxshmfence,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  pciutils,
-  pipewire,
-  snappy,
-  speechd-minimal,
-  udev,
-  wayland,
-  xdg-utils,
-  coreutils,
-  libxcb,
-  vulkan-loader,
-  zlib,
-  # Darwin dependencies
-  undmg,
-  makeWrapper,
-  # command line arguments which are always set e.g "--disable-gpu"
-  commandLineArgs ? "",
-  # Necessary for USB audio devices.
-  pulseSupport ? stdenv.hostPlatform.isLinux,
-  libpulseaudio,
-  # For GPU acceleration support on Wayland (without the lib it doesn't seem to work)
-  libGL,
-  # For video acceleration via VA-API (--enable-features=AcceleratedVideoDecodeLinuxGL,AcceleratedVideoEncoder)
-  libvaSupport ? stdenv.hostPlatform.isLinux,
-  libva,
-  enableVideoAcceleration ? libvaSupport,
-  # For Vulkan support (--enable-features=Vulkan); disabled by default as it seems to break VA-API
-  vulkanSupport ? false,
-  enableVulkan ? vulkanSupport,
-}:
-
-let
-  inherit (lib)
-    optional
-    optionals
-    makeLibraryPath
-    makeSearchPathOutput
-    makeBinPath
-    optionalString
-    strings
-    escapeShellArg
-    ;
-
-  # /opt/brave.com/<optName>/
-  optName = optStem;
-  # Basename used for .desktop, gnome-control-center xml and icon files.
-  fileBase = fileStem;
-  # Secondary .desktop app-id.
-  appId = appIdStem;
-  # Upstream shell wrapper inside /opt.
-  innerWrapper = fileStem;
-  # macOS .app bundle name (inside the zip).
-  darwinApp = darwinStem;
-  # Upstream Exec= target in .desktop files (replaced with our wrapper).
-  upstreamBin = "brave-${flavor}-stable";
-
-  deps = [
-    alsa-lib
-    at-spi2-atk
-    at-spi2-core
-    atk
-    cairo
-    cups
-    dbus
-    expat
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    gtk4
-    libdrm
-    libx11
-    libGL
-    libxkbcommon
-    libxscrnsaver
-    libxcomposite
-    libxcursor
-    libxdamage
-    libxext
-    libxfixes
-    libxi
-    libxrandr
-    libxrender
-    libxshmfence
-    libxtst
-    libuuid
-    libgbm
-    nspr
-    nss
-    pango
-    pciutils # ANGLE dlopens libpci to identify GPUs, including for VA-API device selection.
-    pipewire
-    udev
-    wayland
-    libxcb
-    zlib
-    snappy
-    speechd-minimal # Text-to-speech through speech-dispatcher (--enable-speech-dispatcher).
-    libkrb5
-    vulkan-loader # Chromium and Dawn dlopen libvulkan.so.1 by name.
-    qt6.qtbase
-  ]
-  ++ optional pulseSupport libpulseaudio
-  ++ optional libvaSupport libva;
-
-  rpath = makeLibraryPath deps + ":" + makeSearchPathOutput "lib" "lib64" deps;
-  binpath = makeBinPath deps;
-
-  enableFeatures =
-    optionals enableVideoAcceleration [
-      "AcceleratedVideoDecodeLinuxGL"
-      "AcceleratedVideoEncoder"
-    ]
-    ++ optional enableVulkan "Vulkan";
-
-  disableFeatures = [
-    "OutdatedBuildDetector"
-  ] # disable automatic updates
-  # The feature disable is needed for VAAPI to work correctly: https://github.com/brave/brave-browser/issues/20935
-  ++ optionals enableVideoAcceleration [ "UseChromeOSDirectVideoDecoder" ];
-
-  archive =
-    assert lib.assertMsg (builtins.hasAttr stdenv.hostPlatform.system archives)
-      "${pname} is not available for ${stdenv.hostPlatform.system}";
-    archives.${stdenv.hostPlatform.system};
-in
-stdenv.mkDerivation {
-  inherit pname version;
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  src = fetchurl { inherit (archive) url hash; };
-
-  sourceRoot = lib.optionalString stdenv.hostPlatform.isDarwin "${darwinApp}.app";
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = stdenv.hostPlatform.isDarwin;
-  doInstallCheck = stdenv.hostPlatform.isLinux;
-
-  nativeBuildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      dpkg
-      # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-      # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
-      (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      undmg
-      makeWrapper
-    ];
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-    # needed for GSETTINGS_SCHEMAS_PATH
-    glib
-    gsettings-desktop-schemas
-    gtk3
-    gtk4
-
-    # needed for XDG_ICON_DIRS
-    adwaita-icon-theme
-  ];
-
-  installPhase =
-    lib.optionalString stdenv.hostPlatform.isLinux ''
-      runHook preInstall
-
-      mkdir -p $out $out/bin
-
-      cp -R usr/share $out
-      cp -R opt/ $out/opt
-
-      export BINARYWRAPPER=$out/opt/brave.com/${optName}/${innerWrapper}
-
-      # Fix path to bash in $BINARYWRAPPER
-      substituteInPlace $BINARYWRAPPER \
-          --replace-fail /bin/bash ${stdenv.shell} \
-          --replace-fail 'CHROME_WRAPPER' 'WRAPPER'
-
-      ln -sf $BINARYWRAPPER $out/bin/${pname}
-
-      for exe in $out/opt/brave.com/${optName}/{${innerBinary},chrome_crashpad_handler}; do
-          patchelf \
-              --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-              --set-rpath "${rpath}" $exe
-      done
-
-      # Fix paths
-      substituteInPlace $out/share/applications/{${fileBase},${appId}}.desktop \
-          --replace-fail /usr/bin/${upstreamBin} $out/bin/${pname}
-      substituteInPlace $out/share/gnome-control-center/default-apps/${fileBase}.xml \
-          --replace-fail /opt/brave.com $out/opt/brave.com
-      substituteInPlace $out/opt/brave.com/${optName}/default-app-block \
-          --replace-fail /opt/brave.com $out/opt/brave.com
-
-      # Correct icons location
-      icon_sizes=("16" "24" "32" "48" "64" "128" "256")
-
-      for icon in ''${icon_sizes[*]}
-      do
-          mkdir -p $out/share/icons/hicolor/''${icon}x''${icon}/apps
-          ln -s $out/opt/brave.com/${optName}/product_logo_''${icon}.png $out/share/icons/hicolor/''${icon}x''${icon}/apps/${fileBase}.png
-      done
-
-      # ANGLE loads this copy by absolute path; the NixOS-patched loader finds ICDs
-      # under /run/opengl-driver, the bundled one does not.
-      rm $out/opt/brave.com/${optName}/libvulkan.so.1
-      ln -s ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 $out/opt/brave.com/${optName}/libvulkan.so.1
-
-      # Replace xdg-settings and xdg-mime
-      ln -sf ${xdg-utils}/bin/xdg-settings $out/opt/brave.com/${optName}/xdg-settings
-      ln -sf ${xdg-utils}/bin/xdg-mime $out/opt/brave.com/${optName}/xdg-mime
-
-      runHook postInstall
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      runHook preInstall
-
-      mkdir -p $out/{Applications,bin}
-
-      cp -r . "$out/Applications/${darwinApp}.app"
-
-      makeWrapper "$out/Applications/${darwinApp}.app/Contents/MacOS/${darwinApp}" $out/bin/${pname}
-
-      runHook postInstall
-    '';
-
-  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # Add command line args to wrapGApp.
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : ${rpath}
-      --prefix PATH : ${binpath}
-      --suffix PATH : ${
-        lib.makeBinPath [
-          xdg-utils
-          coreutils
-        ]
-      }
-      --set CHROME_WRAPPER ${pname}
-      ${optionalString (enableFeatures != [ ]) ''
-        --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+,WaylandWindowDecorations --enable-wayland-ime=true}}"
-      ''}
-      ${optionalString (disableFeatures != [ ]) ''
-        --add-flags "--disable-features=${strings.concatStringsSep "," disableFeatures}"
-      ''}
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
-      --add-flags ${escapeShellArg commandLineArgs}
-    )
-  '';
-
-  installCheckPhase = ''
-    # Bypass upstream wrapper which suppresses errors
-    $out/opt/brave.com/${optName}/brave --version
-  '';
-
-  passthru.updateScript = ./update.py;
-
-  meta = {
-    homepage = homepage;
-    description =
-      "Privacy-oriented browser for Desktop and Laptop computers"
-      + lib.optionalString (flavor == "origin") " (Origin variant)";
-    changelog =
-      "https://github.com/brave/brave-browser/blob/master/${changelogFile}#"
-      + lib.replaceStrings [ "." ] [ "" ] version;
-    longDescription =
-      if flavor == "origin" then
-        ''
-          Brave Origin is a stripped-down variant of the Brave browser that
-          removes most non-privacy features (rewards, wallet, AI, etc.) while
-          keeping the core privacy, adblock and Chromium-based browsing
-          experience.
-        ''
-      else
-        ''
-          Brave browser blocks the ads and trackers that slow you down,
-          chew up your bandwidth, and invade your privacy. Brave lets you
-          contribute to your favorite creators automatically.
-        '';
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [
-      uskudnik
-      jefflabonte
-      buckley310
-      rachalaraj
-    ];
-    platforms = builtins.attrNames archives;
-    mainProgram = if flavor == "origin" then "brave-origin" else "brave";
-  };
-}

pkgs/applications/networking/browsers/brave/packages/brave-origin.nix

@@ -1,21 +0,0 @@
-# Expression generated by update.py; do not edit it by hand!
-rec {
-  pname = "brave-origin";
-  version = "1.98.63";
-  flavor = "origin";
-
-  archives = {
-    aarch64-linux = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      hash = "sha256-8nkMT9jDBJ1H2u6TJ4f2Hq50B8LKMN5q6Dar9TV9n4s=";
-    };
-    x86_64-linux = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      hash = "sha256-7b2eyO1VmShI/2iJYX+V1OnvFiW9ouWKLSJv9WBNScg=";
-    };
-    aarch64-darwin = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      hash = "sha256-/7RJV8G2xczV8yHU1nGWv7Y65EOxAdPlhsUSwC/qksg=";
-    };
-  };
-}

pkgs/applications/networking/browsers/brave/packages/brave.nix

@@ -1,20 +0,0 @@
-# Expression generated by update.py; do not edit it by hand!
-rec {
-  pname = "brave";
-  version = "1.98.63";
-
-  archives = {
-    aarch64-linux = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-jQtKAVXCgQ7JwuK3VRWbmieL1R+50Nd2ynrE9C4MwvM=";
-    };
-    x86_64-linux = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-JCJ81aklnr3FEI2zlMxZmN9aw2NfhPiDinRkp7XN3VU=";
-    };
-    aarch64-darwin = {
-      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      hash = "sha256-13XmtzqQIFTu3gj2aeIFDtbDaRJfhLbEsKd0biTBV7k=";
-    };
-  };
-}

pkgs/applications/networking/browsers/brave/update.py

@@ -1,90 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p python3
-
-import base64
-import os
-import urllib.request
-
-download_urls = {
-    "brave": {
-        "aarch64-linux": "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb",
-        "x86_64-linux": "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb",
-        "aarch64-darwin": "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg",
-    },
-    "brave-origin": {
-        "aarch64-linux": "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb",
-        "x86_64-linux": "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb",
-        "aarch64-darwin": "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg",
-    },
-}
-
-
-def wget(url):
-    res = urllib.request.urlopen(url)
-    assert res.code == 200
-    return res.read().decode("ascii")
-
-
-def sha256_to_sri(hash):
-    hash = base64.b64encode(bytes.fromhex(hash)).decode('utf-8')
-    return f"sha256-{hash}"
-
-
-def get_version(base_url):
-    # Grab version strings for each system, and make sure they all match.
-    versions = set(
-        wget(f"{base_url}{channel_platform}.version")
-        for channel_platform in [
-            "release-linux-arm64",
-            "release-linux-x64",
-            "release-macos-arm64",
-        ]
-    )
-    assert len(versions) == 1
-    return versions.pop()
-
-
-def write_package(flavor, version):
-    with open(f"packages/{flavor}.nix", "wt") as f:
-
-        print("# Expression generated by update.py; do not edit it by hand!", file=f)
-        print("rec {", file=f)
-        print(f'  pname = "{flavor}";', file=f)
-        print(f'  version = "{version}";', file=f)
-
-        if flavor == "brave-origin":
-            print('  flavor = "origin";', file=f)
-
-        print("\n  archives = {", file=f)
-
-        for arch in download_urls[flavor].keys():
-            url = download_urls[flavor][arch]
-            hashurl = url.replace("${version}", version) + ".sha256"
-            hash = sha256_to_sri(wget(hashurl).split(" ")[0])
-
-            print(f"    {arch} = {{", file=f)
-            print(f'      url = "{url}";', file=f)
-            print(f'      hash = "{hash}";', file=f)
-            print(f"    }};", file=f)
-
-        print("  };", file=f)
-        print("}", file=f)
-
-
-def main():
-    os.chdir(os.path.dirname(__file__))
-
-    brave_version = get_version(f"https://versions.brave.com/latest/")
-    origin_version = get_version(f"https://versions.brave.com/latest/origin-")
-
-    print(f"brave ver  -> {brave_version}")
-    print(f"origin ver -> {origin_version}")
-
-    write_package("brave", brave_version)
-    write_package("brave-origin", origin_version)
-
-    print("Successfully updated!")
-
-
-if __name__ == "__main__":
-    main()

pkgs/applications/networking/browsers/chromium/README.md

@@ -1,91 +0,0 @@
-# Maintainers
-
-- Note: We could always use more contributors, testers, etc. E.g.:
-  - Dedicated maintainers for the NixOS stable channel
-  - PRs with cleanups, improvements, fixes, etc. (but please try to make reviews
-    as easy as possible)
-  - People who handle stale issues/PRs
-
-- Other relevant packages:
-  - `google-chrome`: Updated via Chromium's `upstream-info.nix`.
-  - `ungoogled-chromium`: A patch set for Chromium, that has its own entry in Chromium's `upstream-info.nix`.
-  - `chromedriver`: Updated via Chromium's `upstream-info.nix` and not built
-    from source. Must match Chromium's major version.
-  - `electron-source`: Various versions of Electron that are built from source using Chromium's
-    `-unwrapped` derivation, due to Electron being based on Chromium.
-
-# Upstream links
-
-- Source code: https://source.chromium.org/chromium/chromium/src
-- Bugs: https://bugs.chromium.org/p/chromium/issues/list
-- Release updates: https://chromereleases.googleblog.com/
-  - Available as Atom or RSS feed (filter for
-    "Stable Channel Update for Desktop")
-  - Release API: https://developer.chrome.com/docs/versionhistory/guide/
-  - Release schedule: https://chromiumdash.appspot.com/schedule
-
-# Updating Chromium
-
-Simply run `./pkgs/applications/networking/browsers/chromium/update.py` to
-update `upstream-info.nix`. After updates it is important to test at least
-`nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
-reuses `upstream-info.nix`).
-
-Note: The source tarball is often only available a few hours after the release
-was announced. The CI/CD status can be tracked here:
-- https://ci.chromium.org/p/infra/builders/cron/publish_tarball
-- https://ci.chromium.org/p/infra/builders/cron/publish_tarball_dispatcher
-
-To run all automated NixOS VM tests for Chromium, ungoogled-chromium,
-and Google Chrome (not recommended, currently 6x tests!):
-```
-nix-build nixos/tests/chromium.nix
-```
-
-A single test can be selected, e.g. to test `ungoogled-chromium` (see
-`channelMap` in `nixos/tests/chromium.nix` for all available options):
-```
-nix-build nixos/tests/chromium.nix -A ungoogled
-```
-(Note: Testing Google Chrome requires `export NIXPKGS_ALLOW_UNFREE=1`.)
-
-For custom builds it's possible to "override" `channelMap`.
-
-## Backports
-
-All updates are considered security critical and should be ported to the stable
-channel ASAP. When there is a new stable release the old one should receive
-security updates for roughly one month. After that it is important to mark
-Chromium as insecure (see 69e4ae56c4b for an example; it is important that the
-tested job still succeeds and that all browsers that use `upstream-info.nix`
-are marked as insecure).
-
-## Major version updates
-
-Unfortunately, Chromium regularly breaks on major updates and might need
-various patches. Either due to issues with the Nix build sandbox (e.g. we cannot
-fetch dependencies via the network and do not use standard FHS paths) or due to
-missing upstream fixes that need to be backported.
-
-Good sources for such patches and other hints:
-- https://github.com/archlinux/svntogit-packages/tree/packages/chromium/trunk
-- https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium
-- https://src.fedoraproject.org/rpms/chromium/tree/master
-
-If the build fails immediately due to unknown compiler flags this usually means
-that a new major release of LLVM is required.
-
-## Beta and Dev channels
-
-Those channels are only used to test and fix builds in advance. They may be
-broken at times and must not delay stable channel updates.
-
-# Testing
-
-Useful tests:
-- Version: chrome://version/
-- GPU acceleration: chrome://gpu/
-- Essential functionality: Browsing, extensions, video+audio, JS, ...
-- WebGL: https://get.webgl.org/
-- VA-API: https://wiki.archlinux.org/index.php/chromium#Hardware_video_acceleration
-- Optional: Widevine CDM (proprietary), Benchmarks, Ozone, etc.

pkgs/applications/networking/browsers/chromium/default.nix

@@ -22,6 +22,7 @@
   lib,
   libkrb5,
   widevine-cdm,
+  nixosTests,
 
   # package customization
   # Note: enable* flags should not require full rebuilds (i.e. only affect the wrapper)
@@ -194,5 +195,8 @@ stdenv.mkDerivation {
     inherit (chromium) upstream-info browser;
     mkDerivation = chromium.mkChromiumDerivation;
     inherit sandboxExecutableName;
+    tests = {
+      nixos = if ungoogled then nixosTests.ungoogled-chromium else nixosTests.chromium;
+    };
   };
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -904,11 +904,11 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-AIRdDcFCDjE4uPZS3aZk4HfZzBN5SsGnJnSBZ2vgIno=",
+    "hash": "sha256-oJlegaTk7XWjCMIzDUPmh3cRz65EtSNHY0zZST184wM=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.10.22",
+    "rev": "2026.10.29",
     "spdx": "0BSD",
     "vendorHash": "sha256-Z/Z5TvhAigUDxi7zvrgmmuoPwMoztAidFChmHWQ/Vc4="
   },
@@ -1120,11 +1120,11 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-uks+FF2JDC1ciMoQMree3hsRSnzeef+F4UDhTy+smWU=",
+    "hash": "sha256-Rr6CmH0n3DyFvTWOYEw2NMhVm2k6GyqyM+9fq7v5AbY=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.23.5",
+    "rev": "v5.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-wtVA37PIlxkZcGKD/Q7N6Se7IyuFTq6G6doyzN4SX70="
   },

pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix

@@ -73,10 +73,12 @@ stdenv.mkDerivation {
     homepage = "https://gitlab.linphone.org/BC/public/external/mbedtls";
     changelog = "https://gitlab.linphone.org/BC/public/external/mbedtls/-/blob/${rev}/ChangeLog";
     description = "Portable cryptographic and TLS library, formerly known as PolarSSL (Linphone fork)";
-    license = with lib.licenses; [
-      asl20 # or
-      gpl2Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        gpl2Plus
+      ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ naxdy ];
     knownVulnerabilities = [

pkgs/build-support/wasm-bindgen-cli/default.nix

@@ -41,10 +41,12 @@ rustPlatform.buildRustPackage {
 
   meta = {
     homepage = "https://wasm-bindgen.github.io/wasm-bindgen/";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     description = "Facilitating high-level interactions between wasm modules and JavaScript";
     maintainers = with lib.maintainers; [
       rizary

pkgs/by-name/ae/aerc/package.nix

@@ -19,6 +19,8 @@ buildGoModule (finalAttrs: {
   pname = "aerc";
   version = "0.22.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";

pkgs/by-name/ag/agate/package.nix

@@ -52,11 +52,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       static files. It uses async I/O, and should be quite efficient even when
       running on low-end hardware and serving many concurrent requests.
     '';
-    license = with lib.licenses; [
-      asl20
-      # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ jk ];
   };
 })

pkgs/by-name/al/alacritty-theme/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alacritty-theme";
-  version = "0-unstable-2026-09-11";
+  version = "0-unstable-2026-10-29";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "ab88d5a80d676b5dc6157e91aba8067f2078dc94";
-    hash = "sha256-fNkRZhb+dfWXnb1iq3dS9ntwodKQ3lgTbUZ+VQGvffA=";
+    rev = "95615789c5eddee1c5407a520cd9959a86fa4716";
+    hash = "sha256-2csu0UVt5o8lVp6YO4A7Va35QV4ZqkMd3JZSNBus1hk=";
     sparseCheckout = [ "themes" ];
   };
 

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2601";
+  version = "2.0.2613";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-brw+U512bYLxAxLB5z2HjL+6MML3rMwtAZWvR0r8jVI=";
+    hash = "sha256-5+TGmDIlI+YjbCUlq4MDWyKceEZRPaftg6kmd7lkG40=";
   };
 
-  npmDepsHash = "sha256-1ofrjx9QbZMbZDu+zVQuyyGtBFjKWdXVzCNwJtIDNaM=";
+  npmDepsHash = "sha256-RqmovxaQ3hB5K8YdXpUnAMAvJzCXNdnRYYvvuXVnJEU=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ar/argc/package.nix

@@ -64,11 +64,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "argc";
     homepage = "https://github.com/sigoden/argc";
     changelog = "https://github.com/sigoden/argc/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [
-      mit
-      # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = [ lib.maintainers.progrm_jarvis ];
   };
 })

pkgs/by-name/as/assaultcube/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   makeDesktopItem,
   copyDesktopItems,
+  desktopToDarwinBundle,
   openal,
   pkg-config,
   libogg,
@@ -14,7 +15,6 @@
   libx11,
   makeWrapper,
   zlib,
-  file,
   client ? true,
   server ? true,
 }:
@@ -33,23 +33,44 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     pkg-config
-    copyDesktopItems
-  ];
+  ]
+  ++ lib.optionals client [ copyDesktopItems ]
+  ++ lib.optionals (client && stdenv.hostPlatform.isDarwin) [ desktopToDarwinBundle ];
 
   buildInputs = [
-    file
     zlib
   ]
+  # On Darwin, even the server needs SDL2 (AC uses SDL threads/timers via __APPLE__)
+  ++ lib.optionals (client || stdenv.hostPlatform.isDarwin) [
+    SDL2
+  ]
   ++ lib.optionals client [
     openal
-    SDL2
     SDL2_image
-    libGL
-    libx11
     libogg
     libvorbis
+  ]
+  ++ lib.optionals (client && !stdenv.hostPlatform.isDarwin) [
+    libGL
+    libx11
   ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2}/include/SDL2";
+  };
+
+  preBuild = lib.optionalString (client && stdenv.hostPlatform.isDarwin) ''
+    substituteInPlace source/src/Makefile \
+      --replace-fail '-lX11' ''' \
+      --replace-fail '-lGL' '-framework OpenGL' \
+      --replace-fail '-lrt' '-lSDL2'
+
+    mkdir -p source/include/OpenAL source/include/Vorbis
+    ln -sf ${lib.getDev openal}/include/AL/al.h source/include/OpenAL/al.h
+    ln -sf ${lib.getDev openal}/include/AL/alc.h source/include/OpenAL/alc.h
+    ln -sf ${lib.getDev libvorbis}/include/vorbis/vorbisfile.h source/include/Vorbis/vorbisfile.h
+  '';
+
   makeFlags = [
     "-C source/src"
     "CXX=${stdenv.cc.targetPrefix}c++"
@@ -57,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals server [ "server" ]
   ++ lib.optionals client [ "client" ];
 
-  desktopItems = [
+  desktopItems = lib.optionals client [
     (makeDesktopItem {
       name = "assaultcube";
       desktopName = "AssaultCube";
@@ -80,20 +101,22 @@ stdenv.mkDerivation (finalAttrs: {
 
     cp -r config packages $out/share/games/assaultcube
 
-    if (test -e source/src/ac_client) then
+    ${lib.optionalString client ''
       cp source/src/ac_client $out/bin
-      mkdir -p $out/share/applications
-      install -Dpm644 packages/misc/icon.png $out/share/icons/hicolor/32x32/apps/assaultcube.png
+      install -Dpm644 packages/misc/icon.png \
+        $out/share/icons/hicolor/32x32/apps/assaultcube.png
 
       makeWrapper $out/bin/ac_client $out/bin/assaultcube \
-        --chdir "$out/share/games/assaultcube" --add-flags "--home=\$HOME/.assaultcube/v1.2next --init"
-    fi
+        --chdir "$out/share/games/assaultcube" \
+        --add-flags "--home=\$HOME/.assaultcube/v1.2next --init"
+    ''}
 
-    if (test -e source/src/ac_server) then
+    ${lib.optionalString server ''
       cp source/src/ac_server $out/bin
       makeWrapper $out/bin/ac_server $out/bin/assaultcube-server \
-        --chdir "$out/share/games/assaultcube" --add-flags "-Cconfig/servercmdline.txt"
-    fi
+        --chdir "$out/share/games/assaultcube" \
+        --add-flags "-Cconfig/servercmdline.txt"
+    ''}
 
     runHook postInstall
   '';
@@ -101,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Fast and fun first-person-shooter based on the Cube fps";
     homepage = "https://assault.cubers.net";
-    platforms = lib.platforms.linux; # should work on darwin with a little effort.
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ darkonion0 ];
   };

pkgs/by-name/av/avbroot/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.37.0";
+  version = "3.37.1";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-wr2yb5hTSaqPPSokr4iYNSWeaS2H6t5b2fk94BmnqAM=";
+    hash = "sha256-EkcS+PCUmviuXBBD0CkUCHhgje3LfhrtvbtDyFa0YXs=";
   };
 
-  cargoHash = "sha256-54i+YWA+CGB6arn6cIpnNpk20YtRQTRpmb/PXcrX5ro=";
+  cargoHash = "sha256-1Jv6anix0VGvHtKQ8+cAObCVc5SvmWDx3R/au1dbnPg=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ba/balena-cli/package.nix

@@ -13,16 +13,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "balena-cli";
-  version = "25.2.7";
+  version = "25.2.9";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XjJJE1FcfMy2N7T8iEPvqJjc0fdxyl3sizGB6r+UUPw=";
+    hash = "sha256-+8W4oKwEjPjk7LyILI7M9eQcRE1OeXnzKv+9QbcsG+Q=";
   };
 
-  npmDepsHash = "sha256-08fU3HX2GFlVDbNuq0cb47Yp3ilmMe8V8nqq3kcIqo0=";
+  npmDepsHash = "sha256-Z5duTbWZ/9Pukmhk0BZlN0YNsB8vp7UHV92YI7Y2l0w=";
 
   makeCacheWritable = true;
 

pkgs/by-name/ba/bat/package.nix

@@ -89,10 +89,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cat(1) clone with syntax highlighting and Git integration";
     homepage = "https://github.com/sharkdp/bat";
     changelog = "https://github.com/sharkdp/bat/raw/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     mainProgram = "bat";
     maintainers = with lib.maintainers; [
       dywedir

pkgs/by-name/be/bear/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bear";
-  version = "4.2.3";
+  version = "4.2.4";
 
   src = fetchFromGitHub {
     owner = "rizsotto";
     repo = "bear";
     rev = finalAttrs.version;
-    hash = "sha256-W0t4UfTytoIXQ39LjHvA9U5owZJMsZNQd+fZ21DvsIg=";
+    hash = "sha256-5aiJHO9O7PMDtUpajRrpod5qDiMQPC5zhWxzXgeKb3g=";
   };
 
-  cargoHash = "sha256-ckWcNHR8D1FUWCFiP1SHdCzsDWppBbuZ/YG0hRj3F+4=";
+  cargoHash = "sha256-nV+exH84tvHOUmzxytAK/rINNKc0u7tBONPVAJRphZo=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/bi/binmerge/package.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  python3,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "binmerge";
+  version = "1.0.3";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "putnam";
+    repo = "binmerge";
+    tag = finalAttrs.version;
+    hash = "sha256-83c7PUZvAplBy03z6BRP5kdruSk72yINMbYsM9wqzeI=";
+  };
+
+  buildInputs = [ python3 ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 binmerge -t $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--license";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool to merge multiple bin/cue tracks into one";
+    homepage = "https://github.com/putnam/binmerge";
+    changelog = "https://github.com/putnam/binmerge/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ keenanweaver ];
+    platforms = lib.platforms.all;
+    mainProgram = "binmerge";
+  };
+})

pkgs/by-name/bi/binocle/package.nix

@@ -53,10 +53,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "binocle";
     homepage = "https://github.com/sharkdp/binocle";
     changelog = "https://github.com/sharkdp/binocle/releases/tag/v0.3.2";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = [ lib.maintainers.progrm_jarvis ];
   };
 })

pkgs/by-name/bi/binsider/package.nix

@@ -28,10 +28,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Analyzer of executables using a terminal user interface";
     homepage = "https://github.com/orhun/binsider";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ samueltardieu ];
     mainProgram = "binsider";
   };

pkgs/by-name/bl/blitz/package.nix

@@ -81,11 +81,13 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Fast multi-dimensional array library for C++";
     homepage = "https://sourceforge.net/projects/blitz/";
-    license = with lib.licenses; [
-      artistic2 # or
-      bsd3 # or
-      lgpl3Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        artistic2
+        bsd3
+        lgpl3Plus
+      ];
     platforms = lib.platforms.unix;
     maintainers = [ ];
     longDescription = ''

pkgs/by-name/bo/boa/package.nix

@@ -48,10 +48,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Embeddable and experimental Javascript engine written in Rust";
     homepage = "https://github.com/boa-dev/boa";
     changelog = "https://github.com/boa-dev/boa/releases/tag/${finalAttrs.src.tag}";
-    license = with lib.licenses; [
-      mit # or
-      unlicense
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        unlicense
+      ];
     mainProgram = "boa";
     maintainers = with lib.maintainers; [ iamanaws ];
   };

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -25,6 +25,7 @@
   buildFHSEnv,
   makeDesktopItem,
   copyDesktopItems,
+  nix-update-script,
   enableRS3 ? false,
 }:
 let
@@ -149,15 +150,19 @@ buildFHSEnv {
     ln -s ${bolt}/share/icons/hicolor/256x256/apps/*.png $out/share/icons/hicolor/256x256/apps/
   '';
 
+  passthru = {
+    inherit (bolt) src;
+    unwrapped = bolt;
+    updateScript = nix-update-script { };
+  };
+
   runScript = "${bolt.name}";
 
   meta = {
     homepage = "https://codeberg.org/Adamcake/Bolt";
     changelog = "https://codeberg.org/Adamcake/Bolt/releases/tag/${bolt.version}";
     description = "Alternative launcher for RuneScape";
-    longDescription = ''
-      Bolt Launcher supports HDOS/RuneLite by default with an optional feature flag for RS3 (enableRS3).
-    '';
+    longDescription = "Bolt Launcher supports HDOS/RuneLite by default with an optional feature flag for RS3 (enableRS3).";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [
       nezia

pkgs/by-name/bo/boxflat/package.nix

@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage (finalAttrs: {
   pname = "boxflat";
-  version = "1.35.5";
+  version = "1.37.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R03mQIsa6T1ApV8SMWvilBfiCGcAWvyZ5hDDgAuGd6s=";
+    hash = "sha256-509wOfzfbiMujaM8kaPHoWk8IhYlrgZnyom2PQpRqss=";
   };
 
   build-system = [ python3Packages.setuptools ];
@@ -36,6 +36,8 @@ python3Packages.buildPythonPackage (finalAttrs: {
     python3Packages.pycairo
     python3Packages.pygobject3
     python3Packages.evdev
+    python3Packages.dbus-python
+    python3Packages.trayer
   ];
 
   nativeBuildInputs = [
@@ -51,17 +53,27 @@ python3Packages.buildPythonPackage (finalAttrs: {
     "pycairo"
     "pygobject"
     "PyYAML"
+    "dbus-python"
+    "trayer"
   ];
 
   preBuild = ''
+    substituteInPlace boxflat/app.py \
+      --replace-fail 'if udev_exists and rules_version >= 2:' 'if udev_exists:'
+
     cat > setup.py << EOF
-    import shutil
     from setuptools import setup
 
     with open('requirements.txt') as f:
         install_requires = f.read().splitlines()
 
-    shutil.copyfile('entrypoint.py', 'boxflat/entrypoint.py')
+    with open('entrypoint.py') as f:
+        content = f.read()
+
+    with open('boxflat/entrypoint.py', 'w') as f:
+        f.write("def main():\n")
+        for line in content.splitlines():
+            f.write("    " + line + "\n")
 
     setup(
       name='boxflat',
@@ -120,7 +132,10 @@ python3Packages.buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/Lawstorant/boxflat/releases/tag/v${finalAttrs.version}";
     description = "Control your Moza gear settings";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ racci ];
+    maintainers = with lib.maintainers; [
+      racci
+      vinso
+    ];
     platforms = lib.platforms.linux;
     mainProgram = "boxflat";
   };

pkgs/by-name/bu/buck2/package.nix

@@ -136,10 +136,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Fast, hermetic, multi-language build system";
     homepage = "https://buck2.build";
     changelog = "https://github.com/facebook/buck2/releases/tag/${finalAttrs.version}";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     mainProgram = "buck2";
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     maintainers = with lib.maintainers; [

pkgs/by-name/c2/c2patool/package.nix

@@ -56,10 +56,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Command line tool for working with C2PA manifests and media assets";
     homepage = "https://github.com/contentauth/c2pa-rs/tree/main/cli";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ ok-nick ];
     mainProgram = "c2patool";
   };

pkgs/by-name/ca/cached-nix-shell/package.nix

@@ -50,11 +50,12 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "cached-nix-shell";
     homepage = "https://github.com/xzfc/cached-nix-shell";
     changelog = "https://github.com/xzfc/cached-nix-shell/releases/tag/v${version}";
-    license = with lib.licenses; [
-      unlicense
-      # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        unlicense
+        mit
+      ];
     maintainers = with lib.maintainers; [ xzfc ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };

pkgs/by-name/ca/cargo-about/package.nix

@@ -33,10 +33,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo plugin to generate list of all licenses for a crate";
     homepage = "https://github.com/EmbarkStudios/cargo-about";
     changelog = "https://github.com/EmbarkStudios/cargo-about/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       evanjs
       matthiasbeyer

pkgs/by-name/ca/cargo-all-features/package.nix

@@ -23,10 +23,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Cargo subcommand to build and test all feature flag combinations";
     homepage = "https://github.com/frewsxcv/cargo-all-features";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-audit/package.nix

@@ -37,10 +37,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-audit";
     homepage = "https://rustsec.org";
     changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${finalAttrs.version}/cargo-audit/CHANGELOG.md";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       basvandijk
       jk

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -59,10 +59,12 @@ lib.extendMkDerivation {
         mainProgram = "cargo-auditable";
         homepage = "https://github.com/rust-secure-code/cargo-auditable";
         changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${finalAttrs.version}/cargo-auditable/CHANGELOG.md";
-        license = with lib.licenses; [
-          mit # or
-          asl20
-        ];
+        license =
+          with lib.licenses;
+          OR [
+            mit
+            asl20
+          ];
         maintainers = with lib.maintainers; [ RossSmyth ];
         broken = stdenv.hostPlatform != stdenv.buildPlatform;
       };

pkgs/by-name/ca/cargo-cache/package.nix

@@ -29,10 +29,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Manage cargo cache (\${CARGO_HOME}, ~/.cargo/), print sizes of dirs and remove dirs selectively";
     mainProgram = "cargo-cache";
     homepage = "https://github.com/matthiaskrgr/cargo-cache";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-clean-recursive/package.nix

@@ -29,10 +29,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cleans all projects under specified directory";
     mainProgram = "cargo-clean-recursive";
     homepage = "https://github.com/IgaguriMK/cargo-clean-recursive";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ qubic ];
   };
 })

pkgs/by-name/ca/cargo-criterion/package.nix

@@ -21,10 +21,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo extension for running Criterion.rs benchmarks";
     mainProgram = "cargo-criterion";
     homepage = "https://github.com/bheisler/cargo-criterion";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       humancalico
       matthiasbeyer

pkgs/by-name/ca/cargo-cross/package.nix

@@ -35,10 +35,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Zero setup cross compilation and cross testing";
     homepage = "https://github.com/cross-rs/cross";
     changelog = "https://github.com/cross-rs/cross/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ otavio ];
     mainProgram = "cross";
   };

pkgs/by-name/ca/cargo-deadlinks/package.nix

@@ -35,10 +35,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo subcommand to check rust documentation for broken links";
     homepage = "https://github.com/deadlinks/cargo-deadlinks";
     changelog = "https://github.com/deadlinks/cargo-deadlinks/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       newam
       matthiasbeyer

pkgs/by-name/ca/cargo-deny/package.nix

@@ -39,10 +39,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-deny";
     homepage = "https://github.com/EmbarkStudios/cargo-deny";
     changelog = "https://github.com/EmbarkStudios/cargo-deny/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
       jk

pkgs/by-name/ca/cargo-dephell/package.nix

@@ -50,10 +50,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Tool to analyze the third-party dependencies imported by a rust crate or rust workspace";
     mainProgram = "cargo-dephell";
     homepage = "https://github.com/mimoo/cargo-dephell";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-edit/package.nix

@@ -36,10 +36,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Utility for managing cargo dependencies from the command line";
     homepage = "https://github.com/killercup/cargo-edit";
     changelog = "https://github.com/killercup/cargo-edit/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     mainProgram = "cargo-edit";
     maintainers = with lib.maintainers; [
       gerschtli

pkgs/by-name/ca/cargo-flamegraph/package.nix

@@ -35,10 +35,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Easy flamegraphs for Rust projects and everything else, without Perl or pipes <3";
     homepage = "https://github.com/flamegraph-rs/flamegraph";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       killercup
       matthiasbeyer

pkgs/by-name/ca/cargo-fund/package.nix

@@ -39,10 +39,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Discover funding links for your project's dependencies";
     mainProgram = "cargo-fund";
     homepage = "https://github.com/acfoltzer/cargo-fund";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [ johntitor ];
   };
 })

pkgs/by-name/ca/cargo-geiger/package.nix

@@ -84,10 +84,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/geiger-rs/cargo-geiger";
     changelog = "https://github.com/geiger-rs/cargo-geiger/blob/cargo-geiger-${finalAttrs.version}/CHANGELOG.md";
     mainProgram = "cargo-geiger";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       evanjs
       gepbird

pkgs/by-name/ca/cargo-generate/package.nix

@@ -68,10 +68,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-generate";
     homepage = "https://github.com/cargo-generate/cargo-generate";
     changelog = "https://github.com/cargo-generate/cargo-generate/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       turbomack
       matthiasbeyer

pkgs/by-name/ca/cargo-guppy/package.nix

@@ -42,10 +42,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/guppy-rs/guppy/releases/tag/${finalAttrs.src.tag}";
     description = "Command-line frontend for guppy";
     homepage = "https://github.com/guppy-rs/guppy/tree/main/cargo-guppy";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     mainProgram = "cargo-guppy";
     maintainers = with lib.maintainers; [ hythera ];
   };

pkgs/by-name/ca/cargo-hack/package.nix

@@ -34,10 +34,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-hack";
     homepage = "https://github.com/taiki-e/cargo-hack";
     changelog = "https://github.com/taiki-e/cargo-hack/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ defelo ];
   };
 })

pkgs/by-name/ca/cargo-limit/package.nix

@@ -25,10 +25,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Cargo subcommand \"limit\": reduces the noise of compiler messages";
     homepage = "https://github.com/cargo-limit/cargo-limit";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       otavio
       matthiasbeyer

pkgs/by-name/ca/cargo-llvm-cov/package.nix

@@ -90,10 +90,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       tools-preview` or install the `llvm-tools-preview` component using your Nix
       library (e.g. fenix or rust-overlay)
     '';
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       wucke13
       matthiasbeyer

pkgs/by-name/ca/cargo-llvm-lines/package.nix

@@ -22,10 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-llvm-lines";
     homepage = "https://github.com/dtolnay/cargo-llvm-lines";
     changelog = "https://github.com/dtolnay/cargo-llvm-lines/releases/tag/${finalAttrs.src.rev}";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-lock/package.nix

@@ -22,10 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-lock";
     homepage = "https://github.com/rustsec/rustsec/tree/main/cargo-lock";
     changelog = "https://github.com/rustsec/rustsec/blob/cargo-lock/v${finalAttrs.version}/cargo-lock/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-mobile2/package.nix

@@ -48,10 +48,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Rust on mobile made easy";
     homepage = "https://tauri.app/";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [ happysalada ];
   };
 })

pkgs/by-name/ca/cargo-msrv/package.nix

@@ -46,10 +46,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo subcommand \"msrv\": assists with finding your minimum supported Rust version (MSRV)";
     mainProgram = "cargo-msrv";
     homepage = "https://github.com/foresterre/cargo-msrv";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       otavio
       matthiasbeyer

pkgs/by-name/ca/cargo-ndk/package.nix

@@ -21,10 +21,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo extension for building Android NDK projects";
     mainProgram = "cargo-ndk";
     homepage = "https://github.com/bbqsrc/cargo-ndk";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = [ ];
   };
 })

pkgs/by-name/ca/cargo-outdated/package.nix

@@ -33,10 +33,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-outdated";
     homepage = "https://github.com/kbknapp/cargo-outdated";
     changelog = "https://github.com/kbknapp/cargo-outdated/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-plumbing/package.nix

@@ -33,10 +33,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Proposed plumbing commands for cargo";
     homepage = "https://github.com/crate-ci/cargo-plumbing";
     changelog = "https://github.com/crate-ci/cargo-plumbing/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       secona
     ];

pkgs/by-name/ca/cargo-release/package.nix

@@ -56,10 +56,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-release";
     homepage = "https://github.com/crate-ci/cargo-release";
     changelog = "https://github.com/crate-ci/cargo-release/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       gerschtli
       progrm_jarvis

pkgs/by-name/ca/cargo-semver-checks/package.nix

@@ -64,10 +64,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-semver-checks";
     homepage = "https://github.com/obi1kenobi/cargo-semver-checks";
     changelog = "https://github.com/obi1kenobi/cargo-semver-checks/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
       chrjabs

pkgs/by-name/ca/cargo-sort/package.nix

@@ -22,10 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-sort";
     homepage = "https://github.com/devinr528/cargo-sort";
     changelog = "https://github.com/devinr528/cargo-sort/blob/v${finalAttrs.version}/changelog.md";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-spellcheck/package.nix

@@ -35,10 +35,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-spellcheck";
     homepage = "https://github.com/drahnr/cargo-spellcheck";
     changelog = "https://github.com/drahnr/cargo-spellcheck/blob/v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       newam
       matthiasbeyer

pkgs/by-name/ca/cargo-tally/package.nix

@@ -20,10 +20,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-tally";
     homepage = "https://github.com/dtolnay/cargo-tally";
     changelog = "https://github.com/dtolnay/cargo-tally/releases/tag/${finalAttrs.version}";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-tarpaulin/package.nix

@@ -48,10 +48,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-tarpaulin";
     homepage = "https://github.com/xd009642/tarpaulin";
     changelog = "https://github.com/xd009642/tarpaulin/blob/${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       hugoreeves
       progrm_jarvis

pkgs/by-name/ca/cargo-tauri/package.nix

@@ -83,10 +83,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Build smaller, faster, and more secure desktop applications with a web frontend";
     homepage = "https://tauri.app/";
     changelog = "https://github.com/tauri-apps/tauri/releases/tag/tauri-cli-v${finalAttrs.version}";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       getchoo
       happysalada

pkgs/by-name/ca/cargo-temp/package.nix

@@ -22,10 +22,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-temp";
     homepage = "https://github.com/yozhgoor/cargo-temp";
     changelog = "https://github.com/yozhgoor/cargo-temp/releases/tag/${finalAttrs.src.rev}";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = with lib.maintainers; [
       matthiasbeyer
     ];

pkgs/by-name/ca/cargo-toml-lint/package.nix

@@ -20,10 +20,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "cargo-toml-lint";
     homepage = "https://github.com/fuellabs/cargo-toml-lint";
     changelog = "https://github.com/fuellabs/cargo-toml-lint/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       mitchmindtree
       matthiasbeyer

pkgs/by-name/ca/cargo-valgrind/package.nix

@@ -47,10 +47,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = ''Cargo subcommand "valgrind": runs valgrind and collects its output in a helpful manner'';
     mainProgram = "cargo-valgrind";
     homepage = "https://github.com/jfrimmel/cargo-valgrind";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       otavio
       matthiasbeyer

pkgs/by-name/ca/cargo-vet/package.nix

@@ -28,10 +28,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/mozilla/cargo-vet/releases/tag/v${finalAttrs.version}";
     mainProgram = "cargo-vet";
     homepage = "https://mozilla.github.io/cargo-vet";
-    license = with lib.licenses; [
-      asl20 # or
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       jk
       matthiasbeyer

pkgs/by-name/ca/cauwugo/package.nix

@@ -31,10 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Alternative cargo frontend that implements dynamic shell completion for usual cargo commands";
     mainProgram = "cauwugo";
     homepage = "https://github.com/pacak/bpaf/tree/master/bpaf_cauwugo";
-    license = with lib.licenses; [
-      mit # or
-      asl20
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
     maintainers = [ ];
   };
 })

pkgs/by-name/ce/cedar/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cedar";
-  version = "4.14.0";
+  version = "4.14.1";
 
   src = fetchFromGitHub {
     owner = "cedar-policy";
     repo = "cedar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nt44iX6Oc/ZPQvAmFzP7jcHNurFa2hPGG4DdBU4n2Pg=";
+    hash = "sha256-MdHongi0OeKKHh0lgf9AogwVDUV6SmogU3I5GFQ6Lts=";
   };
 
-  cargoHash = "sha256-1gmLRfq/D1WYfswCKAPwUm60JZ/Zl32l3knKKvfqTNk=";
+  cargoHash = "sha256-/4meYPBxeygCke6r9vUikdyA9Ep+BrvTHDuDAi7WfLQ=";
 
   cargoBuildFlags = [
     "--bin"

pkgs/by-name/ch/chiaki-ng/package.nix

@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chiaki-ng";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "chiaki-ng";
     repo = "chiaki-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-se60wu1rwk/w5QG+pFvdtKD+zsJQdOmBole2WY2KCxw=";
+    hash = "sha256-hp5CKtxiqShI/OQVs0EomjHkCL9xuqNrN2qKDnlGAbg=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ch/chroncal/package.nix

@@ -9,14 +9,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "chroncal";
-  version = "0.15.1";
+  version = "0.17.4";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "DouglasdeMoura";
     repo = "chroncal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n0MMGJ+l3xCECJIxBWmGdrlK/3oCJ7LTcSoCJEGRMXs=";
+    hash = "sha256-fNYEkgCUpnQYgiSHrjn3KA0a9xb2+MrqCTXVxaYr5po=";
   };
 
   vendorHash = "sha256-7QW8BQ+5Vj6eGECLxbaiZ2CEgHYIbi55g+Rzmf/txcw=";

pkgs/by-name/co/coc-clangd/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-clangd";
-  version = "0-unstable-2026-10-01";
+  version = "0-unstable-2026-11-01";
 
   src = fetchFromGitHub {
     owner = "clangd";
     repo = "coc-clangd";
-    rev = "1b948b02b473de36879c81c7807c1c475213b1f4";
-    hash = "sha256-XBWtZe54YReMj4kKeqy46xminRKMyICxipC+MxXQl8E=";
+    rev = "0979607a8a166c8654033f9a6e10790a63286039";
+    hash = "sha256-JTg04IYwFORJjb953rO5muyH0+sNIFIQAjPGSIieojs=";
   };
 
-  npmDepsHash = "sha256-BBQNMBBZKpD2mj1V2BsxjG3syg20z83WEu9qberM1Nw=";
+  npmDepsHash = "sha256-3JmK+u9hjBnB3VrLaw+SQmAr/3qtap4EXYtwmRaTl2A=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/co/coc-pyright/package.nix

@@ -7,17 +7,17 @@
 
 buildNpmPackage {
   pname = "coc-pyright";
-  version = "0-unstable-2026-10-01";
+  version = "0-unstable-2026-11-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-pyright";
     # No tagged releases, this commit corresponds to the latest release of the package.
-    rev = "3217920ae44add2cafeb9d270dfc06ca0e733747";
-    hash = "sha256-tgyzss+ErtsUSIVuIaBAzQhmzmC+nw3EqYDPFxRT538=";
+    rev = "692b1e88b6df9de2ee033618414ddc72f3e6855d";
+    hash = "sha256-rquFuEOK4/zx4iAqgVLUcYpnO8GSVr0JJme+I69IRv4=";
   };
 
-  npmDepsHash = "sha256-fzjCMC6EDEMZRgh/scfIaTUDil/y8UoJP6QdhQM+mk8=";
+  npmDepsHash = "sha256-bProL/Mu0D7Pih75Mlko2B+o0RtImVIjd8yWJukOeTs=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };